ID: Cookbook: browseurl.jbs Time: 01:14:26 Date: 03/05/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 01:14:26 Date: 03/05/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Copyright Joe Security LLC 2018 Page 2 of 380

3 Statistics Behavior System Behavior Analysis iexplore.exe PID: 3348 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3448 Parent PID: 3348 General File Activities Registry Activities Analysis ssvagent.exe PID: 3508 Parent PID: 3448 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 380

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 01:14:26 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 7m 10s light browseurl.jbs roidsignature Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 1 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal48.phis.win@5/318@45/20 HCA Information: Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Browsing link: linkid= Real link is: US/privacystatement Browsing link: ust.com/1nzh8g_vj0ppf Real link is: pple.com/app/id ?mt=8 Browsing link: ust.com/vj0ppf_1nzh8g Real link is: gle.com/store/apps/details?id= com.microsoft.office.outlook&a mp;referrer=adjust_reftag%3dc7 OshFzV74jY8%26utm_source%3DW2% 2BGet%2BOutlook%2BSMS%2BPage Browsing link: Real link is: Browsing link: rosoft.com/servicesagreement Real link is: osoft.com/en/servicesagreement Browsing link: LinkId= Real link is: Copyright Joe Security LLC 2018 Page 4 of 380

5 Warnings: Show All Exclude process from analysis (whitelisted): ATMFD.DLL, dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3448 because there are no executed function Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 380

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 380

7 Click to jump to signature section Phishing: Invalid T&C link found Phishing site detected (based on logo template match) Found iframes META author tag missing META copyright tag missing Networking: Connects to many different domains Social media urls found in memory data Downloads compressed data via HTTP Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 380

8 Behavior Graph ID: URL: Startdate: 03/05/2018 Architecture: WINDOWS Score: 48 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend Invalid T&C link found Phishing site detected (based on logo template match) started Number of created Registry Values Number of created Files Visual Basic iexplore.exe Delphi Java Net C# or VB.NET C, C++ or other language started Is malicious iexplore.exe is1-ssl.mzstatic.com assets.onestore.ms , 443, 49241, TELIANETTeliaCarrierSE , 443, 49206, SEABONE-NETTELECOMITALIASPARKLESpAIT 30 other IPs or domains started United States United States ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 01:14:46 API Interceptor 5099x Sleep call for process: iexplore.exe modified 01:14:47 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link az vo.msecnd.net 0% virustotal Browse Copyright Joe Security LLC 2018 Page 8 of 380

9 Detection Scanner Label Link 0% virustotal Browse i.ytimg.com 0% virustotal Browse stats.g.doubleclick.net 0% virustotal Browse app.adjust.com 0% virustotal Browse is5-ssl.mzstatic.com 0% virustotal Browse pipe.skype.com 0% virustotal Browse 0% virustotal Browse img-prod-cms-rt-microsoft-com.akamaized.net 0% virustotal Browse statics-uhf-eus.akamaized.net 1% virustotal Browse play.google.com 0% virustotal Browse statics-neu.onestore.ms 0% virustotal Browse apis.google.com 0% virustotal Browse is2-ssl.mzstatic.com 0% virustotal Browse ajax.aspnetcdn.com 0% virustotal Browse statics-eas.onestore.ms 0% virustotal Browse crl.pki.goog 0% virustotal Browse lh3.ggpht.com 0% virustotal Browse ssl.gstatic.com 1% virustotal Browse mem.gfx.ms 0% virustotal Browse w2.outlook.com 0% virustotal Browse is3-ssl.mzstatic.com 0% virustotal Browse lh3.googleusercontent.com 0% virustotal Browse assets.onestore.ms 0% virustotal Browse statics-wcus.onestore.ms 0% virustotal Browse 1% virustotal Browse ocsp.pki.goog 0% virustotal Browse statics-eus.onestore.ms 0% virustotal Browse is4-ssl.mzstatic.com 0% virustotal Browse ol.azureedge.net 0% virustotal Browse is1-ssl.mzstatic.com 0% virustotal Browse fonts.gstatic.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs Copyright Joe Security LLC 2018 Page 9 of 380

10 No context Domains No context ASN No context Dropped Files No context Screenshots Startup System is w7 cleanup iexplore.exe (PID: 3348 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3448 cmdline: '' SCODEF:3348 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3508 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Copyright Joe Security LLC 2018 Page 10 of 380

11 Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): F6081A9F338131C6E AC 6E77E41AE448B56CBC755077CDF9CC6FE61C8E3D 0390D3328D27421A97373B C5E315F0E61A2B2FA862508A15DE4790E48 55B0269EE420FF261A2F7F520F A94B9DAE6EB671B947F8A7F60A E8134E6AFD7D1A9A146356AE 78D5713CE A74D4535ABF17236B6951 C:\Users\HERBBL~1\AppData\Local\Temp\~DF3B8606D66D4E24DA.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): C06CE50EBB32F9F2EDD3FC5B942CAED EF6B1D673E752BED A59EE774A1CF4BA DFFE5869B4AA14BE0388AB8798CE563D718F812591F11373F3C1E329AAE8D06A 24FF6E96D184CD69B05C586E48B8F31FC255078AC5F7176A30F85A2C85153A735AA8FEA3F35693D7A1FE5A24BE C06234D3CCAC82A5A01BF5A0E0290E640BBAFE C:\Users\HERBBL~1\AppData\Local\Temp\~DFC51AF66BD77A5542.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): E9D0A469F2C FD4C922C2E5 D13D928F7F59908A983DBFCDF7F35FE8FF306C77 D54645C5F0F44D5FE92E0D3C30A237ED6E928E589A965028D8BA B3D0 2AB0B60C91E52B03776FA12DE65FC8550B28988AAD3127D59E F4B C60383C7F609BF5869 AC0936AC006F97BE325C A31B4742 C:\Users\HERBBL~1\AppData\Local\Temp\~DFF61BE3F0E4869C18.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): E7CB7DC6BBF19D19CC939528F3EFEC7 2A167B217E0BE5DDEBA1D585AA1C C29A378516FB61EB12D8FF6B640647D B1A00F472CBFFE125B02E5DF7E CF1B BF97ECAE6B04FCA4546CC F877EF9FD AF4DFDD1016DF6021CCDB6 031F5B25771ED79C71CF8DD1F48CC22DC3C80 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 593 Entropy (8bit): Copyright Joe Security LLC 2018 Page 11 of 380

12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 3D88D65A8E15A458BD372ED E5 A8DBF65BE C605F718FFC2DAA5E88B D4896AC34C5D72A0F4F201D2AD998EBECA8A7DD37B F1C81 D0C80275F1FEDCF32E1AD20BF8B F2664AE2B D2F5B6C215D08F881C92D9EA1071D82B6D4E6B88 FCA6F475F48269A0824EDD1E03DFDEFFBF8DF3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ F846F08BEFE0DD8112D932FEF data Size (bytes): 543 Entropy (8bit): B9B4F88D68A9E4B614DFFACF8F56C357 5A709BCC5C2A CEB496A77DF5B AE9B71CC1F3781CF EF0DD8C3489EDB2AC0A71CABAB3F3C240FC6A255 C71F49875E681AC4EAF1C3E627B878E8C890764B855966E47F33FC12238B8E3110FA C18A87E50A3BB3 CBE4A07B9D26EC1D2108C02D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1060B7ADDE0FF6DE85637BF89FC4CEBC_4DFCF0FE54E0F7854F4EC 75B9D data Size (bytes): 1595 Entropy (8bit): E530A42FA7A28F3E0A16703E8EDF84CE 78D3CE9165DB E5A584EAF502A3A9535A4 93BA8616F9D189C621D697D C234DEBEE12F429AEA11AC4D6A441BB57 5CB676D5A2A8BA6B569A9E35F06016B1CF6704B211912A5B47B1454C02179FDCCB8AD54B40DE5388C43DB4F37B FFF643EE A1C75A25FAD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\254248EB318A7F E2AAF7E4DB data Size (bytes): 7642 Entropy (8bit): D12070C5435AB2549EC91DAD76EB80B3 2A9B008E1FB75BB6A72FE2D A534EE F0E4FDFEBAD756EB14FB2DE2E6913CEA08C4C061D45F21169DB75E8F A861EDCAA7994FF A22399B0DFF18A2691C9BAD8A74FD71E370B642E624ED8DF2A13C5234B765FB6DB D9C099F7C5387B67115EBE6FE344CEF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D A90937F0752C8B950AB data Size (bytes): 712 Entropy (8bit): D94F1E22F1BD768583C33CA604B04C7F EA77754E95A8A083F2624E68D87D6BD747A0A138 23F85655DD756A38954FD63F2218B4F6FA6BBFFB5467BA02F3143DC7E4CD36C2 12FB2B5E831F474BCF2153EE7EEC2C727B2570E ECEE0DC4C03B693B03F1A79BE4E E638F4 E4DCA79C364E BAF5CA94258BA246BC Copyright Joe Security LLC 2018 Page 12 of 380

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9 911FE760A9B data Size (bytes): 1831 Entropy (8bit): BC78FC1E6152C0EC0A21846A9D8CC7 DD251DF6D5A407730A7B40CE161147A9F5D54FE0 D1B9595BB39D594E314C12EB873DA51F014E8D5283B1F0BCA6072DDD0E CB3D72BC B400EFC1A6DF6564E1415FB73AD0D0B9155AF0BBC30BA EF78E95235ED76E FBE4CEBCF4056BB17B0DB9DBE1A81A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, 6509 bytes, 1 file B95F90C3BEA1D0E7ECA664B8FA01A720 A2ED44DF03C6971C0A7C335ECEF8D996D6BC0652 D82B D19804D73473CE65D84C4F7D64E453041A9B30CF96C738AA0C 4DB9F495F3B3E39D89685FEDD1F0C715E3C3B0D FB3F51D2B454943E7AC34B1F871C435299B799FCAF3F8 13DAA3BB67C33B221D27C721CCF0F4D67C033 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EDAA817EEF5159B09F6FCD000_2123BCA7AE8E3F7FD62B6 3CCBDBC590F data Size (bytes): 471 Entropy (8bit): CC F0D84752C840651C03EC85 D5E A9E1D33B4BA472F7F82CE1FA DBAFB030B9278E29AF92B447DE63CCBD2E644E31156C454B8CFE3F BAA5AB152CCEACE500890B75B86B458151D9B85622F368CAA47C92D07B4CADFCE32986AD53A4A0A31C9292 DB7F1DCD0B9EA923D3D06780B737A30A04A8CCF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 531 Entropy (8bit): F0300B194C6A43ABCFF4E4872B8F57EA 3954C9C90B15DAD1AE69C550EFB30DFCBF315C ECBD2B FED EC33AC002A13C D9E3AF29CD FC91F10927EC0E273ECFD4EB F5A59DB0EBD B7128FFDFAA9A410EA17C514A5E2C197BAC4990 CA2F392BF6886CBC54D378A3E2DF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 471 Entropy (8bit): B888F6ACEDF622DFC0182A8197CCE4 F96CB2A18EDEAF9CB9755EDCF5ED77ADDDA02F32 Copyright Joe Security LLC 2018 Page 13 of 380

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA C0DCF3DF26FEA5DD85A9429DE3A8F1AF2BC34FD092A21A951CE08EDE2B44C9EA B96343B16789B2E97AA678E14F73F72FB8C28841CF93F0B2C63E2ED9CE53255F5BBD8EBA101405FEDBD2 CDA0969AFD5DC254F22DF179E50BD5E6F208E9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD data Size (bytes): 531 Entropy (8bit): F0300B194C6A43ABCFF4E4872B8F57EA 3954C9C90B15DAD1AE69C550EFB30DFCBF315C ECBD2B FED EC33AC002A13C D9E3AF29CD FC91F10927EC0E273ECFD4EB F5A59DB0EBD B7128FFDFAA9A410EA17C514A5E2C197BAC4990 CA2F392BF6886CBC54D378A3E2DF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6FB1C7BC744B04B7C9588E58823D7FBD data Size (bytes): Entropy (8bit): A1FDB517E48F3526B4580BE0AD1ED28 21E196493E94B80DEFFA45AC99398A1E92A501E4 9FEE2CFDE6F917AFD4225CFE9D4D203DB32A3654AD3E110BB90530A94FB1E8E0 190F4ED642E13326E1543F7698BF14295CAB1B7D921F56C4D4DA156EE4B31941D E5F73DBBED4FD361 A6ACE86E3361B2F836CCDF299E9A548E10113 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8AD 6 data Size (bytes): 471 Entropy (8bit): A3A0DD86FDC09533D85412DF4E1311FA E A2BFB0A71AECFE1FB3024F7B10B87AC3 A862BEB49B8A4113FA8561B5D34FDD EB9BFBC78A30191A5F1CC12160 CF400D8130C5E4B788EE3F3C2EAB3BD DCF19EEEB1743EF2AF5C666521A7DDAB16A36C FF90F2050F7868A752842EEF94A83E3B489C9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D3BD78A30B98D17C317EDD4FFE850A0 data Size (bytes): Entropy (8bit): FE3214E28327C98D4F77FCB0005E1C59 73CC1C1E6BB2D794F3BEA4106B8F364FD59DA65F 042A24D1872CE529E0843CD79F8E897D3AB1C449D67798C403DBF3965B13BF6C C3FE5F3F311C753B1D4DC B936427DF212D32CB C055B50ECBCCEF49DF7ADE02150AF7FBF06E EC DB633F7D43E6CD4ABB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Copyright Joe Security LLC 2018 Page 14 of 380

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F Size (bytes): 4405 Entropy (8bit): BF2FFE7C12AF123F5B26546A50D05E C2566C AFFCB CF75E5819AF7771 F C1FC0281C842B1EEFF057750C956B863D0AFE9A3B1576F4F 62CE0C385A944315F13368CC5FAAB608089C1B AF0C5EFDCA5137FEE4590BDE4EE5C7EE4115CED9 63EBA D019C89CE64CFC6D E5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8C7ADC6BFC7DACEEE377F81BBF9062FC data Size (bytes): 7642 Entropy (8bit): D12070C5435AB2549EC91DAD76EB80B3 2A9B008E1FB75BB6A72FE2D A534EE F0E4FDFEBAD756EB14FB2DE2E6913CEA08C4C061D45F21169DB75E8F A861EDCAA7994FF A22399B0DFF18A2691C9BAD8A74FD71E370B642E624ED8DF2A13C5234B765FB6DB D9C099F7C5387B67115EBE6FE344CEF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CFEDCFFDD2FA38C0C8C71E5FF0E66A9 data Size (bytes): Entropy (8bit): C4D60A88A8FCD8885E98D0169A9535D 50EF F7F17CEDB9F5CCD0D3A7F0133B61D BEBB1CE7BAACBE2255FC3DBEAA345ED42CFADF86DCD29AFDC8342A223A3EA625 3AFC05A4B296117FA016CACC1911BDAD BCEC391A21784E945B5A08FD1DE9F C349241B8B AFC5436D0BEF9D5BC1AF2BC385A12665D491A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8FE2C641C99CFA6687FA8D31B7D528A1 data Size (bytes): Entropy (8bit): E91F7B6B19BAD4AAE619DE C095FC46D2DA9F3A4DE85242A5EABB275F4AA AB74DBA67133C30F8495D318AA A2C009F10E188E17C1006BFF1C34B 19CA837E74167ED1B1BC1E241629AF6520CCA06950F22B64A7138D677142CEEB53C3B98D92A0EBA261F9D1C1C4 71F551573F014708E63A9B1035DBF4E873208D Copyright Joe Security LLC 2018 Page 15 of 380

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8FE2C641C99CFA6687FA8D31B7D528A1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9F9C58BCF02CB8A34F017EC53AEBBE1C data Size (bytes): Entropy (8bit): A1FDB517E48F3526B4580BE0AD1ED28 21E196493E94B80DEFFA45AC99398A1E92A501E4 9FEE2CFDE6F917AFD4225CFE9D4D203DB32A3654AD3E110BB90530A94FB1E8E0 190F4ED642E13326E1543F7698BF14295CAB1B7D921F56C4D4DA156EE4B31941D E5F73DBBED4FD361 A6ACE86E3361B2F836CCDF299E9A548E10113 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D _42820CDFEA41DC84AAB89A6B data Size (bytes): 1754 Entropy (8bit): E3C9ACBF05B1DEDBD9DF1D2D786B9A92 B7D9380FA1B C5B7E0F25A2DE08E6CF207 BF8323EA0EB F731B5276FC48A22FE3C4C622DC37EBD089A2F F6C762E0A1A71D5B0E060BF4AD35C3764BC5EA80D25DEA8B1F0C3B834DC EB4103C107B B6495 E8B676DAB9CA7C70A5828D3C206039B4A8C8AE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E B_C31B E340573F1336DE607D619 data Size (bytes): 471 Entropy (8bit): C3FAFC5C96C9B6C73FEEFA68CFA6FFF AB5DE334197D6CC9EC290B4FF03C52CD31CE163E BA CF293BB21C33EC162C7CCE5A4BB EE368DDDF7CDD86F558A AF1BBC6D6B87DF499478C17E93D30B3B1D191E596210B5B81B01F4BFF062B09EC59ACCCEE5F5AB3578A60ADB F7110A381D4C16DA53E22918D9C08E4BECD747EF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_CE5427FC14BD9BB78C9AA 19858B6AE4B data Size (bytes): 463 Entropy (8bit): Copyright Joe Security LLC 2018 Page 16 of 380

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_CE5427FC14BD9BB78C9AA 19858B6AE4B EA7525C2C9B9CB1F5B367F200869BD66 75BB821084B0A503D437B E43FB783A035 F293CF6896A1D5F6D7740A41DA5A714E44134A9B451C5B9C7AB9EAC4F16C2694 8FCDCA45F5ED8ECEEFD1E8377A342246E F352E462C40A13AB29ADE180C6C56727C6F8F2D4C48843 D DA3A68EF24C8FD78B37BE84A02A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F6F92FBF4E8096C9272B135AF6140AA8_7A4E2A388EC0A74C0B0563A058DB29D E data Size (bytes): 313 Entropy (8bit): C067A675AE42A4F2C0 BAC80D51F7C8C B F44C6260C CA38A02D8438C86DAF6FCF1CFB9387CB5ABBE33E9A3890CA04FDF9A6A114D099 46E522A70DB5400BFDB9F7A644BC38294BEEB85C90E69EDD5247C99DCEE C824ADBF B62F 61FCA9111EAFD3A7B212F7A10FA637F68C798A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Entropy (8bit): BFF24F3F9EBC5D1EB76A6219A0A13D A3CAD6D6CF2871E8ABFC1EDE C2F 3A33F947FEADEE20FA175CE CDA496A02E1F7599D8DAACEB1C0E06FE0F 4F74B5C1BED76EAF1DA37C101180C80FE7B02DCC190DD586E E6106E9AB2A4D4FC82A8F08D15F3E8 3D9A130AD7987AA9A82176A067CCC8FD92601B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ F846F08BEFE0DD8112D932FEF data Size (bytes): 234 Entropy (8bit): DE9B7F8359ABEAD53E5D F4BB7FE6B14CD99B85FC5226EBF46C558C3D9 E4E63CB4314D5321CA356CA0E2FAF4F419A3270CFBBEA69D0A7817B19A CCB54BEBA2098D5EFE4DA168F66C79021A3BDFA367F2C5D7EF9E640D39BA57FB8D3A596D48BEA5E387CBDA8 78D8A1C102E9F41AACFDB7A5C37DC5ABA57D7E06 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1060B7ADDE0FF6DE85637BF89FC4CEBC_4DFCF0FE54E0F7854F4E C75B9D data Size (bytes): 398 Entropy (8bit): B11FECB0F8126A96C E169 7C7C2F7ABF129587F862F BB567DCE3EB BEF77C56099AE2D7888C37D0A7A8F2A4610B3ED9F829E095DB409AE4F190FC ECA3708AEE04C59519A276B63C2A EB8DEFF151E CE22EB860C14B54880E0E880E73BE16 E67FA42C94E972AC1CEB3A5C A36589 Copyright Joe Security LLC 2018 Page 17 of 380

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\254248EB318A7F E2AAF7E4DB data Size (bytes): 198 Entropy (8bit): CE308E7AF79CEB86E6B82A8A D FB61CAEDAA E312012E6A028BDF1CC439CB89D2C9F7C45D87069DE5B462B876F20B7771CBB EF36631FA8C63DA66D885D15866E913808A299B103C33EB08C39AE3C1DAC3B42B30D72189A132953B0A5F DD3B3E963BCFC CB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D A90937F0752C8B950AB data Size (bytes): 272 Entropy (8bit): C2FA1ED E4F14784FBA74B40 257EC02282A622C61CA1058C2B638E7BA812710C DF7FC055F741E401B5DE9F5E501DB72D8EBA C310089E AEE651C3806F B33B76D9AE0C956CC1F B0E D4D1287C624737BF9FE2E637BB8B514B9 8728BB3E6C211450CFE1C98A8F E59 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA 9911FE760A9B data Size (bytes): 486 Entropy (8bit): C3C5BAB184D6EF1A48C93425C67A B56EA137BE3FA6B4CE6A87A821514C038E0337 1B8C065695B618C49B8E9AB11E74AC014C8892BA639D78AA94823D78578F250B 0483A5396FFEB0FE73C8CDD33BD171882B03B0E331FE05BDB0ADBE0480D392C DB EB1E79F 1C86EAD DB1291F38FE12C12DF92 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 684 Entropy (8bit): F5FA49FD9AF2F6597D3E5986A547A1E E5EC206DAB2F815F603D4C54A78FD938C349485A D4B4DE083E670BB97239DD0D8785DA9CB15D36BED142BB0074D2C86BECC140E5 C4E637ABFF0F54FEAF6F3DEAA8C323D11C4701C51837B10322F9A07DB C3FB4E535B71140F2EE000 B2059DDC4BA81A55BCDC1A4FC4908BB7C80AF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ EDAA817EEF5159B09F6FCD000_2123BCA7AE8E3F7FD62B 63CCBDBC590F data Size (bytes): 426 Entropy (8bit): D5BB15F93613B1C62FFD9B6D34115F 12D099B5C01BA002B4E597A8BA214FFAB1B4B2A7 E2CDB99CE6EB04977E C4DF0F4E7BD58D60F56F8212A9B9A8384DCA0 Copyright Joe Security LLC 2018 Page 18 of 380

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ EDAA817EEF5159B09F6FCD000_2123BCA7AE8E3F7FD62B 63CCBDBC590F 168E0638D2536D199811FBE5513D DAC7451AD97A A86F938D0CA774D9BB3A24688A2197 F235DA31FBEA272C9E91F A804B6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 484 Entropy (8bit): CB20CDBF485A9A00E6C417C7AEFCD11 3F035DAB36B572CAF8F228EA032CE00DEE7E1F8D 1D3BF96ACF4B2FC9AF F101867F3D2AF3DF53A3E C9139 CB87C0C4BC90FDF9F F53DA3C03F65EF8C057424A74555D2CAFA875563AD7311D171004B ADC AB6ED212F332B30D73F2A652F4950BB497F71 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 438 Entropy (8bit): C30B2562C82D5CC75C54D4AE2ACC9F04 F97BAFFAC99A5C810A0A3BD D26236DA D91C676DA1741E47B42C17A1C1F5031E46368D12D589DEB CD03A99F1A36A67163BE045E EB4B F529AD5CD0E50A1734CBFE545D11A42D467B6DA0713C4 06B7DD9B65F160E34A05E23D8F6B83DA3CDAC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD data Size (bytes): 216 Entropy (8bit): FC8B37E4B5F B4B9E731C7 E7FC30E760BD91F C7FC176B8381D337C9 924CA5ABDF1593DED0ECFE7F5A87D3F FE CD7A E E3A3AF17C40A C310DFA588CDE5BA72A23C6C9685BEBE263A7D66BBD04394BB543CB89B58A7C58F0 8822D785BEE108A139C997F9E2D6C413FED55DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6FB1C7BC744B04B7C9588E58823D7FBD data Size (bytes): 236 Entropy (8bit): A7EBD C5B7F13A27A620BBD8 8F7CC88226FE8F2962ABC3EC39F8D2E F DE96F8BA1F2F8D387CB347F13D69F282C949AA CB8C06C54B E77760F40A0BBD1C4B EC331070E561418E71AE1B2AA730760BEA F854F2E3B8DE6F6D7F 44D22876AA8DA607E11E6D1ADE05B71A5338D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8A D6 data Copyright Joe Security LLC 2018 Page 19 of 380

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8A D6 Size (bytes): 434 Entropy (8bit): F0D32C405A41B CA40C51 C62A2D59D3D7C6E7A9DB058E288D3683ADF19733 BE6D7A7F849684F846A5A1B3200FBBB884E33B88BEC4F594B2F7F6DC10B11CEB D5F817C24092D6ACC1A1865D13003FA207210BF869F2AD84FEA2627E9FDC9D7957EA1E704FF98CDD9323E3E5AA 5EA7AFE577F2A44BA5E95EC6D28EF D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D3BD78A30B98D17C317EDD4FFE850A0 data Size (bytes): 264 Entropy (8bit): D7BA62EEBB8CF56B6D0A28E2F2295BD1 2A3FA5E190C5F E5027BB732B376AD81 065BD5FC9B ADD34497A40989F46F87AED76C9B874AF65E52B729EC9D AC5C F2ECED5E8EAA5BCC08DA ABA8A4841C624213F7D140039B65238B28ACA21153C8E590F 589E9BF0A5D E6F30E46AC26D9B1E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 452 Entropy (8bit): ACDE25F078242FA4BB54ED6E9FD26F B6E6918F83D57FFFD8B958A2CB5979B5 201A75D7F8274D A65EFDD903D5C23F25047A6D90B1AE52C28CFE63A92 CD39B F317DBDB3AB27C51E7AB23CA2D329C4C D80DB1CF0A108BF16500DF656ED2B081B 996E1A4B5C B341B9E07339D0DEE7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 184 Entropy (8bit): D27B86E4F43122E80A8354FC1BB5FF 365A13A771256B7BA23BB0709CBA0B E0 806E748DB85EFEBB347F103EDE33E0B613AFCFA480A6755D3F79F1C4E1DBE35A 2AF3B6A93A026E4D282CC6012A21B6E93D67BD76FB4F8469A6E4D512E5E657858AE81F41295EB4B ADCD 3402D910CD2CEC80EF8B173398D5098FBD2ADD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8C7ADC6BFC7DACEEE377F81BBF9062FC data Size (bytes): 224 Entropy (8bit): F6488F6B5A70D900F17478BD4A1EFF 93BEB9A7A3392AA8F0BEC98A0A13F30486C557DE 41ADBA BB27D BF64CE50C1AB563A27533A8FA15EB5AFC3886F 6ACC03C5D3D59A71D5DFBEB293DE9DC43886F36E9439F7CA87DA2F04875BAE6A921AC90F4E2860BF8F4A1643E 465C6FF2FC390240E3F2C0A1EA190B02A51A053 Copyright Joe Security LLC 2018 Page 20 of 380

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8C7ADC6BFC7DACEEE377F81BBF9062FC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CFEDCFFDD2FA38C0C8C71E5FF0E66A9 data Size (bytes): 262 Entropy (8bit): F00F37219C6410F12C19BC7BCF96C7E 2D9E54B106450CE905E95AACB5BDC5877FBDB7FF B7B0E12AD762E54CDE2F1584FB18D3601ECBD65EDD2981B81DE346360CF90EAA 9B76F D989C95126AEDFD8C3E8A527E4ECCFC2EEEA9FB3DCC51F42D3D99A27A0941E2EA520E9568C4 6DE3952B21F9028CACF28A6E034348F02908B65 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8FE2C641C99CFA6687FA8D31B7D528A1 data Size (bytes): 268 Entropy (8bit): AC816F0C E51F8395F082E 4CF9CE3DD46D56674D2E B2FF02D80CC E8980D95B A00FEF969002B3F3B02107E967E60E1175BEE4F4A4F4A6 2D24DFB71F37D43CC7BB94BDECF1BED D6E5FF7C FBC5657B4BAA774C6CF5FD0E804EB30BCF 1DCDA2CD1D81D9C1F08F398805CF F358C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9F9C58BCF02CB8A34F017EC53AEBBE1C data Size (bytes): 210 Entropy (8bit): C0BB44984FF7F177C9C5B01BDA97149C 8F1660A6116A6C05A90894DEA8F595BBAB05FE6F 82EA936BF9C19F819E7B8DAE2D45C8D11BA1654C04B40E8FCE8BB3F8436D7CCF E6578C370A02D6DA51D245ECA4AF70D16ADA79C4C8311D5877D9ABE01525EDC072C625C3D2A ED1ABD FB4CA157D0C8BD95AAF036A57D4DC433AE18718 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D _42820CDFEA41DC84AAB89A6B data Size (bytes): 804 Entropy (8bit): CF1B6B3584F06FDC1263FBC0C9F2BACA 9C64FD660B7A7D9103C A982047E005 FA F95EFFC3A4DE37A1837F942D09BD98A06E9CB75AF739EC4120C593 0CC91DC49292A402F2348A9BC762F227FD57EBDB7B6A55752F0AFBB01E674E220EC82E0D2C462E F1DCD 170C1DC93CEB58C1ED856818EAF640661E135B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data Size (bytes): 804 Entropy (8bit): Copyright Joe Security LLC 2018 Page 21 of 380

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F CC8578E3361DF4EEBA01FC04408 B4F6C8197B63667A30E A6D0E5AD2996CC 9367E2C6B1DA4DB657CBBAD9CB06DA15D1F79B42B98D196651C932F4BA7683BA 3E F6B16E00FC6F00487C00E61A256ED742CE32A72C69D87E686A6896F859FD061A2F94200E7E4030B0A6 1EA2A21CBF3409C632BE7F17A1D6C83070F5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E B_C31B E340573F1336DE607D6 19 data Size (bytes): 860 Entropy (8bit): A B7BC D961 45A8D5E3AD371794F08E9D42F5DBE1DBC77C1B FEFCD0E4A B3E1CC25C5A890CCB9762AD6F18B0318C1AE947F807 D9FAAEDC0E9EA4105CDB7183AA20AE5E151880D57DF8CFC6C94B C73ED3F7942DA F896B2FA6 E8B5659FA00207B10CF605B70BDDEF3800A4676 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_CE5427FC14BD9BB78C9A A19858B6AE4B data Size (bytes): 382 Entropy (8bit): D720B28E067F3477E0388C787AB2228 DDCC4C1AB24A74B1FD9F8A91D216F5CD7C81A831 28BEE22A68C1F46E20C7F3F4B1DF22EE0D991C11D02B EBDFC46D55FF 93F4BA6D0E991E5CD A F27D42E616009B71A4CED83E6243B56B3C F693D9D005820B 21EBA3C64CE8A1CE8078B14D2CAA6AB5CED4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F6F92FBF4E8096C9272B135AF6140AA8_7A4E2A388EC0A74C0B0563A058DB29 DE data Size (bytes): 876 Entropy (8bit): E3E426048B79FA782A39DA2512F0AEA9 0D980DF1352A12B C16F149BC6F5320EE 4417F035E C0238C AC1284D8BA B3B4010C8C719E1F F4C9DDFCDC50DFB5F0D41275B18FD9B5C182D8AB23799D2676B5BBACAAD93E6D27A18D4C B97EAA1 B88B DD700810D4F1EDD3A05C405E7C9F C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B Copyright Joe Security LLC 2018 Page 22 of 380

23 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\2XQH78P6\itunes.apple[1].xml Size (bytes): 13 ASCII text, with no line terminators Entropy (8bit): C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 35E3224FCBD3E1AF306F2B6A2C6BBEA9B B71E4D B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB 6BE8CEC7C862AFAE5B37AA32DC5BB A DA41BF808A4EF92C318B355E616BF45A257B995520D72 B7C08752C0BE445DCEADE5CF79F FED C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\63KWR9LZ\w2.outlook[1].xml Size (bytes): 26 ASCII text, with no line terminators Entropy (8bit): CA22370B52822C17DCB5BE3AF6 DD26B82638AD38AD471F7621A9EB79FED448A71C 451ABBE0AEFC000F49967DABF8D42344D146429F03C8C8D4AE5E33FF9963CF77 6D5808CAD199A785C82763C68F0AE1F4938C304B46B70529EA26B3D300EF9430AD496C688D95D B3A577 01D62245D98137FD5CD825AD62E17D36F15C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\L6B92L02\play.google[1].xml Size (bytes): 197 ASCII text, with no line terminators Entropy (8bit): B B9C39774E1F8B426B0B8 33E727D8AA9B8D99FD1FF3E07FF5449C7F1EE A85F41568ADC18A1F C6FB688D46AF737EE3F350B9C8D9B B677FFE390C448AC627D14B1AF C8E482411E522F22344A263A2C71A96A6312B E3ACE991 7AB8AD65BDA7D F F1 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators B8B4D25BDFC45DFBEB305051F191184C 378F159F68D2A8F38E63EFDE98C47612ABC29B22 FD2DEEAD B180300FC4D9CA610FDA2B38BD6CDECD0F40AB1215DAC8ABE EE53BAB EF87F09CD67979C0E608153F3E1EE7F6A0D9E EFB31818DE2504E284AD668B45F40 93AB8BEAF905F4A8DC426674E57F59FE405F3 Copyright Joe Security LLC 2018 Page 23 of 380

24 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9A00A161-4E5E-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): D30AE4A334ED A1A8CE2BFBCD BD099BFF311C20D CF92D861 5CC302EFA8E2B3202C372BBE8677F72704ACDC EC31E0961E94F9900 9A6B1C1CAC41F05E2BAC00D38CDB A42B0F70B32440D511485B5A1BC65AD126530CD589F59067A40BCB1 538B8A82D9E8D1791C2E885106B9E0F4BD3982 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9A00A163-4E5E-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): BD7F83251EBEE702AC2B01D804F8593 CB122CA2E848B EF5EFF52064E857DECEB CB680F665CAFB9B6FF007859A30D082C7383F81623BC C3C50CF73B B4956F52F1D502F5C036C C B97871B45C2BFDAED6FF7CC00149B114E370E69000C15630 AB43130C56F92E1E8DE954F4DF E8 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A3C2B7D0-4E5E-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): CD0F8BA4FA9E5EF1A56B7B594A7D8BE D067B A212C43F03FD5ECF78290CB76042 C23D19D62D A066D C82B A88B C2C8C6CD4ED6 21D3F3E87F03FBA1ADF043E74E39AB2BEBAD2F4D9A3C941FB047D0ED1CFFE81FEA8E0F38AB7182F9A4438BD4 06E94D3FFDEDC96BE5C7B0474C2E9895B939DDEB C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver449D.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED97 0E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver45D3.tmp XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators Size (bytes): Entropy (8bit): C72688DE7D90E6526DC0D8878F3F6 Copyright Joe Security LLC 2018 Page 24 of 380

25 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver45D3.tmp A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED97 0E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data Size (bytes): Entropy (8bit): A3D73AC850BADD1A3CACAA EC 5C353A4943E BACCB14F8CEE028B FE0C178C69DFA9BB2E A06F6CD8F9B495380DBA82DB23BB824 05C572D F679A14050D0E27FD46C5731E923E4073CB24D3D782FEE91B142C6D2449AA BDB CE0AFF2BE9249B A15F540911C5F9 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[1].jpg JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): C5FCC97F02D53D873F7DA218F48B77 A756B198834E4C655CB02364F CC24EE50 E1D59F0C88EC09D1A7D6CAEB40E2821E227CA5DD40DE2CE1396DF79939E1457E C4B7F73362AD26C478E9EF5615B45646A9C5DEE2C6607A139DDA2B29FFC00AEE AF6EDDFC4CAA3E2 4C662A909A53799A7B4D9BBD04A B80 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[2].jpg JPEG image data, JFIF standard 1.01 Size (bytes): 4868 Entropy (8bit): D35D0C65E42542F8F45CFC972D5D 8BB037A3BE7D93ABD89483C835F5EE650EEBDE5C 908E97AF93A7DE146E8EC4FAABEC24E61061AEC7B79A60ABEA90BF0E683C1818 8A743AE726DCB60EBCE7F4BEE95138FC3FDFC55FBBE14FFC6371EE9B37A0BB AD1DC500C223799B2DB 12918E6A F EA8A4D663F599AB63 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[3].jpg JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): E8F1484F9DCEA5ACE8F2B997A3C6E1B E7471C5637BA8A1A03403CBD81DCFC0B7BA5810D E60BF5616EB2B7DFBEFBA3B4FEAAE452DEF910998A7FCA4FDA4AD B68B3C3B2F3DBCD65EC6A91F208AC5514DBE7E1BE95CD63EEAA6BE86D4C25F1412A3B A C58F D96CEEBA62A2748A7AFA9F C6FD1DC091 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[4].jpg JPEG image data, JFIF standard 1.01 Copyright Joe Security LLC 2018 Page 25 of 380

26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[4].jpg Size (bytes): 4563 Entropy (8bit): EA A45A644FF1FB9CED0A63E 618F057906E96431E8F0308BF3C284D8DBF4C1FC D7C164E5A0E6E800D6CC216B56E121EB2AEFCD1B765460F889A463315FD735FB A836DD1A86DF01761D8820B DFAC48B3394A598D103DB02558EA4CECCFD BC517881E1E A8F03D5A2B92854F753D F54A33 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[5].jpg JPEG image data, JFIF standard 1.01 Size (bytes): 5013 Entropy (8bit): FC6C2C517A8ED53DC84B689910EC85B1 077F7E451C67F2EF189BB0AF023CC0E3723D7186 C64EB96E4B5E7C590B34BBB18704E1F334C541977BA813E7F6625B35B6846D14 6DE8304F2A4FB102074B6A7D2483C83396EEC4A481EE474D00072F75E9363AF6CAAF013DBA76769FF1B247B11A 132F2E4B A2E689D508FA0155FA2EAB5 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[6].jpg JPEG image data, JFIF standard 1.01 Size (bytes): 3751 Entropy (8bit): F10D473C32EFF7CC05EA4D23DEB5 5D15A754E1563E8554EA41218B C3BCC88 E4E87BB2452DDC16F47DF17E3E590E05FA8B0F5D507B21707B049ECB4E9FEB1D B448BA0385CFDF8BD123F67A537233B49AC9D5DDC2AF0E87972BE62C59F2CE6B679533DE8AA91A5AB8AE98C6 D479B08BF959CFBFABFEB62DA5807B6D9FA9A22A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[7].jpg JPEG image data, JFIF standard 1.01 Size (bytes): 6942 Entropy (8bit): A657DF520C63FD5752B85E3074BEFAF 1E282ABA7B98A07295C69E6F1DDA64CA541B3B6E B581CAA ACE8258D7B44A07F76B00FCF90951E7A6452C74C75E03C1D 71489FABDA8524A7E4FEBE9378C0AF7E7BEF47B184B AB2593F379C1545ABF D1369AA737E95D7 9BCB7E774175A90C80EAED3B D371 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x0w[8].jpg JPEG image data, JFIF standard 1.01 Size (bytes): 3488 Entropy (8bit): EF996ED0B9D46ECD29894E7E1701DE8 BC7C9A8D160BA4E3E4B8B7BC1B7683F6D963CF9A 30644F2FBBB6EA2A1310A54ADB2EE5D2C8AE1535FBF B7A29D158 DBE352781BD5348B5537A2F5EC4E5321CB7D9ACE96D03D2D8B1A6B B412F57020DC5103C0E107886AF4 CE14BDA189C03FAC2F1AE64EF8541ADD52EBB0 Copyright Joe Security LLC 2018 Page 26 of 380

27 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\2016-appscreens[1].jpg Size (bytes): JPEG image data, EXIF standard Entropy (8bit): CD7C5FA5C4A64D52C7829EF97019D08 F1420A5313DD9A85215C2351E704D6D580EE3BB BA85259C26C31A1A67F56479EF7D A AE240B128E90356 C60A6EFC DEEF2A27F384B9AD6047A93DFF4CF07C8A3D7DFE8B62F69112F4EE70561F5875C0040C F5A689BBA4EB32AF858A1562EB4511EAD2044 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\300x0w[1].jpg JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): C65FDC0A62117AE70DF8E3526D51D6D 5A6241B908A2ED6D10375F F64F8107D85 718A764C187961A01F79703A85118E6B B97DD6EA27CA571C550E15D97 902D439BAA98E3996DFD488BDEAD82FF24DD985299B97F7D2940BC4415DEF66B2A0D08DCB6DD12A36BD598C88 875D19FAD6B ABB1886EBE1A5B6CC1F8 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\300x0w[2].jpg JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): B F EE2A94BB9D4CF1E 728E6AE18C527FF301F3BCED9E1D3C3F301D0B7A 2FE16A97E1462E3998F684E82D25E53A1EADD8CEAD F2014A37DFC5 BA9FB9BBFD271E0E958D5CDE6672D BAFD162306D2131DD389452FCAA4BADEB61EB3366A14DC8EBD C64AA1C00127F7ED0E07A6C64B6B92B78 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\300x0w[3].jpg JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): A8674C40C A0D227EEAEAE C14476E704104C3169D2AE9122DF7691ECADAC37 C F2A9A82A28DA651F40189D6FBF DA98D1B4C9DB597316EA C3EA2DAFD8E2C94BAA4E4F1E41E88DB487A923C04CC2B6E5170B728ACA74AAF92B97A6BF9BD218E68C7AEC1 E03004B158A6F780C5DFFD72241FD2A058F82F4E7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\8d-75d560[1].css Size (bytes): Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators 7B74B4AB375F613D214C4CAB39EC545F 89F5E51F11BFDD8A7EACDD7B7A F307D5 A2C27D006197C8BAC5EDF49D6144A515386BB8AEB4C6C9C183F6EFC22DAD1C37 15F7DF41618A77151B34097ECD5E1EDB15220CC0DE72C1F6D62DBFD638F67F6ADFA EFA1ECF370909C12 63D33F5D954727D3501A102ED76291EA Copyright Joe Security LLC 2018 Page 27 of 380

28 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\8d-75d560[1].css C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\KFOlCnqEu92Fr1MmSU5fBBc-[1].woff Web Open Font Format, flavor 65536, length 19916, version 1.1 Size (bytes): Entropy (8bit): A1471D1D6431C893582A5F6A250DB3F9 FF5673D89E6C2893D24C87BC9786C632290E150E 3AB30E780C8B0BCC4998B838A5B30C3BFE28EDEAD312906DC3C12271FAE0699A 37B9B97549FE24A9390BA540BE065D7E5985E0FBFBE1636E894B224880E64203CB0DDE1213AC72D44EBC65CDC4 F78B80BD7B952FF9951A349F B903C63 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff Web Open Font Format, flavor 65536, length 19888, version 1.1 Size (bytes): Entropy (8bit): CF6613D1ADF490972C557A8E318E0868 B2198C3FC1C72646D372F63E135E70BA2C9FED8E 468E579FE1210FA55525B1C470ED2D A2DD4FB972CAC5CE0FF00B1F 1866D890987B1E56E1337EC1E975906EE8202FCC517620C30E9D3BE0A9E8EAF B178DEB81FA DFE 3FB79B3B20D5F2FF2912B66856C38A28C07EE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Print[1].png Size (bytes): 476 Entropy (8bit): PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced B8E8859FCD4E43D C17A3C7BD F0CA023F26A FA0BF6935DE6A3B8AE6F8 DC15A37B4015D0DECF639006E4F9002E742DDBFD7C669EC0AE469057F238B78D 3605E4C4FE22E6E05553F89D34CFE8B3E5CA72FBDADCCD8B279835A0ECEFCD10B1BF2AD1ACCEEB168EE369E 23A8AD205720FBF33A184188A7F23AEA7B0F22005 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ac-globalfooter.built[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with no line terminators D5AF105756E6DAB82983A70500D1B638 5C AD61BC59BBB3B197AA6BD4FAA1A2 B706998DA6B7FB2C2FBF67DF2B9E48BF91EE71CCC0C800A4D317AAC5D100DE27 93B7CDBBA3B86A47808DC82268EC7A5BFEF6CE54446A751B7852A7B0EBFCF1C6FF4E0CB53083BC009FD01C833 DF591B68BABCC0A9D2EF924A274BC26CCB05F5B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ac-globalnav.built[1].css ASCII text, with very long lines Size (bytes): Entropy (8bit): A4348CF10C2DFBBF963C219EA8F9DD Copyright Joe Security LLC 2018 Page 28 of 380

29 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ac-globalnav.built[1].css A F409DE C304BD942994A5FFE8 74CD808BEF37001A794A567D84AF83F9D8FB2B2F1DEA89C40723A5087FFB CF1998A CB8E4787DC712C1131CD9C0CCD24A877AA04748C084A89D233230D8C53F09D82CE40A589C 0EFCA48869D5E B53F5915E6F94B6F3 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ac-globalnav.built[1].js UTF-8 Unicode text, with very long lines Size (bytes): Entropy (8bit): C3B332F44F C664A68EEEDE53 A982796FDAEC06EFB31862A4F623DE7378DCCCC7 A0A22AADBF5667E E6BA05DF10D16F9B338605D3C05B118D6FFDE358A B43BC5BBC852E0B58E7AD1B6E6145F5C A79774AA8C521EC69CC378AE952221ED7E3CECEB9CC2EB2E 0B55E0754FD60AC23C48A388BA6AE98D6A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\appleicons_text[1].ttf TrueType font data Size (bytes): 1640 Entropy (8bit): E FB659BD46D9A847AC21625 E EC57034D39DEA55FDACEC9A5B580CF BA27DCCE322FB56549CE852AFCDB8B92E9DD1BCD931D1530DC2A19EE45A D357F3CE558F2A8618CF88249EBFB3CB64853A99AE6C1313EBEC9038BB F2256EB18EC7547C2 F560CA0C731DFCA59CAE74C6A0DA960E9E10F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\appleicons_ultralight[1].ttf TrueType font data Size (bytes): 1716 Entropy (8bit): C8B548A2770A F67B3345E7441 0A2C88CC217D AC68EA9C51F6D974DDE 4CE98C14D98CBB507CF7A287AC2BCB95B5320E52CFC0672A80B4054AB135141A 3709EB7ABAEDB2C0EAD55B07F13A FFDC9B2DE8F024C173CAD779E17445F5F94B022B451F8644F8A7C2A 6FA2B1F1F127A4F5CAD7D754F E924E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\apps f76f e-478a-9c05-67b54ad36521[1].jpg JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): DCE742F44E41EE3EECB7E5962C23BD 14AC70819A1EC3DCEF9A27BB5CDD41A9CB18B17C B091E047FCD8A25613F9B912EF82127D8470B5B43A6F58754C7EFA A F249444C7AD5C6AA D704C045BEF070B08BB92A43DF4F6FDBB6D817C18B1C1A3CFFF2AA31281C7CB EB38AB646BB CFF BE10 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\apps e61d2b9-d b- 897b-7e92c73b1e49[1].png Copyright Joe Security LLC 2018 Page 29 of 380