ID: Cookbook: browseurl.jbs Time: 10:30:00 Date: 09/01/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 10:30:00 Date: 09/01/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Software Vulnerabilities: Bitcoin Miner: Networking: Data Obfuscation: System Summary: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets DNS Queries DNS Answers Code Manipulations Statistics Behavior System Behavior Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Analysis Process: iexplore.exe PID: 3244 Parent PID: 548 General File Activities Registry Activities Analysis Process: iexplore.exe PID: 3308 Parent PID: 3244 General File Activities Registry Activities Analysis Process: ssvagent.exe PID: 3368 Parent PID: 3308 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 433

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 10:30:00 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 6m 19s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal48.mine.win@5/505@63/41 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 100% (good quality ratio 85.2%) Quality average: 64.4% Quality standard deviation: 36.1% Cookbook Comments: Warnings: Browsing link: Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found. Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 433

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 433

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Vulnerabilities Software Miner Bitcoin Networking Obfuscation Data Summary System Debugging Anti and other Techniques for Hiding and Protection Hooking Language, Device and Operating System Detection Copyright Joe Security LLC 2018 Page 6 of 433

7 Click to jump to signature section Software Vulnerabilities: Allocates a big amount of memory (probably used for heap spraying) Bitcoin Miner: DNS related to crypt mining pools Found strings related to Crypto-Mining Networking: Downloads files Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS Connects to many different domains Social media urls found in memory data Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) System Summary: Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Classification label Contains functionality to instantiate COM classes Contains functionality to load and extract PE file embedded resources Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Searches the installation path of Mozilla Firefox Copyright Joe Security LLC 2018 Page 7 of 433

8 Anti Debugging: Contains functionality to register its own exception handler Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically determine API calls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Extensive use of GetProcAddress (often used to hide API calls) Language, Device and Operating System Detection: Contains functionality to query local / system time Contains functionality to query windows version Behavior Graph Behavior Graph ID: URL: Startdate: 09/01/2018 Architecture: WINDOWS Score: 48 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend DNS related to crypt mining pools Found strings related to Crypto-Mining started Number of created Registry Values Number of created Files Visual Basic iexplore.exe Delphi Java.Net C# or VB.NET started C, C++ or other language iexplore.exe Is malicious ws017.coinhive.com ws015.coinhive.com 57 other IPs or domains started DNS related to crypt mining pools ssvagent.exe 6 Simulations Behavior and APIs Copyright Joe Security LLC 2018 Page 8 of 433

9 No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains Source Detection Cloud Link 0% virustotal Browse static.criteo.net 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Copyright Joe Security LLC 2018 Page 9 of 433

10 Dropped Files No context Screenshot Startup System is w7 cleanup iexplore.exe (PID: 3244 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3308 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:3244 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3368 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\CabB122.tmp Microsoft Cabinet archive data, bytes, 1 file Size (bytes): Entropy (8bit): true Copyright Joe Security LLC 2018 Page 10 of 433

11 C:\Users\HERBBL~1\AppData\Local\Temp\CabB122.tmp 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133A A582C6FB10DE757DCA445D390B BADE C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): F A743D A D6F544358C47ED07A3F9F213693B80AE C27C CDAE9DA1ECF9ADF25094FB40896AC56E4ACD9B6D7 A5A478A5A71EEFDDFF8FB6DB8AC A4D115828BAB74F E510EB06C1289FC D49 FF71956F098F E78403AFA8F1FD684 C:\Users\HERBBL~1\AppData\Local\Temp\TarB123.tmp data Size (bytes): Entropy (8bit): CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16 E2E6B3437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\dat8046.tmp Size (bytes): TrueType font data Entropy (8bit): B0DFEDF3F471F0A4681B6F82B4ADD6 0757FB8FF3009BB5C75FE0A5A C692A25B 3E DB8F9B9DBFA051DA824594D149F42AAFE5B30898F1C61C4F910A60 1BD1E2D83C3AA19888C1C84C5C5DD60260D70E153EC11F3306B8FD418F312638E33D433ED127FE A0375 7F07A0E609CA3EFC9669BCD7A035996B0D0B C:\Users\HERBBL~1\AppData\Local\Temp\dat8853.tmp Size (bytes): TrueType font data Entropy (8bit): B0DFEDF3F471F0A4681B6F82B4ADD6 0757FB8FF3009BB5C75FE0A5A C692A25B 3E DB8F9B9DBFA051DA824594D149F42AAFE5B30898F1C61C4F910A60 1BD1E2D83C3AA19888C1C84C5C5DD60260D70E153EC11F3306B8FD418F312638E33D433ED127FE A0375 7F07A0E609CA3EFC9669BCD7A035996B0D0B C:\Users\HERBBL~1\AppData\Local\Temp\~DFB623177C9A99E76A.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): CCDBFA8BF88DACA66331D7775B7D Copyright Joe Security LLC 2018 Page 11 of 433

12 C:\Users\HERBBL~1\AppData\Local\Temp\~DFB623177C9A99E76A.TMP 52B664EFF3D72A022AAF8AD677E5A90306C C259BBB F8A54B1ECC29C8B852E CE9C D1E1610B3EFAFEBD14170EC BFC5F36C16C1D118E8E4D9A286A6743F3396D EF91AE3383C743B CF E3ABD5C1276F7E1D7A5B45399C970 C:\Users\HERBBL~1\AppData\Local\Temp\~DFCE905516C56E4547.TMP data Size (bytes): Entropy (8bit): C71FCDFD7DE63FC5227B8050EF38D70 F16FCEFD60FD30F795FBA0DEF3D261DF84E8891A 75221E4AB17DC38C9747CB6C99CF2CD1E64BB426043CD7345EA8E B E DBDD028C B062629D71D EA4EA1D52B8132A348CAF90028DF19D636BB512 93A09B16F8AAA05D645ED53DF131BB43DA6C C:\Users\HERBBL~1\AppData\Local\Temp\~DFD0010EC1890CC76A.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): AFB C43E2DEA21F2C6E1C C574A B F1464EDD3BD7C1 C909FA333DD5FB02C5BD7EFEE840ACA7C7DDB818263B048B84C5958E374641F6 7322A6D8D1D D349EACBB44A29984DA6A3B16F2120D87A5B84C D30DFF EBFA13560 EFAFA6F2A65F25B98FC77AFEC05F385B7476 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0A2EA55F20CC96EF43A26E7FAF8A2217 data Size (bytes): Entropy (8bit): AA489B2A1DFDD9B6AB2B8AD5FE056D2 A7DE4BEF6F B0F8EC70CE99D75591BEEBF 05673C143118BB4B1BB69AA52928EA444E7D70C AB79D82E3943F2541 2F23AF7F4543A8C5E9AD7877C E23A14330CCE99F80723C2D537C5C47966E72602A785B7C0C244E AA6C9B435E09EAE7C8032F662D56DBC38072 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 data Size (bytes): 1378 Entropy (8bit): FD4390F8F56FDD8D2A4A8E0B95895A 5ED1D7A2B7684BDF7B9D B2555C2D376CA F8DBB B1FBD6F944519EFD1B5D9F123259C85618F42A7851DADC F72498F85D032790E0F48BCFA060280EF AAFCFFC94722DA4D62DED257DAE890DFDB6EA1664C3 1141B901B1B70C6BB891270A7D96DD2F50A93D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_40844D66CCA168B F3A3E01D1 9 data Size (bytes): 471 Entropy (8bit): B6EFEF6E20BDF969E2A6BDBF7BA645 Copyright Joe Security LLC 2018 Page 12 of 433

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_40844D66CCA168B F3A3E01D1 9 0F15D8EB3DAE7610C4B8095DD15E95D27BE0E6AE 9859A0FCB0A07BB403BE90F2FF22E5143E33B894A0FB855F2DABD05F AA022D327D4BF2147C8149FE3F3C4B6A3A E40F1AD6776FDE1A72248A F81D150B52485B55A 43D6E336335C4F5FAA4C25C727D38E807C38 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E11E75149C17A93653DA7DC0B8CF53F_2BE0EAFAB CD5C849BA38879F C data Size (bytes): 471 Entropy (8bit): CF8B70BAF8A5DB37A B824C80 414EF1242E B7A30DD5FA D11CF9 195B606DF4D6E6502AE18ECB853C25594FB0323E37AA40B36A6CDE068240E602 D7203B23634BF8D3CCE132EBA4758DB6E38CC28615E0266EA48AFBFA52F169AEF7243FE3FC71D12D512AA ADB30A134D F212F861B64CC6ADE6F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E11E75149C17A93653DA7DC0B8CF53F_BE87EC897B6A49C8DCC5F EE6A773D436 data Size (bytes): 942 Entropy (8bit): A5F031A3A B3E29CC9BC2808D 2AA4FD1D0A15E58C567DD DE03FD40 E92D6F C83F2AFB9B657C094F42C11333DF65613EBC6099F5DAA58C5AD C50CCEB72EE5D4EBF1E42DBA1A2A B5A15CA55F1FC6246E6BA FE76952F4CD5B8 725A59F D159D35825BAAF97F7731 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E11E75149C17A93653DA7DC0B8CF53F_E726C0D9D38BE284DE7F3137E22130C D data Size (bytes): 471 Entropy (8bit): DC82ACA89A16B632FA9B3FA54100DF15 D408C C592BABE19D9A F154FB30 F6E3DD83645CD7AED379D779A0E0B D310B276B415AE650CF6555A6720 9C8F B99477DC56A3F8B585FD61C75B933D38E84CCA040DB8F7DBDF4F7EF9F48F3DAE F A0E59F7B0BE484E89E B51CB81 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 325 Entropy (8bit): D56CCD06F2AF8339D8C0C11A62F66BA 1B0E D8B18EC207EB81FE031E5FB224C7F 9FDE FA331C45DA276B6282EAFC361D2C8F571FEB5F39D5A F 8C5B6D02914A226D0AE174800D7EB89C62AECBC9B F407F22F0936E C987A5EB1FED024C0A7C3 2DADC398F14C9CD07CF2A6AAE64F9184E9376 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3154F0E8356F80B814870A1CC17F5A20 data Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 13 of 433

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3154F0E8356F80B814870A1CC17F5A20 F816976A6759B5F987F23B2E6350BD1A C781B3F5C2F5987E986616EF766ED1213F3120F2 A6FDB97CFDF7C819400F65CECF59AF018B27DA57A3C7AA513DC09AFBA E26300F FBBA69B259B8C9B10B61A81133DDFDB759F92CBB B83C0D79A49F71C2E B5EED0AE3A289C F6BE61C31A1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D data Size (bytes): 602 Entropy (8bit): AD8C69FE51CE82D5DD12418E4F3231 CD6B943D6D0E FB2659E04559C77170 BC0A08BD6859D8C29505C73AA91E800E67F71AABA710EC01D3C4EB098BEE DB3B05481D550AF1E6DB5838D03ED5C9E9E12C5C319FBF1DB980051BD18490C65E39A02BCB63F7E0C5E0676 B2EF119B6FFBEFA20E1D74DA51A496902A526C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\41E BD186E9FDA558705F775 data Size (bytes): Entropy (8bit): C35FBA1BE7A794CD9B8B2260D682E 4DFF3460A9A46E1CF613FEB62A046642BB3ACCCF B6B88E1AF7D ECFDC88A96B4BD22DBB39BAFE02A49A2D37B389DCA971 BCBB04A4D981619E2E098B CCC990768FFDDD E527ADE87A80936EE3E7253DE75D3E6F E0BD8486FBA41F2F234E1D2C4E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C622 0 data Size (bytes): 727 Entropy (8bit): DD5C88D4C D6C4115B1BEB 0FF2910BAB8E92EE9AC07C976C1907B5D21997D6 3AA273FF2AECC179F6F42B4CA9BA07EF21E044A7E75FC733575B0793A9298A9F 2883B6C02E2061EE5AF7A5DE AB0F4B40103A167D D5DF979DDC36B72A059CF0000C3 042A50750A7B86A05C1E458493E291374B86 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B 4 data Size (bytes): 471 Entropy (8bit): E0CC6799FBC1069F1D0F415E97AB DFE9FFCA3E15692D2E8A4969FACFD8006F82675D 8B9313ECBD2BDD08196F87FC44544E9A0FC94E047616E798A2B8F9518C A9D570A4041BF3E30C7B53CA0A59FE4BF5CD583E64D77AE27BCC1E5B20FEFBF41683BBD55E29A B86F7794D34354D129E30B812FF26B5A597 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 531 Entropy (8bit): Copyright Joe Security LLC 2018 Page 14 of 433

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C 97826F2389C8F46467C AAEF89 01D5C79FB6E0DD04CFD1B5F0A5F77987E8CA4D52 40E84DFF CFCA324F43D4E7DC9E852986DDBF40ACA58959F6B E4934C95F517D069F39C62E F FC0D72B34BC0532F6E01B42A413AD4A34CB01FB31C5 F6F823E8561BB4719B6BBCDB175348D39274 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_10B2ED6A055C98951F429 CD0FD943BBD data Size (bytes): 471 Entropy (8bit): C5DFB4383C9C335A78E6A99B A6E139C4C3CD8C653114D0EAC1B D1F7F2 A CC9BBC433435ADBC0CC6988DE394F1BEDC CA5351DFA9 F36CBFFB0A253ACC1240E75AA304AAA8FABD0B6B37C22F97D46C36F6FA967C A0AE43078E4303D66 EE232D9D92F498D BFE1547E614A7DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Size (bytes): 471 Entropy (8bit): B556CDA9CB7DD3505EFF20407FE6AFAA 9FF906CBEB2C5BFD8CC9C18DFF827536E438C A2993EDF894DAA4D7206B8DAADDD1A4BF61EF5E5E65CEB0B0212BA8D81 6AD756739D92B8490E20D4916BA6FB9C E07DDDFD948873EAFF788AC5635A7D D1EEE6CE 1077CD1ACCE3F92F01D700F8775CDB5EEDB9E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F CE086_B E6ADA2B8F616270E9B8A751 5 data Size (bytes): 1609 Entropy (8bit): DB46A9F349D1EEA2AF9EEA1BC641E CDA7539C12729D32D9C87B7C1B0A35D27D8 F81AA85EA26F63F68B732D3E35E6D988FA38617C4B3D35B672108E417EDAAFDB 66BDAF74E098A8E795798A65B947AD99B02F6A35EA1F DB76DDDD8C1FA5CBC66146C8B1AF67570A6F74 EBCEB9B3AA22E5553B5298DEAF7103E620D4C8B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8AD 6 data Size (bytes): 471 Entropy (8bit): CFB8D8C89F41E7B EE174C BC7F5B0DBC0DE7788EC4D3ACCDF FB7AE07DAA24F6E84FA37C1CB D4ACB4EF6DC187BAAB EB E87392A2D37B895DDBF6094ACA626EA504438E5A8FF9A5EEB0C019970B CC56F9FB3486DBE A 1977BCF231F DC33A7CF Copyright Joe Security LLC 2018 Page 15 of 433

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, bytes, 1 file true 1084F35C75317FBFBEFF D6 DCC3B FF247406F1B18D0D97D0AC0FF70 9CF311AD6888F D0F10CCE8543F3D2B69EE4417BC499BFC281AB3E 612BD67C1D211B885CF90DB2D B522B7A784444D15DF9EC17C05C47AB B97F DF6F8F68D5 CD18C52A BFFF A7708F04 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8828F39C7C0CE9A14B25C7EB321181BA_8C550960E440B9C3B93A6A0AA915C9B E data Size (bytes): 1754 Entropy (8bit): F CC CBBF7C6C524E 6A190A9A9FFD0D2486CF547F8456CE1CBEABAC64 FF601F7A5E539F125838BFEEF59F2AA0E18C4124F45C6DD825AC3E7510FE9454 D022775F4A569D0D69BBE4187B16209F550BE87173D77236FBA0FC22A3D161B0B6BAC1537E133A813AEA54F234A AC778D6CF3AA486969CF99A249BB6D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E B5CCD5_EF5A81D8C849760EAF55A8B434FF78E B data Size (bytes): 1570 Entropy (8bit): A1A2B4BE120D6A1513C88FF7ECAADF9D 631DD3C4EF21DDC93F8D8ADABF4FDFFFFB2F D487C30D59684AC1E855FFC07F75F8F15B57B CB54F5AD40F0328ECE CE758B04D3C3032A48DB4424EFE9C184585D50FA017060F611E4DB77717FD87F AF2221A4A1338D118 C5327DFCF38368FE9BB03DC2F241A7B7F0E6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F B52012CE8E279D314C_E537C24E61352CC F5E4081AE1 data Size (bytes): 471 Entropy (8bit): D485923CC70D275DFC71C6BC E 0C2DEF87C0A5F7E6798DC85C87F FFD8693A82F6BBA F677FE9DF2324CBCFEA27B672FDEBF E653B2B0450DBF304DA2D12ABFC1D3F58666A95012D623C13EF8A5C0A074B9D18FBFD3D BF4217C7F 8FE8577AB695B F156FF B5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C3F6CB3C038E4087CC420A057371D1EB_047A09DF9C0C8DF38F225 0BFB0CEDC41 data Size (bytes): 1506 Entropy (8bit): EEE600EBC F B1D 256BD5F9C7D01FC7E4DB02BEE92AC8A9ED2ABAD7 F973E3CB6E7F6B6E5AC124D9AB320030EFCF1CD656C70EFD8984D8910F592A6A BC3E996B0C639F7B9525A23A466D4A8D331CCFC8321C DE7B39E0FE75EAA7948D3AFF19A21F005A0CB2 B7DD165A99002BC45A833D56721A8AC58B4BDA Copyright Joe Security LLC 2018 Page 16 of 433

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D _D9B9F37ECE595B0B7B6AA12451D392C F data Size (bytes): 1754 Entropy (8bit): C20273BC9B0E2EFC25F24178AD8DB1D 4EDC27F93F4D75A9A308C2A86BCC121FCC7AEACF 2E7B1054A27026B268C7BB2A8E5F47E2BC4F7A2D8BEF247B8E2C3E7DF42D8D6D 461FD0DF55BDAE0252A D64156F36738E35957C9728B68BB6043AA515C DE9D68FD297BD48C6A7 E151E7C5F197DCCA1010BB13668A75C6768F8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D080F8FD8CC1905DCE0E357DE704D67D data Size (bytes): Entropy (8bit): C35FBA1BE7A794CD9B8B2260D682E 4DFF3460A9A46E1CF613FEB62A046642BB3ACCCF B6B88E1AF7D ECFDC88A96B4BD22DBB39BAFE02A49A2D37B389DCA971 BCBB04A4D981619E2E098B CCC990768FFDDD E527ADE87A80936EE3E7253DE75D3E6F E0BD8486FBA41F2F234E1D2C4E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86D E data Size (bytes): 1435 Entropy (8bit): F8EBBD67998F2C0E754B3D5BF9209E6 FEA07F2E3DF68569C70FB3B1D539610E13578A24 F33E9B853287EF0FA763F38E0BC137E80ED26F93A235AC0217F2E818309D38F9 CE34C437AF7966CCAC596DBD1D150E5F5DB15B8FAD5038B78F631B4F8B433F0837E05E5F5F2A9A89A B8 E56AECD B17B05B337DA43566FB42C1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_86C23BD2254CCB85E31E7 8CD1E62184F data Size (bytes): 942 Entropy (8bit): E737D9DB019B789BE508BF2D1F8A50 A7BA52755E86C2FA8C8FEE6285EA881B096F50B5 1BE89CB6E21E0CD30EA1FFF6E2ED EACB1B97EB25F85B DCE C6D412B89F9F C05E28CBDA08D5CBC8B0B3E63A5D5531FE90C6070E25CBC0A E9E2D798EB6 B977D641C E151E7E22755A1FB0E41 Copyright Joe Security LLC 2018 Page 17 of 433

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_D5FE3430D858EEC0702EE 96E01AD90B9 data Size (bytes): 471 Entropy (8bit): AE153C182C1B0A5F EE4 93E2541BC1CE768564C44968CD6DE7980BA39A13 69F8C D58A899189DCC541D1F90F4CF0D47F5117BB098C32C7A411F62 C8EE0E12CBA030EED92D4E44FC793A B2768DA4E19FAF8C055C3BA16F0964DF BC43AA40C8E D1048D658CEAA4E216EB25C145C3F69C0D737DD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5A B data Size (bytes): 471 Entropy (8bit): DBE58B947825C8BBE7BA9A8BB B11485E8BEF0B3D6B0CD2896C09DF0D6F1E21E6 3E24F93BFAD204CFB8F4A6C4AFD0024F2F06E84B649E71BB60E6BAFD0EA A5C9BA9F56ACF48940F834B3FF98D95E93E27F0E4B13866A1E20DDD24605B87232E6F72A16BC4C6AD943E953 A7282B0B6F70191DAE8AB1B205BB661C64FA49 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_025FAD919F49882FD3D01AF8DD37B50 8 data Size (bytes): 463 Entropy (8bit): A4EE1637D2D A75C182D9 56B1692A2270EFE6C83BF3742BB210393D1AAA96 39F8DFF0E329948A34BEDB4D6AF70E5A433AFBF54AFE6EC4893BF3AD24C07A43 4BF9A5A40F4C78797E9165A55FD46C1F37B5DF2666B071D46D7CEC EA8256AB80E761F9A292A83D234F5C 37B1C3AAFFF7AAD5CC414F1993F5C92BFA398 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_C98DA798F6E0011E86B9574FACCE740 5 data Size (bytes): 463 Entropy (8bit): C45829A4EAFCF349C9FCC87A5C D0A2F BE467CCC81C07DA C4 AA8A1984C F75E FE53F26EB7AC8CBAE063FC4CE019FA7F72A 819BAE105282AA42B351754E4F357B01CE3CC6EB6C7E00A95A9A52DCE78E89EA1502D14420DA10721E16A48EA9 A6B851AF8A5E702B B12058C0D662 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_D3F BE58706D39FA7DAC2F7901 data Size (bytes): 463 Entropy (8bit): DA6BC11D4CB419F8C49C6DA2AA858BB 98332A1E0109D566ABB6FEDAC75305D7D6A3C7BB 422FD6648B13DD07CDBC1C7A83A79C1DDE402DEC5C019B0B EE5B5E6B 83FA8770CF6A475D4804DCFA173C93DCBDC16E33C676215AD5CAD614DDD9AD CA5B757D8A056E0C1D 8C3294BBED4833F7A66DB4F2E4885A76073F13C Copyright Joe Security LLC 2018 Page 18 of 433

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0A2EA55F20CC96EF43A26E7FAF8A2217 data Size (bytes): 262 Entropy (8bit): E2AAB87FE24CB8E40B058BB38F E4D1F3C597C5A90ED6F2919A375D92EC98D8 E381890F1CB8BB7A034AFE529726B2439F0EE6F35632ED4BB37BF0D69B363D4A 6695D5B761D A7B8A8039A7E5873EDD642701A98AA40820AB48E910A6A0EAB B39DDA4DE597556D 0ADF0BEEE1332CB93F92CB2F59BDF6ABA9D46 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F8 75 data Size (bytes): 716 Entropy (8bit): A9ED9AFD31AED99AF05B8DAF A7D7CD183A1AA96BDA141D018C9A9724FD9C33B FE2B56C FD7D49868B239E3A3A B3E7BCDEB2957B5468A7BCB5 F340A127D054F33C2CB557F1B5AA8CB9C8FA1E975481AA9A43A647ED0CAA26DC2592C00051AE581A87668E2171 A466334B72CA05D12100A54FD4DB45C1CD9528 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_40844D66CCA168B F3A3E01D 19 data Size (bytes): 808 Entropy (8bit): FD0F645A15AA648F4A22FB5B6B530D1 6D DD0AC70952D3AF27B FDC16C 4CBD307B20D0E4E E4EE7ED6940B9F3E674355BE6F3F0A0A8669D64 52D94DC2CE61571B054E4BD F8218D47F C6A2DB69F9830C30AAEBEF151A19C69C3AE3E82 4C5B68D9DFEABE7B1E70223F82542C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_2BE0EAFAB CD5C849BA38879 FC data Size (bytes): 852 Entropy (8bit): C4E7902E3FD679F06A38E8E AD 747AB9399D09B6EA71BFA60B8B8AB604B76D9A97 3B8B595FA92D D81A48F947D731DB15FDE06107FD5A1BAC4AD68F4E2D AEAA9A2CF9F77112E3BAFDE C44F68D13EDE2276A61E450C7E60C886AB0ADE5C9A78DC 54CA3593DA B D106FC60 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_BE87EC897B6A49C8DCC5 FEE6A773D436 data Size (bytes): 1720 Entropy (8bit): CB6466E7FC01588C4A D45697F A9451FB91AE60AB44363FF7529BAB29369F CEB0C E6E325E9C2DF62B3504F974AB685602A2F56A7D9A6A7B265 2FBA6D6A9E96A0881F0710C74F3B8476D5847FA3CD5FE23121B7731A3D2D10D7BF09CC2AE7A9475E92AE FE86B1B67E A8EAB325918BD9B091B Copyright Joe Security LLC 2018 Page 19 of 433

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E11E75149C17A93653DA7DC0B8CF53F_E726C0D9D38BE284DE7F3137E22130 CD data Size (bytes): 852 Entropy (8bit): E7EA340E0C3119E12133C494ABBAF62B 423A636D0C93F066F21E7C56D3A623A A5 3D9943B01E03BDC314447B78F13EBB0F5D4BDF420268CBB20C159F ED0 6A7A59CC76D80E120203DCCE9743B7F831D5FF402DCC5C74ABAC13EEFD212A9A37B12459A02EC548D600B722C 9767AEFE38F946DEF90A974A7FA9B2A79C041DD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 584 Entropy (8bit): F285B31C01D4CE763E9F27DDC82928AA E7D02B49AE409EEBEA2C9C4A022F612FA04A924B C83D73E06D84E6C320E095C24D34103D0D A95 71BE65581FBD1AE89C9FE24A7126F77FC05EBACE084DD51A5FF01F1F780E48071C2F09860B0738C2B8A327A650 37A84124C375FDE7DA3D9B DABBEC898 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3154F0E8356F80B814870A1CC17F5A20 data Size (bytes): 620 Entropy (8bit): D96D9BE96A55CDD FF809490C0 09CCB556A F93873E6E051B14816E1CB11 ECA123898B994C5A84954F819A666CB6A257AA798247FEC49B4BA98032B48D98 3CD8CCAD9E73A9D90D8AFAA4E6AC42C041128AE603938AA19427F4DEB3A8C17A87BBBCC537B7C598E93B47D1 1EDE711CB24F109B6B9016EBB279E955B8B22455 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D data Size (bytes): 440 Entropy (8bit): B66EC0EFCBAA8E1AB0E719DD8919C7 E5901C1E242D626FAD22D869C7F0ACFB14E6FC09 F02E2582C BE6EC717A424C1BAB9A92505EACBA941B6B5E328037F4A32 4E053C85B6CBEBA143938FA71C877A1A77ACC2D4ED9FE6B903CDCBF631E74BA78BB58BA657AB734037C E4A6DF05F3A16510D08925C520EC A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\41E BD186E9FDA558705F775 data Size (bytes): 200 Entropy (8bit): ECAB62DD948B1B19D2CE9CF81BAA9F C0CE793781E9387B15BB11F77EA44D5471CCA3CF 88146BE7BA86CF569112ECC F7B7BF60CAA104DC8486CD4E1E82804F6 BE66D953929D222BAE1E E6E1A03DE2F6AC9F21721AE447C0EF769325EDE87E51A02FD56138EA5A FE01647F42CB81F02EBF3425D65BA531A17952 Copyright Joe Security LLC 2018 Page 20 of 433

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE5 9AF8FC7C6220 data Size (bytes): 800 Entropy (8bit): D7641F C30B221614A844FB23 8AA40F0E997FEA95401DC975300B B16B6 D61D015C4C2281B2FB8C E52D5BC C99FE359CD55764BB31031E 717D463C40D2AA1F257D6893A4A924B339ECD17FA189B1DD5D4F8E7906ECE64C93A8D30B36365E78C42A C367CFE864788E4B69963E659A3725AF12C2F2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2 B4 data Size (bytes): 398 Entropy (8bit): C84CBD6E0E698C97C3143A8034C513 2C369A24F32E0F43131D25393ACF2DB5A8DA12CA CF9ADED6EDECCEE2B7CBFDEB2383A797B4F0F3AC305D23F171902F02F4D0DCBF 154F60DA9CBEAA1FBA761845C F8F73C12F347F28F2587FD892033D16EA9ABCB183E5008B7067FB02 9FFDE1B2E45CD3336DB4D74A6AA92EC3E9423 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 340 Entropy (8bit): D11C51B6DBE25B8D2A06CDD8BF D837E77AF434535D4FC178B1E4F90E8F068ECC 67EAAB232EEB430045C30E A02532AD57649CC2456C1C90998BA6FF 07FAAA31C737776D7C085A5F62DDCDEB60DCE94AB8528F0D00EBDF2C DD CEF284F01A6CA2B1 E94E15AD5320BE4770EC03435C975574E19BF64 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 484 Entropy (8bit): C8B460D1F B12B36B702065F8 D4060C7F3A36B02E19E07FB74BEC9DFB D 6D D2571BCAEAAF5EA3AD54BC99D2AC2E7589BA6432AACCAB0B62B9 5CDFA68ECD3E93A454A63BFDFFC A CEEC386A38FE4BB613E9653C ABD63FC30C44E D6DEA41BD9BBE09F D16F24 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_10B2ED6A055C98951F42 9CD0FD943BBD data Size (bytes): 868 Entropy (8bit): B0AE2C1600C72A83A6E1D44BA43FF C0029A88F4D AAF16300EA8960BD79C20 D2C144A46FCE451D28A AD FAAB3E7FB97A63B246FBE7A94264 ABCF9C06670E15EA4AAF790C437BBF9E8C7CBC0DFC6FB360ABC3F61A0F206D5B66728A7CED34EC0757E54B91 353B3F2FDCDE0D472F6717BBB B450C Copyright Joe Security LLC 2018 Page 21 of 433

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 data Size (bytes): 868 Entropy (8bit): C8B3475C078D9A32161A221D8E13134B 2E99D1C1658BB65422BFD1D8A2F DB82CB DB696BE60F1EA CD5544DB766B4B879EF061ED5079FC31B87DF8EA B771DE86BCC2FB3DA121BA411214ED4EAD49AC9154F0235AA1A D3FDEFE7A3C1281EC9F1EF0B7 C803DB23D5D2250D7EC782F3AAC0A839BFC7E7F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F CE086_B E6ADA2B8F616270E9B8A75 15 data Size (bytes): 394 Entropy (8bit): BA9C4F7F498BF5E9DF2F497892A49 1ABF449EF08C122B9B3C94D3641D65BB9A54701E DE63DC242CADFD62F85F CA5D22C1C784C613535B61A6BDFA BE336880D2F0A5BA2FDE1E9067D29FFEEEAF47026E D53DA57336F D0DCFD B3B AA63DF35C068030B05AAD0DA180E3740E45D9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8A D6 data Size (bytes): 434 Entropy (8bit): C4EB1073FF031621D00B2C4D992D A6BBF1C719A9D8C5410DF928EA48A9F66D24 98D838AADD288E6218A6FC8B361F07545B893FFC693438FBCE384751AF9B0B25 6E09403F404A0FAC9F1A88D62130F231BA8C5876A2A4C99289C8D156AE0A50D92BD0EFAB3F766A4B3170D8FB15 C C4EF6CF A504B0B5B000D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 656 Entropy (8bit): C9AA11867FCC0AB395A780A7D63B30ED DA7747E16F0EC2E3E6E7891BFF2FBACF46828DE6 9C3BCC9B A3A7F722D8C3C02DC92ECE09D92E102A91210B900F3B9DC2A 3C2EDF030BE62DB197DCB216849C81C0A4ECC56E3EACD41B1E42EE22A8AB6C4BE3E75B4AC310F5E6467E0988 E3D6D205761E02BC2D5842FB817B7D16D675D674 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_8C550960E440B9C3B93A6A0AA915C9 BE data Size (bytes): 792 Entropy (8bit): B1BD51B1BD38618A06CD5ADEAAE8DA8 79C8978F220BA4C1F921F1AA7CDFF99DFA11E38D C74A556E62E5EEAC4593C1C8785E FF92B D551A6D07AEE2E0DE ECF7B014C55A66FA B8A47DBD052A24F4F77B721859F2AA8E92B39FB2EC15F1FCEF51C4BE92915 B62F77A8A4C FBFA79E53404F6840B3D Copyright Joe Security LLC 2018 Page 22 of 433

23 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E B5CCD5_EF5A81D8C849760EAF55A8B434FF78 EB data Size (bytes): 1072 Entropy (8bit): EC2CD164A8F255449AD330B2824EA0B D6150E531605B1A7BAC5DA14E FDCAD5 4885DF9B3A72B7C0AC4E76A2BFB31D90ABC804F4E7D7A035187F3AB5FC8E5C40 1D8770C7279FDD872FDD B3D440A8AE7AA3C8898B0A94290BE A2AA85BA957D3B871AD3627B1 1CD C7C7FBD65A02978D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9E4F B52012CE8E279D314C_E537C24E61352CC F5E4081AE1 data Size (bytes): 426 Entropy (8bit): B361D A7E2ADBB21FE4CCEADCD E8D1402D8E2C5366C0C CCAAA 2F77A9F537BF659ED27907F563558B675A7C B71CA86ED0574ABC F3FF13B3F3374B34181EFDE73C37309CEDDBC615C4C977C5CE00D4345B987080FDD7AED1777AFE8CDE C2E26C21B1BFC8D6F88D41322B61CB7E238C301 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C3F6CB3C038E4087CC420A057371D1EB_047A09DF9C0C8DF38F22 50BFB0CEDC41 data Size (bytes): 980 Entropy (8bit): B472B394D12F210558A280AF8 DD67CDE9D393834CED1EF60312F95D8AABC9A94B D A E40CDA2C275E49FE143D D001DC0CFB1 B92D12222EE54C9CD52A E22EA824C1880CDB92AFAA9D E4F98E1D699B983412BC997FA5A17 C9DECBE76115AE D3C13680FDA80EA9B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D _D9B9F37ECE595B0B7B6AA12451D392 CF data Size (bytes): 796 Entropy (8bit): D0D9512E876E0F9AEDFDBB1E539B0 7DC6D3CDC1F482050F595BD E004ADB45 0A21DB6E76E79D FF47D C6B3C5B6EC636FEEB6B624CD1EBEA15 5B35DA61806F78D1F526AC1268A190D227106D6C473169F3684C3C380450F A4D83893DD466D3DF3E09209 E5BB3F974193F982841E5BF7594BE5891C89 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data Size (bytes): 804 Entropy (8bit): FA522AFD1C309F82B941D5FEB E1CCECFEBFC26507D13C081EF4592F222EB 90FF6A BC22A4A658289A97BFA3E3AC9F84F8E B351D C37B20D0A3A77C95DC763DD1AED3B52013AD4086C F1E76BF5512B87D7376DCA0C9E8CAECAA61896ADE 83F709278A97A7EC7B60D1C56B8D8A0414D5B6D Copyright Joe Security LLC 2018 Page 23 of 433

24 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D080F8FD8CC1905DCE0E357DE704D67D data Size (bytes): 452 Entropy (8bit): F58D99384D9BFDDBAFF0B1A9A5AA138F 2ECC7BB9D308BB30053B065F6E12DA5761DADB52 A96FDF24D E27B9518B6955A029CD0E64CE333D9FB0F9BCED1434B AE91C2E77238D122D860339F57DE07387BC006A0D FD825BC FC1FE4F7AE81314D43A42416A E21A14C09C64C1068E89CFCD3A4C918 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86 DE data Size (bytes): 816 Entropy (8bit): FE0F4178F260CFD057DF3A88F6E31 75BB4E58927D0797D81EDF33136C CF9 C4404C542E9B5E9160C60DCCC44DC2D6CB121F094B6E1A1CE6C72FD162E52500 E06B6117FDC495129F86E08C6FD5E0777AFCD7F375AFF CDCAF AABB9DCD00691CAAC1 61CC4D4F5A656C65FDF54439C5C7F7C218A87A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_86C23BD2254CCB85E31E 78CD1E62184F data Size (bytes): 1326 Entropy (8bit): C0EBF88D452A4EEE33EDAF1617B983B A50EA95EFCF538EA1E6B71211CFD17A0 9E9425EA7EF20BCA143D7BB02F AE277AAEF2F3FAEC7EB443DBCAA C63F2831F093DE7DA9551E8ED6CB6D0F72BAE49FFEAF4FAB45A58C433EAFD0A3C47AF60EB51C61F4302D F67802D259B2F8346B70D8A6BC677A6DC6C30AD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_D5FE3430D858EEC0702E E96E01AD90B9 data Size (bytes): 876 Entropy (8bit): C A7A8C99 1A4DBE5F8A7C5DE13B1394C3089D2892D291939E 3DF70FCEAD38E00E0BAE334E D646ECA5F5663DC46335A7E396A C131E4F93E6D203B7E49B42C7A17C513D543BF4207DD063A5F2F831C702C2FC8E716398BC760D8B5FB9C4C0 C4274BC17C3C2663BCD442465D7D5A464BDB92 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5 AB data Size (bytes): 852 Entropy (8bit): D42657DD4C908726A9688F26DC17106F E5E406A1857D48206D5F9082BCFEEC3BA93C2AB FCF55BD1D03633DF84FC4E4A62BF3592B644E8EF16FB FB0AA BFAA42DA941A585BA08A56EA7511C33649E9E683D53C31E0A8C1396C2F A4F3C51BA535A96614D4 F0EB5EADFEBB39382E58407B538C20FA1A9E8 Copyright Joe Security LLC 2018 Page 24 of 433

25 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_025FAD919F49882FD3D01AF8DD37B5 08 data Size (bytes): 764 Entropy (8bit): E87EBFE2DE1053F1B4B413F69CA 6E BB7E3F10AA7924D124B5030A827 E240863B4F28E8B3B5615EBEB EED5CAAB78EE656E19EFF984FDF656D C4368E9A1D53AD25DCF78F822B775CED737B15D019FA7CA767CC8522EBA9B76E207CC87CAB0E447D920510A04 3F25ACCFE504F13D0F522CCA2B944CD265E91B1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_C98DA798F6E0011E86B9574FACCE74 05 data Size (bytes): 764 Entropy (8bit): FFA6BB0EF5E5333D078ACF0F0A E4D4BD6E97AF89E317FA7B482E0DA35CFF FFCD196147D7B1A8D9BC4887F03E12219AD8AF72B E7B039D345 4EAE6725B9C9B C1615F F3A76731FF95F8420B6CFE08BDF45C2949CFF06776A7040DBF69A7 7BA5EA5B1251C8CF9013A87CE15FC1F7F908 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_D3F BE58706D39FA7DAC2F79 01 data Size (bytes): 764 Entropy (8bit): BBAE C5B97ACDC3BBE3B39F4C 91B06DF90D85C1E9BF50C0D39680E65361A72CF0 7D1A5F892335F61F4BCB0BD8A5D43960F16FC6BAA60D74D8E9A6703F2B9E3B35 20C0AFFDE8A AB93769F7907EC FEB33C F4E3D4A02EBE22C2D698A7DE03131DE5B EBC2E43AA0FD6CBCAA861FDB1D97BC4AD90F7 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 300 Entropy (8bit): PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 5B188904E3BC E7AC4A4A 96607BA DF3A A5E83BA8683D 507C647828E8B817E23D90C7BE73B3105C32B D0647B35046A32BE BF5DBC8CBAD84CA240A2DDAD2DE73BFC434193A4F A E8C92D99AA6B0C5698C702FD DF28916F74561CAE1F8C73C0D9DD1A9FF7 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\I1V9I6F5\shopping.geocities[1].xml Size (bytes): 1559 Entropy (8bit): ASCII text, with very long lines, with no line terminators 23259D7B85791C262429FD1C3203C707 01D16CFC9FF220D53355C30364B6C8C311452C40 0F0AE53D6834A00951A638035C4B7A62A4B0CDECA1003CE978CA5F4453B7EB01 7B64A0B7F11A11A5104A8E2A9A79AF9139A2A77A7294F6B881327EE4D9AA BBF68A2CB44EDBBDD E432D2F0614DD84C51E39056F2E6F6B1 Copyright Joe Security LLC 2018 Page 25 of 433

26 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\MLP0OVLU\s.yimg[1].xml Size (bytes): 170 ASCII text, with no line terminators Entropy (8bit): CA4CF2954B88C773A243FDCEF59F495D B50A3C85C5F56BE520276BA1705F9FE2FD1FDF D5B4D97940CDF82AE541349B84AF4FA1C60BA351DF3D248F244D5A F20ACBFFEBAB7E7CC E1F1170E5195A89174EAAA26861C4D FB72A8CD3CC8C5CA9E2C16A9A FF90B73B1F577C0598B24B5BEF68AAD8815CD6F C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\MUEEFDKH\shopping.yahoo.co[1].xml Size (bytes): 13 ASCII text, with no line terminators Entropy (8bit): C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 35E3224FCBD3E1AF306F2B6A2C6BBEA9B B71E4D B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB 6BE8CEC7C862AFAE5B37AA32DC5BB A DA41BF808A4EF92C318B355E616BF45A257B995520D72 B7C08752C0BE445DCEADE5CF79F FED C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\NKF5KN8A\store.shopping.yahoo.co[1].xml Size (bytes): 13 ASCII text, with no line terminators Entropy (8bit): C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 35E3224FCBD3E1AF306F2B6A2C6BBEA9B B71E4D B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB 6BE8CEC7C862AFAE5B37AA32DC5BB A DA41BF808A4EF92C318B355E616BF45A257B995520D72 B7C08752C0BE445DCEADE5CF79F FED C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators E6306BB52BF6F6D5D891B9D0B1E36F14 3F409FAE3E27D64695D977FF7B92AF3EE06024C4 1E0968E9B5D61EF9203FEE7246B FE954DF36075FA0F2CE1B4677 0A913C7C1546F859CF1B1738D865FDEA38DBBFE4D5B EDA1AA27CB4BC80ABDD1BD9A4D496515D D3EA5850BDA06AE981D95FD6854D87614C5CD8 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B4826C11-F51F-11E7-B7AC-B2C276BF9C88}.dat Microsoft Word Document Copyright Joe Security LLC 2018 Page 26 of 433

27 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B4826C11-F51F-11E7-B7AC-B2C276BF9C88}.dat Size (bytes): Entropy (8bit): FF198B4C5725B A3F007D32CB 4C319AAD9D1F80B3EC333FAC2ACED D26 66DD134DE7543FB7E9C45B86D8BA9F6D474FEE0525DC8E71169FC49D2F978E73 6E3F5B6CD8F07108B AD2598CB7841F C1EAF1AA5A50802ADBCDF7E3F1BBCEB39D35C D9D026EC9C8C5E22BC880BC5C4A4E5C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B4826C13-F51F-11E7-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): C84535F4C407967D63BC07AA91FFD086 53BA84BEA19EC12D91491BB41CCE3D74BDC8DDF5 1F7F375D50B81D7E34272A5BA18E4ED145EA22C6CCE9CAEF5D1657FA403AC7D2 E213130AF94309EDD39BEB5D693CA521A56FE37F8C AC481589B B95D3AD19C4046FDEC2E F596CDDB8BCB089DB8CFE6DE9D3F20C4C96E2 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{BE9757C0-F51F-11E7-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): E47AE400BD87E7F0DE325663E6F671 49FC7C8A80332A2B3EB363573B16D379832B768D 003EA692B6108FFB8D D8B D50D9F6BD35CB3A40C6E67605F1A4 9F430CDBDC ECAAA EC14713C768C9FF CE23C5E2803D8FD5CE49BD15E8F5EE4263A374A 858AA2A61E583C9F60DFF89F44B95CCC97256D C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA9DA.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators A37D5835A4A14C9BFAD7898C3B719F3C F21CF355B4515C09174F5D5E5BADBF3319DD70F0 F0B53707B CA2C39C782DD32BCB60DF970313A029D605B719AC1BF9 079F412666F02FE93F2AA4DEC7CBC22B91BE70B71037C B66EA5A680590C8E92DDEE64D2DD934858B44A 4C97A8CE53660F FD31047E4ED08A25C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verAA34.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators A37D5835A4A14C9BFAD7898C3B719F3C F21CF355B4515C09174F5D5E5BADBF3319DD70F0 F0B53707B CA2C39C782DD32BCB60DF970313A029D605B719AC1BF9 079F412666F02FE93F2AA4DEC7CBC22B91BE70B71037C B66EA5A680590C8E92DDEE64D2DD934858B44A 4C97A8CE53660F FD31047E4ED08A25C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\100[1].jpg JPEG image data, EXIF standard Size (bytes): Copyright Joe Security LLC 2018 Page 27 of 433

28 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\100[1].jpg Entropy (8bit): F9F A0F0D77ACCE F669AF3566EB02D2B378A3C92AC35C9F78A13452 C0F603A726BB8665ABCE7E824CDBA1C8BC9A4183D9C5CD102FC7FA50085EF748 10E737E11DA5BEC01C51D58D6B73F08B32004F23CFC0FE538D4B49F319ABBFF79C7A77D0C52C A0E CC C96F74B8BCCD9F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\123250[1].jpg Size (bytes): 8608 JPEG image data, EXIF standard Entropy (8bit): BFD8738DA7EA438EC49F F68ECB5F2582AD25DBB9D4D8060CF6629C34 25FD4C24BEE255DA691E0F50BCD2BC5777B8AC94AAE62E6977E080D3E4BD2045 1C CE721802F75531DC728E3A61B14180AA705E172061C59DD8D3B2D E0F84B8E71879F7AA2FE 9BDE1651C9983DDD24C057B6179A69D9C300 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\1710_iroka_180_70[1].jpg JPEG image data, JFIF standard 1.02 Size (bytes): Entropy (8bit): E78520A27CD4CAABF5E44509E2F7DAC 8D8DED22E789D5DE0BFA8FFB311A7F68A39F0A4C EA649D6B327D87521E28F7455CC4D7A054B5F90DF89C3211DB BA 594B80A C5011EAD64E68588BE72C04CB3A9C8FEA0A30B80163DE23D2F F54B60CF30018DF74B3D F92F6617CA50069CA E3BEFDE49 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\180-70[1].gif GIF image data, version 89a, 180 x 70 Size (bytes): 4430 Entropy (8bit): FC743945A87DFB A086B66 C68867A060EA7BBC FAC8A6BE4 52CFEC5FF8CBFC8979E18568BC9AD57A45FF644C68F8AC792B F866E 1C818F32971D429FBE080A901984DAFF2F25A279BA90C9AEB39AC20B7074F79E E0D838F1FE9337EC2DA C82E7ACB5AE98CCDF623FFB4CA975B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\180_70[1].gif GIF image data, version 89a, 180 x 70 Size (bytes): 4352 Entropy (8bit): F689EC E0BE444ED0E06D37672 E6581BB25F2A0FC874BB D8EA10024D089 CE89767E39FBC1CBD0B0174AE95E7576E683AFC5FEE2D79BDBCD2830A8468F49 1B8B191B DA5068C1B88E1B76227DD070D4B21E26D B48C330D027DFF068D E9359 ADE6C891C53AB8B90FCDD5F8A29FA0CE2CA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\180_70[1].jpg JPEG image data, EXIF standard Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 28 of 433