ID: Cookbook: browseurl.jbs Time: 20:25:07 Date: 07/05/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 20:25:07 Date: 07/05/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: Spreading: System Summary: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Code Manipulations Statistics Behavior System Behavior Analysis iexplore.exe PID: 2744 Parent PID: 544 General File Activities Registry Activities Analysis ie4uinit.exe PID: 2844 Parent PID: 2744 General File Activities File Created Registry Activities Key Value Created Analysis iexplore.exe PID: 2740 Parent PID: 2744 General File Activities Registry Activities Analysis ssvagent.exe PID: 100 Parent PID: 2740 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 496

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 20:25:07 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 6m 46s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal48.phis.win@7/340@67/35 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Browsing link: Real link is: Browsing link: andcure.com/zoomlnfo/login.html# Real link is: ndcure.com/zoomlnfo/login.html# Browsing link: andcure.com/zoomlnfo/login.html# Real link is: ndcure.com/zoomlnfo/login.html# Browsing link: Real link is: Copyright Joe Security LLC 2018 Page 4 of 496

5 Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 2740 because there are no executed function Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 496

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample is no longer working Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking Spreading Summary System Analysis System Evasion Malware Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 496

7 Language, Device and Operating System Detection Click to jump to signature section Phishing: Invalid 'forgot password' link found Invalid T&C link found Form action URLs do not match main URL Found iframes HTML title does not match URL Suspicious form URL found META author tag missing META copyright tag missing Networking: Connects to many different domains Social media urls found in memory data Downloads compressed data via HTTP Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Tries to download non-existing http data (HTTP/ Found) Urls found in memory or binary data Uses HTTPS Spreading: Enumerates the file system System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Writes ini files Found graphical window changes (likely an installer) Copyright Joe Security LLC 2018 Page 7 of 496

8 Uses new MSVCR Dlls Malware Analysis System Evasion: Enumerates the file system Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Behavior Graph Behavior Graph ID: URL: Startdate: 07/05/2018 Architecture: WINDOWS Score: 48 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend Is Windows Process Invalid 'forgot password' link found Invalid T&C link found started Number of created Registry Values Number of created Files iexplore.exe Visual Basic Delphi Java.Net C# or VB.NET other IPs or domains started started C, C++ or other language Is malicious iexplore.exe ie4uinit.exe t.co analytics.twitter.com , 443, 49406, TWITTER-TwitterIncUS , 443, 49402, TWITTER-TwitterIncUS 33 other IPs or domains started United States United States ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 20:25:28 API Interceptor 1x Sleep call for process: ie4uinit.exe modified 20:25:28 API Interceptor 5052x Sleep call for process: iexplore.exe modified 20:25:33 API Interceptor 1x Sleep call for process: ssvagent.exe modified Copyright Joe Security LLC 2018 Page 8 of 496

9 Antivirus Detection Initial Sample Source Detection Scanner Label Link 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link api.filepicker.io 0% virustotal Browse cdnjs.cloudflare.com 0% virustotal Browse 0% virustotal Browse static.ads-twitter.com 0% virustotal Browse rum-static.pingdom.net 0% virustotal Browse stats.g.doubleclick.net 0% virustotal Browse 1% virustotal Browse 0% virustotal Browse crl.godaddy.com 0% virustotal Browse pakcareandcure.com 0% virustotal Browse res.cloudinary.com 0% virustotal Browse 0% virustotal Browse clients1.google.com 0% virustotal Browse cdn.mxpnl.com 0% virustotal Browse events.zoominfo.com 0% virustotal Browse s3.amazonaws.com 0% virustotal Browse googleads.g.doubleclick.net 0% virustotal Browse crl.pki.goog 0% virustotal Browse bam.nr-data.net 0% virustotal Browse api.mixpanel.com 0% virustotal Browse dialog.filepicker.io 0% virustotal Browse status.rapidssl.com 0% virustotal Browse ocsp.comodoca4.com 0% virustotal Browse pashtofonts.com 0% virustotal Browse static.xx.fbcdn.net 0% virustotal Browse analytics.twitter.com 0% virustotal Browse t.co 0% virustotal Browse platform.twitter.com 0% virustotal Browse ocsp.pki.goog 0% virustotal Browse fonts.googleapis.com 0% virustotal Browse staticxx.facebook.com 0% virustotal Browse cdp.rapidssl.com 0% virustotal Browse 0% virustotal Browse 0% virustotal Browse crl.globalsign.net 0% virustotal Browse connect.facebook.net 0% virustotal Browse pki.google.com 0% virustotal Browse js-agent.newrelic.com 0% virustotal Browse Yara Overview Initial Sample No yara matches Copyright Joe Security LLC 2018 Page 9 of 496

10 PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 10 of 496

11 Startup System is w7 cleanup iexplore.exe (PID: 2744 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) ie4uinit.exe (PID: 2844 cmdline: 'C:\Windows\System32\ie4uinit.exe' -ShowQLIcon 184C8F06D CDA3954C489A36) iexplore.exe (PID: 2740 cmdline: '' SCODEF:2744 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 100 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\ANNEBO~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): DF6B754DA6119F61C52B8B988 7FA52E56EAA055F9149FB2AF2B039FA29DD083DF 2B2EF5EC6794FC3CFE4E142A4F39CB4CAE788C7D43A71A8F6A319E05BE388CF1 CCD9672FCFC1D147F6ABC591FA1A482FA D76E38074D9A1FA5AE94E50B8BDC7FDB358C EE77E2 0F85FEDFFBE1D0D0D4EB6B47F2106F Copyright Joe Security LLC 2018 Page 11 of 496

12 C:\Users\ANNEBO~1\AppData\Local\Temp\JavaDeployReg.log C:\Users\ANNEBO~1\AppData\Local\Temp\Kno3DC5.tmp Size (bytes): XML document text Entropy (8bit): D D31D1E7C57990CC A28EC731F9106C252F313CCA349A68EF94EE3DE9 1E2E25BF730FF20C89D57AA38F7F34BE E8279B20127D0014DD27B743F 689E90E7D83EEF054A168B98BA2B8D05AB6FF8564E199D AD3FE E687AA9AD7D94468F9F57A4C C19842D53A9CD2F17758BDADF0503DF63629C6 C:\Users\ANNEBO~1\AppData\Local\Temp\www45E9.tmp Size (bytes): 324 ASCII text, with CRLF line terminators Entropy (8bit): DDF93B98C5AE2C79C09BFA D 71BA59BB8429DFA73A5DD73502E0098A6308CF1E F5E35EA56DBF3FDB1A6EDC8C4B26B170FE9512F8DDDAE56353B5DD03D6FB1386 5EA667BE4746FAF1AF72149D2C18B3BE72C7379ABE95E42140C266B531D6E2FAF4ECD9F8C31B03F82AA578240A AC863E2EAFBD B CD862 C:\Users\ANNEBO~1\AppData\Local\Temp\www45FE.tmp Size (bytes): 411 ASCII text, with CRLF line terminators Entropy (8bit): D8EF58C50B63649CA2A11A6DD21CA FF65A43FC6514B94D815E123DCC87543DFEB3509 A0E D382B06CDF904BB849EA9C84A19C22B7380F F07279D9234D17C8D2F890F18D6D07A64F22002B39B51956F2DAFD38D6EF46C261B7F756B858108CC996A95A7C E92F8AD08ADABF996B81291E49CD247D32AE0 C:\Users\ANNEBO~1\AppData\Local\Temp\www4613.tmp Size (bytes): 452 Entropy (8bit): ASCII text, with CRLF line terminators 431CE3C728B963E531AC57ED03AD7885 4E59DD95CB200BD87778F26DE2C078D943BD B92D61A40EC12A97B69BFD EEEFBB07CD5C91BD5F4C3A1FAF6A64F1 7F0A79E04A7C B54E38E3377E041B221E7A891278ADA5ECEFE2367AB728F8FE3F5A71DA1815C23800CC5 028BFCB6B3A D5DD732D05DEEC11B C:\Users\ANNEBO~1\AppData\Local\Temp\www46DC.tmp ASCII text, with CRLF line terminators Size (bytes): 752 Entropy (8bit): BDCC6FFB83C24153C5FF45FF8 5753D953EDA2ADA640779E282C19E37F159AED09 Copyright Joe Security LLC 2018 Page 12 of 496

13 C:\Users\ANNEBO~1\AppData\Local\Temp\www46DC.tmp A7F9A28D672F9F78C0F950F0262EE8AF2DFDD6E31AE3881C2038D A4B9 BED2B D8082C48D8CB4C45FC185AF94FAFF8DA00FC3C10CFBC711408FC5CDE1118E67D7483FE C892E00FB11232D9BE9207B252E70DBB C:\Users\ANNEBO~1\AppData\Local\Temp\www46DC.tmp:favicon Size (bytes): 474 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced B296C9568BE4B40F DA56A3CE F4B7D1E31B78D81A F951E27745CE921CB 27D67BA98E8641B6A8B5BB9CCDA13FAB5B0E0C8D231311BD39C4915DC71B3159 AF25BC3A74CF1B4F914BB54D65A834020CF81DF369B6892E546EF51DB5A58769B44BA2E33C7B29C3D4B23454F7 5007E9EB88F454CF51459DB2099F361E3272A9 C:\Users\ANNEBO~1\AppData\Local\Temp\~DF5A7B2D1774A97355.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): BC7CD567EF7673E3F5B4883CDAFC24E0 076B698EE83045D093A99716F1C87F940A8AA428 FE431788B7B46A09FACAC4C166B53FC8135C55665C4F131ABD331E6AB2690EF8 3C5752AA8820D06C9E9C05581F77BDEB1AF931B631F6A391CA995C AFEAC753BB3A2EF93942D08EB5F4E 9F59294D DF32202D E530 C:\Users\ANNEBO~1\AppData\Local\Temp\~DFA04B7ECC9585AF51.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): A68A7B6C279D58495A9259C647C8186 2E0AF4E711E26D4A D19D11A7CB501733C 06D74A8C83F176F4425B722EF8F431C7FB4EE06528EB7A FF186E45399 F0A1E290C7591B51F34C67F8F5BC8632ED D0DD8C5FCDCF D8A20A9E23A5400BA6F2E6C5F 95E6E534C24C6074BE939F66F076A1052F00C C:\Users\ANNEBO~1\AppData\Local\Temp\~DFC3A92E12CB8911AE.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): E96485ABAE4374D9D17CA2A174882A6F A929D0EE6A8AFF99D4F9E960454DCFF6EF4DC22A F3EC25C A883A5DBA902C75604BD4F9A8BFE237F714599D1ECCDB9D0E0 F8AFCCBD8C987322E B10A913F51739A4FE4398A7EA8E3A4148BDE802958D3BE5EC653310C5C5611D14 D9F7B1E7638F19F71BCFA6B6E4BAD457792AFB C:\Users\ANNEBO~1\AppData\Local\Temp\~DFF504E53405A9B259.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Copyright Joe Security LLC 2018 Page 13 of 496

14 C:\Users\ANNEBO~1\AppData\Local\Temp\~DFF504E53405A9B259.TMP Entropy (8bit): C7753B1D54ACDFE42B E3 37A96F8D44EF3C0F612E405F81C8B81AA848AD1E BA045E1A46F B9561C6153FF33F6B28D2955AA81F0232CCB9DAA A119A2F40DBB477A3E502D08CDC5931CD703C6D2A40E9D1EBF6E3F851F771EA62A3A D8CB4E117E F27C16CC223275FF450CCED42A7318F238CA60 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 593 Entropy (8bit): F5CF8AD5CED6C4C4A61E4F3E4625B84 E4ADE63380F5DD990D3328EE56A4EA5D56B3442D EB491B3853B6BDB E425C590891C4676FF68AF67B9CD7F2B3A2 EB12C0092F489C35C86AAB6FA D39B4FF5A5EA8074AAA1E0D9CAB8D22259CA D5D701FDC ABAA601A4F2FE7FE232D208E9FE15908 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ F846F08BEFE0DD8112D932FEF data Size (bytes): 543 Entropy (8bit): DC BCDC119F0B D0 B92BD37BE1338ADFFC5E08A19B279B E8 4EA7600D1EF823C6526E3A23ACFB6A2FF19A0E8DC51A713770B93CC29B81F2A2 3A0BAB994AEC6296BFE62E00A29FD0F E90EF745A906F05E EBEF8DEEF285D5A3A FC6F E1CAF47C1DD0481C4DC8E2BF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C EC2F data Size (bytes): 1520 Entropy (8bit): C913F66C55E65D50EAAD08B8B2BE87B9 341B274FC31F1B58C9B16442EDF1D6B1B927D988 2B06F3B69526D0000AC5115F035817AF34E0D4C70D26572CE6EE6CA5A82F7EA5 8CE3AD39B15A4B9B120CDB1BD4FE7415E BEC8575FB10CBA28DB93691FBC07D4D4DFDA7F3D1D4619F 7CC91608CA969F8550DDD622B0C357A40595D04 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ B0C737E58D6701D2EF2176C07 data Size (bytes): Entropy (8bit): C4BA6A1878D0EA1AA62DCDF2FFA1 B8DE1194D492D7E45B3CF400F41492EC7C0F24D8 9CCD149FD7A3CE20B3ADE11CD FC9250A58D4B08CCF A2 D7F7A D336EB D2A B33D2F5A718ACB9F9A9D0824ECBD48B458DB9565CF1D9927 ABE63E1001BBB79FECD0809F53715E6805D6 Copyright Joe Security LLC 2018 Page 14 of 496

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685 data Size (bytes): 782 Entropy (8bit): D66F3FDD48B C7088E 0CA ED51E57440DA7D0676B A80 3A91BCC378CC1EEC801DB9C FC36B6B0994B B0CD 515F6D051D7AACE6089E776FA7F8CF25B81B26F81B FD D025D3B453DDEA0273AFF8967DD0CF8F B9C4F48B0A110B2D07D509F8372C28D75A45E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_A8BDE2086B2C8A C258BE1F8C3 data Size (bytes): 471 Entropy (8bit): D00A580DD3FACC80BBB93854BCAE656A 12FAA D782EC15C886CB0B58F00C8FD AB8BFDA1644B19E CEDBF5993DB99BFB63A7BED5B2A8F6C386576D95E 7F877C307FCEE19FA2BF358E230063DB38EBBE76814BDB78ECF06FC8E05E4E3D49C4E290801A315F9B8C63BD CBE57B39BA3D80CFB5388FF8283E12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_E9F39E58F65974A7DB477F711D3E100 3 data Size (bytes): 472 Entropy (8bit): A E68BF87DAEA50D8C851D9B64 F8DC5E35AA0C2A89225CE DC428304EF42 14BEAE35455C5ABE280E5CBB249AAB36E6D591434EF2E8D91E4A45C1F35D3BFF B92A E12CAF55BEE79D42E8D8CA2C72EB33D9686E38A753198DA130BA2865BBE4973A7FEFA7 0CA8CFFF2E43CA6CA5F04F81B9C F745 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E698CCB2C296D265AC1A253974E09FD_5235A77C5C58E8A69EE14 AB7780BDB17 data Size (bytes): 471 Entropy (8bit): EFE26BD286E797B1BA2CBDB6ED30A8 AEF934747CA0BF1ECB6D8AA45E A3B55 730D56F93ECE54212E714DE09DCA0B355015CBDACA6AFF0DDAB81988E B1803A0F3CC5EE49847AA42D31E6C2A5BAC5EBECA1F005258CB24D62A3F00AB7FA6A2953A9C9FD AD F921C0FA64EB17BF71529A24C92 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B177 1 data Size (bytes): 1730 Entropy (8bit): F5A9AC6D CCD243BB2936E13 Copyright Joe Security LLC 2018 Page 15 of 496

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B177 1 B381FC3A29A B46F79A9DCC021631F31D2 16DF72A69FA2D50B404F5F45BEBD294EFCDDA26C734DCD9B9568FC27F6F8C49B E1C19E20C677839C1891A3753A2737F367D75971AAAED3082E767515FD2120F1FB642276F3B76C74404C2 9D20C82045C8C0D5ED13DE2ACBF2B91D474 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 325 Entropy (8bit): FA5564A032E20141C8E182F0BA27 61A31DE063D1A0B6668FBE7E8F6B465B47739E21 938AF27FE1C1F416B474B1929BF8F1930CAE14B5CFAC24A2F6D275F6F89F F15FF24419C2853D3C1D A3F7C396896C0A1B33AB3869BDB909B428631D4CC53311C2F386B3F814C6 B724D380598D0F8A83FB973047B037ECADFA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF D1D277A171D8DF7B_F2DE72102A14736B534BA AAB62F0BD4B data Size (bytes): 471 Entropy (8bit): E9EB0E546E685D30B6B5F54BB01 E8C45637B3507BFFB6C548F349BD7145DC46AC7A 90A0FED4888BCAB E08CC7D659343D E7F1FFA0B E8B487DB013674E4CF91A1D F7C178D7B14452F21830F BAB421D14F54CAD85713F96D8 CF68A30EDB2945BAD0B4D8D55A10386F7B8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D data Size (bytes): 602 Entropy (8bit): A395EDFEF2638F8667B6B84DFA9F0316 1A1D3E005E2C516747CCBDB21FB A46B 85B94074A3AB0E FDD9A200644B651D78061E3B3A6BB C7C C4E3B8D603FC4AC803254A10DC1FFB9E36C26D6D090310D55DFE858E3368F402D86F0E64B813BC965D2EB4B608 DB8E40FA8297A C40EB55F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\410002B7DF52B20345A44DEF490FB5D7 data Size (bytes): Entropy (8bit): EBF9818B63CCBCEE6E5F321F A538A91D5EF29A650A8D41A670280FDD0B8BA5B A79F85A91E19F133D90FBE8422C7C7AEED93F78C7AD79DB FE526C80 828D3EE6742FFCD1F7DE0E22EFD27FD1AEA83184F E9F D349467F74BF36F82BE7107 A6F150E80C06F AC73C84E2364C2FC Copyright Joe Security LLC 2018 Page 16 of 496

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C622 0 data Size (bytes): 727 Entropy (8bit): FA90F22ED90B9BBE2603E07443EA8B 34B1C1E9AD896DC B656087A8F62A91A B2FF992EDDA F062013D688B6DF946C648562DCE7F400D0A70D D9ED8ABC02FC801822E1879DC682A31837B B F41CB846B95D23F72628DE019B83739B9B7F 9928FFA695C26BC04C F536DF6AA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9 911FE760A9B data Size (bytes): 1831 Entropy (8bit): F681B70E59BA FD58E4080A6 21CADB F2FAC517677B0B9E5E6F0A0D 920FF938DA6E97D6F73ACDDA4AF7BBCDB9AF3DC08A19A77B77003E7CA4BB26D0 BD3520A0EEF833EE2328D70918EDE55F789F EF30267E4F8077DB01DB12553F7147CE3C07EFAC2612D8F 1E BF096CD63DC55C4EE6E57F6F31B7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B 4 data Size (bytes): 471 Entropy (8bit): BCE4954E7C13080AFEB351C02F03A6A8 38EB8078FD3A82BB3BEC619C965E5CB D8A691DAF15C41C6F91274CE47F7C8D9316B7E2BF79D3A0188DBCD A68 3B9A9E628CFE8DB4D57725CCF2A1C72DF405BC7FB30C80945A591358F4FEF7A2B4FD31561D651AF37BE765CED F8C40AC7AD018D0659BD936AE11F05029FBE1CC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, 6509 bytes, 1 file B95F90C3BEA1D0E7ECA664B8FA01A720 A2ED44DF03C6971C0A7C335ECEF8D996D6BC0652 D82B D19804D73473CE65D84C4F7D64E453041A9B30CF96C738AA0C 4DB9F495F3B3E39D89685FEDD1F0C715E3C3B0D FB3F51D2B454943E7AC34B1F871C435299B799FCAF3F8 13DAA3BB67C33B221D27C721CCF0F4D67C033 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EDAA817EEF5159B09F6FCD000_6A9B0341EBE392E934DCDE1A2B5F70B D data Size (bytes): 471 Entropy (8bit): EE41A1BA2DAD72A DCD76 Copyright Joe Security LLC 2018 Page 17 of 496

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EDAA817EEF5159B09F6FCD000_6A9B0341EBE392E934DCDE1A2B5F70B D 5131CA8CBAE7B4A9A0CF8F3ED635118C20D91C1D E7D226926A1508BBB3A63DAA8AF22DC354432F69D9C3EB71F C C4BF8CF1740DFAF346A28A3253ADC16E04AB348D3C77DFFD0BBBF97ADA AC21CD67BD3F61D1C42C FB5772C74ED9F17E FEB708E30B94A4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B B5E195ECB0E8F243A4 data Size (bytes): 896 Entropy (8bit): A2270D666AD772CACB9A7AAD78B85EC5 DDB920ECEA12AEA4DD568F85218D615402BEB2A C1337A297E7CC32972B6D95F9421A1380BE59D7DC69F8EAFE5221F8FCD 51D4AE27AD599A9D02E13697ECE7851CA5DC65FFF9C7D172D614F6DB3ECD8A3B5BCA9B18CFE24E4C8073B4E5 6A6E6B2925E71EFA2E26CA30BA77CE2DE50C705E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data Size (bytes): 314 Entropy (8bit): C6201B F50AF881FE8F7 AE196D CF348D74563ECF FB87B0B7E8DB9DE86429E D9A929CD1D F4F3460FF7B8C5B 42D8A931B1D5A229BF5702B27D AA E5AE0B16D910B75228A025E638D44E62C3490AF8E24AF0 E78F8EB9778BE0043CBC161A0DF00C4AF3595 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90 data Size (bytes): 462 Entropy (8bit): A68A2AE020719B8942F12700C2AA7326 8B382EF2E4FE11578EB042012F49DA87F2CC56E9 D605EF4CA0057C59A4E90EB65A86BFFCA2A76509F5D67A2B7C6FCB66DA48B95F E9E343A249A7E304703D C17A870C4245A84755B2592A6736A70CD921D0B249A14A7EA4E3C9674CED206B E0D D A722A7495CE672BAE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 531 Entropy (8bit): D4320A556DE14BC2613A E66 6F5A53DD344613D9AD2434FE1A4EFE5165AFCA7F 1DE7AD2D11BC04482BA1E6318A4596B2E079EEF1D ADD B416 A697F39E5ECC745220B8DDA3144A368BCD392FD306D4E22EBA618B65F5200A9ED2EDBB9100D75D730222DB968 FE725A B18FB C7F26E96 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 Copyright Joe Security LLC 2018 Page 18 of 496

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Size (bytes): 471 Entropy (8bit): F0210FCA CC216A E2 D10B86C6F353C30D98B55BFCAADD40E7D493397C 397AD878DB2D20AFD65BA634252E B089E1C9526BD D1221F9 C5CA0CE0D36CB0716ECC6E37F96C261EF4E992C6C6B03D7EF703252D5494DE7AAFB222089C8BEC0A52ECD39D CF B994898E994C7D29C8C513BB690DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6FB1C7BC744B04B7C9588E58823D7FBD data Size (bytes): Entropy (8bit): BE7798C8E6FB5C6B3BF5D30E70 BB2FA98AD80CD6C208F91A865EFE132F41E102DB 23840BB267B1FA0FA96892AF81413F1F BC56675CF01881A5033FB30D 9FD1F63C630C6B4D0435ADE17E5227C77821F2DCB0A550B63E966FE4BDEDC9DB2674BBE7BB4AA52BD53C BB8CFF4BC1FCBB E63C2F4888A647C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF data Size (bytes): Entropy (8bit): FFBAC89CB7B60BC8918AF5F3212CA F53C8F59C59543C91BF4F87AFBE43D1116F65E96 7F7E2B FABA0CCB8AF70BB4D5A4ED7776B6998DD54C907C7099FC4B019 F A412D87CD8675E2EF56A EF F16692B88689B3F22CE6DAC6868F929A1197FCAE 2CA9D53ACAD0597D77A89266FE917A0C34A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7810C722F621F1DEEC60D43FBB data Size (bytes): Entropy (8bit): C524C DFDEADCD706F978AE48 7E04949E B22A476C98F7171A1 E2FA4677AFEBAA055AE6E2717A3F45D E35F0B E7B5A2A430E43 2F6F2FE728915F78BDD495ACD3D40B26EEA801BA9EE4FD1C1B81A C337C77E69E30F840919B9337C1FD7 2303D654D2E7D17A A66AD0DB64BDDC0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D3BD78A30B98D17C317EDD4FFE850A0 data Size (bytes): Entropy (8bit): C8A EF98E7BD14F4CB E314B48800C1F8F8638E3D74835E7C78336C1B8A 37EA1F379A2AD13226F208E6E2B6F8718EB46CEB987C7BEB41E18FE2975F4B28 Copyright Joe Security LLC 2018 Page 19 of 496

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D3BD78A30B98D17C317EDD4FFE850A0 7D945AFEC2BED76366ACBF20C342A78E628B3F0667AD5634AF491C6CD311DC40C37A646CBA8B7294C3340B2C1 4AA EEF36B32C103A A02FB75 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_D0D81BAC EADEF5A854CE7856 E data Size (bytes): 463 Entropy (8bit): F E4D0FA83DF2DE49C7FC AE0283B60F04B517D9A4C45192F626A38E013F EA87306E002D931981CAD91BDB9400B DF2639DE821C E8B17A74C8E793DDDE629D5E935009ABAF68CBF24A6FC71B99D6A6E4AB0F3C1DBE3E66ABCC0B7826 FB58982AF434D5442D98B13B BB7C6DE7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 data Size (bytes): 1391 Entropy (8bit): BF94D8454E53287EB3D9A3816F013FB2 3C6CFCF98F7E31B12B5A534B64EA01EA43DC5E5E B14D5DB0ACB2673CFB416CACE22AD258C01FA9C785A54B0DE9C4330D33E4E146 C0BFF1AC0CEA B3073F7B2D2D8766E3BDC7629F11E809B06F1E733C7934E78EA0175C4D5B5E4651C998A C83ABE7650B EC9C0C5837B4C52767 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4405 Entropy (8bit): BF2FFE7C12AF123F5B26546A50D05E C2566C AFFCB CF75E5819AF7771 F C1FC0281C842B1EEFF057750C956B863D0AFE9A3B1576F4F 62CE0C385A944315F13368CC5FAAB608089C1B AF0C5EFDCA5137FEE4590BDE4EE5C7EE4115CED9 63EBA D019C89CE64CFC6D E5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC D220C7448 data Size (bytes): 596 Copyright Joe Security LLC 2018 Page 20 of 496

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC D220C7448 Entropy (8bit): E9D512FCA2D9C603E690FBB5A41DAA 32586C53FDD8ED61D8F1CC1F65A1A416C954CFF4 D6D3D6991C8D365E80EA54E8C9A7D39C B5EDDDCADDDB9144DA600AC8 4AD24F2E54FA6BAF96937D76D51B6468B3AF2FC418C5A172AB4CD05481E34057A94B15C48F51B11A69EEDC7B3F 747D80DE6A5ABEC40381F132C8C3F5C0C4ED65 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8FE2C641C99CFA6687FA8D31B7D528A1 data Size (bytes): Entropy (8bit): C8A EF98E7BD14F4CB E314B48800C1F8F8638E3D74835E7C78336C1B8A 37EA1F379A2AD13226F208E6E2B6F8718EB46CEB987C7BEB41E18FE2975F4B28 7D945AFEC2BED76366ACBF20C342A78E628B3F0667AD5634AF491C6CD311DC40C37A646CBA8B7294C3340B2C1 AA EEF36B32C103A A02FB75 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9F9C58BCF02CB8A34F017EC53AEBBE1C data Size (bytes): Entropy (8bit): BE7798C8E6FB5C6B3BF5D30E70 BB2FA98AD80CD6C208F91A865EFE132F41E102DB 23840BB267B1FA0FA96892AF81413F1F BC56675CF01881A5033FB30D 9FD1F63C630C6B4D0435ADE17E5227C77821F2DCB0A550B63E966FE4BDEDC9DB2674BBE7BB4AA52BD53C BB8CFF4BC1FCBB E63C2F4888A647C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A6E643304C5FBB7CBF4025F1978D6EED data Size (bytes): 357 Entropy (8bit): F2A12DDECE0D68904BBF09AE9737D5E 2759DBAFCC11FB9EE65D7E8D6E60B400307D3B4F C77CD6BD2BB6022EF44020FAE3D11CFE9B71C9FA6437A8AE63A3F2EEA2F1517E B F2FC26EAE4AEA553A2FDEAB4E5F4D3064C84F67716F808B090954D0F2A645459FBF CBD D1C D97B3FF081BF50FC67DB7D76EA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A AA1471E96C data Size (bytes): 1517 Entropy (8bit): BAEDE0945AAF2C405EC5364CB4FAA98F F68FF5CCA50BB7C0A3668E8E8EFD0D8BD3AB1E F0A3A1AC2D40C58E47ED4485E4294C885067B9CF79E513498F06AD00245B B7DDE471893A8377CF3A0C97ABCE0E95B8D76E260415A1A AD4AD194E074241BB1C842535FC81AEF9 C29FFDBD4C07AD6EDB A76064CF0EE3 Copyright Joe Security LLC 2018 Page 21 of 496

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AF3BA1CDD96BBC740C9CE3754F348BED_E8DF C09F72B41 C3B9B8C152B data Size (bytes): 471 Entropy (8bit): F47BADD0CB700BA4509ED1EC274B0B07 C852D29CF0A35D76C32B29F91E8B463E B9873D4A7DB4FBC372ED0BE A3B19A31FD596B17D902F8EA298C9721 0A555F8ACF31F293C1F1748A1DD012E BCC8F4B85DF03E3A811F6B2FA5102F AEC317BB23D CDC4DD992751B775656F5A3E50B8B7D6047B7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F DB21AB308D_CCF564BE5A3C924B17DDEBDEB5236E1 2 data Size (bytes): 471 Entropy (8bit): D203ACEEDDCF5FE26E90F9B6DA D948B36480A00C B51EB0D1E0952C224 55C2F861BEE3AAE1A0FCF6ED74F488022E9C298EE4EE98C8588CF57C9B1C46E F850EB99C9D06ABA6A4A3FCFB210DA817BE8375C EC D444288BDB7F41CEBEB B160D0F3DF94DD9ECCBAC25B0E14D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B data Size (bytes): Entropy (8bit): FFBAC89CB7B60BC8918AF5F3212CA F53C8F59C59543C91BF4F87AFBE43D1116F65E96 7F7E2B FABA0CCB8AF70BB4D5A4ED7776B6998DD54C907C7099FC4B019 F A412D87CD8675E2EF56A EF F16692B88689B3F22CE6DAC6868F929A1197FCAE 32CA9D53ACAD0597D77A89266FE917A0C34A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C07822D A1B8E01486E66C5F3 data Size (bytes): Entropy (8bit): DA1FDD967A2D8F9C8D336CDD1748F30A E3D3B9FA4493CF4AD43F720B133F846A FE193BB1921B359E653E2C1CF189B EBE26E65EC73C265C50F28D5E7 424AFCE6E8139B1E32C59C5097DB0CCB9B A061EB82A2E25AC4FCB9A34E47A C4FF7B893676B A A4E4CE16F0589C5493CA478C72AA3D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5FD5BF0CE6372B1CAFE381FD0BC969C data Size (bytes): 429 Entropy (8bit): EC298C64E5AACBC4DBD62633AA53A80B 5A5CA27645EBCE6B9AEAFC9A803C39FD3E2C8B5E CC4BEAAB8386E2700C8CED0C4556B2C24DBA47B6FE9F0BD4D9AB2B408C9355A9 Copyright Joe Security LLC 2018 Page 22 of 496

23 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5FD5BF0CE6372B1CAFE381FD0BC969C 874F02B0FCB2A7A00C79A E92B8E45A8BC6FF34B90E079578F3E4C A26659B737B2BB10CB662 9CF95F06BAC0F6D4240FCEA2675DB472AABF1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 data Size (bytes): 782 Entropy (8bit): D66F3FDD48B C7088E 0CA ED51E57440DA7D0676B A80 3A91BCC378CC1EEC801DB9C FC36B6B0994B B0CD 515F6D051D7AACE6089E776FA7F8CF25B81B26F81B FD D025D3B453DDEA0273AFF8967DD0CF8F B9C4F48B0A110B2D07D509F8372C28D75A45E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D data Size (bytes): 812 Entropy (8bit): DA8DC594137DCFEC44C4FDD830D D3CFE9B2BFAE6351EB873D91F82CB8FA3946 AB4104EF1CCE80A19AED C34366AE4B9EDC2E07CCFDD69063CC8BF0AA F9B1F483DAE5CE249D99524C D21D4A77C8002AD387D53F91968DF404E63CA570D366AE AA6C0A 10A9F35F8C85A3EA8A4DD1295D4A4D950A3CC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D57B3BFF6E0B79FBD8CB6482C7775D35 data Size (bytes): Entropy (8bit): DA1FDD967A2D8F9C8D336CDD1748F30A E3D3B9FA4493CF4AD43F720B133F846A FE193BB1921B359E653E2C1CF189B EBE26E65EC73C265C50F28D5E7 424AFCE6E8139B1E32C59C5097DB0CCB9B A061EB82A2E25AC4FCB9A34E47A C4FF7B893676B A A4E4CE16F0589C5493CA478C72AA3D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7B4E43171BB9E412497B0377F4343E7 data Size (bytes): 665 Copyright Joe Security LLC 2018 Page 23 of 496

24 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7B4E43171BB9E412497B0377F4343E7 Entropy (8bit): C0FC7EC6D88ECC67E0923EE47D40E10B CD441B B732BB92E3B22F62F4 B4B70625D79853B396A7344C8481CCB068A115DC9B442303C40B26999A86DD6E 63C93C1B2E363824BABDD F973EC3FEF8E3CE0347E7F55D E2B351CB401B016CBA962D2B B8F79AA7E7693A28ECCF0A695C1C2A9FFB3670 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E075CBE60F32EA398C1862CE38A04F63_E0FD29FB0C329012A06D91998F64D9D A data Size (bytes): 1777 Entropy (8bit): FA80CAA7FB90F BE05458 C2EEA0A760AA920DC8074E8C64B2270FD5E8ECF0 D803899CE1C AAED1E0D53512E6053E224D84866B54ECD0173E D26B9FC2FEAEF6A1258A19652AD418C141B00A0CF3DEDB BCD38D5CEBAA219C3C489BCB AB59 ADE7074E76204B BD38FC7D27F079D6DF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A data Size (bytes): 1786 Entropy (8bit): AEB4E76C6F68EFD7A48092E9F0F A035C0BDCC3DC09C881E788F7FACA53C6B458 FE1B9A0EABF44FDBE4DDE97C3CC1209FAD2FBB2D2D7476FFBF64066BD9919A4F 50D98FB4C9875B1AED0AEC06A9C934DB5010B6C5F54539E323EC14FD487E1D92D01652E4614DDF308AB2F1EDE A9E9CB1E23030C971255CC106016C6E7BBAF48C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B0 8 data Size (bytes): 1396 Entropy (8bit): DCB97527F4DB87F91871A5C7D4124 CCC1405D6B19E0DA23BF93F22A44585E7E9D07FA 7ABCC14E551904ABE12C4EAF59F50C2C89B59A03DFE07FE BAE0987B C44642E96B438E3B7B84D02345CBCA0D8BB DD8B4E301A7D54287C8183C3D19A6F4AA4EE7B4EFAD506 C64C94786D3EC5096F4D65356B8ADF49C2C91DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E665346F0BE57F34168E0A55B data Size (bytes): Entropy (8bit): C524C DFDEADCD706F978AE48 7E04949E B22A476C98F7171A1 E2FA4677AFEBAA055AE6E2717A3F45D E35F0B E7B5A2A430E43 2F6F2FE728915F78BDD495ACD3D40B26EEA801BA9EE4FD1C1B81A C337C77E69E30F840919B9337C1FD7 2303D654D2E7D17A A66AD0DB64BDDC0 Copyright Joe Security LLC 2018 Page 24 of 496

25 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E665346F0BE57F34168E0A55B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A A396_D76DB901EE986B889F30D8CC06229E2 D data Size (bytes): 1697 Entropy (8bit): DB5A10A4895CCCCDB EBB48F 1267C C ED2A9DE7A6871 B3DC5D02993AA37C3CD9A7A047B5E2677B911E39FFD704A01CDDCDE11FC949E6 D927D5B1E958BB85FA4966AA0EDA462F3E5CD570167AF92AA9739D4F119C6110A9170DCC553269BF052E9761B9 FA7C29FE DC9A2F449F12B7D6A03521C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5A B data Size (bytes): 471 Entropy (8bit): CA99ECDDDFB02D31CBFCE79398AC458F B87E EED379792F9341FAE0E4B2A487 F71ADAFDD2B BAC55ED6EA13484A23ACF33493C2475FB2FD0A2FAA662B 64E94A7602AB2F3BF6AAFC30B27BB0122A7BF7A702D5A192C035ABA D605152CF60807D52453C059070E3 8F0E4E5F6B44CED4359B5A7885ED65A34AE0C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F B15AB61E0E47645E5 data Size (bytes): Entropy (8bit): F2D1CB10CB728EB38F4C03B4E EBF6EC8AE45AE5B188B9D C65E39926 F440E1DBB3D0811FA7A5AC67BECE5BC13D1FF6AEDF64933FABB62C65C87204E7 37E33518E42186D3E988BD6251FC05BF2203FE514C6804D704509C1FEE87F982E7459CAEE5E4CE1EF7E4181A5D9 3EEA37714E8E143666DCAAB3DEE8C40A54475 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_9CE57C1AF2E6D58DAA0CA B9A826DF515 data Size (bytes): 463 Entropy (8bit): A830658A8FFB9394C000C4026D37DBF2 26B129B4CF2163D974A7E27C5A1BC31A0A92EBEC B308191FB5513C1F38B1532BFC47CC E413B2FEED0D9ACD C36FA77D44CC55998AE2F834BD4C134F74ABC79D2097BCB445CDD5DD47CAB84F4AB6A52EBA8AD427AC00 EF8447D54A7BB841BB102F2E8352D5C55165E169 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE0DA2326A F66779D450C7D6_45B2BD042F46F1619B0D3B7C6C5551EC data Size (bytes): 471 Entropy (8bit): Copyright Joe Security LLC 2018 Page 25 of 496

26 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FE0DA2326A F66779D450C7D6_45B2BD042F46F1619B0D3B7C6C5551EC A65D068A44A337C699F2AB6CA09BAC88 D0E16FF70591B93B E933BD7A34FCF0A49 6FA6DA68A788E10BEA16141CB9E7F ABD7D14CBFC08BBEE829DA7AEEA A98A6C8799AE7F131782BD5BE291A9CB2908F91B479F94A859DC30103E873627BB670D371D4BFCDCDA7459F4C8 1DE88A7D4DE63D6ACCD67D151944E1A161602C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Entropy (8bit): AA51827D652F2661C0C46FC731380A12 EA5F2BF0222A09F7DA02B9A7B04C83DCF188399D 57D0DE863F1FACCF2377B7486AE6427A83E1E069E41F65A2298A76EFDFCB0551 BE516809F57EDC78D100240A3ED750489BECCBED61ABB4F13B7DE0FAE881A42EDE1C6B55B7077E261093E5613 6CA7DD C6885C917C5F91CE54906AC30B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ F846F08BEFE0DD8112D932FEF data Size (bytes): 468 Entropy (8bit): FEB487E67FE2A9D3ADE7070E1C080AA 87D36211D83D3A017592E954FCF547683BCB9960 2E8309FB985242D41E75278BCEA446FCC566A58300CDF285B58F5B032A32ACCD CFC56987E22F05F64D5F6E1FF5BC9D2AC5C15B0A22C5F7E9777C531077C4B74FD68DC4C6170BF59FA2FEB4317D 87DAF7CFDC274783CBD5DFDC8A7AF140B003AF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C EC2F data Size (bytes): 500 Entropy (8bit): DDFBD3B12F2292A A6B 7BCD5D35CF6D584A01C3F50F8E15B7F24B8F627D A80DEFEE3F62A9C16B0E98D00CEE2A7AC55B3E9EDFB7A4085E0D7C EF 8B3378F5B98B0AE720373B630D70AE84E67BCC220BC32F2979A0B9E2AEEF D73246BD0B3E18AF9BC7A91 3B21884C032DB4660E114927B BC7D16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ B0C737E58D6701D2EF2176C07 data Size (bytes): 468 Entropy (8bit): A256C92A802C43BC0451E1CC5294A9EC 526F2893D FB27AD49D1924EE73E1D08 56C0B F4F79796FD2B9731CECA22CA75196E15C9CF425953F935F9AD7 8855ACD5074CEC8D45F8F5A5C21BDA2F402BA91252D5C75CB293AE32E78530EAE9617E92EEB84108E8B32796F D1588DF4613A3EEE F17473A7 Copyright Joe Security LLC 2018 Page 26 of 496

27 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685 data Size (bytes): 186 Entropy (8bit): C027E8F1826FA886CB5A78 1C21DD CA39C3BC3A45F6FD688F315AE3 E7C9D F28D1E15A2EAAE5744EE3DBD7CE54B543B74DA08EF25335FED63 0CA14416CA4E53D94618ACDE6BEB029C125EC FDADE520EE07EAA1899E883EC166E0B8AF3EF4704D604 33B0A AE8547B5FA76E0E61714BA51469 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_A8BDE2086B2C8A C258BE1F8C3 data Size (bytes): 400 Entropy (8bit): BA3AF005F3A9B07463C7C266CED808AD 90CB23B843DBD06FC C20B625409D4 FD0606F6F9F4F79437D7BA0DAAB69121BD09B8D7A42CBCCC3F55559A9A33D749 3F31A01E7A1EAE9843C27F08612D4F1CE FC0A4AAAEC252BAB0771C5F3A625044DD7356BD2888DA DD59015A35A09076EC154616D1805D0A99014C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_E9F39E58F65974A7DB477F711D3E10 03 data Size (bytes): 396 Entropy (8bit): DEE2A58D62D1C60017A45B3375DF0B 9148E443D87E67CEA33B EB6BBCBFED3DB 7E0D6D9B7A4747A5A6D74BC43584F72E94D9C49B973C587ED21E90E993404ABF DBC5C254F6EF18E0EA C481CD5403BF6D7CB57FD2808C439C5A5B033C23679A1C2420C EC 969C0560FD67F4DCAD11E40967F939DB1BAF1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E698CCB2C296D265AC1A253974E09FD_5235A77C5C58E8A69EE1 4AB7780BDB17 data Size (bytes): 892 Entropy (8bit): BF41AD6B3A423B9BFAB498B1421E706 3E9CB9D988A F535EBB0820DBBD81 4A9505CF8A3E054A0E1291B8F9C78E56925C69B6993C35825E088E561636B411 B9CBD2FFB8E279C0F280CA9BBB FC98495E44144AB4DAFE7A3684C6B EEC9F524F31E6E DA5C33A1AFDA1C2F15A416B12684F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F26 1FA85A0B1771 data Size (bytes): 450 Entropy (8bit): DC45C3FD15435E8B12489 Copyright Joe Security LLC 2018 Page 27 of 496

28 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F26 1FA85A0B E5F25BC75928B8FB4FFFADE154C84CBFF43 36DDAE6C67C41F252EA2BB454A4F28E16741E723FFC66F3BFE5F75C9719B5F49 9FC5DCCC67A0CDEB66BA1532A513250EECAB6B E9F AA487F22971CD791C91DCFA56D7581DF3 8F14DBEDF96938C3FFE4423F573530CE2431A5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 584 Entropy (8bit): B6BF14C896702C2FFA79575EC323160A 65E28A9D662D1B706EB0DAA8BBD044CDE80C83EB D3F562470E8205DF8F7FE73A56F1A521EF1E53803F427B DEBBA164A BD1B4F0301F37218EF78BC835E37AB83591FD6A3E53725FD120BAAD745253B0ECC1EE187543F7B7209F8798 7F38E127244E F5B0D40270BE136 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF D1D277A171D8DF7B_F2DE72102A14736B534B AAAB62F0BD4B data Size (bytes): 876 Entropy (8bit): A373E4468D99692B055CB E9B B A07D0A F481FFE4363B FA5362FB467EF13B5C054DFDFD67D430F1F31EAFABD17C0F26FA7CDF8F40BB39 C4D43CFABFF673453AC282E973129A1169BB5E4F5D00EC49149A9E780493C510F41495BA392198E5F8D43D5FDC9 0D46D7E184DFDB805654A18917BBE2156B1B6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D data Size (bytes): 220 Entropy (8bit): D6980DA35BC2707E1C6DEE915C6C F3C04FDEC8E38C1E6D39C74DEBB074AEA C28C D787FA5E162DA2767C01C7029E195ACC5B49AD02C00BE9F97 A0BBD01B8794AC36E15680A D80F4F9D4A3342DB94FA2C0A C820F80DE76A0C947D688999FB0BE CF49A EF84FFE77296C2B13BFF51CF2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\410002B7DF52B20345A44DEF490FB5D7 data Size (bytes): 232 Entropy (8bit): BB062662F909F1289F87D39D63638CAB F37A9064A7C14D7661CFA8B116520F B 45F7A71886D17674E B5FBBEBEF95E5B0B48D4BC25BED03A6AB5911AD D49A25FB6F02B88D69EE2794D6A98FF9FADAC43A92EF0B15409D36DDBC97EA6CFCD7F7A14C1FEDE23B BDF1CCDD0F125B0FC0C4E43F7CCA5ED5A Copyright Joe Security LLC 2018 Page 28 of 496

29 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE5 9AF8FC7C6220 data Size (bytes): 800 Entropy (8bit): E6B4E1B58915CB18B0F806C6647D68 02DE A4C BB7C154ABA275 B08882C1360D05F3B13219C769AC0EF500C4C6C210A11843AE1B9281A459126B 5D5B5F065B074FF040B0BC1FB6E F0B11DC458DF121D607DC9562B1AD78BD1E65119BA7D1465B9A F89004FB55F2F5F6C158F12452CC035E9305B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA 9911FE760A9B data Size (bytes): 486 Entropy (8bit): CC797826A4CB8D42D66E15557D08F7 84AF29C98ED1FD275BE07E162775A48BDEFC3990 8AA6CA13ED0FF17B54BD071CC3B0835CED5C4A6C793049BA94B51CEB D 0D3D4F974C1D26902BEE37F023DDA6D9BF468B78C3AC3E51DB17296FF F469BC41C FC AD7FAF130F163DE52B654B80D589EB5A80 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2 B4 data Size (bytes): 796 Entropy (8bit): CA5169ACF654A7A94A9BC9A07AF87165 ABDCDDDE994A2CB26B1B59FCAE168ECAF5453E EF3F9ECE8D35DC02AB5BA7E47C0109CF7D4F53DAE3EE6151A944AC74FD6C 33D19797BC8C D6D77DF98EF261FBD F2A7C1E C6A33EEBED96A1C02C5CC604BA8EBC3 A A2B529BFEA106FB384B83CD450F3502 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 684 Entropy (8bit): A3130F608FC6D CF7497F177 20A91A99C7BAF62D62D48F0A4E7D4E228EF5ECFC 9C9059D37A575E087605E355BD3D76E8E09D49E3B3DEE5AAECAA54C1DE097F9E 17197F791B9FC20BD4E23DD977BDDF3056E8145FAE ED8C34E9B3DC6ABB1B118764E78C4A895BFCC2DB AE657A5A660A0C457889BCFD0C198 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ EDAA817EEF5159B09F6FCD000_6A9B0341EBE392E934DCDE1A2B5F70 BD data Size (bytes): 426 Entropy (8bit): F9E92FCD31975B1830FE8A8FF Copyright Joe Security LLC 2018 Page 29 of 496

30 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ EDAA817EEF5159B09F6FCD000_6A9B0341EBE392E934DCDE1A2B5F70 BD AB80B5D5685F0FCAB7DA47909E09C86F 5690B6E2AD36C1DC4314B2CD4D895173CA9152F5BF9AC748D3D027F9C7340F87 7E9C42E47089CB61511E5CADD34CE486B99839BFFCE969A823868C04D0E55AE59C628479C21323F89263CC CDECF9706F6DF113CC8EBA58A4B4F818D4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B B5E195ECB0E8F243A4 data Size (bytes): 204 Entropy (8bit): A CFC2BC571E35C9017E8CD48 DEAA E11DF007047A0C3912FFEADFEC 789C213E3AD55D F4B25B8ABC1C4D1CCD844381E1E27F4B143BCF 5E4AC5ED2C271F0850B3DFF838F06E8E514105AEF9D E7AF6A143E F15E2326EDEC3E EE4 7019FACD45759D6A255CD5CDC8D1E630A06B8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data Size (bytes): 406 Entropy (8bit): FC3CB7D5E767E1B5A6AF4 DB31744FDA9F A FA60517E31 A91F1791B08699B CDC511E804F5221CF4FA5458C6C6673A8AEE0C694E 1A643A876D84F9839F2D B ECDB16ABE7F49FD CDD0DB02BCA979F9A5D83A8AADFD CF2F5D330C738034D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90 data Size (bytes): 230 Entropy (8bit): EA2B4B0A9FAE6B7A011895A2575EA4E 7D51B0341D947C5E761F1F96BA950AB7D5DCD237 8B8789F2DA4EC9679EFD8C834896EDB914ECED041FA78B5BF057C C767 AEF9E41E1D447884F71BE9DA240AFE42665D995EEA19D4786BDCF83B0CA3476E0F4DB772467B7259AE C 50A0A0EF4A7039DE7C46FFBB262AFBA65F73F5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 484 Entropy (8bit): BC55AFD1EFC1D7078E4FF B D0DCA3639A0E D165DACF12FD725B702 C1CC945A CDDF3CA10D C52D5D819BDDB7021BABC9D1B6FB4 9D65D91A751A2D08C5EB9ABC24AD1F42F66BEBCEFB36DC9F3BF643BAEE323DF77809DF7B8BDAD5D F5 0A6BCAC698AD89AF2EAFD3703DE813D31BCD1006 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 Copyright Joe Security LLC 2018 Page 30 of 496