ID: Cookbook: browseurl.jbs Time: 01:54:38 Date: 10/05/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 01:54:38 Date: 10/05/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: Spreading: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets Copyright Joe Security LLC 2018 Page 2 of 392

3 HTTPS Packets Code Manipulations Statistics Behavior System Behavior Analysis iexplore.exe PID: 2868 Parent PID: 544 General File Activities Registry Activities Analysis ie4uinit.exe PID: 2844 Parent PID: 2868 General File Activities File Created Registry Activities Key Value Created Analysis iexplore.exe PID: 2904 Parent PID: 2868 General File Activities Registry Activities Analysis ssvagent.exe PID: 2236 Parent PID: 2904 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 392

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 01:54:38 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 13m 34s light browseurl.jbs ure&utm_medium= &utm_campaign=bau&ut m_content=textlink Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout SUS sus24.phis.win@7/311@33/22 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Failed Failed Copyright Joe Security LLC 2018 Page 4 of 392

5 Cookbook Comments: Warnings: Adjust boot time Correcting counters for adjusted boot time Browsing link: utm_source=signature&a mp;utm_medium= &utm_ca mpaign=bau&utm_content=textlink# Real link is: utm_source=signature&am p;utm_medium= &utm_cam paign=bau&utm_content=textlink# Browsing link: om/enettregistration/en-au/registration/validate Real link is: Browsing link: utm_source=signature&a mp;utm_medium= &utm_ca mpaign=bau&utm_content=textlink# Real link is: utm_source=signature&am p;utm_medium= &utm_cam paign=bau&utm_content=textlink# Browsing link: setlang=true Real link is: Browsing link: setlang=true Real link is: setlang=true Browsing link: setlang=true Real link is: setlang=true Browsing link: setlang=true Real link is: Browsing link: Real link is: Browsing link: Real link is: Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2018 Page 5 of 392

6 Strategy Score Range Further Analysis Required? Threshold true Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Sample searches for specific file, try point organization specific fake files to the analysis machine Copyright Joe Security LLC 2018 Page 6 of 392

7 Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking Spreading System Summary Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section Phishing: Phishing site detected (based on logo template match) Form action URLs do not match main URL Found iframes HTML title does not match URL META author tag missing META copyright tag missing Networking: Social media urls found in memory data Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS Spreading: Enumerates the file system System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Writes ini files Copyright Joe Security LLC 2018 Page 7 of 392

8 Found graphical window changes (likely an installer) Uses new MSVCR Dlls Anti Debugging: Checks if the current process is being debugged Malware Analysis System Evasion: Enumerates the file system May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Behavior Graph Behavior Graph ID: URL: Startdate: 10/05/2018 Architecture: WINDOWS Score: 24 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend Phishing site detected (based on logo template match) iexplore.exe started Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language other IPs or domains started started Is malicious iexplore.exe ie4uinit.exe syndication.twitter.com enett.com , 443, 49242, TWITTER-TwitterIncUS , 443, 49277, TRAVELPORT-TravelportOperationsIncUS 20 other IPs or domains started United States United States ssvagent.exe 6 Simulations Behavior and APIs Copyright Joe Security LLC 2018 Page 8 of 392

9 Time Type Description 01:55:31 API Interceptor 1x Sleep call for process: ie4uinit.exe modified 01:55:31 API Interceptor 4908x Sleep call for process: iexplore.exe modified 01:55:35 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link oss.maxcdn.com 0% virustotal Browse cm.g.doubleclick.net 0% virustotal Browse doug1izaerwt3.cloudfront.net 0% virustotal Browse syndication.twitter.com 0% virustotal Browse cdnjs.cloudflare.com 0% virustotal Browse 0% virustotal Browse enett.com 0% virustotal Browse 0% virustotal Browse maps.googleapis.com 0% virustotal Browse 0% virustotal Browse stats.g.doubleclick.net 0% virustotal Browse maxcdn.bootstrapcdn.com 0% virustotal Browse googleads.g.doubleclick.net 0% virustotal Browse crl.pki.goog 0% virustotal Browse img03.en25.com 0% virustotal Browse i.kissmetrics.com 0% virustotal Browse ocsp.comodoca4.com 0% virustotal Browse ocsp.pki.goog 0% virustotal Browse 0% virustotal Browse trc.kissmetrics.com 0% virustotal Browse ib.adnxs.com 0% virustotal Browse 0% virustotal Browse bid.g.doubleclick.net 0% virustotal Browse img.en25.com 0% virustotal Browse ad.yieldlab.net 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files Copyright Joe Security LLC 2018 Page 9 of 392

10 No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 10 of 392

11 Startup System is w7 cleanup iexplore.exe (PID: 2868 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) ie4uinit.exe (PID: 2844 cmdline: 'C:\Windows\System32\ie4uinit.exe' -ShowQLIcon 184C8F06D CDA3954C489A36) iexplore.exe (PID: 2904 cmdline: '' SCODEF:2868 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 2236 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\ANNEBO~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): F40F86107E7947A6AAE175AD5BDFC99B C37F7785D63C11D6B711677F7034F B B2C73CDCD BE8DCCC2341D857D BDDCD57D09F4C797FB83DB89 072C9DA1FB03BC7179CA95C39DD A44CD54BA91BBED4C3F04AF97A19DF52CC2BAF1DA70C41707AB0 C3B696C2E62E1566AC984FEBEF99691D592D114 Copyright Joe Security LLC 2018 Page 11 of 392

12 C:\Users\ANNEBO~1\AppData\Local\Temp\JavaDeployReg.log C:\Users\ANNEBO~1\AppData\Local\Temp\Kno7497.tmp Size (bytes): XML document text Entropy (8bit): D D31D1E7C57990CC A28EC731F9106C252F313CCA349A68EF94EE3DE9 1E2E25BF730FF20C89D57AA38F7F34BE E8279B20127D0014DD27B743F 689E90E7D83EEF054A168B98BA2B8D05AB6FF8564E199D AD3FE E687AA9AD7D94468F9F57A4C C19842D53A9CD2F17758BDADF0503DF63629C6 C:\Users\ANNEBO~1\AppData\Local\Temp\www7BAD.tmp Size (bytes): 324 ASCII text, with CRLF line terminators Entropy (8bit): DDF93B98C5AE2C79C09BFA D 71BA59BB8429DFA73A5DD73502E0098A6308CF1E F5E35EA56DBF3FDB1A6EDC8C4B26B170FE9512F8DDDAE56353B5DD03D6FB1386 5EA667BE4746FAF1AF72149D2C18B3BE72C7379ABE95E42140C266B531D6E2FAF4ECD9F8C31B03F82AA578240A AC863E2EAFBD B CD862 C:\Users\ANNEBO~1\AppData\Local\Temp\www8923.tmp Size (bytes): 411 ASCII text, with CRLF line terminators Entropy (8bit): D8EF58C50B63649CA2A11A6DD21CA FF65A43FC6514B94D815E123DCC87543DFEB3509 A0E D382B06CDF904BB849EA9C84A19C22B7380F F07279D9234D17C8D2F890F18D6D07A64F22002B39B51956F2DAFD38D6EF46C261B7F756B858108CC996A95A7C E92F8AD08ADABF996B81291E49CD247D32AE0 C:\Users\ANNEBO~1\AppData\Local\Temp\www8974.tmp Size (bytes): 452 Entropy (8bit): ASCII text, with CRLF line terminators 431CE3C728B963E531AC57ED03AD7885 4E59DD95CB200BD87778F26DE2C078D943BD B92D61A40EC12A97B69BFD EEEFBB07CD5C91BD5F4C3A1FAF6A64F1 7F0A79E04A7C B54E38E3377E041B221E7A891278ADA5ECEFE2367AB728F8FE3F5A71DA1815C23800CC5 028BFCB6B3A D5DD732D05DEEC11B C:\Users\ANNEBO~1\AppData\Local\Temp\www899D.tmp ASCII text, with CRLF line terminators Size (bytes): 752 Entropy (8bit): BDCC6FFB83C24153C5FF45FF8 5753D953EDA2ADA640779E282C19E37F159AED09 Copyright Joe Security LLC 2018 Page 12 of 392

13 C:\Users\ANNEBO~1\AppData\Local\Temp\www899D.tmp A7F9A28D672F9F78C0F950F0262EE8AF2DFDD6E31AE3881C2038D A4B9 BED2B D8082C48D8CB4C45FC185AF94FAFF8DA00FC3C10CFBC711408FC5CDE1118E67D7483FE C892E00FB11232D9BE9207B252E70DBB C:\Users\ANNEBO~1\AppData\Local\Temp\~DF AA1F.TMP data Size (bytes): Entropy (8bit): E8DB296D5B9CE3E1EA5B4055B BA8C5F2C CA867F6D5AACB3E314B266 71EAECC13C93EF67D0F7EF8E F4C454B3CD8560BEC32F026F515F6DF9 8015C41B01DC80602A2D65417E803544DEDA F05EC9B70EAF439F213BD0C4F654565A4E06C07E B 6B8343ADF0095BD6FA951C2D8D8F7D093EC1 C:\Users\ANNEBO~1\AppData\Local\Temp\~DF17543CB5F7FC13E1.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): B69BD4E8C4FF75C8AB39CC4D7183DD CFB B3FC805313B7D38A7CBE61A06E6 CCCB8B67910DDAEC2B6D90F0F6AA172E72CFFD2FB598D2FACFC12A134A490C33 3A48DE11D78E9D6C9CF BA0DD9F7EED4BA3E01A D5B3EB9D27369E5B08EC3D1E48F92FF 741F8B721FEC5EA85FB2CA25773A3B417AA703 C:\Users\ANNEBO~1\AppData\Local\Temp\~DF283BAA36E432E421.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): D7DF0498B601DC55E6E1B5488F0CED89 957A9E31D4B88E6F1135A8101D13FEA2A23E5377 E5CE9AD95D134DEA1016F51114EF4A10EAC03D1BD79E9867B2FD5BC5BA39CE52 82A CB4D0AD005CF1D2818FF232348C5A7526EFE396D01C4CF963AF8E5D683A65815C9DE13DCDC0BB34 B E0691B BFACBAC0938F0D64 C:\Users\ANNEBO~1\AppData\Local\Temp\~DF30E4CF7378B64D14.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): F390F6E665B7D9A5EB4E498CB02C74CA BF5C9A00D8CD6D5621D E9D47C6270C16A AB699534A380F E679959BA5D128BED1908F91A539D35FEC9729EE0C7C 9608DF49A4FAA96CA47C76D3DC9BE7C7A096451D0B65BDCE149001D7A93BDF32A3D1D98491D1D243FB2B1909E C0A4AA BC9EC2F7F A7B4082F C:\Users\ANNEBO~1\AppData\Local\Temp\~DF5F F08784.TMP data Size (bytes): Copyright Joe Security LLC 2018 Page 13 of 392

14 C:\Users\ANNEBO~1\AppData\Local\Temp\~DF5F F08784.TMP Entropy (8bit): B9EF36D6CFCAE91987DEA E45 ED5F463C9D73E96E928BA7B42E7F01A3ABC438D3 434D4F40510DF1ADB6765C8D4EBAC6D2642F9DCC757DD1C72B4B0411F474700E C0A1D51ACEC9D10157F0EB5DF27DCED1E C113C365ECEA718604D0D600DC17C7B785870BBAADB2AC4 4EB131F1996AAF07126A5FDAD1025E71F2178B6B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 593 Entropy (8bit): C1812A882C2FBB908237F26F07E7F5 175E61E7A8A432DE EA6A45BA71A D408E3B63F9E9F430111BEEF486F97DF70158C12C3DFC2F0B27A111497E FB4CDB95640E16E2D76F8A192DEAB0E1A978725D5B42120D29A1DD19585CE33045F BA73CBDB2289DBF 64F57C359749D168DE372965E73F8F30E6A3DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ F846F08BEFE0DD8112D932FEF data Size (bytes): 543 Entropy (8bit): DC BCDC119F0B D0 B92BD37BE1338ADFFC5E08A19B279B E8 4EA7600D1EF823C6526E3A23ACFB6A2FF19A0E8DC51A713770B93CC29B81F2A2 3A0BAB994AEC6296BFE62E00A29FD0F E90EF745A906F05E EBEF8DEEF285D5A3A FC6F E1CAF47C1DD0481C4DC8E2BF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0AB67BD4882FB0E CFEB33A58 data Size (bytes): 531 Entropy (8bit): BDA5618A275F4D8F03FC737EB A4A F3752E0AF469762E23646EBBC1 86F C8DE9D223B04349C3925B078856D8DA2CD5A EB5D00 0B413EAE87FDB6A FE34579E90C68FE59A857E32AED37B2B4B878CB11536C280CC9F391D02E F3E788D54AC7E6E7ACDEC3E8D88F40B8BBB5B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_23C17A228306CAEB4EB2C D2DDF data Size (bytes): 472 Entropy (8bit): BBB97A9E5B79BCD4EFE7809B337DB4BC 09C3E4D1A48E0C0F7BBF9312FAE0CF3A6C42621C D8E B56F277EB15D810A1F3CECDB97089CFA50D25474D0BC3694F318B3 90FFF1DF556D2AC13F4F8C6E15838AE07EB7AACBE5A353E06B7A43C9A9E3A3E41E9E90B4DDA7693AC1474BBD 34985D0E6336A1C37DB30EB857E443BDE48736CD Copyright Joe Security LLC 2018 Page 14 of 392

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_6CA46809F08C6D2B1C30A BA88F1C6D87 data Size (bytes): 471 Entropy (8bit): EB81FA3941A8AA99C650252BA91B6CFD 7DB6A36B93E99FF96B0061E4A16BFA8D2BE48E D04D2B018D6B46A13CBFF4140D2933AF9F113F900E4B6C397E98508C8E 31B3643D50DC2DEAF98ECD FF CF348E9B8E58C924BC6FBE58CD271A70CC9E32FF C8E 69821B05B30BC0080B428D698E7F7439E38C3E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0C E44422ED38B data Size (bytes): 471 Entropy (8bit): A6D7F31AE864E5FCD632E3C36623CDF E66D475A04F625B3AA1F2BF354EB9E629D3B8E58 9C567CCF21D5B82AF43A8BC8F70450F546BEE4C10F51D396CF716B78D95C98A7 C81C84D1CD79166DB49611A D B90D4DA0EB02A2B CA9CA AB43FC38DF04D CAA357A84BC FF460 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\41E BD186E9FDA558705F775 data Size (bytes): Entropy (8bit): D5CC407260D68F4CBABC6CEFA39D415C D5D6CD42232CE6C56A89A260533D14196DB98CC1 C79C85267F18E9324AD7AC7D2385BF75663C92DA20953ECDA915A026CB2FBCBD A30273EFF639D68C0A058E0902CF33910C7CD25FC31BD9011D5D F2CB A56A3B61887F64D91 2EB98D2EDA66579D9B63ABEB078BB390056D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C622 0 data Size (bytes): 727 Entropy (8bit): FA90F22ED90B9BBE2603E07443EA8B 34B1C1E9AD896DC B656087A8F62A91A B2FF992EDDA F062013D688B6DF946C648562DCE7F400D0A70D D9ED8ABC02FC801822E1879DC682A31837B B F41CB846B95D23F72628DE019B83739B9B7F 9928FFA695C26BC04C F536DF6AA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9 911FE760A9B data Size (bytes): 1831 Entropy (8bit): B76A6AEDB428BB249E167406A341 Copyright Joe Security LLC 2018 Page 15 of 392

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9 911FE760A9B AC059898B5B9BC147FF176548C8B871C3D18E4AB 383CAE E648B7D7E34103B88004BA8CE36C02212EE13B3B257674AC FF9368F11B177E045D9122F240B4BC24A3C7294B9DE356DCCD37CA64727E4DCC569035C740ED1F23249 ECAE12E64C9F2463D3932DAF A31B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Microsoft Cabinet archive data, 6509 bytes, 1 file Size (bytes): Entropy (8bit): CE371CD7EF9CC216BB EBD518D1A89C6F0079BE759A38869DE9ECC399A D858B12945B35906DD709A2FA9EAFEDA3CDE7E342041AEE65BBD43CDF783C C5FB7B6ED27E52F6EF48754DE5D1B9A756961A EB086135BD5C5420D CC8C1D82D845E8AEBD 50ACABDE23EE17A DB0A13C30E2CC1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data Size (bytes): 314 Entropy (8bit): C6201B F50AF881FE8F7 AE196D CF348D74563ECF FB87B0B7E8DB9DE86429E D9A929CD1D F4F3460FF7B8C5B 42D8A931B1D5A229BF5702B27D AA E5AE0B16D910B75228A025E638D44E62C3490AF8E24AF0 E78F8EB9778BE0043CBC161A0DF00C4AF3595 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\678B9F95B126F CA85CB2F3DA_AB8D94F B E3EB7F2B7 data Size (bytes): 1428 Entropy (8bit): D8FADB0453F75516E1335FE6F54E2BD 23410FD1B EB6E5E39B8716DC1D09C5B59 D5749C02AEC986C8BCE D27EF585D11CFC5C92BB0E91AB95EB77E2E6B9 DDF5C0B475633E4A4A18E548DDFC5B27AB F0B56964A603DCDE D8EF02D28F7ED653A45E206CE3 CFB C4BD0A3785F9EA2B5134EAD63B7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 531 Entropy (8bit): D4320A556DE14BC2613A E66 6F5A53DD344613D9AD2434FE1A4EFE5165AFCA7F 1DE7AD2D11BC04482BA1E6318A4596B2E079EEF1D ADD B416 A697F39E5ECC745220B8DDA3144A368BCD392FD306D4E22EBA618B65F5200A9ED2EDBB9100D75D730222DB968 FE725A B18FB C7F26E96 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 Copyright Joe Security LLC 2018 Page 16 of 392

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Size (bytes): 471 Entropy (8bit): F0210FCA CC216A E2 D10B86C6F353C30D98B55BFCAADD40E7D493397C 397AD878DB2D20AFD65BA634252E B089E1C9526BD D1221F9 C5CA0CE0D36CB0716ECC6E37F96C261EF4E992C6C6B03D7EF703252D5494DE7AAFB222089C8BEC0A52ECD39D CF B994898E994C7D29C8C513BB690DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD data Size (bytes): 531 Entropy (8bit): D4320A556DE14BC2613A E66 6F5A53DD344613D9AD2434FE1A4EFE5165AFCA7F 1DE7AD2D11BC04482BA1E6318A4596B2E079EEF1D ADD B416 A697F39E5ECC745220B8DDA3144A368BCD392FD306D4E22EBA618B65F5200A9ED2EDBB9100D75D730222DB968 FE725A B18FB C7F26E96 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8AD 6 data Size (bytes): 471 Entropy (8bit): E75BC2AF773C7B1AB96B8D21EF5F F7C D8C24F739C27B821335F1F1 F0FC B2F8E56864C744D79D8512A3BE8A9DFF7A B5D37C9B8E 8286CA2E037F2219D725AF8B4F530D87ADB178E140A3B17B5D5B8B27FFFA704D0D7F5D40E517E044D532128F753 B8814D2C88F4BE E6E55B76662AF61 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D3BD78A30B98D17C317EDD4FFE850A0 data Size (bytes): Entropy (8bit): C8A EF98E7BD14F4CB E314B48800C1F8F8638E3D74835E7C78336C1B8A 37EA1F379A2AD13226F208E6E2B6F8718EB46CEB987C7BEB41E18FE2975F4B28 7D945AFEC2BED76366ACBF20C342A78E628B3F0667AD5634AF491C6CD311DC40C37A646CBA8B7294C3340B2C1 4AA EEF36B32C103A A02FB75 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4405 Entropy (8bit): F49D05A12DAF7DC1437D8CCDB188A74 CC31C730E0CB60FF D781AD8F1F8DB788F B6CAF30D26C9B F0E345C3C5F343AE0D4378DE4FEECB0E9E5D9DA27C16 Copyright Joe Security LLC 2018 Page 17 of 392

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F 956F073E850CC D01450C632CDCA0CE7B449221FF81DA4C278785D1F1933A85C43FE97994CC7C67EBB 70E177ADA752BFDE76A88D061C7B047FB548C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A FCFF127E4EADADE B data Size (bytes): 531 Entropy (8bit): BDA5618A275F4D8F03FC737EB A4A F3752E0AF469762E23646EBBC1 86F C8DE9D223B04349C3925B078856D8DA2CD5A EB5D00 0B413EAE87FDB6A FE34579E90C68FE59A857E32AED37B2B4B878CB11536C280CC9F391D02E F3E788D54AC7E6E7ACDEC3E8D88F40B8BBB5B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8FE2C641C99CFA6687FA8D31B7D528A1 data Size (bytes): Entropy (8bit): C8A EF98E7BD14F4CB E314B48800C1F8F8638E3D74835E7C78336C1B8A 37EA1F379A2AD13226F208E6E2B6F8718EB46CEB987C7BEB41E18FE2975F4B28 7D945AFEC2BED76366ACBF20C342A78E628B3F0667AD5634AF491C6CD311DC40C37A646CBA8B7294C3340B2C1 AA EEF36B32C103A A02FB75 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\935997A99AD561648D062FC0CD data Size (bytes): Entropy (8bit): ADA17A0B6DCB9DE53EA39528EA9930ED 72EE933728A71BA49DBCA7D3D248DD5BF39C3A5A 4BFB35F59282F9C4FFD32417FADF2C2DDA947DAC9ED666A7D07CA9CB97F1A9C2 861DABDBC02F49CE987894E0D84EDDC7C3746F089D78E9B2ED47D1EE5728C143099A5E9ED9DFD154DCECFD D750345D4C2CC271C1C78D75DF AB5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A819A172D8B839CA790602F4C968FBA data Size (bytes): 525 Entropy (8bit): Copyright Joe Security LLC 2018 Page 18 of 392

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A819A172D8B839CA790602F4C968FBA 5DF FB22C336F41E02DA3EB F4F81CA1E98542C F6C8CC8AC6 6C1B93E21B448CCCCAD3960F167B1C08691D4DEBD5BB4C7D942AA0FB2ADA8C3A DF3D F833EFB7BC9C45AEF4C2BF2F8C30A3CD1D315BD585DD0C B6588E02FCD0D4D1B15F78 B0168AD4DAADCEB6A17A7CB7EAAAB1B7C4ABB0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CD228D3BE9D7C030237F48AE580AC0E_1D3FBDB0C20467F3946D8C08E88C997 A data Size (bytes): 1425 Entropy (8bit): B141040B8BE450FD2B55B1BF25B5A E3277F9EE58FA391521D02420B898E9113A2 7EF44E033B0EE9C0BED6D1C89BDCC0A625E81D18D25E5FB2C01F3B5CC2B1652F E43B5DB42103D9A74F36B1BD E0078A885E889F62AC842B9A221055EF8DF96AA11B3CCFD2B84780D2 CA9FD2B4251D163BD46E1BF0CED1BFF7192A75 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A3D5BF1283C2E63D8C8A8C72F0051F5A data Size (bytes): 712 Entropy (8bit): D94F1E22F1BD768583C33CA604B04C7F EA77754E95A8A083F2624E68D87D6BD747A0A138 23F85655DD756A38954FD63F2218B4F6FA6BBFFB5467BA02F3143DC7E4CD36C2 12FB2B5E831F474BCF2153EE7EEC2C727B2570E ECEE0DC4C03B693B03F1A79BE4E E638F4 E4DCA79C364E BAF5CA94258BA246BC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A6E643304C5FBB7CBF4025F1978D6EED data Size (bytes): 357 Entropy (8bit): AF4CB F0B762032BC3B601A986 BF B0E033B1DF5CB8C92973AECA20438F0 23C6BE787F67F15FBA1800F46D2FBC713008A617A97AC2E36C91503D8F02395D F6E63331C49E0046B68A918F92109DAE5DAC011E E4EC378255A2BFC0721A0E495B81619F4434C883E DBE60BE41F53F034A937F8E4A70F1A4AB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A9E4F B52012CE8E279D314C_E27CFF85F206CF55AF304E A15 data Size (bytes): 471 Entropy (8bit): FF3E5BFD6604CA112EA6CD372C D2AC3F752B28759E8B8729E290395CA14BE8B 6D4FFC4C7A052A9986CC5AD1C70402F36C21CD52EEEF721C27F34D26B1CC6E15 78A2A0572B0ECBB8176D78E0C211748F D257D07AD3C75B9F33F5D92274B325BD23378F4AC CB0B C9C16F478868B837F81EE Copyright Joe Security LLC 2018 Page 19 of 392

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D data Size (bytes): 812 Entropy (8bit): F82592FA84DB8BFD006DCFD0AD 3B77CEEBE8300D4511D1E572F897B0B383EFBEDA 021AEF6353A89CCFECE38B508CD7C7F92C0A8934A27D72CB21E98A7F8D4FC084 13E659DBFFF49B38042ABFB0EA0D41A8494A661F9491A12EB507009E0DD1078AF96D8F848CB037A8E7396E3F37 B91B140672B3C68450DA2AFD97ED1B7B97C123 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D080F8FD8CC1905DCE0E357DE704D67D data Size (bytes): Entropy (8bit): D5CC407260D68F4CBABC6CEFA39D415C D5D6CD42232CE6C56A89A260533D14196DB98CC1 C79C85267F18E9324AD7AC7D2385BF75663C92DA20953ECDA915A026CB2FBCBD A30273EFF639D68C0A058E0902CF33910C7CD25FC31BD9011D5D F2CB A56A3B61887F64D91 2EB98D2EDA66579D9B63ABEB078BB390056D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB90709B4_C82ABCBFF5F798932E6AA 48E5B0C1C95 data Size (bytes): 471 Entropy (8bit): EC47C0CAC8306EBEDBD982C2E5BC0A1 EA F269A9D3514AD4F79B8D 02BC9DE178A08A79697FFFD44E3C2141BCF6A002DEFCF4198EA90C0EE B964BAF6C67AD298BC53C916A120381D5AE A3FC833F77A52008CD69E217DCB4B4DD4C8ABC6 92EF614A8F79D0DF2D2A6E309E49EDB6152C3B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E961199C820C769E8780DF5E0A data Size (bytes): Entropy (8bit): BE22EE8436FAB5A4302B7EDB87682EE B60F23E0C9417FBFCF87D9CD9BAD441219B8F268 A2A7F62B792979D6E1D01A1EDF562EE208D334D82DDBECEED8BCDB28868AE853 Copyright Joe Security LLC 2018 Page 20 of 392

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E961199C820C769E8780DF5E0A B000565C B2B19B3DDB5AECD475ED867AFB93508A3C21910C85CECE8AFECA7B5003A3587EA B4 B47EBD07A68E74CD8903EE25B8EF8A646BBF8CE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5A B data Size (bytes): 471 Entropy (8bit): E6704EA7B8CFB9BAB506EE9E84A7C04 455E0BAC3509A9F491A2B1C26068CA97ACDAC DF0E73F48069D9D5B7236BCC2E01E8B87883BFD695EC8E9488BC3FA727AD 0DABFDF34427E65E99A4FE24C F51E72C44B77DF071CCC A3AE41FFB265608B687B0FFFD05 97D560EBA234F73BEC3D B1FDC6986 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0060A9F B15AB61E0E47645E5 data Size (bytes): Entropy (8bit): E7335B3FF8385DD81C9E2E64BB8879A5 147C26A55F786618EC7F4D808A53F6F319436A FCFC222B5F76B31FFD15F8C8FF7DEB1C41A471149E4564DB8996F07766E E493D1BBFBD58DF7A34E9170D8C60596C882AAA47D56B64062BFB329D6FAD9F77BF0CB9805DCB7509A4B3F01A 46E9F47572D7B7B26360CB67397EC98B5E09072 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_D0021D188712E9DC384A4B357EF70F08 data Size (bytes): 463 Entropy (8bit): F3E8813C EC39CBEFDCAAB25 7DCCEF E9F6550D1F43EE22CB2C4C36F 2053AA69836A85A3B7AC2EDA1B3FC6ABD2AAE0D247881E444A566FDD7EA3BDB F09ED64E174F86C7D7C4F183F67DFA02A3179FFF40E77149C63F09F6B72BBE6D4EFAB5D462F BF9 0AE6498E9B8D6EBBB0E8584EA26CFDF33A496 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F94FD5F2AAEFDB A4E9 data Size (bytes): Entropy (8bit): BE22EE8436FAB5A4302B7EDB87682EE B60F23E0C9417FBFCF87D9CD9BAD441219B8F268 A2A7F62B792979D6E1D01A1EDF562EE208D334D82DDBECEED8BCDB28868AE853 B000565C B2B19B3DDB5AECD475ED867AFB93508A3C21910C85CECE8AFECA7B5003A3587EA B4 B47EBD07A68E74CD8903EE25B8EF8A646BBF8CE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Copyright Joe Security LLC 2018 Page 21 of 392

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 Entropy (8bit): B1E0A8BC96EEE705D359FD4203F989 89FBE01B DBA9D117F8ACFD9403FD8B7B E0E59D58BFC6B6B980BB2D9F67F0E F3A0B139FB8838EFC01B12998C F58DFE9CC99BD7B904BAD6C0A0944A693A1B0F26F5EB4BFCCE8E66BCC41C9EFB7F1DF A682997D07C5 BD00B0C3A4A1E5B F2A5C840AEA90AFD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ F846F08BEFE0DD8112D932FEF data Size (bytes): 234 Entropy (8bit): CD9B484B66F5DC D3FDF D6029D34BF9E4AE7BC3932A47383A855AC 05E4B65818B0CE8591AC6063D0A09465E D7B51CDDF9891DAED880DF 7E9B2ECF6B6F24C6FA138C5A3EFADDE6E63FD3D B6FFBC4AB0CE21E5FE81D5FF77D1BD1A95E36D E58EF1B6E30AF E254438D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0AB67BD4882FB0E CFEB33A58 data Size (bytes): 216 Entropy (8bit): E95209FC4701B682930F69F7E905F8F D54021FA0A7F4A76A01947F237D96EEB5A F3C55CE6B82DC85145B325E045A87A8850F D25BE760E3D09AA05E4FA 6971F264EA77FD9CC27EA6D346FA1F4C591F87D749ACE025382B15F6E5CD1849A1B9C8CF570EF72F B13F 87B22C4377CA D49CB82E65B134C598 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_23C17A228306CAEB4EB2 C888908D2DDF data Size (bytes): 396 Entropy (8bit): B15D5E17EBAB8D0478F3A29D333D03F9 2F04B5195E51AAD3D4D2179C2E8B0B6B61E813CE 6D6A6CBEC42F56CDCB8BDE9B365DB226A8B A11957DBAC992B38EF DD6E62DD035B19329D2B93BBA76050FAE83030CC5CA531232BC0B A9E52C4E61C59070A063141E976 44B1A6EAFA84E72B426BE83414EB08FFEC292 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_6CA46809F08C6D2B1C30 ABA88F1C6D87 data Size (bytes): 404 Entropy (8bit): F844949BA65C03125AE28B2E6BB65E 5B166E232F0FB0FF1D6DF38B337582A7B0AD0309 4F8027F3E03ACA0C7853A A420D2CD2B4EC8FDFFBA4E2BBAE93 42C5C5F9B30F839B41E C9534FA6908ED55580E851A45693B01883FB401D46E2FC558409BDBFC411F 37ADB571A6B6FE4CD142C94C50E2B6D615C2 Copyright Joe Security LLC 2018 Page 22 of 392

23 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_6CA46809F08C6D2B1C30 ABA88F1C6D87 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0 CE44422ED38B data Size (bytes): 446 Entropy (8bit): C77C5D66A146FEF359BF623B5C2B626 D043DD C69B06C1E96C2F975549FE8EF E82985A2E943A0DFB7F70B1D049BA8175DB8E48F54027DF73490F4E2026A17A4 136A4AC7CADD6C83D5C9B24A34D41D2BECEC FCB4EADDDBBE1B483A9D3C06E3EB33258B54CAE59527 E990C1282A9E35E76A17D09F6CC1AD8A22A026EB5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\41E BD186E9FDA558705F775 data Size (bytes): 200 Entropy (8bit): FC7112B D66E8D2C1AA8 E91D3C0D281E0BD9BD9B26A C5BDA C5ED1515D7A2FDC247AE20422F7EA04EB6F515124BEA44EC8CDDC97A35A97 656F96AD9F8AAA5B9EFFDED F9A786CC394FEF55B2A5445BE5985B1BB289430BD9FE2DB2BE64C28 255B74B55EA04B351181F87F40635BFB3FB7DB0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE5 9AF8FC7C6220 data Size (bytes): 800 Entropy (8bit): AFF71C55B9C88E04A37FE C8 2DE38E62D05E711D6BD4AD003C917CFFCE5F96F8 4BED253A B7A533644E26F670EE525A5FF7523E07C85ED703B0E6B4C 99AE56B678AAE7318C765AA5CC24B24DD8DD8BCCFF785A1256C158062EDCE286A5BE5B0AA925C678C6725A48C 4C19F508D94F2428D390031BCBBF94A43A4C649 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA 9911FE760A9B data Size (bytes): 486 Entropy (8bit): BCB88A09F223AA1CF16D4DB4ACB374D A B6C49B60C72E7CEC876E67DC27E35F6 2B0DD A0B3B14A4258B27CD72BAFC7FE6E531ACC4DF66F0A36BB3D99 F6257DB7AD8D40922A3EAFC044D6C4D3C63D9EBCAB8D6BAF6FDBE5A3EAF269DA1E CC27EFA43AC 409B1D D545A8C9B60B30C64EFC C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 1368 Entropy (8bit): Copyright Joe Security LLC 2018 Page 23 of 392

24 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD EE9A041521BEF89D3DAE0156FA5C12 E491E659A77FD63FC9CCE8E090382E5DA1A6C76D DF86EFB8BA DDBB158F3FD24013F2FAE9CDE9040CBE49179A E439314E577B C50BF9F1566A2E6EC B5C3590E0817DA3988C367853EB4A04D6D D8E6353C3E F BD9BF3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data Size (bytes): 406 Entropy (8bit): C685F1208BB65A7CD03193DC31D 837CD D0A73752DDD648107B48DC02DC 8ED2B C DF7135DC23402CAC16D1BD30AB6445F7D C1C42CDA5622B6DE1E339AD9D53F0B217AA548CD53BD6A9BC0FB9E7D B9DEA0EB0748FBA7A221D542 F B45D756FD18F9F1BD819D561F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\678B9F95B126F CA85CB2F3DA_AB8D94F B E3EB7F2 B7 data Size (bytes): 390 Entropy (8bit): D47D1D932883B29131F6E06B5DCF F04DD12150CE6CF6077BF928DD9798CB5F4 0DA20A4B1FEA7E7D352B675FECB CF6AFD7B1FE9F0254E38ED5C9D C284A82348C1504A43059FB7C1F53ABE61FAC6B1A825DA74B1F D25D2FDC64EF82CFF18EC731F4843 DF EA992D50B5DB D0D7F05CE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 484 Entropy (8bit): C9C8CF1CE556E45C9353A1C9DF968E07 AD41CB4AEF126CB6F7E0D5108F6551A4857AB34A 8268C92A88EE2E853C6E5AF7606E2C0FB60738F83D43BDE15BD BC368D 50BFE9BC9D3788AF3C01D686D3CE1EE649F1604ABE6CD94939D9091B443CC1BD6FEF3B E0C7D D332EAFE0C3705BE9B0CFB21DD350 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 data Size (bytes): 868 Entropy (8bit): A3C4DBDCA5EC84927F106CCC7D597D51 71A935C0FA8DD6B8142EE3AA0EB9ABD76B6A3A74 8C0EB01F658FCD4FB59D8668FE7D711FC0C1EF33077C2EF925E42FF140FC5236 3C5F2C11B7D4B589DCCDD8BB61350AB4216AA7357A12E51F21A692FE5BE6FDEA44E2A7501C7DB6FB81B25DA4 C0B12B59B71A31A5B49AC5983C29DE4469A95462 Copyright Joe Security LLC 2018 Page 24 of 392

25 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD data Size (bytes): 216 Entropy (8bit): A19E7D6E59E8F658ECAB4EF76F8FA BCB8E289D1596A FB9C279E FCD0C1CACC73E4F92638B57BFDFF6D1B3C6E838B423834A8DFEB30B CE16EADD47D189BA21D588C7DC32E8967C4BC2A772A7769A8C772AC8312DC52841CFF88DBEF50AC9EE00D5B2 958BC9B83D66012B8D2458B6DC4734F2812C66D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8A D6 data Size (bytes): 868 Entropy (8bit): A77ED8EFDA4BBA0D6AB05C0B379AE99 C7C5FB618F9F6CA472901B22F1B7A7AC3086CCA7 F9D695914CE31D FFD860182D217EAD484902B E48E3ED27B489A C7EF03B1A55656F79D868622F068DBD3FB88F34881B572CC631FC77AC7B48B E05B6A48595F89CB086C3080BE233D5222C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 3960 Entropy (8bit): AE4C C4BB8D795D60334A2496E B3BA91CE90BD206743AF62EA9F41E0E BB7B2C943939AE876653A6F69461E7E48EF2C80C08E6AF98C33456A0C08 564CB5CD422EB6B9DB7B421F008071EC71D4746AF588994D55AA0E5B F7D26CEC1B3C0677F00A1C07F AC57DAA3D9D53FC6EC45ED6320C6B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D3BD78A30B98D17C317EDD4FFE850A0 data Size (bytes): 264 Entropy (8bit): B1F8CE186B46E7939FE6019A AC5EC69FF31123F306816E99ADC E75DF C14A17FEFB02FACA1EB602B1094F988C0EB293ED07A94144B5ECA5BB0C B7E62FFA08B0C5E3860D199E4AC97B4CC41F15EEBDF48D490E12592B47CC1DE5185E70257BB3E2EC6A025685A 7B79928A16DC A023C497455E350040D0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 452 Entropy (8bit): AD A4FD167D04F BA8BD9967BEEE024ED6226BCD7ECF4F4A026C901 5AE36E21A3502A694B57F F83972D15C1B540DB09650F5AD799B2BF8BC Copyright Joe Security LLC 2018 Page 25 of 392

26 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F CEC6E F81907A774435E2A7DABC8ADA333B741085BB62A10A55E47B44F1B67BE947737EA15B228309CC4 4A CA834C3D283199F7D3DACB38F8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 184 Entropy (8bit): AA205C6DCB E7AAC3FF41CE3C 65C22A FD7DD1CA43D7C55074DD6B450B 29E677778E7A CB6E13B57BE4D7CE530F5DC8BB D7B219F 579C78FBCF4BBC1C8CB41C DD3A09F6AA0C7BEC298549B2B6EEF1BCD651FE0A35BB7757C72E8DDB8D5 EEF9583BB72277C59F468F9965C1BCCB37EAFC6F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A FCFF127E4EADADE B data Size (bytes): 242 Entropy (8bit): D8F97AA6968A987BEAE16E0E6F2BF7A2 57D6AEBD62A6B17F24EFBDB6DD722B E0 27DDBE4D8EF04D2BF8E9824F7BAB274DED D0DD0DAF04FED465E2E B69B8D28915B8F56AAD2837B7CB833E8160B139B196F851BAB789ABFA47A9D2EDEAEA9FBAE179FCFA9CB905C C45D8ED8FC666E0EAA943C99DF6B6E A9A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8FE2C641C99CFA6687FA8D31B7D528A1 data Size (bytes): 268 Entropy (8bit): E3C8B82CDD8E9DD360E1F D00EC6BDEABD27D5A3CDEA38026BB54BD2C728C8 9D5BB3144B3A1A657AF160DA32095E92D909D0410F375D68B8A0D6A46C422FF5 2070E00A1B952513ECDC0588E4EF047E84F96E192AF6DCA53A8EC5DFA903287D4A29F1345D6CEDC25E3FEEBE5 41FFC415335D7E17E6E7F1F1BC00F D3C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\935997A99AD561648D062FC0CD data Size (bytes): 262 Entropy (8bit): BA A9EC4E188059ECC854DA75 7F319D88DCF4092EB F7CC21F9C6A AA40AF8D998DDFA4922E921AA9E76D86C89A679809A0E81EE583FEBED3 63AFEC3B4F3E0CAA2361C5EF947B165DAECE826AE179A83390AD2EA18E946A5B1D E009FF451427C2A A61DD563A9AB906179F7FDAF137633D1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A819A172D8B839CA790602F4C968FBA data Size (bytes): 280 Entropy (8bit): Copyright Joe Security LLC 2018 Page 26 of 392

27 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A819A172D8B839CA790602F4C968FBA F93598FE038869CEC8C E2796B30025A290D319D94FE41DA1820DDB3F1A 12761C9FDA81C2AC587018B2D8026ABB B138F7C54F525021E8B2F C62A46CD773F CE0CE05B88F745C9557C4845B6B730FFE426AF9205DB57F8D03CBE4C68F2FF4A DFA9A37E2A086714C64AAF5ACD8CFA1CFD48 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CD228D3BE9D7C030237F48AE580AC0E_1D3FBDB0C20467F3946D 8C08E88C997A data Size (bytes): 390 Entropy (8bit): DE09CA7FA664B2E268A E 6A0EB CD4BDB D269AE839DE71 370EF9E60F9524EDA9A429C9D D5B58A441B985A0B5477B9AE D240D93A CC064F01B064FE720BDD9AB8F9DB F321A0836EEC98D28AD10CED5013D1EB81C5 770FDB8E509D4FFE5429CA821F8EDEC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A data Size (bytes): 270 Entropy (8bit): AA8B61D83B836538DD74EC8772E DDC204411B D5FE2C3D36210C52D64 DA658C56E7687BF2E49F4A297DB5D951BB447AF C7BFB2FDAAE2E8AF E40A8E801F41E485B4C6EA41B0BAA5CC4833D807834AE4C290EA08EF87243FF836717DBD2C9E4F1DA08EB EED05784C8240BCBCE54DACECBF8DFAA194FA6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A6E643304C5FBB7CBF4025F1978D6EED data Size (bytes): 236 Entropy (8bit): E4220B4C83C178A5EE370F56A2D58F25 14E B8873FA921162FE72B4F7F9B46EF0 4435A6B73BA AD8F374FD2F1CFCFA36437E8D7F98E099E3BD3BE6A880 FEE2258F9002B0C95EC6983BE5EC5D6BFC03705C4C03C33F6DDB4F2C43BD3CF966F7846A9AD8C1E892FBAC156 7DF2D594F601254A6246D9A632EB39CD3D0D5E6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A9E4F B52012CE8E279D314C_E27CFF85F206CF55AF304E A 15 data Size (bytes): 852 Entropy (8bit): DEF8C9BB8B3028B94B001CDFBF5E0DB1 7AB35FD904F2F D916506EABE833F3849 1C613ED4E6370EA8B3DB84B5616CC588C3F7A6946C215CF48FB A2A8A 3776BE310348F44B0AAF75F018DB2DAD9ACE3AEF01E89C2CFC1F2E B0B99BD80B B34B605647A4 8E1EF8B4B86A08AE8ECE081EB895D Copyright Joe Security LLC 2018 Page 27 of 392

28 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D data Size (bytes): 236 Entropy (8bit): DF677EB1B57B1E8CCB700D536408F6D4 1B A D4EA E795170EFB D45165E79D3D689B1616D64726ED856E1FDC4123BA3A0440CFA02A4AF1EE1225 9B15FF6371ACA1FC ECD774DC35843ED7103C608C9B381A9142B0B5B4B9EEA48CF6C9ACA119EABE26E 9BA0FBA08F5CB7B5CC9E6A110C34638EDCB80BD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data Size (bytes): 804 Entropy (8bit): C88EFB2B3DAC706F604467D421B4E 9531D66CA8796A182DF74FE22FE AEB54B A41A982FD4CFB11FD58D4E0B8FDC891C4F88D55886A74E453F186ACC0C3983C8 5A1B77304BD4758FDE62F B21E90FBC5042C5A15271F4B00E2735B0BC8CDBB37C85A48372FB93B2E7A C9DC490D899F900BB6780F2527FF69F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D080F8FD8CC1905DCE0E357DE704D67D data Size (bytes): 226 Entropy (8bit): F3670F02DD4311AA145B2249C59791E C6A2F5270C600389C403FBD48D109BED20819C05 985D553A16EEAFA6DE46AB5E78B5E8DDC652C091459F2EE B3B1D79D1 D08E0F0D7C213180A2E524519D6FFC9389A4075EE40104D FA70E2C507D259D58928A A8D5FC8 0A5BB8FCA92055E851F76804F563CEC57836 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB90709B4_C82ABCBFF5F798932E6A A48E5B0C1C95 data Size (bytes): 438 Entropy (8bit): C0DEDF30810B03A2C69E429519C2CFC D24744B7FAC817841E0139C833FF4226A9A9E1B6 4AA4F5E1BC064E BECF080C6BBF90E868459E0B7A5D23B1A34430E339 5EFB4509EE982AC690179C4BF436DFB6D7989D4EAE87418FA1E2DD279A6C7FC7B097BFF4BE7F8C5FEF369D0B1 72B77BFB8C2B1E55C33CDDE30CA F4D9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E961199C820C769E8780DF5E0A data Size (bytes): 210 Entropy (8bit): EBBF95C50BCCE0E2CD1BB3C8FF 4FF6915F833717B6AA670AD1B764E0C87F854CBF AE135E699F9ABE756EB22E5F95F2D4F1D4F480961A503000A B6 Copyright Joe Security LLC 2018 Page 28 of 392

29 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E961199C820C769E8780DF5E0A BD FBADC7E6D4020CF566379F32D5C9438C2A81DDA9367E03D031322EFD75E840C015C8CA DFD815DE3B9D8E78BF5DCD3C DA13E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5 AB data Size (bytes): 426 Entropy (8bit): B537F0BF489175FBD A228F88BCB C3DDD B4 C6DF345EB9AF3C4A3F8C18585DE1AED785E7E6BD0E15BA48C4ED9FBC597031C D00BDA31E3C28F943593BFA5E933DDA237F3974E758935A615AD9AE7A5F5DB9F5A090F26DAA29 C03DBCB8EBF3498F0E087FF6B88785F90541D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0060A9F B15AB61E0E47645E5 data Size (bytes): 252 Entropy (8bit): FF442DFCB9409E6EEDA62B73743 BF39015E95E245AE45FE2E22D79D96B1D0926C49 1E550C13D601C5C089108DB7BCE9E1D8D A E2CA4701C998BD D B EC04D48D590D686BCFA458D7CC10F0920FF9B046B4584A77BF2C971B376E5896CEEA0 CB9F46500C7FFA BFCCF815345FD70B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_D0021D188712E9DC384A4B357EF70F 08 data Size (bytes): 386 Entropy (8bit): F2FDD606387ED8D6D86B4A2F C0DB742E72564F64A4A7D08F81B7D3233DC4D ADD2828D98DB185DA237D5EE65029F250AA6039EA8FB7A078A356A8D BD82364C23C2FD9D6FF4A2CDE3D17FA688CCE91C915740EF9A698C3FA5F94B529644BC830F4A5BD35CAB 6485ADE B7F021FC0A6355BCC467CE91 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F94FD5F2AAEFDB A4E9 data Size (bytes): 236 Entropy (8bit): B1493F7FBCBF047C82BA2799AC09AE2 FEDE945BDE28212A4607FE198E74AA0D4B4260ED 7063EEEC7BAB8A6BAF1A068DB5649E4DC86DD2D26030A16CA76FBB8B98294A38 3A356F3564D7A2C2BE67BC8080E7E671F0E8F27E3E649816A3BCB51959B8669AC9FAE91C425AB63205C36388F0 A4A5066EB23F9736A1B05FC82BA74BE C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico PNG image data, 16 x 16, 4-bit colormap, non-interlaced Size (bytes): 474 Copyright Joe Security LLC 2018 Page 29 of 392

30 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Entropy (8bit): B296C9568BE4B40F DA56A3CE F4B7D1E31B78D81A F951E27745CE921CB 27D67BA98E8641B6A8B5BB9CCDA13FAB5B0E0C8D231311BD39C4915DC71B3159 AF25BC3A74CF1B4F914BB54D65A834020CF81DF369B6892E546EF51DB5A58769B44BA2E33C7B29C3D4B23454F7 5007E9EB88F454CF51459DB2099F361E3272A9 C:\Users\user\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms data Size (bytes): Entropy (8bit): AD984F418E87A8AFD398C0E A0 C2CF F5A1D03D6F9CA8B50B180F DA5D7CABC72351A8C72696F A120B522BD8F3C5FD1FFF23973BA04 AE6CC8A9D89A186B00076B7352F54A B0F8A04C176A208C1EF55EA9A205C4CB48D C FD9B3CDA949EEA3CF7CBB AFAD4 C:\Users\user\AppData\Local\Microsoft\Feeds\{5588ACFD B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms Size (bytes): Entropy (8bit): Composite Document File V2 Document, No summary info 789A8C45ECA7CB07DF0F43ADFE03B5BF 326A179AD6E7ECB890CE40CC20AF94A7CCD408B4 4DC0D17E322BFC26E5D09455AC2D0431CB6AEB81EF2505B9EE14A CC1C C47066AAF60BE27E1629FEC79CC DB2D753D8F9D0476BE0C783281FD06E9D63BFD136D67E7598EBAAAF E0A D98FD6B796578CF38E6E C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\VOM8QEN2\ Size (bytes): 117 ASCII text, with no line terminators Entropy (8bit): DCE6287ABC9DA240D2140D0ACEF3D0 3B8FED97CE6B31E0F1AC3D25AB1C3A30E B4E474A CD8864DDCB74C526279C AD14C8BBDC0C112C50 9AFCF8F4835D2DF555AA99FD879EA404106D66EAD5EC063B81145BE286E32C5600A6411D0D0ADBFAB274BB605 ED EB7F9EC99E591B120593A850D2C01C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE Copyright Joe Security LLC 2018 Page 30 of 392