ID: Cookbook: browseurl.jbs Time: 17:57:53 Date: 27/04/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 17:57:53 Date: 27/04/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers HTTPS Packets Code Manipulations Statistics Behavior Copyright Joe Security LLC 2018 Page 2 of 125

3 System Behavior Analysis iexplore.exe PID: 3336 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3396 Parent PID: 3336 General File Activities Registry Activities Analysis ssvagent.exe PID: 3504 Parent PID: 3396 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 125

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 17:57:53 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 7m 39s light browseurl.jbs CE2/Meet/brooke.anderson/836Y08WG?sl=1 Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.win@5/163@25/9 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Failed Failed Copyright Joe Security LLC 2018 Page 4 of 125

5 Cookbook Comments: Warnings: Adjust boot time Correcting counters for adjusted boot time Browsing link: ommunicateanywhere.com/certent.com/ce2/meet/brooke.anderson/ Real link is: mmunicateanywhere.com/certent. com/ce2/meet/brooke.anderson/ Browsing link: ommunicateanywhere.com/certent.com/ce2/meet/brooke.anderson/ Real link is: mmunicateanywhere.com/certent. com/ce2/meet/brooke.anderson/ Browsing link: LinkId= Real link is: d6f323d-d0d3-46bc-be73-56f7abe5265a?ui=en- US&rs=en-US&ad=US Browsing link: LinkId= Real link is: us/article/join-a-lync-meeting-5b f2-407f- 9b17-cd40b83c1681?ui=en-US&rs=en- US&ad=US Browsing link: ommunicateanywhere.com/certent.com/ce2/meet/brooke.anderson/ Real link is: mmunicateanywhere.com/certent. com/ce2/meet/brooke.anderson/ Browsing link: ommunicateanywhere.com/certent.com/ce2/meet/brooke.anderson/ Real link is: mmunicateanywhere.com/certent. com/ce2/meet/brooke.anderson/ Browsing link: ommunicateanywhere.com/certent.com/ce2/meet/brooke.anderson/ Real link is: mmunicateanywhere.com/certent. com/ce2/meet/brooke.anderson/ Browsing link: ommunicateanywhere.com/certent.com/ce2/meet/brooke.anderson/ Real link is: mmunicateanywhere.com/certent. com/ce2/meet/brooke.anderson/ Browsing link: LinkId= Real link is: d6f323d-d0d3-46bc-be73-56f7abe5265a?ui=en- US&rs=en-US&ad=US Show All Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3396 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 5 of 125

6 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold true Classification Copyright Joe Security LLC 2018 Page 6 of 125

7 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 7 of 125

8 Click to jump to signature section Networking: Social media urls found in memory data Downloads files Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 8 of 125

9 Behavior Graph ID: URL: Startdate: 27/04/2018 Architecture: WINDOWS Score: 1 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend started Number of created Registry Values iexplore.exe started iexplore.exe Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious img-prod-cms-rt-microsoft-com.akamaized.net statics-uhf-eus.akamaized.net , 443, 49232, XO-AS15-XOCommunicationsUS , 443, 49227, XO-AS15-XOCommunicationsUS 13 other IPs or domains started United States United States ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 17:58:45 API Interceptor 7202x Sleep call for process: iexplore.exe modified 17:58:46 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link az vo.msecnd.net 0% virustotal Browse meetings.sfbassets.com 0% virustotal Browse Copyright Joe Security LLC 2018 Page 9 of 125

10 Source Detection Scanner Label Link az vo.msecnd.net 0% virustotal Browse lyncweb.ucommunicateanywhere.com 0% virustotal Browse login.microsoftonline.com 1% virustotal Browse meet.ucommunicateanywhere.com 0% virustotal Browse statics-uhf-eus.akamaized.net 1% virustotal Browse img-prod-cms-rt-microsoft-com.akamaized.net 0% virustotal Browse support.content.office.net 0% virustotal Browse ajax.aspnetcdn.com 0% virustotal Browse mem.gfx.ms 0% virustotal Browse support.office.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 10 of 125

11 Startup System is w7 cleanup iexplore.exe (PID: 3336 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3396 cmdline: '' SCODEF:3336 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3504 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): B58393F5EAEE572D1CCDF00885A6EF06 B4CC916C296DA69AA30A40B781A2B F43 E82BA7586AAFDE5A1C593AEDF61FE1B20F8A6096ED400ADC314D495B90892A E1FADBDE79F AC1776F3F19B259859ECE94EAACE5930D103DA0BB4750A189BA1A9B42E8538E483 E362C4AC5B E70307AC27A95968E79BB Copyright Joe Security LLC 2018 Page 11 of 125

12 C:\Users\HERBBL~1\AppData\Local\Temp\~DF130E624C8947FE65.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): B5BF934B9A7B24EB6FFB468086F279D 802D1CAFB5FD1BA20836B51B05E2E0D398AC84E4 5B2C6E79E84E8DF0A1230D21F5804E2631D8BE58EB09E8CFFF A6897 EE5FEC2839FB1610CFA38EAD5AB0449CD329B AF28A F80E8E65836BFF909881A C 2AA90EAAFB3783A6A511E7332EC09865E4BD C:\Users\HERBBL~1\AppData\Local\Temp\~DF B78EE09A.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): E4D0991F9FC96D203369D81B4B7694 E7E1F5FCB0031DC2312C022DD9DB3B154DA7B178 2A3259B3136DE74DC D3F09C788D5CF31FFDB548A37E5904C8BE8AD6F B1994B0F92FC3DD1834E99DCC34C6F08841F29BD3CD6EE F27ABCA974F9B0B265B2757AE881AB0BA9 D23BB5C8601B291B8E70ED5BB49C25EFF1C595 C:\Users\HERBBL~1\AppData\Local\Temp\~DF6FDB52C81DC986B7.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): CD140D6B3456C59D4CF505B0C66ABD F1D DDB4BA0C3A0F07C5FBF558 24E12BD47CE2ABB48761BCC3A2FDC A955C2D85F7EB3C5570D46F5F307 13C37C5B226F39E3459E0781C2A75CF9DC8FECE0ACD4707BBFC862A29DAA3929B569D2BBF41B0D77172E0CA91 09FC3C834C7172F8CCEC522E6390D2A49BC978C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0177A2B8C3D D69E6BD54B0_3716D9E6C5C0BA820AA1A 0A430B2BEBC data Size (bytes): 1831 Entropy (8bit): C7D172A60B0E725ECBC8602F5FE1E44 CF89B9B04CDF498F21BF5B832EF60099E EF352CFA F0768A9337F1668CB81EBD A94D714D7A1881A5 0F51E8305D09791E898094C6E5DBA3188B516898B5B7BB48474E CD5DC870FC21FC8D150CD94C2362DA50 38C2207D66678B452964E6D70ED1F6D912CA1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ DA7B23A0B8C1E6C396DBE1E data Size (bytes): Entropy (8bit): F71810CE4D1487D935C695BF 8C8E24DA028B07F30AD8309B077BCAA2DC88B9FC AF6996BC899D09F7A BBB966B8C5360A0F4768D08209ED175DC172FCC0 Copyright Joe Security LLC 2018 Page 12 of 125

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ DA7B23A0B8C1E6C396DBE1E A985CC82B0F34AE73F03BBE33BC6A22A2E79BC6E1AFD8D BBC75117D42FDC2FBC2D E32731AD B32B123C502461FB9BF3269D49F3742C5EC2C60 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\242D23DDBD947BF510369DC41BEA052E data Size (bytes): Entropy (8bit): F71810CE4D1487D935C695BF 8C8E24DA028B07F30AD8309B077BCAA2DC88B9FC AF6996BC899D09F7A BBB966B8C5360A0F4768D08209ED175DC172FCC0 A985CC82B0F34AE73F03BBE33BC6A22A2E79BC6E1AFD8D BBC75117D42FDC2FBC2D E32731AD B32B123C502461FB9BF3269D49F3742C5EC2C60 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ A80F F6665E92A12 data Size (bytes): Entropy (8bit): FA25050A7C38669A6A07F4B044F94E D488D608CCB17E7A9408DA87D3C C6C2492FAB6E7F E21C8B0424DCE78B08E5E69AF2190E6FF9420D9F E424FBD721C947CEC6D56C AD4272FD97BA53D36AEEB4670FB AEE D780C3711AF2E6 4DE31C D45E6AB509E731296BCB4F93 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, 6497 bytes, 1 file F1AB BD85220BA8C7E4217B6B C3B3A27FA A1BBB7102E45AEE2ABC09FB 7A35AC3BE379F28C2BF459E7897C331B7512D5CACC14AEFE8C814595A942A427 0BF4AF9BA99EA802DF7A886983C32BC62326E4D35A8FF5A0B1BE13F018B7643E9D3C2862DDD291D6F3793C E9A9B0D3263C397530CFCB9AD92C02278C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 531 Entropy (8bit): A997FD2F832622F036EC06CF4D1B8 A06195E325B099682C20B0564E C8A9E38CA6AA009D91D9AFEA85C004376DCC9CAC165B8A06D1F873A94CEF FA3BEDDD54DCCF4188D333DB38A3B468400C20765CEDA C4B43846C DB306890CD562CE3 B D9FA9C67660D5B12CA940E0EE023 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Size (bytes): 471 Copyright Joe Security LLC 2018 Page 13 of 125

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 Entropy (8bit): F0210FCA CC216A E2 D10B86C6F353C30D98B55BFCAADD40E7D493397C 397AD878DB2D20AFD65BA634252E B089E1C9526BD D1221F9 C5CA0CE0D36CB0716ECC6E37F96C261EF4E992C6C6B03D7EF703252D5494DE7AAFB222089C8BEC0A52ECD39D CF B994898E994C7D29C8C513BB690DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 471 Entropy (8bit): B888F6ACEDF622DFC0182A8197CCE4 F96CB2A18EDEAF9CB9755EDCF5ED77ADDDA02F32 C0DCF3DF26FEA5DD85A9429DE3A8F1AF2BC34FD092A21A951CE08EDE2B44C9EA B96343B16789B2E97AA678E14F73F72FB8C28841CF93F0B2C63E2ED9CE53255F5BBD8EBA101405FEDBD2 CDA0969AFD5DC254F22DF179E50BD5E6F208E9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD data Size (bytes): 531 Entropy (8bit): A997FD2F832622F036EC06CF4D1B8 A06195E325B099682C20B0564E C8A9E38CA6AA009D91D9AFEA85C004376DCC9CAC165B8A06D1F873A94CEF FA3BEDDD54DCCF4188D333DB38A3B468400C20765CEDA C4B43846C DB306890CD562CE3 B D9FA9C67660D5B12CA940E0EE023 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8AD 6 data Size (bytes): 471 Entropy (8bit): B6A7BE215BCD8D001516F50FD1AE913 54FE562E171BDAA173ACF95AED41145D7B95604D 95DD878029D66C5A0EBB878C3B0F4E725BA0D D6B7DFEACCECDB1F7EB CB26AC293AED8B48C92DAAA17CF8C6E61B68C45FD00E6B780DC69BF68FEC11A5D966D709A0015BD AA5 FDC79647C40DF15D443925CE08E45C71F603BFD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4267 Entropy (8bit): F8216FD354CA2C606769D95731D45B19 950CA8F6EE3A EB8BD1CF170C259D80 68B74DD2A491A8490A6DCF99AF4AC4F E712F92545DF678962EF2D903D 2E19E49E10747CCB526591CDFB4BBD7F0F55B8BB34F1C11509D130710EDCEE87E4FB313BC74164D4F1F1E1F91A F6ECF30ADB8A AC072D EC5 Copyright Joe Security LLC 2018 Page 14 of 125

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\96385D66FC0D184E05CF52F82EF524C0_211A310D4F931FB5C44BEAAD745DED1 5 data Size (bytes): 1831 Entropy (8bit): F56FB20563D47B64289BF42E50FDF62F 6E27AD92CE6A329B0F8F6871C89C120E1E6161E7 3BC FFE76260EF23C96EEB0D9BEB44419D6ECFE6459D A1A5 067ABC32D36B6D8CE5F5578C8BFE3A9D46408AE5E87064CD7E7A732A2E41F2A41FFD27FC94D86E8554BB3169F4 7CD600FD600439E3B6B428ECD75F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A3D5BF1283C2E63D8C8A8C72F0051F5A data Size (bytes): 712 Entropy (8bit): D94F1E22F1BD768583C33CA604B04C7F EA77754E95A8A083F2624E68D87D6BD747A0A138 23F85655DD756A38954FD63F2218B4F6FA6BBFFB5467BA02F3143DC7E4CD36C2 12FB2B5E831F474BCF2153EE7EEC2C727B2570E ECEE0DC4C03B693B03F1A79BE4E E638F4 E4DCA79C364E BAF5CA94258BA246BC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5D328B175B1E9E E842FE47D data Size (bytes): Entropy (8bit): FA25050A7C38669A6A07F4B044F94E D488D608CCB17E7A9408DA87D3C C6C2492FAB6E7F E21C8B0424DCE78B08E5E69AF2190E6FF9420D9F E424FBD721C947CEC6D56C AD4272FD97BA53D36AEEB4670FB AEE D780C3711AF2E6 4DE31C D45E6AB509E731296BCB4F93 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0177A2B8C3D D69E6BD54B0_3716D9E6C5C0BA820AA1 A0A430B2BEBC data Size (bytes): 502 Entropy (8bit): DE4A57DBE2AFD6AE9188D6A A D E6CB799F89FF541C9 F0F561C2F A4FAA6C31BA36DEFD46FD3C8AED99662D35CF8D1E50131A6 942CD A2EE451E945AA93B8AE002A4ABCFE4A3F894A37DDE86FB8609A98FF20832A3A673A7E4028A805 85F08D30BC02EC053B5F F92B9A1AD57 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ DA7B23A0B8C1E6C396DBE1E data Size (bytes): 264 Entropy (8bit): Copyright Joe Security LLC 2018 Page 15 of 125

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ DA7B23A0B8C1E6C396DBE1E 3C4ABC0962D B11C20D37C4BB A CD5FB7441EF378165D032D3B1CB C1466E2C491D402D38F032A4762AF9F64ACCB888BE9ECD452B8926B4608E03 B E6F4A06EB00B2DC70C B579622E18C77990B5ACE2704F2C88408A0794CD2B32DB6675D968340D 064FD29DB C68D646240C4752FEDE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\242D23DDBD947BF510369DC41BEA052E data Size (bytes): 268 Entropy (8bit): CC AAF867E00D1607FD56A0D7 D CF71AF547EBD7FCA90AA7EADA796 30F0706E33462A591D2439CD FE000B3F6B20E0E2D6FA34E955E2BD4 B834B871716F3262BBF492CFA030F0F395AF8D397791C4EA C095C66A5F5312A5FD6915BA5267AEB2BE09 EE46855D4A146869F E97D1B7EB9DD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ A80F F6665E92A12 data Size (bytes): 268 Entropy (8bit): DD39B7C49D19398EE445BB2783EDEE5C AB6A626E915B381BC392C0EB5A5A50F0F378C0AD 62FA6DD37CE3FCC4B615AEA9F01987F7E63AC4E7BB797C4CCB9403D75198A114 6A434EA789A73A1D7DA93C054C04270ADA6692C66338D7E546CAE1021E0CE05D1739D76FEB0042A8A9036BCC84 CF A8E5E8EB9226DD5AAAE076AC2F5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 1026 Entropy (8bit): F12C705BE72A584A5DDDBCB9151ED803 2F29A63652B85BFA4262D5DAE86422ACFA4A69EA 62CFA4560E18007D7783F906CE807D317B547D267C5544E5238D71C6B3531B56 566EE3EBC2D B109C1F5C17A009835B7B01563D11521D5FA1A8145BF500B329BC659801BD22B9FC6C6C BC2FF04EEE5A14AAD9C2472F89D2A195 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C data Size (bytes): 242 Entropy (8bit): CB2461CA8E59A6624B3E4B77DE7 B8C39AD14385F2843ADF3C9E3C4BE890998A06EC F0E36FE15AECBB7F0DBC E5C824AD847B12CCF19D98E033D34D15EB408 BBE0DB4C4E2220C90420C407311CB4C3F246503C638F2F6A19BF96744C9287DD6E7DF8670D638F79E D7 5440AC3223B2B6F76B56A36E588D74248AE31 Copyright Joe Security LLC 2018 Page 16 of 125

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 data Size (bytes): 868 Entropy (8bit): CDA5B7BF0423A7D8A1683D6 6B6E6B773EAC7A0973BAEE2D9D5A9B9B9D59AFD9 2617D1EE9ABB C A9124B05D9EF3B3448B31F30D579C1C4F0 47D7B95945EE388CD962D180102CCB2B7EAAFA3C E64C8245EA621BDCC842DD21FDC89273C372F49BA1 FDECD6BC81EE AB0A40EF9B96CA0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 438 Entropy (8bit): A61E93B F22AD0F6C24600E0 E1B7389B829ED98F0BAC2CD BA792886C AB07E2194F04F08E0C AB9956A0EC285F9792E0A85495B CB641 B5F943BBABE12D D1C433FFB23497F3292C5E310E B1B387FC21D3A0E89D3CC4B5009B28EEF AFBB6E5D3835DB5A35E0145A1A6E03C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD data Size (bytes): 216 Entropy (8bit): A643120E1615C216C6D10657A050CA2C 6C5E7D90C518FFFBAEF14C23B20AA28CAA8F9D7C FC7FDC A5BC5A1F2AAAF456CAA80BAD4EAB45E240EE4620D8060FB3EE 71401E14CC2B8E91525E51FA33A1F8CF815179CC64FA6A9B1071FAAE1803CEB098181C A2CA98AF8A6 32C8E87F29BD81EB6CD9E1C4ED4C65C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA C8D112023D8A7A8A D6 data Size (bytes): 868 Entropy (8bit): B2CBEFA617A02 6E44A4946F7D4ECA6962D B263F130E326 1BF9666CEA21DE901C721A8F5B7A3A F15633E71CE53A BB5786 6D0BEEA4D3EFB4678A231C70DF8B240F84B196F037F3B5EA9156F58E56FFCA5CAD053B2873FD7B952A3F4B9FD A71C2965B5A0445FEEDEEBD55CE54623B961A4F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 224 Entropy (8bit): DB09B9027D1DEE434E9884C0741D7DE2 BF7F8B23361D4EAD91FBA CB859FB072B3 Copyright Joe Security LLC 2018 Page 17 of 125

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F AB DCE7AC71A AAD9A9AE6BE4BA8AADEC2E1F8 6B2F17C856047C7589BCB4E6D2C2B9BCD9DBFFD7E7EC7126D7C9E E624EA779DF754A831A8DD3B58E8 1B14D8AEB9BA62373F889F489B9A06D098899F4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\96385D66FC0D184E05CF52F82EF524C0_211A310D4F931FB5C44BEAAD745DED 15 data Size (bytes): 498 Entropy (8bit): E6B12B8C3D377C5AE29AB2CBA7D1239 B8E89F129D01221A9E4900A8710E8D653DA5F893 01DBC3236FB E1F184E8D9824A90D3D30B342FD705C D5E5B 1CE08506A42651F3CFCC3C6242E27C E9BED808EC48B7879BD1575F52F041EBE312E52AF71C5B30E2EC3 84A3B069DCE3398FABF765A59D0A205835C1AC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A data Size (bytes): 270 Entropy (8bit): FBC0261FB2C166B7EC8A352A C7439D5C3A FFC3DE710C DC 318BC40B9B44C06AC24FB6B5D9728B37D9DE34ADD4E39566EC B66C0A 8991B0874D9F9AF754A492D D8D5E66634FD52A5BE526FB0F65DF167405B5247A1689AF2543D4C3D1C0E E19EB4D66A0245FF77A971F952E43C6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5D328B175B1E9E E842FE47D data Size (bytes): 264 Entropy (8bit): B924AE1DC15B672390ABECBB2735F9 180A6EFB4B5C4B66FF90E8607F4FEFEC3848C463 C42A8AC1D52934C050F3B181FB4FFB D A11DDB8C7ABA4F39BB 1A FB5C5A15961E22F5B400E FD842905D316AA306FA8D563EE9C413A D4656BC6C80784 DAEE1E3384B90F283E4BC3BD8233CB669C18 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\100W99RU\lyncweb.ucommunicateanywhere[1].xml ASCII text, with no line terminators Copyright Joe Security LLC 2018 Page 18 of 125

19 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\100W99RU\lyncweb.ucommunicateanywhere[1].xml Size (bytes): 13 Entropy (8bit): C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 35E3224FCBD3E1AF306F2B6A2C6BBEA9B B71E4D B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB 6BE8CEC7C862AFAE5B37AA32DC5BB A DA41BF808A4EF92C318B355E616BF45A257B995520D72 B7C08752C0BE445DCEADE5CF79F FED C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators ECACE7E808CD8FA0E0787BDE09832C0C C570F615D6BE9A28A73D34A73F42636BF5 B496A9E118B1CEFF59F13EB3FD2C4BF6E3B6D0398FC46C5BAFBD60D08CDF55BA FBBFA958C2C616EC2671F8A691F77AE66EFE0878DD49224A7A1C45A225A65DD0BE08D3E63E86B5D2290F6636EE 5C0ACB9C928E86C25E1BDDB9B5B1FA A C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DCAB9FE1-4A33-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): C88B8D38C12A5FBD1DDCB62A43C7D1AF ADF8FD44A110641CFDA3BF50C0CD DCC616E99286CD61FF07D81D69B5600DF8DB5F4B26630BC5C720D7050B04F A25E0E8758BDD A93D04AF4E0AA80EA72D936ED324D3D8964DF2B7C5E4326F0A6855F8AA00E9 DD5AA122EDCFA11F1D42E903C5BF868A6A64F C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DCAB9FE3-4A33-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): DA5A29C9657D3648E C2A0FC A6734CC90093E505DB26418D F F26FFE2ACB8728BD84A6D D98C3E6A722CEF96521CEEDD8BF31 5D6C12E7C1950D5EDC050724C3EFEAD018870D0C5E2EF16BFD1A3EF F19CFA2CE8589AA358479D21CF7 A773D9C1219F B557D912B6D2F27322 Copyright Joe Security LLC 2018 Page 19 of 125

20 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E684F340-4A33-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): D2E4070BB9F D609A1E7 78CACAB9F19EC07F4777B9A03580E7EF15648D29 A49E4F3DF41C84D5609FFD6FF64E9725AE6E6CC12B612279F CFC9 2637AF57B6D9E593E28CCDE808F66A8BDF2D023DFBCDCE259DD4B357E25DE44F2E59A786B9047AE16D52F86D2 3BD05BE5703B0E D BF7 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver537E.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED9 70E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver5A6B.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED9 70E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data Size (bytes): Entropy (8bit): F8CFCF8119ED DDC9FE37C137 C42078EB5C560C97671B410CA67E0F939D49C013 3ED8ECD B986E2CB417BE6324F3F34C956CA3E F38DC789A77E7 B624DC CA5F1430FE4D40FAA64ABECE924CC6A9BFBD7A9F0FC093D5978E764A47A167DB158978BD2156 EF5F5A07CCB9AEE39F0A6CD1FEF7ABB3F8CB9DE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\836Y08WG[1].htm Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators 07E26F F28873F54A76E3811CA 7BA5487FEA800477A F0800A18CAAB8B80 97CACDA43541DEED199B03E3495FABEC967F7FA27DC233CCBC23DBD95B1E1B94 DBC5559F301C41920F8B462A59E6D578541B25DA2C75EA079BD61C9B7CCA00B0982B40E05EA37D3468E6C ADEC1E050A A5247C1F535B8E521E3 Copyright Joe Security LLC 2018 Page 20 of 125

21 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\836Y08WG[1].htm C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Button_normal_bottom[1].png Size (bytes): 2915 Entropy (8bit): PNG image data, 401 x 7, 8-bit/color RGBA, non-interlaced 7CE40771B2FCB34AC9057DD2DB2CB214 B46DCE04D164258C9F36DD383E8FD32FE5D5ABB7 ACEAA9210AD61C7F4E6FDAA5B2D00C39F38535D BD5B A6F9 1241C34BF6583F1DF6A A21097F5AFD7A1579D41CB12392D CA19C A8AEEF9F264E8 6C8F74BCE49B13A283EF10DDFF2EE3A0DD33 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Help_19x30[1].png Size (bytes): 405 Entropy (8bit): PNG image data, 19 x 30, 8-bit/color RGBA, non-interlaced 1399EE28C34558EAB629F3335B51BA54 89ACE702736BC406F7A40A4DACEA569A831E CFE01B4FDCA FFA60A50F01ED37CEE88F837EFBB5B2E25E35BA7E 4FF05DC42D6C36FFFDC5A864C98A4904D052A119467C1E515E556A9EE3FBFA63684EE BB3D1560B585B65 F6BAEA94B1F8B506570F14DD415A252A174AD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Lync.Client.PreAuth.Model.Consolidated[1].js Size (bytes): ASCII text, with CRLF line terminators Entropy (8bit): EF0B DD6FE50C11D22257E24B2 0F1492B2FCA37768D35F412F52D05E5492A8A5E0 BDE3246D5B8103AB9AE303B2B6DFAC2B3F74F0B488ED A3D127D5597C6 6A6ABE9462FE85DDC6F4C2BB64C84D26BA9894C965C51EB22B3066BBBAF822ADF73755B8E6F01C5E2B8E13CE D4158B56C16163D C D7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Lync.Extensions[1].js Size (bytes): 1426 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators C3F3180B4B65771CC97D0E89E4AE7346 A98CB5EF7750AE4FC881C7DE1965A34FC6A80AC A48B68D9B09E5BF7F2A4EFA5C2AD981155C95937E06F75D619C18AC51C FA0A8AF9E85ADE9A8E32B6386B6CBD541D2F272D54258D0F42A2A74B B7ABF79E6B6F378C56CF743CC6 366DEBD296854BA105FE88CCCF7B38CC5DFAEA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Mainbg_bottom[1].png PNG image data, 500 x 88, 8-bit/color RGBA, non-interlaced Size (bytes): Entropy (8bit): C F D16E8255FAB Copyright Joe Security LLC 2018 Page 21 of 125

22 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Mainbg_bottom[1].png B4E9CCD7D90BC3C2F775086AD0AB57B178E6F24E 29E15FD603293C5F4DA8041B0038C43DE94AF176DEE6D6BD91EAC F6C 6F06F2DE9B4D84CA2E881BEB29DB5E9B F45BC6D6CDBE97C4F561178FEC8C584B2F30F8C0CC A 46992C7AE88A C5E95DE18A793FB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\RE1Mu3b[1].png Size (bytes): 4054 Entropy (8bit): PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced 9F14C20150A003D7CE4DE57C298F0FBA DAA53CF17CC45878A1B153F3C3BF47DC9669D78F 112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960 D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF ACC2B41DAEFC25ED38FCC8D96C FED35C36A5017A11E63C8DAE5C487 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ReachClient[1].css Size (bytes): Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators 6F15C21982C03CCA38C8B400D8C5D061 D65B62F2D31AFC3086C6DFF74BCE8DBACBA BD30F121C42D85408DF0F9D53B646CD03F5A4B2903A6FBDD9C002942FB8E1B EEC84AD5EF38A5E0C4F6ACE9802A2B7B3C65117F3DFDCB11327B5AB015F941351E8B8ED2A67DDF52ECCB0EB C34D4BFFB46A1C23572EE587F1A9ACA1C77F0FA41 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\SOC-Facebook[1].png Size (bytes): 240 Entropy (8bit): PNG image data, 25 x 32, 4-bit colormap, non-interlaced 44352B4A87345DCE6414CCA0F E7370B22BD5C767E295B33A02AFA10C24FE6 1E6A1DB4E61EFCA3846B5A27F5ABB9ED776B935E90424CD55AE1F2CE92D73E15 85FD6F89DBEEB4CF569E8F5FC1CC4941FD0C9953E58F0AC9D9C4C08D8D4EA1192E74E77F22ECF2A357856DEF0 946B0C1DEAD44186BA25D963E63B91DF588CEEC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\angular[1].js Size (bytes): Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators 1A FF AC B2B68A24C742CE F B A94F38626CD1DA293C9337BBBE4A2E2560B5AFA8FBAFE805F4C14E069E05F5A7 5F AE864F824EAE991D37601CFDDA12667D9DBD6D0B A70CAA6B4B6E2444BC90B2A75A88F 149CFBF3673A5BF5ED2CE7C13CA324652EFCEB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\articleCss[1].css UTF-8 Unicode text, with very long lines, with no line terminators Copyright Joe Security LLC 2018 Page 22 of 125

23 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\articleCss[1].css Size (bytes): Entropy (8bit): E4469E4FD85B448BA2D8D9E87A2 8F16E1D5423F476F50D2DADC9E1AB80125D6E301 D04A0C20A62A88A7DA8F11A C207307CD1C4F70CBD6F7553D52AAEB6 E920E22ACD5D AA535A19EC1A0E13C680970DBCAF4CBC4E4F05A9AB9E7B71F34890E47072D2F AEBF1C2833A4FC35EFB8E7CA6BE4557F5A43 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\backgroundauth[1].htm Size (bytes): 227 Entropy (8bit): HTML document, ASCII text, with CRLF line terminators 2ADC99387D6A36F9FEA4DF35E870504F B273CE4D693450B93715BCD3F9F6D9CFC2D1E DF87C3A69F485DE5A031E4F29C7A2AB970C842EA9BDC6C5F925945C4D89E9 41BA3AE7E58912A7F4CB06C9C495DC086D7A4D4F4389E4EAD9FF37C05676FD52F67E25C0BBEF5198D5565DD D7BB618AF921216F04F5B3EBABBE5328C2 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\cartcount[1].htm Size (bytes): 1554 Entropy (8bit): HTML document, ASCII text, with CRLF line terminators C18BB907A2CA02C117A87417B2785E F639A8EDD7639F436B553FB44BC19786BEED 355AE0FF4C8516A0D5082E933ECC2957F65FE1BB466BE2BA7DCE E690D 3FBCEFF92D7EF5AE38A63542A FC98800C81116B5A5DA542EC87FAB887B93535EB527F42D255D73BAD64 BACA05E3232A2DF2F88BBF2CFBF2BD72D70564 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\config[1].js Size (bytes): 303 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators F53E65E65E3A2B9E5A0EC7BC7F10B8CB E510E533B2EF4F06E EFFD908E E8E99742C AF37D50A46FE17EAAE0F59768DB7306E19ACA F951F2C5A2C5703ED400C256F5F145A407E9FE504971EFB687E7E1FC61FD7A9886FEBC7660C166C5FCC9B1CACE C B374EAF659797F1C3B994EB3E2AE96 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].ico Size (bytes): Entropy (8bit): MS Windows icon resource - 6 icons, 16-colors 12E3DAC858061D088023B2BD48E2FA96 E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 90CDAF E C605D D348116D198F355A98B8C6CD21 C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0 D349B247EB4912EE169D C719CD01 Copyright Joe Security LLC 2018 Page 23 of 125

24 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\latest[1].eot Size (bytes): Embedded OpenType (EOT) Entropy (8bit): CAD76E4816AF6890C9BFD02A6D1EA899 9EDC91541C31034FCE0D83AABBAAD4C314CD3D33 D D1A062E5DBE6C34C1994C8CE3792B24AFD5218D0644CB1F53DA4BE A5856C2B4D8CBE2A4BD233A93B266A03D E1D1733B33B65AB7A504AF0AC31DE2F1E69F6FF8CCD7 A169CD D34FFF8DE4CB8C98DB2DB2C863 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\meCore.min[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with CRLF line terminators 2EF45C C118F2F012CD0D A7518FA1C5F2E4E88061C40AC9B53E0FD4FBF CF30D6987AFAF5B6021A7D95FACE8B DF816D19C493D5D26D6C31 C1B4CB9C F0E786E9EE694317ACE0972E21C3C2D6D067BE8E546813A F0D993FDBC40F1279A6019 EA9159A767D0CECA4E08DD1552B22F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\meversion[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with no line terminators A414819C7E42384B26F343E6CCE96CC8 A5AE1973C0BDD33315C48B83149E E CDA236F070D02D061A5E178AD92AF01B68D4670DD42F1873F714C3A23328A FBDDCEB0ABBF26EA9EED F9A8D63AE84F489F8B3483F106F850892D5FE843F22D DF832F57E D737A46ABC163ADFEA83D58FFFA97B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\override[1].css Size (bytes): 420 ASCII text, with CRLF line terminators Entropy (8bit): AFAC1FEEA498DF747B3D74F47423C 1D6DE95F95A5D42F7E4430E A0AC37B 1CADDBB14A56B49D3AA8111B0C21445D6E1D93B3EC904E79504C8F154F1EA34B A C7DD9C87B1E2DBF AC80B60A3204CAF3DBCC084C51E746AB45A6F84109AA7179FC F8A62BA82B8716A2EDAE6B12C74 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\skypelogo[1].png Size (bytes): 3247 Entropy (8bit): PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced C6EAFD1732CDE2C1CC9CD03C8971A328 5F31B4C6861D1AB71B239440F13D F5BFE 4FFA109D5A2FA121084C80CF2969EF7A36FA9455D4BABCCF8C174B3D67AF7AD1 D24604A31520B243A923E214D32D69F6F661D8A7BFFAB AFB0C03B75B635D FF005929C7917E9 4CC5E6DF311EB5707DE72F9B455BF960F029 Copyright Joe Security LLC 2018 Page 24 of 125

25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\skypelogo[1].png C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\sprite1[1].png Size (bytes): Entropy (8bit): PNG image data, 450 x 2252, 8-bit/color RGBA, non-interlaced AC1CBA284A8A4D783DDDE10548B9277A D58CEB1CA4EED4F80B5F FE9E2866B427D E8D188EE00A9E66A577C737EC52F05A4F5498E2BA2D1A80BBCB2FB6067BD060A 2BF509738A86B9440CE F81EF4F3CEA73F01B408FD2E06FA0A86DB08F7AE0DE5FA DFFD C91CAB16C32FD2CFBC74E83D4875 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\suggestions[1].en-US data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 9B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\support[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with no line terminators 012FC1B3F1CDCC25E8AAEBCF0AAB0FD1 6520A489650A498F0C09FE9BE183C8C40B8836B5 0441A1DBB403E8E5189CE1C2214F32F10586F61B1E44654E0B008C133CC403E7 C1B15144F684018A6887DDF286594D300F75AB7D0B6338FEE7B2426AB40E4740BAEED1301FA684D05B81CBED24 674FFBA78BF62B193D77CC1EA814A8D5B2615E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\836Y08WG[1].htm Size (bytes): Entropy (8bit): HTML document, ASCII text, with very long lines, with CRLF line terminators CD6358F57027E0D E2B835B1 2EA977A6E51270E5AF5BA5A127DC74CAB7CD4D9E B873F57C3AEA4F1D2C AFFE9C0752DCBFBF069AFE57879D1B43 A37751FDE1C4C415CA AB7CA23CDA93C FEB4107C49E4CCB183F1D8DB70ACD8C88F8C71D5A 877CE019E22559AFB3DC EF6ECFCBE0 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\87-324cc8[1].js UTF-8 Unicode text, with very long lines Size (bytes): Entropy (8bit): E0B8F66791CFBC6FD19A69E2513D615A Copyright Joe Security LLC 2018 Page 25 of 125

26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\87-324cc8[1].js CDF2DD9A937AFCA60EBA3BD0E1547E101BBF26FF 48C18D3E1884E90869C9EFE342D1BE79F556FE6C2EE85306E1B7ADCDE6E01DB2 ED318456C2C3CD169310A4D9688B3B32ED A406478E9F1F09C7AE212F95429A8292EAE96A3C29331C73F 3C0AFF83A96D AEFA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\Lync.Client.MiscClientConsolidated[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with CRLF line terminators E070DA1E02A43E0EF1567E4D750CC465 9E2005E302CDCA09523EA0C3A75FCF8F86CBC5A1 7DB417CD09D2A DD6FDE42C9104E A9492FCBA3F4655C77F D6843C70CFEDB83961B7C4126A5B9C ABFF31D70C04707FFDEEC1FF5F5F8E53631C03AD0A7E E079D0DB3247B12AC8D41C330CEF3AF C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\Lync.Client.PluginFramework[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with CRLF line terminators 177C5D100B3A CEA82D96E38 28E8CC7D56613DF1B6EB9DD35E50C9A8D50DB C003D087439F04C856430B7ACB74B7F6A132AD83E84FEDA189792A687427E 2E5FFDE82624FE6B1386F48FE1A8A9CAB14DBAC6873BC3455C F8CA8A339565DD507FBA976C02BBE D31179BECD4ACE45E EAD22523EF08C1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\LyncLogo2011[1].png Size (bytes): 3307 Entropy (8bit): PNG image data, 166 x 115, 8-bit/color RGBA, non-interlaced 24EB106649E CDC364B3A646F 31BEF1E E4BAB5DE AA E8E4FC75E35EA672E484982D698EFC41910D5ED512E1B68BC E2F48E7417C75183DBAEEAAF8F47CE42EC2C1DFEE3B33C1C4E0E2027EC115227E722EE76F538F867F9384A76E 285B0DFA2DC40F913EBD997B0CFD25B4FF96546 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\PluginLoader[1].js Size (bytes): 7072 ASCII text, with CRLF line terminators Entropy (8bit): E8B9B9C3A758C5AB5E12A43 5C E BBF418D66E9D89FD44EA B25B6D92FD875DA1A130D5499AB23A0E3A6E36F3B678501D73F793C0A18B163F 0BA7E7C7DA39A9C6B8BF04B643FF7B6D9C2F8009B2CDFB2F188188B9F9D67CAB33AC71C77B6FC CB857 B715A819545CE66C0DEF73BE12F7E1B3A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\SOC-Mail[1].png PNG image data, 32 x 32, 8-bit colormap, non-interlaced Copyright Joe Security LLC 2018 Page 26 of 125

27 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\SOC-Mail[1].png Size (bytes): 284 Entropy (8bit): C B9493C12B1B682CAA47F5F2 D522ED9D356837FED083E4D69262C749F4807FC0 8EF6E4F16AE501AD B404AF57871BE54EA8A0C B88EB5DC2B02 F01BF3AB533D6CB7CCF5A26C2F23526BC107B79C9379ABC DC044DFA852E3FF C8FFE756E E9988B758D602AB1FC6756ADEA50B603050FB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\SfB_Logo_Vertical_Mobile[1].png Size (bytes): 4584 Entropy (8bit): PNG image data, 57 x 57, 8-bit/color RGBA, non-interlaced FC9D3A80C6CD0A B D0B DA77138AE0DB2F7EDBAB90CB24F6F062A40ED87D E0F451D53F611743D5CE0FCC77A D5B550E384EAC4CC45E040FF7 F09EE EA84B66DF8ACEBC755AF0C87BE4C93FCF73FE F26BC51A16072DA80995ADEC0C D71CF0FD915D983906ED2F814C7AF633B25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\TopNav[1].js Size (bytes): 1322 Entropy (8bit): ASCII text, with very long lines, with no line terminators DFEBDD6655F1BE6D37481F3928D23F6A AABDF65AF4A4D0CF213766BCA60285C0FA46D05F B846F82239A1E1E0DCF2B52CBEBE5DA690C623D1FCF92288C077E4D335A D575B8E15670B8AE2A5C68C3358A9BB AECA9F278C23EBCB5C3107B3A506628FCF722B1A01DE82C E91D121CE474DF4A08562B457B86A98F9F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\broker-config[1].js Size (bytes): 1717 Entropy (8bit): ASCII text, with very long lines, with no line terminators 9028A04346CBA2AC2BFA8ECCBD260DC0 34CAFE DF1F60DD6CA D5 07BE3CDF452D3F623FA5EEFBF31E19416C94B1C8A7724B1C2EA054E0CEB43667 DB2C987F640F3305A3F61F1E33F4EE9F3AEC0C984DA9B7915D4AC67C8AECEAAEC87AF99B00AD462972E7FE009 2F3328AE5E3471FBD80FAC8F33EA6BFE31EF2AC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\broker-config[2].js Size (bytes): 1717 Entropy (8bit): ASCII text, with very long lines, with no line terminators 9028A04346CBA2AC2BFA8ECCBD260DC0 34CAFE DF1F60DD6CA D5 07BE3CDF452D3F623FA5EEFBF31E19416C94B1C8A7724B1C2EA054E0CEB43667 DB2C987F640F3305A3F61F1E33F4EE9F3AEC0C984DA9B7915D4AC67C8AECEAAEC87AF99B00AD462972E7FE009 2F3328AE5E3471FBD80FAC8F33EA6BFE31EF2AC Copyright Joe Security LLC 2018 Page 27 of 125

28 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\clientlogging[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with no line terminators C2F11119F939504F7F5C786E36BC5B06 FB6897A9B BB49BFE1C10CC 4FAE92C18D8063B6DF06ED4D624E11FA1CFCF4D9307E1AAC D2701CD1 194FF469812EC2E3FACBDB27E2B9BCFC6193DAD222535DDE11EC974746B73E2FDD943601FBA74D1680B17A C ECC838BBE4293E825BEE6AC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\join-a-lync-meeting-5b f2-407f-9b17-cd40 b83c1681[1].htm Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators 58750B3C FDF2E7AE09D5DF8 05C0E7E1697AB7C8D458113DC998E16C9F9A5FE5 745C4612AF2A2CB8EDDC3D73137B4A7DD6B9043B10E94AA43A5E2ADE256F9C5D 88F3762F5A95D604D6094A5468FEDCA9FA38401E3B8F86A6A3E52093EEC51B7434F656F48BE2F80986B33AB33E6 2EA620D7A309738C139EB73544CE60884B0B6 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\latest[1].css Size (bytes): 541 Entropy (8bit): ASCII text, with very long lines, with no line terminators 55052ACFCE9D0D156E591DC89CEC132E 3E19885D190FC69AC BC01B13A65BF4C06 2DE63BB1061D38355AA3F33D35B90D7AA72592B3BC00B650082B4B0187D0A23D F CC8038EA0F87FDBE3311B2A5B95EB2107EEEBBE1032C0CB FB9D90B8C45EC4CFE60AC423AC 0D4D722E9C5C4F D386E095D9ADD6E953 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\mainbg_top[1].png Size (bytes): 3427 Entropy (8bit): PNG image data, 500 x 21, 8-bit/color RGBA, non-interlaced 82AD3911AFFBEA64C3E8684C82ED8263 7ABE17B94D11C17F47EB442DE6E561928E1761A3 BE946CC32C7FFAD1201C85497AC DB0C5FB74EE5573CB7D9963E03A7A4 7A21F060FE78A8F78B994ECE36DC459B006B9CF7765DF84508BD8BBCFEBAFFDED078137F42A1130DC7946A97F 8F4EA3B31917F6EA5AFB784C22CCBE7CF174D4E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\mwfmdl2-v1.17.3[1].woff Web Open Font Format, flavor 65536, length 13832, version 0.0 Size (bytes): Entropy (8bit): F287AE EF CE03F15F 8D A82B9A95E05B08DADB75314FEEA245 7CE1FFCBCBE0E292D6B63C045E0302BFBCEE98C40C1F74685FDBEC2E880E9412 Copyright Joe Security LLC 2018 Page 28 of 125

29 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\mwfmdl2-v1.17.3[1].woff 19B4257E45651BC72F74F6BC B9C958A43818B5FC6EB74E76830A7FC08F20A4E7CB840101FBCD0C0FF253 4C8EF1D088F24F567EC89D0DA28FBA123513E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\strings[1].js Size (bytes): Entropy (8bit): UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators 3025AE6958EC AAF8356B0 24CF1AE158B67542C05A9BC2D8F3BC7CCAE36C C784E89474CD9D83A0C E03F A65DDC67B087D82759AB3 D4EC8D9C6F9486A1EF95230CF91EA1F576AA174C59E37016D E5AF52E7A78113E3BC6DF549B0627F614 C192CDE4711BECBD83B6BAB75B370797AD445 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\topNavCss[1].css Size (bytes): 4119 Entropy (8bit): ASCII text, with very long lines, with no line terminators 5E764B73341AA4EC5C7C52C9D7C534D0 C3CCFCB18E673D7CA40DE7CA61204E14284D D4B77DD4E25232BF217C5F44A8EC84BC275F981034D CFE8C758B4 43C69047CF230B2BA A00535FAE54112F0107DB527508D92B17AF768BF12E6CBCB67013A06FC033C12014 EA18D7454BAA3231FD6DACE9837ADB519F64C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\unchecked_normal[1].png Size (bytes): Entropy (8bit): PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 046FD5DBE4EFBD0C17882C534AD34AD CA1981DDC4F70C035E877930A11320A143A B594E331E4F0D2FDD752C4861DF9B9AE5F5FF3ACE93F4D70E191AE2EF5 170E1CAB F3F2863A07D88A0B9228B4FE2B5C8898A7D3AD0A508BF6F567542F042978D4AB08FF49AB918 DD4E32A4E71FF8D78B7F0587C CDB52 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\urlblockindex[1].bin Size (bytes): 16 Entropy (8bit): data FA518E3DFAE8CA3A0E495460FD60C791 E4F30E D37267C0162FD4A C C4B4E5F883F9FD5A278E61C471B3EE B6D129499AA7 D21667F3FB081D39B579178E74E9BB1B6E9A97F C165729A58F1787DC0ADADD980CD026C7A601D416665A 81AC13A69E49A6A2FE2FDD AA645C07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\what-s-new-in-microsoft-lync d6f323d-d0d3-46bc-be73-56f7abe5265a[1].htm Size (bytes): HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators Copyright Joe Security LLC 2018 Page 29 of 125