ID: Cookbook: browseurl.jbs Time: 07:59:30 Date: 29/11/2017 Version:

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 07:59:30 Date: 29/11/2017 Version:"

Lucy Gray
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 07:59:30 Date: 29/11/2017 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: Data Obfuscation: System Summary: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Table of Contents Copyright Joe Security LLC 2017 Page 2 of

3 Statistics Behavior System Behavior Analysis Process: iexplore.exe PID: 3072 Parent PID: 548 General File Activities Registry Activities Analysis Process: iexplore.exe PID: 3124 Parent PID: 3072 General File Activities Registry Activities Analysis Process: ssvagent.exe PID: 3176 Parent PID: 3124 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 3 of 156

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 07:59:30 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 4m 46s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal48.phis.win@5/111@34/20 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 100% (good quality ratio 85.2%) Quality average: 64.3% Quality standard deviation: 36.1% Cookbook Comments: Warnings: Browsing: i=3czqe1akz Browsing link: s=6970&b=3954&ymid=53czqe1akz Browsing link: p://premium.talktoapp.com/c/unsubscribe? i=53czqe1akz Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2017 Page 4 of 156

Strategy Score Range Reporting Detection Threshold 48

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2017 Page 5 of 156

Ransomware Miner Spreading malicious malicious malicious Evader Phishing

/ Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any

network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data'

Data Summary System Debugging Anti and other Techniques for Hiding and Protection

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking Obfuscation Data Summary System Debugging Anti and other Techniques for Hiding and Protection Hooking Language, Device and Operating System Detection Copyright Joe Security LLC 2017 Page 6 of 156

7 Click to jump to signature section Phishing: META author tag missing META copyright tag missing HTML title does not match URL HTML body contains number of good links None HTTPS page querying sensitive user data Networking: Downloads compressed data via HTTP Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Posts data to webserver Urls found in memory or binary data Uses HTTPS Social media urls found in memory data Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) System Summary: Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Classification label Contains functionality to instantiate COM classes Contains functionality to load and extract PE file embedded resources Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Searches the installation path of Mozilla Firefox Copyright Joe Security LLC 2017 Page 7 of 156

Anti Debugging: Contains functionality to register its own exception handler Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically

8 Anti Debugging: Contains functionality to register its own exception handler Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically determine API calls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Extensive use of GetProcAddress (often used to hide API calls) Language, Device and Operating System Detection: Contains functionality to query local / system time Contains functionality to query windows version Behavior Graph Behavior Graph ID: Sample: Startdate: 29/11/2017 Architecture: WINDOWS Score: 48 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend started Number of created Registry Values iexplore.exe Number of created Files Visual Basic started Delphi Java.Net C# or VB.NET C, C++ or other language iexplore.exe Is malicious Connected ips exeeded maximum capacity for this level. 42 connected ips have been hidden. main2.vodonet.net , 443 CLOUDFLARENET-CloudFlareIncUS create.lidstatic.com , 80 CLOUDFLARENET-CloudFlareIncUS zinq-cdn.imgfolder01.com , 80 AMAZON-02-AmazoncomIncUS started United States United States United States ssvagent.exe 6 Simulations Behavior and APIs Copyright Joe Security LLC 2017 Page 8 of 156

9 No simulations Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains Detection Cloud Link aussieshopping.co 0% virustotal Browse cdnjs.cloudflare.com 0% virustotal Browse 0% virustotal Browse zinq-cdn.imgfolder01.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN Copyright Joe Security LLC 2017 Page 9 of 156

$No context Dropped Files No context Screenshot Startup System is w7 iexplore.exe (PID: 3072 cmdline: 'C:\Program Files\Internet Explorer\iexplore.$

10 No context Dropped Files No context Screenshot Startup System is w7 iexplore.exe (PID: 3072 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3124 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:3072 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3176 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) cleanup Created / dropped Files Copyright Joe Security LLC 2017 Page 10 of 156

11 C:\Users\HERBBL~1\AppData\Local\Temp\Cab78C1.tmp Microsoft Cabinet archive data, bytes, 1 file 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133AA582C6F B10DE757DCA445D390B BADE C:\Users\HERBBL~1\AppData\Local\Temp\Cab7B76.tmp Microsoft Cabinet archive data, bytes, 1 file 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133AA582C6F B10DE757DCA445D390B BADE C:\Users\HERBBL~1\AppData\Local\Temp\Cab7BA0.tmp Microsoft Cabinet archive data, bytes, 1 file 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133AA582C6F B10DE757DCA445D390B BADE C:\Users\HERBBL~1\AppData\Local\Temp\Cab7C89.tmp Microsoft Cabinet archive data, bytes, 1 file 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133AA582C6F B10DE757DCA445D390B BADE C:\Users\HERBBL~1\AppData\Local\Temp\Cab7CC7.tmp Microsoft Cabinet archive data, bytes, 1 file 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133AA582C6F B10DE757DCA445D390B BADE C:\Users\HERBBL~1\AppData\Local\Temp\Cab7D9B.tmp Microsoft Cabinet archive data, bytes, 1 file 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133AA582C6F B10DE757DCA445D390B BADE C:\Users\HERBBL~1\AppData\Local\Temp\Cab7DCF.tmp Microsoft Cabinet archive data, bytes, 1 file 7D75707BCEDE1005E6791BA62D373C38 E33DF37548FC6595DBA6BF1593A12E9058F1FEC E5BE196FD70B7BF91EAF319CC125DB98105C9DA7A1B0CBCFDA A3E45C10422FF6660AD753A1E4BE45D3225C0E1584E4785BCAD10A00850FD915BE9B3F5FC8C17133AA582C6 FB10DE757DCA445D390B BADE Copyright Joe Security LLC 2017 Page 11 of 156

12 C:\Users\HERBBL~1\AppData\Local\Temp\Cab7DCF.tmp C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log ASCII text, with CRLF line terminators 5CC8EC A008E508E7E36E2795B 6A80D959DD3B30F3A3E9603BCBA7CB AF 22E1D4DF0BCE04CDE473892D19F561F24B3FD4A3BE1E89FAD0391A0E7AE9C123 F6DF100DD385CAB49F6FA6E3448A982F6585D30295DD76270D42B508EED832E82DC295CC100B3CA4FB15C15B3CA41811 FBB71EDF74D00DEBB3989BC374639C80 C:\Users\HERBBL~1\AppData\Local\Temp\Tar78C2.tmp data 2921CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16E2E6B3 437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\Tar7B77.tmp data 2921CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16E2E6B3 437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\Tar7BA1.tmp data 2921CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16E2E6B3 437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\Tar7C8A.tmp data 2921CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16E2E6B3 437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\Tar7CC8.tmp data 2921CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16E2E6B3 437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\Tar7D9C.tmp data 2921CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 Copyright Joe Security LLC 2017 Page 12 of 156

13 C:\Users\HERBBL~1\AppData\Local\Temp\Tar7D9C.tmp DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16E2E6B3 437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\Tar7DD0.tmp data 2921CDB BFB2FCBF0D3F86B11F 3C556A91995A3FFC55C8FCD71D687EF4560A1AB A4580B1B1601BC E6E299FD70008CFEAF0FE3AB DE6B3 DC7B3BD3A36D8B02C9D9E475B93E3A4FF3A4D5751A762B40AA5A0C8543D18B047B19DB31F18D1FF314275E3A16E2E6B3 437E3AC825A63AE895F13B82C7273E8B C:\Users\HERBBL~1\AppData\Local\Temp\~DF TMP FoxPro FPT, blocks size 258, next free block index CC01DEFFC6058C7B999DD598885F2CD FE F69B D ABFD 2742EE9F D10DC16DE1B99A6D7AA4C0BD DFFF1190A F977D40D2114ACCFFD37C25F96C7DB EEFC5E458A488940EBB5EB106A4CBA9E93BA361C84520A B85D C8B4CD765A5DA80F47ABB6154EB2 C:\Users\HERBBL~1\AppData\Local\Temp\~DF51FF3369D TMP FoxPro FPT, blocks size 258, next free block index A7BA7562DECB911E15529F267EC4E83C 7ED84324F89E733E752431FEBF162B4E1F66F9F3 A5C742EF83D0E5969A36AA5E12E5C59E3629E870A7AF051154C943F10B32101B 5AA22A2D02898DD9CF072F89BCF86C328E67A2387E2234C99E707130FED E4B39C5A6DF94B12F67B87A0B04F98 E2BAB91EC3910D5BF98D5EE06EA12E C:\Users\HERBBL~1\AppData\Local\Temp\~DF936D C75.TMP FoxPro FPT, blocks size 258, next free block index F6A626835C2A804352E584ED22837E90 36E6176FE58B3BD63C35AB7AA0FBFABCE3E0228F 8894D43DA887CFB754936FE0541C196DAEB75CC072AAFD37B0BCDAB8ACD3351A 4AC04B5E45F32609B0E9876CEE3CDE864DCAFB33A1A2F8E61F BC509A62178FE650DB09BE2D4A8208F07235A4 3C51AD036A2AEAC0C3D0025AC0B7C32 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC C193A7AA85AA5B_940E452E20B0168EEB754C6CB5110C7 8 data F4840ADDED188AE3EDF A77675A A E16BA50253D 88408BBB933957E3A0ED9D5EA0A617949E048A15BB830061E46636AD9A6CB329 4C4B0B52CB9801BF98F142DFD553D9DB58CF52144E41AD29EDC58EB12B6D44C71D9100C0C285D950BF1B0FB18DB1627 E503C08F3FCF476EADC1C4DB18A9F464 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E7375CE FDBAF7D8B0755CBC5 data 6CD857B0BFAB236CBA758BE2877E3392 B B5794F017BD76B367330F3B3F85B 507F580F15DB3B6B3B02D66394D726D354498BED90CD C B67 6F54516EFF053EF32E A6869CBB17F72F18AC48CD2D364A6608B71F02D60E432981D812A B69E86F3 38E7740E5259E54C49EDC56FD0C2D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D data Copyright Joe Security LLC 2017 Page 13 of 156

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D 643E58FD8F66A89F88CC6196C3BE2A11 EF521B9D551C14FD98EBE24BF5B7B DF DD0C4FFE4BC74A2EBC80A8E1E4F5CD223D27E23E93174C62408DC4D590F9 7913C461F6798DA46C2CD7901DB45FEB1FB3689CD7BA80ADCB01D0BF54A644477B804C494155C9B885D9D7A62944C32D 5B24EBEC27E7556F1D70FF5CE1D93309 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\41B FB235D76D9FB66287FBBA9 data 6772D27E08D51A7C17316A BF2 421B BE4A7C3899FA89D0B09DD7DFA76AF 0B9A2B0FDA4845DF6E701D1CC3C13205D066BC16C023B5E300E43D7B0B65FEE2 D6C74FB12D6D4BC6E232029E6F207EE6B85B3C0D1B02364C47C15FA4BC79DAC7B20C537705C74E3FA2007CFE0BC40D0 D4BC E921922D460F09F8D6D05 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C622 0 data DDDF FDE4ECDD1F D95 B64AD81B45378E5E7BCF83F621D79301B0896B58 8E3A73DB4C7C3F9BE8E591C0E5272A6B70FB0D643D50004A92FA3287BF4582BA F927BD32D8371FD8BE3BCC7CB51810A28C8BBA91268D6C9B A62525E76D648A4C847AB158454B0C826B1024C9A E682820A73955E710CF45B895319DE5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B 4 data 9D36E0F2D9746C3637F2EF32165CB7BC 2A9E8B2100C90E14E261E39CD6FE50035BB82FF2 6AB03AEF445E3B569981C7F9405A867AAED6D3CB11CAFD5E61D7172E80C2A960 E5654BE6B5B0ED38854FA C7908B3E075D0562C9773F8D CC BF8F85E45558E7F2EA865D A8F9B51E F0E144C1946 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data D0F17ED1DA473B3C648D7BEB894F933D 8954C7EFCD5C65C495CEA209150FADCEC9120F1A 053A4F72127CAD65E547F4E59CA6D55B4FFED0B626D7C7AD2AE2B E87F E1A628F E800951E50C20380B6D2F AF3A54ABDA923607E4D2A332BA7564E2FD6BB51550B876A0F47A E9BD3A412D D11E84EB2BB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data B556CDA9CB7DD3505EFF20407FE6AFAA 9FF906CBEB2C5BFD8CC9C18DFF827536E438C A2993EDF894DAA4D7206B8DAADDD1A4BF61EF5E5E65CEB0B0212BA8D81 6AD756739D92B8490E20D4916BA6FB9C E07DDDFD948873EAFF788AC5635A7D D1EEE6CE1077CD 1ACCE3F92F01D700F8775CDB5EEDB9E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Microsoft Cabinet archive data, bytes, 1 file 480C3D2A312754D05F54F5B63E8A DD557C3961DC72EE3E9FE0F86C02E583E2B490 CE953CD8BB80B3CC324A23E3B6C216F62C75DD09DEAFB70640D89CEE0AB01EEC A17285C2C0FB63D18017A12735B7E92FC01B49AFF43BD4FB94E6F7ECBEDE9750AFD124A1CC84F2A1751F731F6AD0921A 0872C79C D4CB7D7B9E0F9B61 Copyright Joe Security LLC 2017 Page 14 of 156

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_169DEB87D3E09CE69CAEE87347BF2F3 4 data 139E7F72FDAF6C6C1756FC5D6BBC6577 E D3E33BEDC88BFCB38D FED45 74AAD FF76512B28F9B9AB155D4BC A1685B195E3C4DB2 414FB3F4E0730D7A82DA06D70B41FCD138B010E349A46DDF6E8AB4CBF7FC865C4F98AB2D64CB1CB43AB15D3CEB26F5 E702E25A3C6DC69075D170D6CBD6E335D0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_5C66EC7F0589EFE9D976DB021AF3DFC D data 81364E4E7EFD9CD DED 5815C55F1D89309F9DB74DEA6E08C2D89B541E79 A81A7F9C1E0B1C CF71ED6ADD A83F6F3C37BA79B88151B51646 FD3F04B4B52D0061ED4733A11A455858E1A27F305D906252B6E1DBAE66F197B7B0DEE10BE789C8D56494C9B0815CA8332 B16DAB68B8A0A80A4192A07826FE846 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 data 7737D C12FD0C6110 9D26B26C72E7BE FEFC C0C5F7 078C3D323B3B64D0AA265E14329D3D1948A3FA0FDB47E29F6F4B6EAC4E2C13D9 A6C83F5C73ACB7F33086EF3CEA511FA773468AA09B21B07CC7AD886BA84E847A91179A286060A6DD5DB4C AD 5EDAA1371EFA0A7650B6E85C9108E293 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D B 2 data 7E7FD6B6C833524DE77FC843B74154C0 67F9ACA909FC719B5AFE3C0FFE02B64CD21857DA 7320C2FFB0A CF6631E15C8AC829E81AFAD205687EB00A564760E5FB09 92ACCF5446DCFF3F03D8ACFA2E52112AD093EF70FF3D15250BE06FDBD68B2A143E4F9FECB355B4C6B980B50C13B0A93 513CC5A8F8462A7490B9A76972A1CD90D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data 6BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029 DF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A data D4AE187B C2D76B6DF8A8C1A30 B06F409FA14BAB33CBAF4A37811B8740B624D9E5 A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7 1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E D2809C8CF218D0B9196EC646B0C Copyright Joe Security LLC 2017 Page 15 of 156

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B0 8 data CFB EE4B9D6005B9306A74B 97E DE7B CE5ED BE57D7 BBEFA203BF12C822058A84C014C0CE6F5E39F27D C37E CC F3A2E7C55CFB83185B18A6DA81BF1B7A603E15D42D8CD6548A782C192C4E40F7534B7B60F1AA93F93FACF244C7 DACEDD84DB607B9F404340B750AFD260 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_FA04981E76B0A574CC A03EE8 data D081E422A98D5A45996EFEF16D7A3CA1 4CEA788F107C967BF17FA2084C712B6435C8D74F B71F453B057279ED3D161111A70EACF2B7EDE715C473AECADEE91E1D91E11FD4 33C4FB96933FC90F16AF7445D32A1B35FE3EEA79ECF2DC35CC1979F8CB7AE63D94BEFDB3459F ECC5513B73F DA3548C712E083805D8ADC9BB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC C193A7AA85AA5B_940E452E20B0168EEB75 4C6CB5110C78 data 68E4AB847D712F50F69E8E13A6536E15 A4E267DAABFBBDE6FC9EA8DB9D302BF6AE0431A0 53D41D7AB2DF18C8AF1C098B9E4E59CFA883BDCDEE5F11A945DFE8EE8FBA0E54 E3D14946BFEB39DDF2A8200E0AC40F386A1DB9A92924E8F502FCA4C4AF76DF2EB2D F95A866B433C C5 CAFDC153F299036E22C030811F79AAC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E7375CE FDBAF7D8B0755CBC5 data 20D599CB6E98E75D050A4674E6B95F93 5CC2C58AD6CB5C AECC6A016AF402E3CB B D90E48E EE365F2E20D352ADF90AE4E24E28063B31FD3D A9C18901DFB78A6AD3CD01054E04632F6AC41E8C9C7B311E1D0209B5EF47EEDD15A74F6E55C440E E8EE45A5 48E4BFE16C825955CF36036B2DB537F9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D data 1618DAA1CB670D8F72FFA43B0C7BCFF0 5CA8E49EFB79CBFC2F5E46D7A068D214556CD9AF 1BD162FF0E51046D AA2C3B3BAFBB2920CF7D2DAC9F98F923A6F5C1F1F A959AA99D5A48F652BF9B0F018291A360A21F535AE180D5C1AA7FA9E3842B2A5601CA55E476010D B60A59CEB CDC723FEBD5EBC25D318B2C5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\41B FB235D76D9FB66287FBBA9 data B3C973E29EB748A592577EEBEB C116B2F5CA15E959479A3D20D0B848B DC 3D0F04B69A9C2A9FB8025C5CD9D FAFAC8632E1CDEB70F8E59774F4C 7BA869881E81E0675F71DBBED134C ACF313C1E701C8A17333A2C590E64746A9D9B0D F29EDEA2BC88A AA37D5905F2C9E8ACBBACBC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE5 9AF8FC7C6220 data 0A63D1C7E6CC803A5B3D718A1099FE20 B4C52A1ABBE083DF72A0742EE3274B64E30411FB 5BD79A8D030FD9CA2D046478DAC356EAB65F C3BA9A85F8C16EC0AE265 Copyright Joe Security LLC 2017 Page 16 of 156

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE5 9AF8FC7C6220 DB52A E071883C7CA036D89E5DAEF4D CBD A2AAF6C015A D2249BCBCB2C85C4 CD45313C01139A45EBDA84F1A2E71E3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2 B4 data 0332DF D704C8E742AB55B81E9 4E410F625AA2E1444C5B5A7F115C70D8B9BC4A05 7DFCD660B283E822BE2A F41BCB72BECA3CDFF0F08EB9E99C 57A932DC3C3D0E272B5C6173FEF6DB733DC1946C047ABA8EE8FB198F003A13A4BC1C14E491947CBFC26F DB12 15A3AE9C E968E97176B066 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data E4DA5B B B60CC246 A271560D5CBF267992C8C81AAEC24CE3E8789D8C C94B927819D2EF4464A40D697A0F91339F327D20878C168F271FADA80776B4DC BC655F1A048A1E54F8507FAE78ECE81F B0B20086C811CAD61D84912BA125F6FB22EDF4E710553E54E288169E5 EF8C0788D3C289EFFC9A93D749D15ED C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data C8A FC1BF76CB36924D8E8E AA481C35E43A1B85F6E D8014BCFA9B2B6 E4DE50E A4EB6C2F8066F6BF B7D4D C 6CBDC0E12A66CC4C306CD804A98B35B57AB0105F942BE63708A5B970E96E0FDF09F201A175E4DD8BAFD4B660FFD7F0E F8FC1ADA7BC8FC4A7DD279772E76BEC3C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 data 1A356A674943BE53AADECECB82421C17 3A1D48DA96BEC194B573DAA460E C1D2B7 365A590E2080A0CFBEF27D299EAD060F69B8D0C77B3FC6DC725F911D062A83C1 238F8AAA751EE5A4DFFA88F401E17F83BBD7AAF0629BCFADEEFFFCFC0249B DFDF084DD B61D5532 C0D0C74E20525BE8C60F06050DE83308 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data 28BE0A3A4EBB E0F786C6 382AD89BED38D47D0F960D178D8AC7B4392CA97E 0823B E7A42DE83D7D0624BE F1FEFB4138A685727F8BB51 54DE54480B629AFBB9EB4BC002E5DDFAE2D FE459446DA3EAF741CEDFD1932A36CE58FF032435CE0DC111C 3F4CF EB1F8604A0FC200B826 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_169DEB87D3E09CE69CAEE87347BF2F 34 data C0F0B9B04F90873F9F8BD6A69AA1DB7A DB390984D C8CC150215EF2FAFDBA7034C 92963CD500CF2B2FC3F61B B42C17DA0D E2C8958F014D6CC CC0B42E4DF48A686EAD4015A45FF263455E79D6BC AEF1B5124DD64226E986D725A0A6E35580CAD B AFCC7697F6F DC C655 Copyright Joe Security LLC 2017 Page 17 of 156

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_5C66EC7F0589EFE9D976DB021AF3DF CD data 8303C03C780DB900FCEAA720F5A51346 C5D292A26BE2192DA7E3C84A52251BF2C0EE8FF2 FB7B01A9581B80F A4F D ED B5209AF15A4B844A165F848B65C067015D1D4A672B9FAC CE5EA9B35233E678BC84FBE3D4C98F8AFAF357B BDA075AA158542F2FC A79 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D 56 data 0CC754AC53C86D692DE4A196B91D40B8 E24584D AB5BCBC9E45DBAD7BC92D2DDE7 26F647CDDD0CB41B E D7A A1A2A8A A F C424FE56A5C1D5C0CC0A8ED915B61696CFDA8A5C0747E53FB5E610E1E9FC7EABD5CE787490A94 EC83AB9A5730C5B3F6AA5F3B08BC48AF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D B2 data A2E008E0688C5D79C2FCBD23077EB7A3 9B508376CD010A70D A5A9FF5FC49EFD6 E246866C1B591B88337E74EC51F599333AA17A816588C69E46CC316734CE5113 A4EAECCDE7F3C7F0869A78D3826FFA70E99A6F5C260294A6494C54AE60D E DC CA7D59C40 155E4B11213AB4980B A2C13F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data 6D7339B90CE99DA51851F91B68FC7515 C9DEC7C352C4F820A33C8F3D787C2E5B7970C39C FE160C03CCAB59FFCB359088CA0C700F11839B0F23BD53F9698F6DE8860A94A8 F5F78BB01C829C90191FFDE9259AF270AEBB9D22B7A6D7EA4E CBB006A316150E52866DC1A4EB43C632F B9B1C272DE B4951B389F6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A data E91ED08ED86DEE6E8E80BCB466DDB8AA BC684972B40E9D6879FE3958A B99CCD13 C9DCF401A024346F64A203ECE858AC4769C88C3D0CE6FE415DEA29DB155D8BC7 54AE A2648B8EE7A88E9CEE45003ABB4F8B33965E15BEA25E62980C9AC458E87DE0929AEC9440DE81357BBA026 5EA5F4CCE646BDA8BEA58055D8F9AEB8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B 08 data 18CFFD580D4673D349DE3F A536A0DE4BFEAA A389AEFF0F2B777 0EE7860D3A43C019F68429FB7BEB56F3416C3FC4E7170A9A9112D9861E3A0F57 F84DB675266D89EE77C592F9605DB2D2280EA8FF1CE7A9C3E4EAE8D F57A4D C623F95D37F457F125C A91EBE036FD06BCB885E8867B6D0A80 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_FA04981E76B0A574CC A03E E8 data 7AEA05D8A00E896262F0E623C969AC91 Copyright Joe Security LLC 2017 Page 18 of 156

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_FA04981E76B0A574CC A03E E8 648F541E8BBF67766EC2BD510EC5531EA282379A C9EFF7A109A5389E28DE5AD38B30DC6F3AD91236DDA36887C12FDEC76FE9D224 F20196A0A8E939FDC662984E43C57D31E6FA4F9F28DAF0CBB6AE16A4027FE3AF0D2C316186B8EA5A307DF431BCD4FF04 12CAD05DBB D86D24422D8CF9 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 5B188904E3BC E7AC4A4A 96607BA DF3A A5E83BA8683D 507C647828E8B817E23D90C7BE73B3105C32B D0647B35046A32BE BF5DBC8CBAD84CA240A2DDAD2DE73BFC434193A4F A E8C92D99AA6B0C5698C702FD155663DF 28916F74561CAE1F8C73C0D9DD1A9FF7 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data 5A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A609B2590 C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators FD0571C58C9AA61FE90C1736A05DD A3986C91D32D113B6D0CECD189E AB 0A69A5007EAACA135D20024A97B9622B0B59422A6782F DC54DE6 C EA35E692EEFE6597E4F2889FD9B6A9F5EB2AFA9B8979A705E0C3C8E8E48BCCFF5A9D21C8D90EBA9A8F0 952AE E5DBCA8B5FAE6F07164CB C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D0BAAE61-D4D2-11E7-B7AC-B2C276BF9C88}.dat Microsoft Word Document F30635B6C30DB46A8B569BAE69AEB3F5 B0621E3EF5F33434F EB5C6B278F540 2DEF235F1082D976F7E5044B F31B0042D6B4D53D3421D8FA9C4992E 561A9E8B3430EC154617FAC16A20B38A1595F3C8D86ECD518834A06641E4FA1D5B10F15B6D5953D9C55093BB57CD819E1 3AD8A0BE6770EED2F4BC681F4A515CD C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D0BAAE63-D4D2-11E7-B7AC-B2C276BF9C88}.dat Microsoft Word Document 265E58FA590B32ED9662C9E E9 EBA2BFE3F633C737763BE7EA5FA808A55FE510E9 1A68F5E4C6655E BD AF51404A5A3F3224A891D7FB7520B1 A26E23B6E7489E771CCB53B08F2CE0E77B97FC615FBFBBE942D7AA921631CBBC5EE065D5EB3BE FB B 2CDE1B F6BE2E2B0E2C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{DA D4D2-11E7-B7AC-B2C276BF9C88}.dat Microsoft Word Document 1715AD3AE7BF894043CB7AEA7EAF36E7 AADA340D39B64B293366A406E068BFAA8D9BF83D 335EC69766FA7AE7F4AB1A562F13D383ADC1BF8C8DEEB35A680E8751F9BB473A D7FB8E81FAF292395BE926AF0CF2C803763A9AA53D165AF4234D86AD5F1B5F0DCA1F50D02E19D7142FACCB5C61F2BF6 F6CC4FE8FAC1952D5FC1FDE849CC760C1 Copyright Joe Security LLC 2017 Page 19 of 156

20 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA2E7.tmp XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators E19AB74E16EFE96F142EB4 66B9CE117BACE5088B09B4AB506C CD 2B25A9DD5C47DA010258E1BC93D512B8E484359AF1003FE1B85390E93519C60A E01570FA713BAB17D4941A1D46605D5C0FB89635C E286F608A256F40D260B662CDAF2ED064D52CC57400DAD9B DB4FE1677D18559FBBF7B64068D2C75 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA55A.tmp XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators E19AB74E16EFE96F142EB4 66B9CE117BACE5088B09B4AB506C CD 2B25A9DD5C47DA010258E1BC93D512B8E484359AF1003FE1B85390E93519C60A E01570FA713BAB17D4941A1D46605D5C0FB89635C E286F608A256F40D260B662CDAF2ED064D52CC57400DAD9B DB4FE1677D18559FBBF7B64068D2C75 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data CEB3415F58AB5738AC3CC7 FBD50A2AFBAF33B F664B FFD6BE D04CA0F29407E1A7FD17B578803C9C09D93E211E3D6DFFD2A74EFAC83E 8D0A10488CC9A7684A386E A FDE9DAC746338D411DB91AF2C3C3128FFD8B2A FD A F7B2291C2DF140B5F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\3MqCRziw6rZYt9t[1].gif GIF image data, version 89a, 466 x 448 A37F6EE0C5A4F6DE80E24ABAEFF59EE4 36B8924B109C7875BE7E BDD00F5E BA7DE3466B6FB5DAAEDDB30DB6FCFCC42364EDA3C2C1EB681C1A FC36FAE5E0902C2A38FE13F5559AAC2DD2EA6C21981BAA A42C1C6DD34D89CCA4AA100CF74151A6D2C85C 814B59925A81F534BB8D39C8FFCF1DC85 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\IkLIZ1sE9d1xiPr[1].png PNG image data, 679 x 147, 8-bit/color RGBA, non-interlaced AEE4F8DB1DE4B3A6CCD3137FDC0FE930 C5F9045C19DF012DE703A30591B4254C24AB FE999343C F36D3DB ABB07C DA7A7F50D4 2C7C7A65FE37DFCFEE4928EA073C9597B7FF5BBD435DC25E83EEBAA940A7776B5D6AC3F9864B9001B760BD2AFC81AC4 2245B808F5D013560D15B91E53DBA160F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\OSX-Checkbox-OFF[1].png PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced 22E8105AE0B403A7189AE848303C524D AB2DEF16EDD65CE72DE60984FEAB567F67EFD E21C5112DF4E1F7815B7ADB5CD26BA1702F9880CB816B4CF5B678B8D0C 9B413A5203E97BDC6386ABDF474AE9473FC24BB389C F42E5D658F5BB B7EB5EC261B1209FD9D0A C341B1B3BB5E CA506AA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\RFUKAEBI.htm HTML document, UTF-8 Unicode text, with very long lines F2E8AB7A4C4AAC4461A974DA99EA93D2 FF7EF6F3CAFCAB8FDD0263F4CC742F9B0475AFA5 9EA56C1274FF5ABAE7D6D ECD853DDF5C86A D424152B0CC7F F79847BA1019A49EC5DDD491C9AB47C1A7A5F178B4C40E4F37BB2B54CC097AA454357A510195F119DC3621B32A9AB582 B345BE14EA3488D2ECEFFFDC0365AE93 Copyright Joe Security LLC 2017 Page 20 of 156

21 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\RFUKAEBI.htm C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\analytics[2].js HTML document, ASCII text, with very long lines DE39A19DFC75359D8EB0727CE0FA486B 85F77DA7711AC89A15348BE015119ED2D496B080 F8EF655EF916E39713EDE9C6DB56D7CA5618BD82CF5AC991DCD013F05E0FDFC7 264E6BD5F0FB67241C8ED169E9FB446E618F52E4A2D4CEAE70DAD65F C8A74714A3C1B73D24C651ABDE50EBD5 CBADAE3D143E4AE72B8584AD09AB00B69 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\bootstrap.min[1].css ASCII text, with very long lines 5D5357CB3704E1F43A1F5BFED2AEBF42 08DF9A F2CBD310C30FACD934E348C2C5 31FBD99641C212A6AD3681A2397BDE13C148C0CCD98385BCE6A7EB7C81417D E07BFCE0A0C6293FB41B1F2E2058C106B1BB1D65E097CFB8AB22D8DC0B7B0F505B5FD24B856C3CFF8B11BB02B4F 19838CB5C399ECC7B9B78D8A4C8A195C9 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\bootstrap.min[1].js ASCII text, with very long lines 4BECDC E891FBB9D38BBA01BE4 6C264E0E0026AB5ECE49350C6A E696CBB 4A4DE7903EA62D330E17410EA4DB6C22BCBEB350AC6AA402D6B54B4C0CBED327 2B5AA343E35C1764D83BF788DCCEAFF0488D6197C0F79A50BA67EF715AD31EDC105431BE68746A2E2FC44E7DAE07ED4 9AB062A546DCB22F766F658FA8A64BFA5 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\glyphicons-halflings-regular[1].eot Embedded OpenType (EOT) F4769F9BDB7466BE C12046D1 86B6F62B7853E67D3E635F6512A5A5EFC58EA3C DA87D9E23F8C3ED9108CE1724D183A39AD072E73E1B3D8CBF646D2D0407 EFC910C96B9F5C58EA11A84577CF60AE995503B1EE670BB7E7D4A413B F82600B581F1BD4EE03D71C76C1525 5F0972ED66AD969487B5A4043F472C4 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\iecompatviewlist[1].xml XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators FD0571C58C9AA61FE90C1736A05DD A3986C91D32D113B6D0CECD189E AB 0A69A5007EAACA135D20024A97B9622B0B59422A6782F DC54DE6 C EA35E692EEFE6597E4F2889FD9B6A9F5EB2AFA9B8979A705E0C3C8E8E48BCCFF5A9D21C8D90EBA9A8F0 952AE E5DBCA8B5FAE6F07164CB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\mobpop[1].js ASCII text A85EA54DA854F9B42860D3F7D34A3C32 9B705637EF37D38C32131F82966B0DBEB5C3AF7D A2A3E219EA51DE BAB55254A48287F A9C24F49E0291D9 F7090F D1A7F639DF9980EA6749A59EFCB63C4E81D997470C83C1C501C7275DB5599A2114ACAA5F28D6E01E44D 84CF DA5011E2BD9D87F0F760 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\scripts[1].js ASCII text, with very long lines 9E7AA7A18C6F31D07D6CA153C1DF A4D397D628C49AF7A29A5BA1DDC9B38175C 82F1B82D3EC7B82D073A8926BCFCBEF8AFD0E497C18B71A90493FE5361C643A8 Copyright Joe Security LLC 2017 Page 21 of 156

22 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\scripts[1].js B1E4B0B BF04C24669FA962DCB18E87F CF86A2039D662EB5D9DEBDEAF5FC6D6F8637DA8F5DD 8FF5ED8C21EC2F0F0200A9B90CA8C9C3 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\IQHow_FEYlDC4Gzy_m8fcgFhaRv2pGgT5Kf0An 0s4MM[1].woff Web Open Font Format, flavor 65536, length 23104, version E93FBBE131A59791CD820D98B A0B BD2646F511A09721AF 07203F2DB0617E381C5B66DDA78117B4E86BFF303D C294666D5E5DFC0 003F4BF70BAFD2A923D1FAA D363F3EF62F7C5AD900D6BDDD7099C03C114CCFA AAFF57E0FFED8CE 2FB9519BC7C6F2335BAE0000D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\aEu-9ATAroJ1iN4zmQ55BoPAkl-0rCkX4F4zIO 7lYWE[1].woff Web Open Font Format, flavor 65536, length 22860, version CAE8091DA578150D81958E217714A C162578FAFC20BA4B78A63097D85E19E8FD EB5E6D14C2AA A47CB6A4800E D5CD44E FE1C6 0511F99B4B4CB55CDA69D642A294E789089D00A2832AEA12CB73E386C9A1C0D5639EB8A812FD6930A397FF126DA4597A4 8BEF D58958DED40C1A99E6 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\animate.min[1].css ASCII text, with very long lines 178B651958CEFF556CBC5F355E08BBF1 97AFA151569F046B2E01F27C E9CD87CAF 8FE3FA119255ADB5E0C F9E092E85BCFF56AB6ECC0510BFA2056B898D 4F251A31B62B28565F41FA7EF B7EBC6BB89CACCB93429A5779C589F2F72BC9FB9736FC0DAC93CCB38AD29372 CF1189CC6452C3BF1EF31A DD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\generate[1].json ASCII text, with no line terminators 37A6259CC0C1DAE299A DFF0BD 2BE88CA4242C76E8253AC D E98AFE7498FB5DAF1F36AC2D78ACC339464F950703B8C019892F982B90B 04F8FF E405BF88DE102ED7710AC45C E4EE3E5F5A2241E453614ACC451345B91BAFC88F C E94E8CF4BE53817F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\paint[1].gif GIF image data, version 89a, 1 x 1 DF3E567D6F16D040326C7A0EA29A4F41 EA7DF B62712B5E73BFFBCD45CC F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87 B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D AC060DC3F8ACF3C1708 C336626BE F4D0ECAA7F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\q2OIMsAtXEkOulLQVdSl024H_cQCpNmkmj7HsM zmiim[1].woff Web Open Font Format, flavor 65536, length 22912, version 1.1 F6DC6096F C1787D9A722570A EBD32713B7B155AE9EB35F3D64B5A4EDC694F BED336164D703C1A3DA6F07559B7D7BE5B3B98DA19E283E575B4F7628D0A5 31F7DE9791FFF C85C CFAF2DF39B7194CA853E2D9F BBD78F68D75CE95FB14C51EB8BC947CB 7ABDCE8C07DF29B093ED013FD Copyright Joe Security LLC 2017 Page 22 of 156

23 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\site[1].css ASCII text, with very long lines, with CRLF line terminators B5E8759BFF5CE3B14D79666C08FDAB8A 82D0971D66DF3D6FD339C2F04E00D24EBC4CD8DE 3AEB555B764BD40E3904C9FC6AF91B3631F94C831AE160CC680EB1E813F D73A2294F554B87BF2E7787E7C0703E4DC363D1D0697C2170BDF3EEAC793E03EB D4E11C378EC6B086B86F0D C709C72003E2B30EEECFDCF809B179A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\urlblockindex[1].bin data FA518E3DFAE8CA3A0E495460FD60C791 E4F30E D37267C0162FD4A C C4B4E5F883F9FD5A278E61C471B3EE B6D129499AA7 D21667F3FB081D39B579178E74E9BB1B6E9A97F C165729A58F1787DC0ADADD980CD026C7A601D416665A81AC13 A69E49A6A2FE2FDD AA645C07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\zhcz-_WihjSQC0oHJ9TCYBsxEYwM7FgeyaSgU7 1cLG0[1].woff Web Open Font Format, flavor 65536, length 22804, version 1.1 F29D2B B6BEB5B29B25B8BC572 F439AFC6A45DDC AD5284F31ED5B0F40CC F73C9F5598D19C1D050C9D5D81DCC6A77B8790CB94129A C2B5DA045 FADA02932F482CF5C4232DBA0679A ED9C9C99944B0CAB069E84B1CFAD5DB4537D10987F294BCA7FCF F457E6538FF0339AEB430DA5ABB99FF C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\H8_7oktkjVeeX06kbAvc0CS-0kw_uRLN9JEz12 uqvrq[1].woff Web Open Font Format, flavor 65536, length 23132, version D91B E7D58D AB53604FC133342D353C4BCB DF78F D533CAB3CF0A064303E1F87F18BCB8691CD2492AA5BB0363 8A4330D66A00FCC59A CF1F038D74CCCC84094D0EE87D03924F6517E050DDB955DD9979A70E160846A7038F58 701D65533A771205F5D8AA86E9E363 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\d[1].htm HTML document, ASCII text, with very long lines, with CR, LF line terminators 71405BAE7F0E0E8C5E9C0C75C353D727 1B88AE47D2B9AC5FB7DC0BA192C9199B4D03D6DB 47C8E3B8949C5BA234C6ADBB4DC413753F0045D7E459EF9C0C4E8F29AC4FE69D 055D166ACC FEDA3FAE72AC3068A66E54F15DE7B A6D6649F7F80F2273E95A0A0983F88CF9417EB E6418A55F CE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\ _check[1].js ASCII text 3B8E3FD847A6AC888C85BB C4D E97D89DD396C400B942EA31038D8B88E050D3C30 32BD9B94367A02C30759CA3BF7BFEEA38A06C89499E502638F938B66CAC71C5D B4EA418392FF54C F1B1254A CDC93843E44DFA27B61AED35FE95CE327904B9C0A7F2DACC5701 B959B74FA5463DD18B648B3C72BAA2E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\header[1].png PNG image data, 531 x 140, 8-bit/color RGBA, non-interlaced 2FF2238AACC68A6441E46159A97DA936 D36C924D DFADF4DA82249DD15795B2E2B 25BF2801BC0D291632BF5B6B45200FF57854ABC240D401A2FF6253B5304D0517 F60BC7C9EF5FDBCC9026A23C464FA678308C12000CA8C548841B0F4DF2082E38B6ADC817E2C4D7D1847C5E3A4645EE8A DCA5D122F75FC45293D68121BF9448E5 Copyright Joe Security LLC 2017 Page 23 of 156

24 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\header[1].png C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\jquery.min[1].js ASCII text, with very long lines 8FC25E27D42774AEAE6EDBC0A18B72AA B66ED708717BF0B4A005A4D0113AF8843EF3B8FF B294E973896F8F874E90A8EB1A8908AC790980D034C4C4BDF0FC3D37B8ABF682 87D90A665C15D71AC872BD8BC003D C7EC7ADA6370B902B93C0BBD7770FE25730D946C7C6A465BAA95EFA74BC E78AF3F83AEA615AF35060CC8702A6C1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\lp[1].js ASCII text, with very long lines C54936E329CF2C87C C6C42DE F08DCA CF0BB7C01F A70F4D D376F0F46E0E0292A4A C0339DFAB166C0990C9D4F2300BA3B1D B22FC4DABE8FEA9ACE40A0A6ACEAEC0D62F731EB49694A41B50716C6517E7CAC782830A A437EDD9E2 B5355F4BEF1A AFC2D861D5A4F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\phone_check[1].js ASCII text C1717C F E4411DD7BAB 41C4091EC38BAAC8B3980A5A0C892534D00B8E6D 368C810B522E72E8F856AD6FFD9CB88C553E6F77F392BE7BD6092B22242C8CAC 8DADB344EDE4051FAC64A07B D E9B4F1F54D9128EE8D51B76EA7FF50DB624858C1BC1BC19629FE7C356 2D45F04F277FCAD77F2901E7646D6677 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\redirect[1].htm HTML document, ASCII text F220365C79A3A2EC3C91BCEBCE80E1E8 869AB1F3678B8079A6D47F9A895531B0290A81B2 96A01E8CC9FDC1604F B DCFD65A513EFC16BF58FE7030CBD4 34B9C2D32065EA6630BCD640AB698AC59BCF8149C0A5FBCF99F832795B0D5071B844E FC1B0B1C9A91F20DB FC2FC333E4C3F4F4C8D279794CDA214 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\redirect[2].htm HTML document, ASCII text 5B71C D C43A05C59 EB3A77F2537CF9817D A4DEEB666D2F1 5269A56D71B84E3F68AAA56C71EF7EF44353E2E79B8490DF167C3CB9EC47BCA2 B8414A416786C9B B33A8D2313B134258E39B29A71FE920C5F79352D6B0E0FD17C8A04DEC2A49DE535C149984E 7ACF2E9098C3686A77BEB0741DA4D1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\script[1].js UTF-8 Unicode text 7D1BE15030CE2BF5C49F391F8A03CA53 735AD F039079FDF73DA EB52FB FC1CBBF137B8D2F0B1B28EB44A28BD86A722AE499B5FECEDB8CDBFCEFEDF22A9 3FBB287B379BECC0CCBF938C1A83F3A756C7146DF41B3F2441BC2CBE14BA52CC8F4E47C57B780F1E5184B CBFF 2DF9D82E63ED6314E8A4AA238EA7958B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\style[1].css ASCII text, with very long lines 4B711AD5ADDCA3A469C526D5F272E3F2 BBA9C14670ECA7EE592DB48977D5AEE05270DB62 Copyright Joe Security LLC 2017 Page 24 of 156

25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\style[1].css D6FEAB1B0634C A694500D8259F C5313D726BADD0E556DB6F 4B6BD0D1CBDA1FB6AAB4A2BDA40B D8C4A48B6620AF402F5BFD2DC980EAD08A4C8B5E01BB3FD8764E E85447F A229D6954DB3D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\XWONLAJ3wDAJd7E[1].jpg JPEG image data, JFIF standard 1.01 D3E98E416650FADECCC887FBCBDC93A C9089CECA67385F6F65F8E6D12B2AE545 5C1AD6B13E C6C596185E7662B87EC8F7CB2E33120C8E94138C27C4D9 0C7EC85CF695DCB0CC3B040DB36EAA796424AF6879E50EDC325976C051E545211B610F71D E4A1034AD9D0A034 B4387FCC147B4AC3A32A776B317B23E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\bg[1].jpg JPEG image data, EXIF standard F3487F0EBFE4D FDE2878AF 0908EEDE4F8923F3BD64B96B81D979E90EAF8FB E3AAAD96DEB550C5245BD658C5192FBB37A4459A6E20941B E68CC23C5B168253F9B FAA1327D579E4F D40BCEB A5A31E73B3B2BEE1FD6B064CF099ED00C427 D008E551204D4EA15C0F807B063532F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\css[1].css ASCII text C2D826AFCAF104AC5F3D25F869B6BF F4431FC9CF232B00C C434480AE 3FF104223C89C7C470397BF16CCA660C8D1EE97891AEF5E6CFD6BE1BD0E75E1D 627B6440D7705D623D116A FEC21BA3BFD9244D2C56EC2709E9FFBC78F6B0E667FD373AEF F274 FFEF EA4F0FFB62CC23EC41 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\f[1].txt ASCII text, with very long lines 492BD5E90C70DCD622D301F77292A368 B5D A815F08BA59CE2EFF141F6F7109F9 3BD894051D3B2CF7CCDA11EC0AF9FEC052D48D27841D2A3EB A806F 20296DCDB2A5F8EA8E14CD534C2E13CBEF9C26C4885E01FCBC9D1CF996DD964BD946363C D04CCBB63896F0A9 F7523DF3EEE2BDF4B409882CD8177D26B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\favicon[1].ico PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 5B188904E3BC E7AC4A4A 96607BA DF3A A5E83BA8683D 507C647828E8B817E23D90C7BE73B3105C32B D0647B35046A32BE BF5DBC8CBAD84CA240A2DDAD2DE73BFC434193A4F A E8C92D99AA6B0C5698C702FD155663DF 28916F74561CAE1F8C73C0D9DD1A9FF7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\ico_finish[1].png PNG image data, 32 x 30, 8-bit/color RGBA, non-interlaced 035EC8BE8A5C468540D6053C81CA2C16 ADCD2814C16D57D8DC9FFFF2A82B7B1728D35B2C 9674E9852DBC4082E87E33BF641E74404D6F4A73158A07F22045CA444349E9BA 7027DD37683FC36E41A544E6FD6955D4B0771DF A43470D51E9DFD09307F3AF37C327EC4E141BC238172F008DD D57C C2A2927CFE1EAD24 Copyright Joe Security LLC 2017 Page 25 of 156

26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\iphone-1[1].png PNG image data, 637 x 261, 8-bit/color RGBA, non-interlaced DFB86CA992EE27D5A92BAE67A 3E32B8E1E4392F0B376B463BDBF C27 C1CF025D2826A0060BB9503CE0915C4BE29F721921D75A78F9BC93E987BE406D 733F95DECB2F240B9367B1A1B25A05105AE AAE5AF6DBD A EEA44E42EC8F6D25C0E7375DAA 81CAD79CB76B6995BA24E792F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\jquery.min[1].js ASCII text, with very long lines F03E5A3BF534F4A738BC350631FD05BD 37B1DB88B57438F1072A8EBC7559C909C9D3A682 AEC3D419D50F05781A96F223E18289AEB52598B5DB39BE82A7B71DC67D6A7947 8EEEAEFB86CF5F9D F7B60E1805E644CAC3F5AB382C4D393DD0B7AB272C1909A31A57E6D38D5ACF207555F097 A64A6DD62F60A97093E97BB184126D2A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\jquery.webticker.min[1].js HTML document, ASCII text, with very long lines, with no line terminators F78E1731F573B8281FE8FBBCFD62F522 BE78749F5021B8C9CB32220FDF5143D6FF4DC AEA358EA4427BF F28232C91BF522E7927F2E9C2A66D79F E B06BCC29C1F0A02F4190EB40E7B85E324F46CFFD3BEB1CF8A0B26684B14A6AFF851E B4F9E70491AF54AD E79FF819E98E764E7F149A0B4AB5A51 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\oBVz2rc_jWPsQSr[1].png PNG image data, 759 x 916, 8-bit colormap, non-interlaced 7C4E79E49B6E487F00D55B1B3A5DB211 16A35AF2F5F466C BBFDA5F9F8E94CF276 A51BDD6510AAD1BAFCFC48A07AB7D4535B8081AF814D5850BD4B8A8FE893A37B A9B2A39A4BE0E12088F71C3200F11388D199BDDE30BE2FE50E009809FF42B3B266C58CC11263A703D632093A77CEBDCA 1AFF5E869C9992C46C F8EFDC8 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\suggestions[1].en-US data 5A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A609B2590 C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\template[1].css ASCII text, with very long lines 11CAB51579BA0326F38F4917A683D6A2 8F6E7D6510B2176C4BA949C4DB AD26BE 22C1AC75E6CAB9AADA0C99098EF38F637E7AD3B582EAAB27D839A6AC59E51C75 B6EB8EE8BFA041567FE87318CD6EE D5F D9D B682F2AC62EEDBD FDE4B79E88B6D20B46 ACCE0EC52191F2D5D40DEB514B5C18F C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\685EN3YL.txt ASCII text AB979F66A2987C0C0D948F712E6404E C33E C E6F1EC86700B B02E654D5B C195C64CBF6F66F7363DC844089CD63D9D4A79F54A 3B703522B4DAADDDBAF0175FD4ED43F23D8800D52FA96C1A271C75B59D373CA449BD69A03C84D6FB7D1A9E06CB44D32 D9DCB480511EA07CB775DB1F7A6B95E8F Copyright Joe Security LLC 2017 Page 26 of 156

ID: Cookbook: browseurl.jbs Time: 20:23:06 Date: 25/05/2018 Version:

ID: Cookbook: browseurl.jbs Time: 20:23:06 Date: 25/05/2018 Version: ID: 61270 Cookbook: browseurl.jbs Time: 20:23:06 Date: 25/05/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature