ID: Cookbook: browseurl.jbs Time: 21:16:31 Date: 24/04/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 21:16:31 Date: 24/04/2018 Version:"

Warren Pitts
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 21:16:31 Date: 24/04/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Copyright Joe Security LLC 2018 Page 2 of 357

3 Statistics Behavior System Behavior Analysis iexplore.exe PID: 3344 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3400 Parent PID: 3344 General File Activities Registry Activities Analysis ssvagent.exe PID: 3500 Parent PID: 3400 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 357

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 21:16:31 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 15m 27s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.win@5/333@32/13 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Failed Failed Adjust boot time Correcting counters for adjusted boot time Browsing link: Real link is: Browsing link: Real link is: redirect-to=%2fmoj-payback%2fwybierz-cel Browsing link: Real link is: Browsing link: Real link is: Browsing link: Real link is: redirect-to=%2fmoj-payback Browsing link: Real link is: redirect-to=%2fmoj-payback Browsing link: Real link is: Browsing link: Real link is: Browsing link: Copyright Joe Security LLC 2018 Page 4 of 357

Warnings: Show All Max analysis timeout: 600s exceeded, the analysis took too long Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target iexplore.

Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found.

5 Warnings: Show All Max analysis timeout: 600s exceeded, the analysis took too long Exclude process from analysis (whitelisted): dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3400 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Too many dropped files, some of them have not been restored Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold true Classification Copyright Joe Security LLC 2018 Page 5 of 357

Ransomware Miner Spreading malicious malicious malicious Evader Phishing

Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe

may extend behavior Uses HTTPS for network communication, use the 'Proxy

analysis Signature Overview Phishing Networking Summary System Hooking

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 6 of 357

7 Click to jump to signature section Phishing: Found iframes Networking: Social media urls found in memory data Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 357

Behavior Graph ID: 56483 URL: http://www.payback.

8 Behavior Graph ID: URL: Startdate: 24/04/2018 Architecture: WINDOWS Score: 1 started Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend iexplore.exe Number of created Registry Values Number of created Files Visual Basic Delphi Java , 49408, 50225, GOOGLE-GoogleIncUS United States 20 other IPs or domains started.net C# or VB.NET C, C++ or other language Is malicious iexplore.exe data.miasto.payback.pl cms.payback.pl , 443, 49276, SPRINT-SDCPL , 443, 49168, OVHFR 10 other IPs or domains started Poland France ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 21:16:46 API Interceptor 29454x Sleep call for process: iexplore.exe modified 21:16:47 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link ad.doubleclick.net 0% virustotal Browse Copyright Joe Security LLC 2018 Page 8 of 357

9 Source Detection Scanner Label Link vars.hotjar.com 0% virustotal Browse 0% virustotal Browse ocsp.int-x3.letsencrypt.org 0% virustotal Browse 0% virustotal Browse stats.g.doubleclick.net 0% virustotal Browse ocsp.pki.goog 0% virustotal Browse adservice.google.dk 0% virustotal Browse 0% virustotal Browse tpc.googlesyndication.com 0% virustotal Browse occssl.payback.pl 0% virustotal Browse clients1.google.com 0% virustotal Browse cms.payback.pl 0% virustotal Browse pki.google.com 0% virustotal Browse crl.pki.goog 0% virustotal Browse static.hotjar.com 0% virustotal Browse data.miasto.payback.pl 0% virustotal Browse code.jquery.com 0% virustotal Browse securepubads.g.doubleclick.net 0% virustotal Browse adservice.google.com 0% virustotal Browse script.hotjar.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Copyright Joe Security LLC 2018 Page 9 of 357

10 Dropped Files No context Screenshots Startup System is w7 cleanup iexplore.exe (PID: 3344 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3400 cmdline: '' SCODEF:3344 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3500 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\~DF78DE1AE9561AD02C.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Copyright Joe Security LLC 2018 Page 10 of 357

11 C:\Users\HERBBL~1\AppData\Local\Temp\~DF78DE1AE9561AD02C.TMP Entropy (8bit): C900C6E1BD07DD3C65F8DA580053BC1 7AF7AC880680FD48C06F4B45B15F4B49769E C1C5D1CA306AD53EAF941BE3F1490D3FD047BCB75DE40AF5F56EB7653F6B C0B5CDCA0E053001DA49C8BA0306AEDB46CEF B82829DBECB9001BF6148CC9DA5C67DCC B7D177BAB7B8ABFC04B3A56089 C:\Users\HERBBL~1\AppData\Local\Temp\~DFF0FAA4854D695E75.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): BE3D6DDA742D98779C7CAC801F7EA8F 0455D1D160A6040E2CA11E3D22BE CD79C 94546A79BD1DAA4BB127F78DD46A3FBA2DF899DF936EF14CDDBDC6FE2F3EF701 42E F4655D086F3E9D9955F82FACEFBF D6166E83890DEF65E ABF3D07F914E5EE F FBE411BF87BEB5C292D8EE C:\Users\HERBBL~1\AppData\Local\Temp\~DFF46F5728BAFA28E5.TMP data Size (bytes): Entropy (8bit): D7A482B042211D3C5DD411D4BD3A2E3C 4D5B0C51FAA9716B8E802FAC BAF8DFF1 522E C19F32FD EA91F5931E6AC03637B63307CC027A134 9EE641554DBDC22749EAED4073E8187F34111D CF11FD3507D014F53B42A6F2266CC0853C3AF4A1E A7EF16437D6B68A99AD4774FC882 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\009434C E5F982E04C09638F data Size (bytes): 527 Entropy (8bit): F0D50129BFCB65ED999D3EB6D33780 EADF481C928F3F7DFB F8FA3660E8ACB 57F433FA7E1A5EEDAB B F5396A502E8792D F6 95F23D F8391EB8374C1EF4A0F972FC4CCD5EDE6EFF29E69C1AE7D1C286A8CC3A412DEB11A69BF9693 C26640FEA0284CFEEABD9032A6503AA1C26D0D7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 552 Entropy (8bit): A522C83CF406B6E4CDC772C0AA90055E F8FA4CB89C8DC3EFED8A2145E0A53E2EBB D FD1AC0F3A0FC7274C5D916B F74D47CDC970D746A016C 1F5DE D4768CE4D9347A560CA868D8079C7A0CBDC A8F81A9FB73B7B2A8DC87F4E0EDA858FF02 66B2C26C641A34F7FA1088BAFC72C64D82DBEC Copyright Joe Security LLC 2018 Page 11 of 357

12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 data Size (bytes): 1378 Entropy (8bit): B6A8318B FD31B17C73C149C FABB771BE2F21BD515B386050E47D7A7733C E6033AF2A3E32B4872A566895EFE5EF6E4A88EB3DC56E5042C66CB D9AEA58843F1547CF26D5CE8D5BB25966C0F0058A807F940A2F85F1F3F42B94A2E18B05FDABCEBCC6DFB81BB D29E392C58C736FDF78AC50BC54F9DFABE7BD81 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 325 Entropy (8bit): E027F182AA89DC2698C5BC6F1C B8214AC6643B6D49DA1F0844B438C1277B593B1 E748FCBC8B24D32FD3EFFFFCF4F49B9F27A C348B388F93AABDA4200A1 28F97CD916D3B730D4CC13A5AB3CEAD04B BE589391D59DB8A96BC4B9AA34B6A0E62C9FC9DA09FFC D70EE112F837400B3A863A2444E333404E78F13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23C3EC62E9584EF713FE9F24587CC8FC data Size (bytes): 527 Entropy (8bit): F E398D086A6DB0CD253AB F0636EEED82E6579C051E262B25DB96789C 83B1D677B41F176A7587ADD2E44E167538F452BEA63192A82DC2BEAA7B15EF0D 43C1C94660E019A510207AC8B06C0584B9F91117E0B9E83B9F7DE25AA4F1755FC6235AE44F27C40FF4B144D1EF9 AC671D7F909C0BA192DADB1ECC527CC09A02B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3388ECC3F7BC4A9271C10ED8621E5A65_6040D3032E13FA73C57A7722D30BF137 data Size (bytes): 1419 Entropy (8bit): B6760FE2B143CF910D94E5A2B E95A83ADDF8B3EC87B8DD8B711A986CDED0D6 CE9E6738ECF756F21E2695BB83C1C6D29425B93AB4B021B79E0EE5A21A683CCE 4FB22EBDBE90FE01C44C22983F70C8330FEFE42864C44B07CBD2E2B8A415B4AAC9CDA3677F6E5A80A034FDB F512908E0D7CA1D350BA542B48C53299A7D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5024A99DB487E61F859A7848B9CAE2C4 data Size (bytes): 665 Entropy (8bit): C0FC7EC6D88ECC67E0923EE47D40E10B CD441B B732BB92E3B22F62F4 B4B70625D79853B396A7344C8481CCB068A115DC9B442303C40B26999A86DD6E 63C93C1B2E363824BABDD F973EC3FEF8E3CE0347E7F55D E2B351CB401B016CBA962D2B B8F79AA7E7693A28ECCF0A695C1C2A9FFB3670 Copyright Joe Security LLC 2018 Page 12 of 357

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5024A99DB487E61F859A7848B9CAE2C4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, 6497 bytes, 1 file 18B4D884C1283C838F32B3649D7C8F50 F74715D9D34F449CC27AC1F88D3810B7775DC510 2EF0CBCC2BB074EE1D84FB A551D71D012EE82B760D635D139BC319 A D0344A645F1BD427A11C0C3B4A41A46957B2FADA C0C231EB350830F80C74C603A8A2A4C25 FADD6B C7626BCBA9E522EADAE22399 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B B5E195ECB0E8F243A4 data Size (bytes): 896 Entropy (8bit): F4DE9D7ED07B90F74B30F8E6F338ED 5F4AF4AA669988DC C3E529D7E1 DE7D8C72B389E18C8B1C835B0DB12A3A3EBABCAD3496EE63D2EC7DF594D62541 BDC1DA76BDB19EA306C1F66CE8FDBD9384D0F65580B04DAB5286C8F5A66D25F5DD9F4B17DDC7DFCB6D9F1D3D 64687A80371AD96B33EA8B85509ABC7D96DA34E3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 471 Entropy (8bit): B888F6ACEDF622DFC0182A8197CCE4 F96CB2A18EDEAF9CB9755EDCF5ED77ADDDA02F32 C0DCF3DF26FEA5DD85A9429DE3A8F1AF2BC34FD092A21A951CE08EDE2B44C9EA B96343B16789B2E97AA678E14F73F72FB8C28841CF93F0B2C63E2ED9CE53255F5BBD8EBA101405FEDBD2 CDA0969AFD5DC254F22DF179E50BD5E6F208E9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6E5336CDD9652A36A93E734B280625C5 data Size (bytes): Entropy (8bit): C07AD27FF07B9EDB9F638F319CDE4 7A41FB83E858EB889F6F1164F6ECDF6EDD77E2C0 29CE429F3331F28C6BF514F2E4BBB746D8D2147FE9B2A2F491F1115AA2DC0059 AA78218AF5E735EF4608F5560C6D10F41F5E339AC0ECBFADCDC4CFD044C0519E87801BEF5EF35D40F582CEABE 4CC8F10896B876F2FC7E7BD6BBACC70168B86A1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Microsoft Cabinet archive data, bytes, 1 file Size (bytes): Entropy (8bit): true Copyright Joe Security LLC 2018 Page 13 of 357

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F AFEB D3EBD263D4A566 60FD115D146875DC7A88CD66F9C26280E61468B9 359B8F D12194A294444F46E77EF286E9D9E4AA9844C40D873CA99CC D4E0D25E2A83A987949C1AE AEADAE761BBDBA453B3E3EDA529B37A9A98CB59FAEABD3CC731A5929FB 30C0A CFEBE7BCA4B6B475B3A957D534CB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_ E37660D44BD5816D0A6EF6779 data Size (bytes): 463 Entropy (8bit): F63C6240E4E03F6FEB6FC578678DB C3CB30CE5684A A E28C41C9C6D6 E268920F3D5C68EA6E5FF8557BFCF6E6CF9350EDC5388AAA5D4EDE97B7A1892D 1CC472646AFD8019B17A464592F8BDB7A55C3F652BB8CD872DB7D05979BA9F52009C1AB257238F9F7CBF4BB339 FB E56F3C1EFB76FCA83A5669C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 data Size (bytes): 1391 Entropy (8bit): F4A082AE49103B6F71BB95B4D55ED8 3641E99A2CD9AF5742EE10C702A1C482FD A34946F5A82FB3100E29ECC79D06F88D4440FB7D72EE BB82421EB6F2 8BD0D2FDF5741EDE88394ED13E9C42267ACB E8DD1E36870B52FDAF88924EAA606F7F596A93623E63DD7 5C0A285C5D C4BD039E88ABC178E3388 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4267 Entropy (8bit): F8216FD354CA2C606769D95731D45B19 950CA8F6EE3A EB8BD1CF170C259D80 68B74DD2A491A8490A6DCF99AF4AC4F E712F92545DF678962EF2D903D 2E19E49E10747CCB526591CDFB4BBD7F0F55B8BB34F1C11509D130710EDCEE87E4FB313BC74164D4F1F1E1F91A F6ECF30ADB8A AC072D EC5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC D220C7448 Copyright Joe Security LLC 2018 Page 14 of 357

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC D220C7448 data Size (bytes): 596 Entropy (8bit): DA FD6855BC7D BF9 2A906D944D06672F26CD2C75785CDC1E85DB853D D3BFF065B6A487DACC2D625394D5D8E614529B7A16A490F6F7BBC3188C565CBF E7A8750B555C5BC23A6AEAE70EB0F0848D0AF83ACA3E7C4A D61CDABFD5403D61C F588D AC511BF27DB62786FB8A72F54B5CF9895C0D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90A28E5813F331556AF2E65DD1E835D data Size (bytes): 527 Entropy (8bit): DCF754E9C6CF061665FC33B8AFA430CF E64C7BBF96342BDFA6DE8ACD CD64225BD 81C5A12F4DDD7E98B0C150F5EEFE7DB4ACD6118F6BA56C0B8B52B5EE26085ED8 C49BCA688AB013CBE6BDD4CBACE12E2013C1232AACA20978DD568FA8EACDD88E28D7774F3BE095957EE18AD2 72A401BA2D841797F DED71CFDE65C51 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7B4E43171BB9E412497B0377F4343E7 data Size (bytes): 665 Entropy (8bit): C0FC7EC6D88ECC67E0923EE47D40E10B CD441B B732BB92E3B22F62F4 B4B70625D79853B396A7344C8481CCB068A115DC9B442303C40B26999A86DD6E 63C93C1B2E363824BABDD F973EC3FEF8E3CE0347E7F55D E2B351CB401B016CBA962D2B B8F79AA7E7693A28ECCF0A695C1C2A9FFB3670 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DD05AD37A2ABDB C0170F4FC2 data Size (bytes): Entropy (8bit): BC072E BAF9DF09CE9DA2EF 48430EAA1FD44BDF1D2386B07AC329BF5DD631FA 20A CA450F D1586CC990754EEA01CA60EDF88DEB82870D80D5 E9243DF154B5B133CD3E33BC832C724C84CF4CEC8D6CAF806B2A0D5729A460B14FF0BD18DB4330D EB5 D99D61AE85C80758A66FBF41F24DC1FE6C08B9 Copyright Joe Security LLC 2018 Page 15 of 357

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DD05AD37A2ABDB C0170F4FC2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DE F3B953A6EC67A0654E15F_9F5FD1DB477F61052ADD6A6A5B5CA7C 1 data Size (bytes): 1414 Entropy (8bit): D3F39CE2FD761604F80373A8285F8D7 D5C01AF0231D12CECDD82496AAF256E3C24C157B 25EE477643E4329D1E3FB7DA8B96E536A06BA55F334127CDDC F0B B4BDA6F50D564FBFE7EA8D12FA563AF814F3BA1F7D33D17C8FC278C44AA8A D8E18E74AD495E C308F07266E317F588A7E708CAC39993 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A data Size (bytes): 1786 Entropy (8bit): AEB4E76C6F68EFD7A48092E9F0F A035C0BDCC3DC09C881E788F7FACA53C6B458 FE1B9A0EABF44FDBE4DDE97C3CC1209FAD2FBB2D2D7476FFBF64066BD9919A4F 50D98FB4C9875B1AED0AEC06A9C934DB5010B6C5F54539E323EC14FD487E1D92D01652E4614DDF308AB2F1EDE A9E9CB1E23030C971255CC106016C6E7BBAF48C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B0 8 data Size (bytes): 1396 Entropy (8bit): AB F40B09618FD0B1740E63A1 579D0D64CCAA699751C2E EE98F53482E 919DC376AEB56E0EF2E4B AC7BF30649D568B0205DE241DA573E72DA7E 4B628665F06ACC9D4D0CC7F46175C8FF45660F5E942EC75E7272FD8576F646928E1CC6C414918E00C9DB3C128A B4EC9B22D1E4E A D13E2B383 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_0FABCAE06CEAE0413F50A 1AD5ACDC381 data Size (bytes): 463 Entropy (8bit): E8A23C3DB44E9E AF81AE9C95 40DDDB D05B146D486439C2972EB8FA9B E6066F8D8760DE5FEB2CFF8BB4FE0C3AC7B65D5B327CC11DDD951617C BD0531F BC86ABFBDA32B6A743FB027C5769AD8C238FB09AF72AB350CB72CDAB89736B BE39BCCF048445C248D D55E3C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\009434C E5F982E04C09638F data Size (bytes): 1148 Copyright Joe Security LLC 2018 Page 16 of 357

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\009434C E5F982E04C09638F Entropy (8bit): DE54CB0A691436EEDFD3694BC4224E54 F80717E1020AF31843B82DF395F6461EC9DD8ABA 856ED14C2A11F600BAC4BBD230E121846FB3FCF430F65AB1D8328B971DD87B69 D99441D8E7DC9CB64E04D19B177CE2D5A10191AB368CABE2496AF4C8C7BC11D593D68591F E751B3BC1 EDE6C57AD6C AD4DB3760DD4FFAD9686 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Entropy (8bit): B2AC11A8FA257B7337DAD FCF9 A2DE4F3FB37DD090C4168E5AB00472B444636CFA C714EF6422DBF2AF80EE78553F9F5364C9B6372A8B98302B8348CE906067B748 FD760F15C519E32B2EF235370F6CC930D22957CAAAE96C77B1F05001CDF6FEFA162B62674D1AC D9C6A7 1E96CF68F978645F49B82E10DD42816A7FC01E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F8 75 data Size (bytes): 716 Entropy (8bit): C0FAD7C7B2B1947E9BA258E30B604FEC FB FBCDC5B07B30FE6A0824E274D77ED2 B6EA04998BF6E8CD29A60355EF84DA6484F37C4D928391A68B21456E22F2C1B6 6158ECC03ECA507B2BE042A97F9ADF752C5D3452CFE9A1D342AD1DD0B6246C2C B27D861F5C127F7FE9 FC56EEC52E51474CC50FC6B207169AE3536EF1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 292 Entropy (8bit): EF9D6AFCADDA1C7B0E28EF38E68EA3DA 88796AEE9A6D524F3A05B47C2C597BAF62F6A154 A504D4020B E DACEA915E4A EFB22ADF8B3A9C EA617F219657D2FAD3A8B394444B2086FBD1F387E4C0CBF6EC137247B85DE86DCFEA1ACE305F6F D5E CBDC4A37A36E69B0E5742D555919D33971DC67D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23C3EC62E9584EF713FE9F24587CC8FC data Size (bytes): 574 Entropy (8bit): E44E2C26D319841E93F75BB8E C08EC8C836D417FCAE45074AE8EFA C6E038115F0A5417A98945C48E682D54CA A0D7827EC531F27E59AF 7EFAB85CF624E5A97D894BC0537C4D5B8583C2E727EC64EA05303D13E664D3597B28FFB65E81D57CB5F6E789F7 3ABE316A6AE6E7B1174C3ED8D8C83DED71432A Copyright Joe Security LLC 2018 Page 17 of 357

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3388ECC3F7BC4A9271C10ED8621E5A65_6040D3032E13FA73C57A7722D30BF1 37 data Size (bytes): 788 Entropy (8bit): BC8AF43F126297DB1BEDBB0A2 8E5CC7AC8B34B3EB90E5E5BE97D326B842AE9EF9 E6C87CD85F5E497A4B2BE5FFD026B2577A36F61245F9325DE94E5237C2BFC744 FFC11DA62892E525BAED9E0B428C2889CC3077BD81739E38F06706BA48EB45DA647B1FFEA65B CA1F2F 0044D1200D3886D8824AC748CB9DC9AE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5024A99DB487E61F859A7848B9CAE2C4 data Size (bytes): 568 Entropy (8bit): BD7F2E6DE9AA4F1330DB27619F 954BC5D6E4DC8B5C861AF3189F5AF AEF1 3A2A4C258C8C0DF578DCF0D7AFA6AF950BD735D0F7DB305EF8FC F915 FF303F0B26B6E0FDCAF5F19804E541FF1F4149CDBFF3E DB09C3A0F611D11CC BDB65D11835C 387F3C62F48F25B48636F34DB34A98D11A972 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 1368 Entropy (8bit): F6565A66110E27F94B5A9AA1DAF8 BB5FA29B24AB08DC477C9AA310BE F20F1512B8613DCFA9EC6E90BB1E7B67D4EEC595872BB26AB2C6D7DC4D1DD2 9C4EE5E88B38896A8DDB8BB7E200DAB3537B988187FCC4BAC59B16E C27F9803EB5CA203C8D892D F8C9FCBF55769E0C48944BB996EC95EE6D9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B B5E195ECB0E8F243A4 data Size (bytes): 204 Entropy (8bit): FC6C6C087E17416CF3E9EE27F0E4F 2C15E199B5B0B3734C469FC86C975BA36767B453 8ED0F637E6B6AB638B8DB45E715E0D441C9B64101ECFD50645F CBE7F3 71FEE255C4E5CA89A00F135BD5E0D0F15CE FE5616FB9F4FF5C02C1A50B8174D F23D0A E8C85A730B32DA42FF364EB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 438 Entropy (8bit): EC624C2A47A1EE89CA3231A50D7C1 5326D6D149E9E2FEE674F0A310B99C00514E77AB 9B5D3F7F83EFF84D0D5851A463B1B8732E78BDD2178EBEEA0490C68F0BC10470 Copyright Joe Security LLC 2018 Page 18 of 357

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA DE299A5BBDD5D65ADFCF C3AB93FB903765F37094B5A058F0E2C2017BE4B00CCBBBE915988FDE19 DAF941192B5DD730D310942D09621F417265E64 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E5336CDD9652A36A93E734B280625C5 data Size (bytes): 262 Entropy (8bit): F56FAA8CB5EE8568FC7E8108A586281E 2CEB8E9DBEF53278BD513F37DAA4E93E2D8D95A CDB569346B30092A1909F02379B5AABBCFD02D4674B5DE F C8E7F0D BAA68A37AA6B77C713664B342709B673F77A63E B249A9F15FE4EEC8C904E6E A0B2D8AD485252A260620FBBF059347A35501 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 990 Entropy (8bit): F4111A08A4223E27BDBF847F62A670A2 2E55F61314E1B80BACFD9DB8212ACE7CC938F221 5EA5FC61381F7ED7B49D825A43607F5C9FEDC5B7732E6B2AB2E691B0FFE2A719 A6583AEE320908DE5870DC4969AD1B45E572A8F C53B9E9E928A3AE0164A4FD6AD442AAB E3 F75A B84EC8F1E610819AB0EC9F1AA8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_ E37660D44BD5816D0A6EF67 79 data Size (bytes): 386 Entropy (8bit): E4D0FCBE108EE2BC2C B1 63A7E47CB0A9C083B7AC5EDAF6C24197BD7F8BC7 0D2D3C842A8F44739F A95C9374EB9876FD9A79276ABEEA369148C61FA 0E71FAA3C595495D32BEAC772C554718C78E0E A058BB946CB01EDE2CF D00E C BD4B6CC95759DE515B20E208AE7D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D 56 data Size (bytes): 384 Entropy (8bit): FD05B52E0C4020B104F610A1F56C7A4D D4BC0EA57606F9CB70CDA8E37065FF2984AD9E5F 6DC4D92A9E347891B79ED1DFA24F D CE555DB5B667C043BF5E E93C DA07F EDA590CE746EDA8EDBA4777AA371EC92BA3583BAE27630DD9B737674EA1D35 49EE4826A5901F234FBAB6EA71900BF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Copyright Joe Security LLC 2018 Page 19 of 357

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F Size (bytes): 448 Entropy (8bit): F5F0AD3F D3BC7D0BB1B309EC A2FCA82234DA4D CBDEF588EB8244E8314 7F BF9EA27E D096469E9180CF6FC140BE8F01C A F81D41EC8CD5A131BF172E201269D36EDDB54D0A9AED979A44D5F872CD8DEAF74DBCD94BC82EA1FA662C9F6D D2CB02F0E286BC21F5DA3CF3D051E616 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 184 Entropy (8bit): FBCC917D8B6933EE0CAE1C0FCADD9276 D4E22D3E28A9E028FCA42DA9C CABD28F 31104DB31E1114FD123772AF6C24066F3F0AECF9B CD70605EDEE95C15 3F0FB944AF8A80E7E2677DC1FCF73B1892F4225B000B3E1D CDA18433BC01813A68D74074B05DF7 D7C1C B3C8F602622A253FC1AA972 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC D220C7448 data Size (bytes): 180 Entropy (8bit): B61C09DD5280E546603B7FD5AA0F690 1EA081CFFCA08394E14C9EB4179F7A77D794EC48 917DC3338BCABE5B9297A9351D51EF0C7C9E01C785BBA168ED17556F1F79755F 7A8E67445A66BC769131CA8A7082D1BA0FAB49D4BB47C4B88CC70AD3B13E5F831854A1A630E6BEF2DD8E2DB9 A E1C91E71AA457273DE54DA5C04C3A70F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90A28E5813F331556AF2E65DD1E835D data Size (bytes): 582 Entropy (8bit): E6E13A5A36E069A7B5548EFA78195DB F9DF516C9F04BE6F0F ACA53FDE5AAB 5A881C C6A45D345452F1AE AAA716858CBDF455A444E7444A3 41B1D8AF5AB53A271292F4EEBC8846FD6B B66E93294FC637EBE7FDD C83ABA4FE02E59AD8AA7 54DAA5BE14E3B4BF77FE8431CDF6B3F5B0FA142 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data Size (bytes): 804 Entropy (8bit): EC7056C6FAB06DD1B8EF80CB6BADEF 9A4BBA8AA11EEDB253C05E7774ED0414A92D588A 9CD56519F CBCC3B2A7A4C12B0D44EE94DBFBE630ACAD5E0688D BFC2F8A9A401EDD17CEE1876D475C288887CF210B90DA5BAE3F2D E3E71F4F102F30D45878CA2EB5F9A C F58704B8BDA4296B95C Copyright Joe Security LLC 2018 Page 20 of 357

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7B4E43171BB9E412497B0377F4343E7 data Size (bytes): 282 Entropy (8bit): B679D337BB59F9AD902D34843E1394B 7DE1ECE19FF58526B1AF20B2F03EB18C9B7DED5C 7668F482D1A1DF60BC36F5ADB0FBA5E6A197AD44633C54F2280B14DA F 03DEBC018BD74A57A360B7697C1CA64CC6BD2D8DBB22A6FF90D2013D2EFF63C2C494AB5F4047BBBC22E8791C D274DD1BDF9A7B4233EB26D75C259091C353AFFE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DD05AD37A2ABDB C0170F4FC2 data Size (bytes): 262 Entropy (8bit): A48CA4FEA83D957C0D798B4B15FF FB28F6C4D2D4F08BAE5F31A559D C9A12CD4F D57BC094230A569CB217A06CDA1E33E6F41B373E7 1ED B7E8FCD44550B06ABE4F4BA9A110FBD6B89AF70B94C039426D203D27F5FCC19DF354F1F0EBDDCDA AB046C0469C78063A5B6CDD400B21C65CD5CC35 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DE F3B953A6EC67A0654E15F_9F5FD1DB477F61052ADD6A6A5B5CA7 C1 data Size (bytes): 804 Entropy (8bit): B2B7F2C4119B273F971EBDDA5F12BC FDF2AAC07FB4860DD D17E44F C6C7B3EA9E46437AB08135E0356A8C0F8F07E28B06F229FD984AD8E354158B8 1CE89E0303D6651C2E6B99D978095B66811FE7A966D15F12BDB922E7F53AB99961FF98AC9AE48B8352F06CAF DDDD53328F47B71159EE059D6F625B187 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A data Size (bytes): 424 Entropy (8bit): F4E278484A43F5DAA81D44DE A31AF752959D002037DD24E6ABF1C9CAF6E5DA6 0A9AF3B82D44703DA20016F0ACF03E4C15C6B6B3FF8443E21091D382E4C24A6A 47C1EB7C71B B72FD3D1856EB B3E2330D7ED42AC8E69C18BE97C331219CBE30EBA42D0454A3BB 12639FD3D853CFFECB2E09D991462E062915F1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B 08 data Size (bytes): 1028 Entropy (8bit): Copyright Joe Security LLC 2018 Page 21 of 357

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B 08 E8E7AE12D7B0E0B4D8011D92BB B933A790A1D7DD65B14FACDB B08F0A35 FFA63C C3A12E4B70F3052ABA4D DAC5D7018EC B CDFC4904DA552DBC0D722B5E71ACBF133BB5A29C42742E563C70F8B877250C48BF91AD37D21B39D51 E88ABA171F5A775BC9AF FE6A17A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_0FABCAE06CEAE0413F50 A1AD5ACDC381 data Size (bytes): 764 Entropy (8bit): B818598C5EE6DBE8EB801DBF847355AC 5E0CE9C92B3BD2998D5E3B7DCFAAD1394DCD78A6 6E1BCFD9A F289338D43E729E75B6C1405F5D410EC0F96A28AFA35BB16 18C87A00BDF020D3E41CF740BF326F0FCEB6C84F57AD86667CB7885DD23E7223B07D49E9DD F5B5F06CB F5D272EEFDC64FFB8EE7FEF9B23D285E02DC89 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\FD780P8R\ Size (bytes): 3593 Entropy (8bit): ASCII text, with very long lines, with no line terminators B46138AB13D946CF8D3F1A C6 FF97C7D565F523B957FB088A8BBB62ABC7FD3886 A43CEA03C0D8741C86B7C5F0A7FC A36383F93A3D5F90BD25C9AA6CBCC 023E7AC53F102058F5EDCC2BF326D60D12043BE1576BC787714F5D907722A AE1E7C892F5F7ACEEA54568 B28B4B6ADCD344E609C7CD02C08B1A6A760F6 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE Copyright Joe Security LLC 2018 Page 22 of 357

23 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 473A239AD1D D9D227DBF3B 8D450E66ADFDEB881D44E268E9593E20F3C57DF7 1CB0A5F39D7D49E1099C53C71DE969C424B1C32B3D5B60CEA42168BE0B374CC8 5A34DFAE6A8CE A022FAD6A3EFCC3A07CE15C356F237E413676AB40F9F74D10F A352B727982A99 0A8AAEE6A11FB936D2143A4ACE25811BEC309 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0713AFF1-47F4-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): E44062BECDA E63D73EE153 7D7F972723E26F71AA42B93D739753DA88F3F2AB 09873E07479A A296C8B7A774ADD0C BDD1249AFCA68EFF9F94 79EEDDEF1C00D1ED2F CF006BBF1C5E2C517D BC99387D4904D08509CA594CBC FC0D6 882B46C7103DA3F69D25BF8EC69ABABE601E4B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0713AFF3-47F4-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): F98ADDB44BB22C3536B871673B10 C6C85189DEF7CB D5968E8C7D908BBFC65 276CDA BB4987E89F98D05626FF4C0A91B7EE9BD2ED17742F2A492DB4 41F443B95F1EBD7D434B15001A5B47BA66FE54F8BB62ABFDF9E937FFAAAFC2D634375E3C130A459348D9F1BF85 FC07E2FD20FAE75DC66B0A863E15A8E2A24E53 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{10D925E0-47F4-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): B1EA7B4BE D1F09B0DBF260ED 1E07F29729FE1B0BC030A8642AD8B267A9767A31 4F82E399A3EB5F0961CC65E9EC41C3A1C8E8798E09AE21E86744D44E9BDBB23E 7B53EA7B4111D820A06EFDA878B5B7662CE09057BF2E3C377DD780B3DA005EC338740FAAA5FF27A9B1D5B448A 2A558AF C0B319C88DBE432199E6667B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA303.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED97 0E219B6CEBBF68F9A12B6C629B6816CDE1615C Copyright Joe Security LLC 2018 Page 23 of 357

24 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA303.tmp C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA3AD.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED9 70E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data Size (bytes): 1070 Entropy (8bit): F59B65A6AE6900AB8FB709D5A83808D4 9541AC35A BE2B48C614E371A5AD49CA9F 862EBEA50F9ADEAAAF73DE3094AB21A8EDCFC E71653F8A25AF3A927C A131C F19B05C508D81F97C0F F01A63F560320C6E2D4F424E7187F88FC52577E82B4581 D2CD3AA464C934B24D9CCCE53506AB7C13D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\200x80logortv-15585[1].png Size (bytes): 3493 Entropy (8bit): PNG image data, 200 x 80, 8-bit colormap, non-interlaced FA97F985FBAB978FC172EA6C0B441B0B D078E E13F1D70A1A23062D77F20EF10D 2C8AC7F8E2CE66A63C745A90536ED4A7B29C6F2E70A596D576109ABD1D32B852 33E89E76F81C4A7009B0C5E4AA9EAFE0D29CBA81AA5426AD0A9DE23762CE2BE0D6A07D8A5B7230B83AEE628C CABE736D A1F72A76DF2CC7DE51D47D3C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ADL-2072_200x100[1].png Size (bytes): 4132 Entropy (8bit): PNG image data, 209 x 67, 8-bit/color RGBA, non-interlaced 7A1E6ED9BD6A0A92FF568E62899CD38B B3ED769B669D932A997E0E533A3BDD1738DDBCED DE9B0AC9EA6D3AF0890DF53FF5CD0986D534BAA865ADFAB6EFF24E041F 05058CF329C9B98F8B4B67E3FD02A5C47E7D16BDFC8F3FB7F7F4D CA5546B412633B547EAD862A01EB36 AE25CF9F45ED8994C907014D7FFC74D3962D76 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\DroidSans-Bold-webfont[1].eot Embedded OpenType (EOT) Size (bytes): Entropy (8bit): D37E18D760049FB82959B787FEAC47 Copyright Joe Security LLC 2018 Page 24 of 357

25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\DroidSans-Bold-webfont[1].eot F8BCA40D9B74727E7C90775A3C59F8A55B4E2E8F EB9BA6D8E2607FC98944A9D5786CBFA654F0BB42DE87A5EF80F683FE7727EB7F E83267BD195137D1BC22AED2D88687C0313E0240A37FA0F00D0F3FE0C6A3B451237EB35CF0761B37CA C D65EA8E7642DC7FE291A5228C4E9FAC271B24 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Logo_RGB[1].png Size (bytes): Entropy (8bit): PNG image data, 2362 x 2362, 8-bit/color RGB, non-interlaced CB8EDECC58D495D898D8FBA2E9AEC6E1 64F8F9917A7B164B A0CB10EEB46EF5AC FAF41A8E3D5A26CCCDF7124D97E9CD FA7EFECBA03E660D197D81E D DC035DD9333E5E87012D3D27BB4015E1A55EB86ECA08C234258C35229D02DE1D4389F5B298F F379343C559F E91A63FD25A2C02 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\OpenSans-Bold[1].ttf Size (bytes): TrueType font data Entropy (8bit): F5331CB6372B6C0D8BAF2DD7E200498C 8387D4F8E061C264DC3AEBEBE6068B66E45D7C6F 1B43DE2449D39B65FF6F63315D4AFDA585F72FBBEC2E3D9A56F59DE6C75149D3 B534A27EE E087FF2A546AB6EAA7A6CDD1C449687B97DCEE2028D3ABF6F9B0A DFAEDA 30C0342C01DB0F2826F7E80B6B9CCDC A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\app[1].js Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): A5E5AB5638C7ED4CA52CA2C8CC21B3E5 2CBEF5EBF212F93B85D6F6ADF1AD24723DE DF29360CDDBE4E82A65B95A1CECFAB340B9DB5DFFC01F4F69EE1D947CF FA83DCC5EE12C6F4C9153B0C936FB775A50BE3155BF70A7EE0C749D99AEF70D1FFED5C2DC2F4F2ABC53FDD D53C69F323699BA71FDDAD9978CE50A663F2344C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\app[2].js Size (bytes): Entropy (8bit): Pascal source, UTF-8 Unicode text, with very long lines E5F13B8E447C4C4B2AC537B3F1C1A0D6 25D7AA2A1B5BE19A6A8016E2C738D450A471FD0E C19E5933F6CB0824A460470EE3418D7B16ABFCB2510DE3AE63E7A437596F279E 91390EB43C7C5E78DB53EDF4A9B6FBCA458F3A1D E1F24FAA1C8D0CF1BD725D401C1ED7375F8CF5AF 83BDA7A44E EE7E E2AA0CE71F4 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\arrow-grey-left[1].png PNG image data, 6 x 8, 8-bit/color RGBA, non-interlaced Copyright Joe Security LLC 2018 Page 25 of 357

26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\arrow-grey-left[1].png Size (bytes): 1022 Entropy (8bit): E6179B94CC00B17E5F840CCB9C5D 2DAD652F96A022895ADC63F9E0D572A6A970689A F0BB3F38E1AF66ABEC803DA3586B57D37F E8C49BBDBB7DDDA3A0DF34 7A4D0D76DDDACCE7BD86FEDA6905CDAA383E11596D9821B FB71249A706FCC772B D71164C8BF E2C0A95D71C18F3329F543FB2286FD3C4B58AA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\arrow-left[1].png Size (bytes): 2857 Entropy (8bit): PNG image data, 8 x 10, 8-bit/color RGBA, non-interlaced F0BF602F87343B99A10CAE131A40F756 48BCD26BCF1E3B6C51937E54909EA4480F969AA3 836D9F162E7AE3AE716572C52957A409E3FD2BDF39C454F6B103E9AFDF84D3BF 6CAA16186A45514B4265BAC39F08BAE3CE2E435077C13DA4743D678AD147DC469CDEA A86793ECC27 95E5CC1FB29B2DF62AEDCB15F67EF76CAF991A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\arrow-up-blue[1].png Size (bytes): 344 Entropy (8bit): PNG image data, 12 x 7, 8-bit/color RGBA, non-interlaced C96BF945FB B70ADB410BB18 96B0F783D2EB85B619850BA9B9A5BB54F27E326A F585EEBCB12CC7FD A88C815B02204FEC2CE24E794F DEE0 2801B890245ABCFD16ED2F3FAFB9713E93AA7CEC2C9AD4DA485EDC903BEC1A1A027EA1585F66A3A5F6F26F769 7CFE65B9186D D6467A28A04CB028 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\arrow_down[1].png Size (bytes): 361 Entropy (8bit): PNG image data, 8 x 6, 8-bit/color RGBA, non-interlaced 1840FD0F82DECF85B1E10D F DFEDEBE2F8C4F2E11BDF3AD1FBC12CFF6BF F7F9BEC75C0B2ED83928AC215B53644E117AF48A7D429C886885DBE698A D81AAF7A03BB0B2A B139F61A59D E6EA4D151C50D3C2DB11196FA89A9E509ED8E646EF2C18 27B88019DEC E13A391EC65AB49078F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\close-btn-small[1].png Size (bytes): 1017 Entropy (8bit): PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced 4C2253E4EDF4F15069D401BF2597F560 C4628AD87D31929B22F2187DF89A03B5656FB568 74E8DEF59DC0F7D17D2580CEDD3D1FD67762A740EC0C2A D F6963AC87FC0E39D6C48316ECD72E47973AE5BC41EAE879BAC737483BEBDCBE B897385F8B76EA1030 C7CBDFBE16FFC43F3A AC19D3F9F2B2 Copyright Joe Security LLC 2018 Page 26 of 357

27 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\collect[1].gif GIF image data, version 89a, 1 x 1 Size (bytes): 35 Entropy (8bit): D6814F309EA289F847C69CF91194C6 0F4E929DD5BB2564F7AB9C76338E04E292A42ACE E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015 1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC E0D85540FF9BE0B20175BE3 F5B7B4EAE D5CCA13486AAB4C582C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\common[1].css Size (bytes): UTF-8 Unicode text Entropy (8bit): BB21C53E3A0CB9B9F69D24E880FC8D0C 13E337904BC2533E85E6F2B810CB0171FAE504A0 B27DA95C5B56B0C4D1F9D4BAA63407D8E E607DE6A8ED09E45F9D F27D9BD98365D5774D13BCF3980BFDE66DB24E52B340DB884F7C86F6EE7CE605B7F47D85F59DF806A882177D2 AD4BB45091FF07DB06F4ACAFEA7D5773B798F5 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\cookies-192[1].png Size (bytes): 243 Entropy (8bit): PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 6D2C791FEA3A18D16AE5D818A45ED D334B E32B9A716D5B684FC256C94 BCAC20E343E80C8A920925A28F2DD487B978A1E93CE9F92CA8E D1DC4 F BA140320E6C16A4ACD73BF0F1D7DF87C12C89169D282CA5DBC80D7102C22BBD3C1593E0C4AF7B7FAD A5BCB49BB27D155E65C D254B7F9667 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\coupons[1].js Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): E15D011BC5F8D71B6D70719F050A 81FBE1EEF82253D72001F8505B2FAA3AFD66E75B E66106FC98A2C9A8F162A834369EE5B74A2A620524AD91394CB38CEA355F9E6C 651D09F00789A810502E8325DC F37FBBC802E46E1A0471C04EB103D3211A28611F1C0141F45A64DC65B04 E67B7D2245E83EA5923D0D91DEC9CA8C6634 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\dane-osobowe[1].htm Size (bytes): 4981 HTML document, UTF-8 Unicode text Entropy (8bit): DDDCAFA68D5FF73CC46C0102F5F9DE3 C91D752D2B10F883CD23539BAF3C27EFA4D5EB27 94E100D15A25A74B812512BEA3A6A4CA7B3F71FF4BA7FFA5586EC4A4F06D959F F429A598CEB73B47643C01C4C74F1E3341B9C19721BB495515F6D690C8296C04C5AC0B06333C0A4F A39C02AA00403AAA5F53590CFBD1F8C8434 Copyright Joe Security LLC 2018 Page 27 of 357

28 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\dane-osobowe[1].htm C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\fb-logo[1].png Size (bytes): 1296 Entropy (8bit): PNG image data, 40 x 40, 8-bit/color RGB, non-interlaced 038E57E60A213637EBF7DEF A BB8A5D0C802513F783AF92A2AB D25092CCFF7C2C6E058DBF2661AA5FBF0E0B576A46EB3FA2ECA902EF E 27C2DF7D8CB0EBD966F64B1C17997B38251FDA5F26B6E8508FAB4AE A2F6C09681F89A69BE837E39D71 17E864F10942EE71BEDED8AA2E D2CF C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\fb[1].png Size (bytes): 942 Entropy (8bit): PNG image data, 29 x 29, 8-bit/color RGBA, non-interlaced A292552F8822BDA323A0CB483FAE7A0D AB70BB83B2B9B72E2543C22853A2FD97EC4DBB3D 6EC6F9B073FCA0F723D3215CE61A11FE60F0C2F2ED893CE59C6F84D8E126F772 69DBB7EF92EC7E B3EDD286888C CFAD359AD0737CC07D8023B4045A1EE17C11917DCF60241AF D0F07906BEE8C1ED0C0E24ED4E86C98697E058 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\filters[1].js Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): E656F1433E4B45969B6C69D04C9B4 E5FFA4914E0F5482CE1433BE9B73F58B2E C5A354203AB79923FE1869B51C53B32ED6994BE08EFB807890B806183C472F C605D345E5BCE3BCCA26AE213582ED476C091AF097CDFF932B17501BFE7206DAE7A581733EB8106C8C2EC83E1 D0431BCCEA09664F83DE6EE94A1A3ADF8F69352 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\gtm[1].js ASCII text, with very long lines Size (bytes): Entropy (8bit): E5F477B0DF49F69E6CABC64F377 Copyright Joe Security LLC 2018 Page 28 of 357

29 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\gtm[1].js CE453D FA54AD6F872996FC64A5CBF8A38 B2BA13021F23CEDCB D0663B09309ED11B0483AA75BDE0DCB F7D0E5749D45AE8A8BDA7FC11FF2BE86E5C1312B954E726F30803D309ECD9A545CD80135EA6EE19402AF57 BDEE35E5CA3814C2F F481F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\hotjar [1].js Size (bytes): 2430 ASCII text, with very long lines Entropy (8bit): E1C43DF F83A E207 07BAEF752B095A5A0CC299D7538ABE23A4CFA0F7 BFB2A3B989BB0FBC339C93ECD963D7DB9F E141AA B25C F922537A8AFCDB8FB1861E30154B5E2387FCBA8F0434A18E830AB5D B063E98E CBA D545CCCA7ABE315EA FA5FE49DF C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\html5shiv[1].js Size (bytes): 9498 HTML document, ASCII text Entropy (8bit): F9AE49BA54AD8F A0EB0B27E8 C6DB39435FCC82DBBBABC0F753F0737DAC06DDEC E7E8FFB2A39448D06DC71BD3B FE9B3349FD8FFD483B6CAB97928C7 0BEE99BC9C1AB3F57D2BC42D137BE0E4D2E42EF70AC82E10C0D508A28631C43788F67EC6C B86B0A3C 7165ECC2F14D041341F334B66CB1C6559F278C6 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\icon-timeline[1].png Size (bytes): 564 Entropy (8bit): PNG image data, 14 x 14, 8-bit/color RGBA, interlaced 2F4DF0477FBE5E7EE D041EE5D FD E180E5390F6B7D5C1C07BBB945138D5 6ADED09807D706AFE8CF4CB094BD204DBE27B0CA9062AF7767A5471B5A462B6F B177D52305AF8B0D033EF D63095FEF06A43AD61C87E4FD55476D966CE22DA111568FB6DE8BB4AAAE7D 6A6DDBDC03C08825ABFFA808EF09C7A1C4E785 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\icon_address[1].png Size (bytes): 677 Entropy (8bit): PNG image data, 15 x 17, 8-bit/color RGB, non-interlaced 5E11A28FEF84C7CAB85F1B26F9442F02 20CA192958C2E0A8F054A9410E7011B1ADB22A66 FEFB0FFA3B7E1DD5B931DBB9455E4B C2A4D258696A9564A7E5D6DC6 1B21BF1DA57DCE18FACDDFB2B55DA6DDE43A86525AD4A88756A4939BCA9F12AC65332EF7762E45D5C8132E E2F6F69D8CA99E07499E1C6B15793A37F2E6 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\imagesloaded.min[1].js ASCII text, with very long lines Copyright Joe Security LLC 2018 Page 29 of 357

ID: Cookbook: browseurl.jbs Time: 03:38:04 Date: 30/04/2018 Version:

ID: Cookbook: browseurl.jbs Time: 03:38:04 Date: 30/04/2018 Version: ID: 57282 Cookbook: browseurl.jbs Time: 03:38:04 Date: 30/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature