ID: Cookbook: browseurl.jbs Time: 20:23:06 Date: 25/05/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 20:23:06 Date: 25/05/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: System Summary: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Code Manipulations Statistics Behavior System Behavior Analysis iexplore.exe PID: 3736 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3796 Parent PID: 3736 General File Activities Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 155

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 20:23:06 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 6m 1s light browseurl.jbs ion/ui/login Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout SUS sus21.phis.win@3/93@42/16 HCA Information: Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Browsing link: aisonedu.com/letters_by_liaison_help_center Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3796 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 155

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 155

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking System Summary Copyright Joe Security LLC 2018 Page 6 of 155

7 Click to jump to signature section Phishing: Invalid 'forgot password' link found HTML body contains number of good links META author tag missing META copyright tag missing Networking: Social media urls found in memory data Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Classification label Creates files inside the user directory Creates temporary files Reads ini files Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 155

8 Behavior Graph ID: URL: Startdate: 25/05/2018 Architecture: WINDOWS Score: 21 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend Invalid 'forgot password' link found iexplore.exe started 8 46 Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started iexplore.exe 2 89 webchat.liaisoncas.com , 49236, 49237, 8085 RBS-BOSTON-SideraNetworksLLCUS United States stats.g.doubleclick.net , 443, 49245, GOOGLE-GoogleIncUS United States 17 other IPs or domains Simulations Behavior and APIs Time Type Description 20:23:25 API Interceptor 939x Sleep call for process: iexplore.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link crl.rootca1.amazontrust.com 0% virustotal Browse o.ss2.us 0% virustotal Browse Copyright Joe Security LLC 2018 Page 8 of 155

9 Source Detection Scanner Label Link s.ss2.us 0% virustotal Browse ocsp.rootg2.amazontrust.com 0% virustotal Browse ocsp.sca1b.amazontrust.com 0% virustotal Browse crl.rootg2.amazontrust.com 0% virustotal Browse files.mtstatic.com 0% virustotal Browse stats.g.doubleclick.net 0% virustotal Browse ocsp.pki.goog 0% virustotal Browse crl.godaddy.com 0% virustotal Browse a.mtstatic.com 0% virustotal Browse ocsp.rootca1.amazontrust.com 0% virustotal Browse help.liaisonedu.com 0% virustotal Browse ajax.aspnetcdn.com 0% virustotal Browse crl.pki.goog 0% virustotal Browse crl.sca1b.amazontrust.com 0% virustotal Browse x.ss2.us 0% virustotal Browse URLs Source Detection Scanner Label Link 0% virustotal Browse 0% virustotal Browse 0% virustotal Browse 2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D 0% virustotal Browse 0% virustotal Browse 0% virustotal Browse 0% virustotal Browse kmynd7o5mhzegqunf8a36ob1zaroiiiug1knpirkymcewz%2fleoqj83z%2bskukwh5co6 5xMY%3D 5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUz JbvJmLVg0%3D 0% virustotal Browse 0% virustotal Browse 0% virustotal Browse 0% virustotal Browse 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Copyright Joe Security LLC 2018 Page 9 of 155

10 Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Startup Copyright Joe Security LLC 2018 Page 10 of 155

11 System is w7 iexplore.exe (PID: 3736 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3796 cmdline: '' SCODEF:3736 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) cleanup Created / dropped Files C:\Users\SAMTAR~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): AC C11DF8C710AECD861AD9FE C9822AE66DB761C29CF683EA11A1E585C823730B 2C CBB07072D7A27F4599BC92EEA146ECEFCD8D02AE169BDF023794B6D 19BDE35814CAA F37FBFBD3CD489300F586C986AC81FB38E293F7D21D7B7594AFFA62EDAE3CFC6AB90 E B5110D81A98BBF F7B0E7B C:\Users\SAMTAR~1\AppData\Local\Temp\~DF1AF0A6BCA957BB09.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): B66F7C11AB87AF16BF8E B9DDF BBB115FF1DE650EB3EFB03F96FE39F177 C35AE20AEBDFE6765F1132CCA9BF48DAA3CF721149B1E3B02E58F7506A43B45C 4EDE8B84DF7162A74ED1B6507A0CC73117AB5097CB37BB9F34A46B01B7774B34F8856F46419CDF9A016146C54D A5B3D2D4A9EDC4D5DA4AA6E359E01D2C6E5590 C:\Users\SAMTAR~1\AppData\Local\Temp\~DFA52D5C855D8653BC.TMP data Size (bytes): Entropy (8bit): EEFA77D78B171E88EC723FF25753F F2800CDACD36C40B01C67BE B 80E7C8FD3EE1D2DF6D42430BC961BFF9CA2FDBAC4861E E0F70B3178D D15A482B2C393ECC5D38675B734CF0BDA674B72A17B1A94D8DA509CACDF4B1D11E53A240E7459A05B4F109FF4 BFC127F262C6515A554A17AD5913E7A3CA8D5E5 C:\Users\SAMTAR~1\AppData\Local\Temp\~DFB F1301BA4.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): BEDD4971A35965C3F63AA200F C1BC52BA9D2D5B66F9DD4129FE72F4E2CFB61C 354DBB F2BBD2D6E070C33DA0D9FC A7D13E24F1CFC957F0C0 27AF39CF20BED20E3AA2D689E58C6FDF3C161A400D65C3FB42F05D51AAC620E6284F19A7422BB4E72959E3D01C F7E AF FBE7D4B1A34C69848AF Copyright Joe Security LLC 2018 Page 11 of 155

12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 593 Entropy (8bit): E27FBE9E22048B D6BD172EA D2F68FD810A476A7106FEA6D28B5653BAB1F864F E281F517250F4CC5D274B849F13C9DC44DDB4EEE4A34906B8692C73882C25E74 589C67E234D2341DAC4449EE901CF13C2C5309EAB B3ACC367BD385FFD83255F0CE072D57F27637C0CCD 9E7A3416D EF4B D7EEF8DC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E D9D67350CD2613E78E416 data Size (bytes): 2604 Entropy (8bit): AB1579E53AFCCF C19D25AF FA9EF64F2F27D7C6C039BDF0DAD3814B1 FA8F31103CBCB150797C4E49D43F6FF150549BCE3D15511C ACDE12AEE F70E91BE7B8E437C98ED40B633A6E30E8E0EB25EB392BD6EF937D09B2A24CA478F18A3CE76F81ACC513781C2F A70BBF1361AFD8CF58A7AC81A06641E0BD7C14B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E5B83846ED89B DE6F9B data Size (bytes): Entropy (8bit): DF02B18C146FC3094FAC2F2193BE BAD83EE0920A260227C68FDAF3EA8E66E68 D09BFCE06E756D7F2CF9A90D2986DF FEED D9A98E138F5 A961171AD7307B7DA3BA1E D6E F6F0F872E8BA6A3A315FA4A1C5CCD7FF4F3BF11364EC C8E2F53996BC889302B72D59907CC648C974D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B177 1 data Size (bytes): 1730 Entropy (8bit): ED86BA180961EA77A465980E9F09E658 A F2131CD875A1D0E711BC B8535 B025EF6AF7CEB1CB30C97DE11F15B3BC46BB A1C EA6F2B92 4F3392A A6236D A5D2DAEA5F0B0682E6589F F90B6A27B7B6ECBD5630D88F1081EEC 99A1B27E7D836F4ECFFCC752330B54E80E3B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\55AC3EA1CF18B8109D01B5567AA383C4_153EC77973A0BE1BE83F51E D D data Size (bytes): 1777 Entropy (8bit): FDE60818E27BEF7B32F21D4CB05CA673 1F816E9F5DB7DCFA6520E3675E930EBA2DA9306F EA9248B73AA739FFC63E13DE4E4DD2403D96FD17FFD1AA EC6178C27F Copyright Joe Security LLC 2018 Page 12 of 155

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\55AC3EA1CF18B8109D01B5567AA383C4_153EC77973A0BE1BE83F51E D D F9ACAA89A3CAD921B7DC4FA DC6B3CE04A03459D9942B9E6232B05BDAA084ADCA084D32BE F848EEFE32CEC32193A2AEB6048F246AA4EA418 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Microsoft Cabinet archive data, 6509 bytes, 1 file Size (bytes): Entropy (8bit): B95F90C3BEA1D0E7ECA664B8FA01A720 A2ED44DF03C6971C0A7C335ECEF8D996D6BC0652 D82B D19804D73473CE65D84C4F7D64E453041A9B30CF96C738AA0C 4DB9F495F3B3E39D89685FEDD1F0C715E3C3B0D FB3F51D2B454943E7AC34B1F871C435299B799FCAF3F8 13DAA3BB67C33B221D27C721CCF0F4D67C033 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896 data Size (bytes): 439 Entropy (8bit): A76B87E3E2A9F0C864610B7CCBC3C AA0762C939E3155CCC4E051F9B2EF5B1D060299D 2176AE7D47513B54DADD14FF28C141A7BDC92EF6F84D211C B60D8644D D4D41551C97E8E422A9D7D9CEA3953B3A486E83B711DCB11E04CA9613A179272B3A685268F95BF78DB0EFB6B51 2C373A1F B4D2DBA6BC7ABA5DEADA106 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67F6625BC22310D5C99DDE12020DBD90 data Size (bytes): 462 Entropy (8bit): A68A2AE020719B8942F12700C2AA7326 8B382EF2E4FE11578EB042012F49DA87F2CC56E9 D605EF4CA0057C59A4E90EB65A86BFFCA2A76509F5D67A2B7C6FCB66DA48B95F E9E343A249A7E304703D C17A870C4245A84755B2592A6736A70CD921D0B249A14A7EA4E3C9674CED206B E0D D A722A7495CE672BAE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50 data Size (bytes): 434 Entropy (8bit): CA B3A8B8E912E7D2138B DEEC92073BEA F ECF6F2750B1B4 A7692AA2B5B2664DE344B922A091B7BA6F4FA01A4FFC80F279BAC31D4A3E468B F8DC07C60ABEAB1B60DED14C3D51C25A41F28FA7EC657A06038ECB2AFEF D FAFBD A 8ED5A2039A20B37F3A341518BACDD319C7B6D02 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Size (bytes): 471 Copyright Joe Security LLC 2018 Page 13 of 155

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 Entropy (8bit): F0210FCA CC216A E2 D10B86C6F353C30D98B55BFCAADD40E7D493397C 397AD878DB2D20AFD65BA634252E B089E1C9526BD D1221F9 C5CA0CE0D36CB0716ECC6E37F96C261EF4E992C6C6B03D7EF703252D5494DE7AAFB222089C8BEC0A52ECD39D CF B994898E994C7D29C8C513BB690DA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC _93E4B2BA79A897B3100CCB27F2D3BF4 F data Size (bytes): 1426 Entropy (8bit): B7B12F21B26EA4F2D6840A6A CF9A62BC700B4E12CE2F9697D3E338F32794C 44BF22BBF7441DB7A61AB3CD8C3962A8C225B195D28F9A54A57635C B12021FA0510E3E5B25FE7A FDED75990F93BE3225D328C2B6FA5C4E A2BF38E D0E056BB AE610DF632EF4A750 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, bytes, 1 file true D4D97C0055BA826C38805C0DF7E3C95E 9C051704ABAEC7E009AAA309A9E95D91FB386AE8 B901A8A0C45B8B8D2C88D4A85BB78D4DE87BF57FDAF4D447ACFC7B6AC863DF0B 069C93F7799AB98800B0E A14776AF2CEE137C5849D928199FB936AACA7C1D875465F0E093792C03668A04 927F817DC96896E7A42A4C8C0DCA5BB34758 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4451 Entropy (8bit): B3802BE9E45543B3C62D1AC7A8E2DE2 CFA00693CA2C693AAEC6F0130E0557D9B37830FB C7ED89957E06ED13EFD25EFC A961BD E578DD11BD49531EA B7F7F09AE71078B21C70CD4B4DE7FCD4F462D98A CF1B391E2FBC578BD724CFD AF F4C 5766D78CA0F537B4F634D51A6DEE07C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84F55D2FC6F6BA50E7EB ACD4 data Size (bytes): Entropy (8bit): E5A2A655D30BF906B6F161D4E5A FF39BC511B2072C A259D03AE5611C 31CA6C52D2851F93997FF2E27EA2446C33B8977EB777A80765C975AF642BD96E 52471B EC28DF96B412336DDBC80F3DA15FDEE6BA9C7F008EE4D189A5E451219BE83BFCFDED6E BFE44B0532B3683F5BB7D16390BBCA5309 Copyright Joe Security LLC 2018 Page 14 of 155

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84F55D2FC6F6BA50E7EB ACD4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\908BBCC0FDDA6F687B3F34B676C88EDC data Size (bytes): Entropy (8bit): F B8B5C0393B7BDA2795D1 916D1CE691F61E65BF4CC7ADC CEFDEB4 3803ABFCECE99387D38675CD4A34AA72ABAE1783E48FFB99AF3C224F41236CBD E39820E4B94E7D7234EF0EF25D2C415CCD457F382301BED778C5EED6997EDB2ED6998C A33B813903A A72369D96283AD071EACCD8BCE49D65941D80 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A6 2 data Size (bytes): 1744 Entropy (8bit): B185A80F22AB09EB77465C E D2F224813A9311C50AD6EC3ECF8F2E2652EC9F63 09DEF35EB6EADE8E5CE14C186E4A5E171E13C36A0B88D255B4A24417D19B751B 97746A0D3B25DF11BE13F3088E E77818A0B12B95E19125A4CBB97ACB52192E91AB4B AE8BAE C944318D92055BEB2693F7578F25439E6FF300 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD data Size (bytes): 1548 Entropy (8bit): E DA47034FA7C720FAB A7FF7B93C1B4E2C614A5BD329463BEB233207E2 918E907D95D440F52777BD10D DC201EB920D22F610F23B2C6A D49F29BDB6E5CD03250D711B9A1AD40AD2150E96E6E0FAB4FAEBDFB7D3F99C0D5B5F7AF38171BF2400D91AE 101A501A43073A71D1753A36F3524D9A792DF01C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F data Size (bytes): 608 Entropy (8bit): Copyright Joe Security LLC 2018 Page 15 of 155

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F 425BA4BAFED05B83120D4319B565AA08 14A D60E10A0B834EE6C9B9F762F83D FCE2ED7B48D566A1BCD6EFBA6A4AC8C1BA9892B7CFC95AE4BDEA7534A323C6A6 3D9C347BC2687A66F004D4F87773A5F0B3CBBE6505E015AB253B D0CD92E5FE8F37DD735A761203DF3A CACC8C326C57E43FCC7E768AAD3BAFFEEE11A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5FD5BF0CE6372B1CAFE381FD0BC969C data Size (bytes): 429 Entropy (8bit): EC298C64E5AACBC4DBD62633AA53A80B 5A5CA27645EBCE6B9AEAFC9A803C39FD3E2C8B5E CC4BEAAB8386E2700C8CED0C4556B2C24DBA47B6FE9F0BD4D9AB2B408C9355A9 874F02B0FCB2A7A00C79A E92B8E45A8BC6FF34B90E079578F3E4C A26659B737B2BB10CB662 9CF95F06BAC0F6D4240FCEA2675DB472AABF1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1434C615EDDFF9CCD78747A9820E2E3_53A10359DF368DD7638F036F79232ED C data Size (bytes): 1777 Entropy (8bit): BDF979722AAD0A4F6B985CD89560E5B7 1855FC6ADBF50C3AE0B6345F8087F92FF2997A68 8A4B4CA337C649F553481EEB00DE3972FF9FA15C73DBDBF7713B9F06DCC39FF8 76BB461D3AB67F E2C71AC6AD528369CCC87E0CDD2D988A206FAA7AA9F238CC065FBF21A87159A1 986BECC65567EA7A390BCD1C08F1400DB2F521 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A A396_D76DB901EE986B889F30D8CC06229E2 D data Size (bytes): 1697 Entropy (8bit): EA481F FA255FF5C93A6AA2 45B4F0B6BAB674F A72009B4F3F1F529D3 9F2F9449CFAA67121B5DC2C3C858C2BB5EA02C41D897AC31370B2A9C55CC3D62 E7FE1E68B9F83E42202AB67CCCEA419FA4ABAEC BDCF3FA193955C656E83820EB63344D854FC2A258E1 7D6ABF403CE3878DA605EE03BC808B9AB54B0A6 Copyright Joe Security LLC 2018 Page 16 of 155

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_ACC85EC5C6B5706C23B33FB C data Size (bytes): 463 Entropy (8bit): B567E4A82C73E66D23EA AA6CCAE5AAB65D32E2F53566ADE0B2B38A4F576 8BEBA1D123A01CFDA9D3306D7BFD2407F297607A6C006FA62C4A94AC0BF4A346 E917F02948A7E5CA8697C9AE3C9FB6A6C325657B45A9808D7A798CB876BB0B919CB98DD0AE7D619DCD1F2ADC1 5E47431A1E3C31A4EF8E738C2B8001A86E2C4DE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FC5A820A001B41D68902E051F36A5282_002E5E9FA D3147FDBEE2B73E data Size (bytes): 471 Entropy (8bit): E4FAB517DF21029C378F85FD6EE EFF830C D35DFDBA37A AE FA62CF757F6170DC527789FF83072ED9C39DFB457E7FA7BF38DC9B4FCCA5 2667B3CD610B12A2B963060F D57750BD018AF2299A60BDB26E25F6CDFD0FD5238C79E9F4A016C0B27C1B A FF368F81E11903B27737C89FA3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Entropy (8bit): AADD0DDA52D BBFAD FB356CD30D21F1B8CA500B7EDEEA611B7 E7CC04F73B8A0FC35F84B09A48FF996EE17AD8BC39DA6CD2F6B286574CCE9D26 F25476E7F12F4707B0B9DD1277ABBFAA3FF97D28E395E209FB09A9C213E14B90BE4F16E6161AE3BF0ACEC54234 E195331DC2BCA2CC1BDBAEFA02D8A34DD480AF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E D9D67350CD2613E78E416 data Size (bytes): 460 Entropy (8bit): C97C2527CF250E FBBC72A42D0 E69ABF670A19CF66B3F3CF7D37365D0BBA99D0EB 99B9EC731B96CC7EE7F9EC72D9E4898B7F753185BB C BBA2A18E5F3E6B15834E2EDF75C6C9A0E7B4B01DC8F532206A8F0C9DECE EC5317CCB30C55491B99 6C7EF058C6A7DE7F67E7F549FCCADC12B7704C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E5B83846ED89B DE6F9B data Size (bytes): 202 Entropy (8bit): AAFCA649BFC31533FE5CDCC7999AA0 22CD315D02C370F5F5000C3D0F B703F AC6BEB4718AA44A7F71E40AA4885B261074CD5F7F855F7DAA915 Copyright Joe Security LLC 2018 Page 17 of 155

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E5B83846ED89B DE6F9B 00A2EC9BF1B4A29A75C D8A9D4C00C1EAC44C2671CF6AADB5329A0E485772E94244BA B305E520 D4A4BCFD05071A5557FBDDE7FF1C048BC29D0A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE A660ED7C9DD9E7_EFF9B9BA98DEAA773F26 1FA85A0B1771 data Size (bytes): 450 Entropy (8bit): EE8345BBE15DE71AD07F10B6AB0D AD803B16DE63E156DD9E5F28433E657E98F31F 438C96B4611AC0E070C4EC11EE16B6A8318C331C8DFAA060DEF3CA8C6B A FBDCAB77366B501CE1AC4796AA0C0440F6F08F90DE10565C1CA41089DC9C7CE266F4FDD934B F4FD5059C A7EA609D467112A237A2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\55AC3EA1CF18B8109D01B5567AA383C4_153EC77973A0BE1BE83F51E DD data Size (bytes): 474 Entropy (8bit): A152A26CE6514B61424C1D136A04A 172B E62C DF098AD E7E79957C41EF9B C52EF56ED20DC3B5CCE72F92A0A98B714ABA1748A2 A5EBA62D13A8D1C E06B565D7AE D2F01E7C8464CA934001D2C3BCFFCA5B857F0B91FB27 C49EBD3C10BA172EFECB1E1089CF9DE1FB6796 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 684 Entropy (8bit): DDAEA4F2AD DD06D0CB 6A8136BE329D2B D561D39D20A8E61BBD9 EED1A5D28269A2A116A A16940C7E6D25E4BF4A16C7CCB26728DA 0C08843E50D27B5A90AC68FED07122D85C3AA1BCAA585805E3E94A3B54D E61298BD80DEC041CD4 8B2F11AA4218C5AD7AB24DF7C12DAA0A C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896 data Size (bytes): 280 Entropy (8bit): CCDC33655DE9EE8246A42B385A82B DDBCD7EA A01C56C03EEA B51834BB7E4D8F685BD45EC49761C180E528922EC8331D0139C5BC8AF62747B1 EC7402BA0C95683A09AC1AA4A D F845F25C6A25DD CD50D123970CD0AFF A651A024E5E8FEB3A3B67E6BC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90 data Size (bytes): 230 Copyright Joe Security LLC 2018 Page 18 of 155

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67F6625BC22310D5C99DDE12020DBD90 Entropy (8bit): B02F6C721D587D26681E36A560BD9 8E56CFBB9F9AF271078F4E99DFD CEDE0 7A AED985B72827E76124D26C789BFCA2EEAF FC2F70CA B470E5207BE6CF DB67E52F468C2CC A58A45A320EFD65736AE48298B2A18665F04C622FA43140 B2BEB15FEF25AB0CB80EFD08FFB5358A1089 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6A2279C2CA42EBEE26F14589F0736E50 data Size (bytes): 200 Entropy (8bit): FFA51D36A223EB509BB64EEC30C1C C2E110D67F47E5E7AB76D002F B41D4BB5A9B1D34F9B C9D10E9528FD EC72AB3C71C07 A3F73962C95C263AE36E8A990B8F29E3CBAEF802408D8A64B1E162B3E5EA81124D38FEA88D1AF8A2D9A42AA98 86D6356C08E08975D374D31DDCB7CEBD3041A9F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 data Size (bytes): 434 Entropy (8bit): BA467A83D77B2F608DA01F7 D2059E49F0498A1C AF037E0F7BF72E0 3B5372DF9A014F2355EDBBEFAD1283B1A32512E7B06EB0FFD402AE82FA6B5478 3B2DE40EE9C3926D191700A000CBEAEFA51D94BC9C8D344BFD962899D42F39C698F2FEC6394FDF3F532E94A1E F08EF0F547625ECB44366C820D85EA1A08A8410 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC _93E4B2BA79A897B3100CCB27F2D3BF 4F data Size (bytes): 884 Entropy (8bit): A47520CEC8A8ECA E16D EFA0329FC0A0EE833E0B80ABB4D41B3BF7BD3F07 D51CD580D70ACF6DFE945E9CC8AEC9730F729F8306FB74249DC6A148F5F FA067F3E902823C9CE7FE8B029483C10AEC33E1DFC717C95DFFD2633EC90658FB373FCFDB53F85743E7BF 8E314B110B9BA56D8761C714E0D1D7A6A93EE2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 990 Entropy (8bit): CFFB7AA610DC69A832073A2C27B E8819EBDC83FD52800CD7E82F7F2F ED294BC85F3A061D37DBF29FB4A6BF1AF4E0133A350FB0473BA789E7A697DD 135A2E7AC4B766EBDD4805BA D5D5FB18EB6FF7B5BEF357A257A642C34ED91F6511A7CD DF651A6B95317D3CAE904D367478AECCAD9B Copyright Joe Security LLC 2018 Page 19 of 155

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 452 Entropy (8bit): E458C58077ECEA4BEB A 2E6A757F830A82DA9CBE69FA197760D00971DD59 1CFDCB00951F59BD949EA5274D922749F84C384312F6C07427C7D7F99D17206D A752D09BA3A54540B9D9B718251FB3E76BB1B69B85E083E8CEE E9B859CA533A22E F2C58 39B7CC F0A6F32252E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84F55D2FC6F6BA50E7EB ACD4 data Size (bytes): 236 Entropy (8bit): A9BA648D2E966850BB5F8289A391B63C 0CDA9F7333F52F4C390DF2653BC1C47F A CCA89978F12540D F85D9EEDF0C86A98C93673DA58DF2DD5CC9E7BEF C5E8060AA AC9B3D038CC7ED84802F40EF9F9E5E5A5DCD4A15DC9554FA9E1C3F538FB1CD11A3C7500 2B48C4BA30AF9E5DDDCF4F51FCF6A9E8CB5789 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 184 Entropy (8bit): D7305E FEB D20FD 1A266E9FECF54F2864F96113F85576EB594F70AC A83D239DFA85139E67C6116A6C4DBFA6F0B5B70BFFEE0F8722C09EDB1B256AF0 AEADB2C136AFDCB911396C66F1AA76CBCF11FBF80759A0C DC445EC96C25D4D3A022128F38883C A3E1D3574AEF54E885B683CEFAB46C08E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\908BBCC0FDDA6F687B3F34B676C88EDC data Size (bytes): 238 Entropy (8bit): CDE42C4EDFB210758CDA7F2D BF7FA4FED0F6A022B52D720F04AE6561DFBA5A BA65F6AA343F738E0B5A9DAE1E0259CEE2AF49F0C39B924144B8036C4C 35FA AA82438C42F0DD08CB18A262238EB6670BFCF4FCB07B9AB62A41A5AD8042E6A00A361FE5E A7AD4FCF F7FF6AADDD B3D84 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A 62 data Size (bytes): 916 Entropy (8bit): Copyright Joe Security LLC 2018 Page 20 of 155

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A D426F46E1922CE5772B08B FD6FF71ADCCFBA4ECD4F7EA EC 0B502AA94E938DB6C09EAF0D943FE02E7F0BE251BFF1A04AE9FB44331BB D8FB11A36C122A87611EC3B18D5FC732BEC4942A9DE C116045B5D897AABBD54CC CF B B6CB94FA4CED4C01BEFF7B1F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD data Size (bytes): 864 Entropy (8bit): D E9C0D8A74EE8F5454A594E3 F408759B15025EEEFE2226CA88316EBB8F421CE9 EA90ACA8655BAD426AFDD32DDA888EF0DC2EB89B183A109FC48F3F13EBE DC8CD022BF5411CB2A581AB D49428D6724A5D0AF11F9517D19B44014CE68A B55B86E433A3 25F218AC4FF4B7811CECB86B8FE8922ECD8E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879F data Size (bytes): 276 Entropy (8bit): ADEEBF05449DA45FE0F960B7AC935E3 BB1DA74BD205F DD432FED52AB 34C D48B865720A6D E0187C0A3AA0C29420E6751E96995 AE5E D300D73E5DDAFD8F5E45610A3760FD46B29700D8C0589E60A432BC081C2A661564D2E1C3693CCE5 BE0DF43D991634B2F8E EE7868CD3B6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5FD5BF0CE6372B1CAFE381FD0BC969C data Size (bytes): 224 Entropy (8bit): A AD809918F73B2A99A3ED0 D426C561B34A111F8520C01FC81A9DF37F06E847 BDD27D3A4EC6880E385E37D615BDDE3868FA80444F870159FC1C171FBA5F AB07C0AA5C216306BBE6BCCAE2C88A828C61D FDE85BE0E3C7EFE5660EA1C8F13F35B C44 DF167F9C4BE423A1BBB5B77EC7DCFD507B25FE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data Size (bytes): 804 Entropy (8bit): DCB79CC31B55382E C4F1D2CA1 D C5FB0CA01D49E85FEE51EAE972D6D67A F2AA17B450AA4F1CD723DB6072BDDA86A43798EDF2C35E2983C8B5AEA0F9579F E72F102ABF6DBB3367A AA68F44B572248C10F9C0D98326D084E04FF63A36EFE209D6D3E3592FC5B7DC3 0BB64A02E0FA19B879F039D5A257BF42230E4 Copyright Joe Security LLC 2018 Page 21 of 155

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1434C615EDDFF9CCD78747A9820E2E3_53A10359DF368DD7638F036F79232E DC data Size (bytes): 478 Entropy (8bit): C97BDAC27CC04559C848D0A75E27544D D7C44BA6E FD93187E3B5E656A2743B367 FCC67EB2163E1E9DC057F7DE02E B51378C63B6FC0DF55545C772C9A6A 33F7CE4A97F5A CC53089D3A52A0A50D C8BE8AE93B EB88E8E0F01C78D B9870E4834DF4FA6AA6133B8CBB37788D054 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A A396_D76DB901EE986B889F30D8CC06229E 2D data Size (bytes): 458 Entropy (8bit): A5CDCC20B6F0DCF62C527E95F0B42B74 0B23FED3278A8C0AAE72086F19229BFE1A09CC B26D7D3AC482103CCCBDC3125C53FD0B4857E0D6D1ABB8E9947B D942A79A785A509B53DD44BF4BD4ABDA3DA6B4D7A1A7A9FC68711F792081E4ECFCC2E31DFB77585FF7EC CB0A3574A5CAD8A2FCF0313E8AA9A34A653C184 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_ACC85EC5C6B5706C23B33FB C data Size (bytes): 382 Entropy (8bit): F94CDF420E2105E734359A AF6001C369E3730F401FC79638B F15D9 EF1EBAC438F30B98AEBC58E7E7D1739B7FD51E5EC45C880A5D63C0A20DA2ECA2 BB5D053A4E59783EF64B99C7E590163CE17E701D76F4D4FE2C90B11F53BC1B1EB85E24F0C6B2076FCDB C1B0D015FA34A0E13886A863072F48110F5996 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC5A820A001B41D68902E051F36A5282_002E5E9FA D3147FDBEE2B7 3E data Size (bytes): 444 Entropy (8bit): C5389D0EF62F1DC5F85E20109D15AE39 BB6630B1BC8033F43473CA2FD44B7C23D3C559B3 C69113F20368F1E50289FDCCA36ED810739CE62D9E63E1B9E7B3C01A F33AF1CB54A142C43080A29D2AFCF04628E5458A2FEC4F84C4B53D6CA1B12EC3BB9D7BECF25CAE9673FA962F6 A616B8791C7A0C7C10D30E581662FB DF C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico PNG image data, 16 x 16, 4-bit colormap, non-interlaced Size (bytes): 237 Entropy (8bit): FB559A E77D F6541 Copyright Joe Security LLC 2018 Page 22 of 155

23 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B E8-B3E3-CCDA62336E41}.dat Size (bytes): Microsoft Word Document Entropy (8bit): FE5E22FCF526625DDB3074C8FF FF D5F1F91E197C3EEE B5938EE F2FC2FC9753FB5F27B0DF15047A E3FD E9D981B02C53F4C 851AEA C2CFB3E79C382EC1D81AC199BC5DF5A375329F1E8ED0FCB80011FDA738F3ED73C51D4FE58F 6292AE0A52BD5547F4CA2DC7BC57940E1A99B2A C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B E8-B3E3-CCDA62336E41}.dat Size (bytes): Microsoft Word Document Entropy (8bit): EDF CEB59F4D9E6359FA E625FFA2F5B17032E0D45FE6A C7D BFBB234B56B D6610B5D0015C8DCC75ED75F3AB967CEAFDA9BE515F5F 6F7F3C963AD84F0FFAB3F61A446E08BDFF938E64AED6E905A5E6D5DE2E3E469E43D2C2ED39176AEEE9B D1C0FCB99A778C12A0385A D6E29E458 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C04CD6F E8-B3E3-CCDA62336E41}.dat Size (bytes): Microsoft Word Document Entropy (8bit): C16D0AAF A4CDB302413AD82BD 6342B752128FC7F53248B837E4D96B939EA7BD94 E962E0D5C9F42BB1D186916C7E3772FA9B1C1E A28B940917E734A56F A0F370E34AB C59C2AAB5515CC3D01B079876B89BFCA5D7E1D243A00D2E4B4D9A612D7C5FF156C8E19 1C9AD82067FD9A0009A A679987A826 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\cdqwwe7\imagestore.dat data Size (bytes): 4472 Entropy (8bit): BAA2C4CC961EDE1B654E48EA7BDC13B 80F475250C9FF5092D47A4D6C346FCC048BED7B8 497EA146B872DE25BB9A54F33249ADEC01F5C015F4EC C75FC13012D3C 34ED42F3D8A9F5C9AE2DBF2FB58DB F1AD1698C69E4DE6780D427A2761F17AECB4D360B1DB0893A DDDDF0CB877F7BC479C75256E15607AEFA07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\Letters_by_Liaison_Help_Center[1].htm HTML document, ASCII text, with very long lines, with CRLF, LF line terminators Copyright Joe Security LLC 2018 Page 23 of 155

24 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\Letters_by_Liaison_Help_Center[1].htm Size (bytes): Entropy (8bit): E34734FBB41FBD028319B09 95F28F0818EF70E7FE92E DA206FEDC1 3FE3CF9BF0DE36005AE1CFCD4E2E4E4B2F40478FF0C68A3DBA82197FE736D7EC 330C4FBD4E0C07B52DC991E12D05A1910FB58E5D4AFC505EA287C3F84F255A0C F670707B030E7125F9A8 7481D96A8334CD0D5F7CDECB2A605CE9783C5 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\f1.widget[1].js Size (bytes): ASCII text, with very long lines Entropy (8bit): DB1159BCF66E7E84CEF7B42E C4EE7B6B1E0B15E53FEBB A79157 BC9A69B4E228472FAB1FA2653A205A4AF21BE D9BDD9FB4AE712E CAC62B86C5D094BB235CE A877ADDB FED063B2283BE6B0630D3C1515DF84AEDB674F978EA9C 856D7BBFF3C309F83B21A00E2A8E82621A26E2 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\f1[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with no line terminators FF4E85D08D9D41BFD754295D614D79C7 5D24BF42797EA56A1C62AD9848C6B435D6EB9FCB 5D F0C9E98D16A48E5E5FFC8CAF9F3A5B681997B650511F7FA61E2CD3 33D563E9ADB4B44BE92FC8E8BA537C130A80075C427FD760C4EC3950E657C2B16BE68BDB7EA7B961C887B4FC A99D9D180E9EA1A7F72868F73B898C58 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\favicon[1].htm Size (bytes): 710 Entropy (8bit): HTML document, ASCII text, with very long lines, with no line terminators 4F3A56FCB97DACCA023296ED91D0DC2B D9B89CDABDCF41DF9A16B0E10B46C9F70EDB98BE E F8E58E80E41E0635D686DD099A5AB0F4F4A82D2D383A A5CA97B142274A1F53EFC3D359C070A4DE1E54CB56718FE0899E5953E63E81FBD8E7AA56227B7C6026F0B61E0D E5FB080377CBF194B58D96E29582C3C82F29AD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\font-awesome[2].css Size (bytes): Entropy (8bit): troff or preprocessor input, ASCII text, with very long lines 6E4DE942FA5D6E2D4A8C77E0E5E40715 A635DE204A68098AEA809C52F4D20A32F65A06FE 448CC0E8BB769F39FBE1672C6E23D955C3F345E BCF71C30C7D301BC0 B622EEACE1F9F937FE8A04AD0E87F7BD C9051B0F5C CB8DC07A4D570E73E4D0B2FA56 C98816F3FF8E68E9A29D56F44F11AF618634C0 Copyright Joe Security LLC 2018 Page 24 of 155

25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\mindtouch[1].page#thumbnail Size (bytes): 3507 Entropy (8bit): PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced C6F21999FB77E01DB249A5FD628DAFE5 E2A3D8357ED334495D689E3D07840A702DBAC6F7 D3AC823E453C996D7519D6F5434C6B96B9A18679A BE965630EF D8CBB9E975D63CB03098FAC8C809B5515B4A98B2AFD38AB4B93C1745D88D ECB264A2CF D1BB93D7CC3A359B78D9523EF508 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\mindtouch[1].png Size (bytes): 1916 Entropy (8bit): PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced A76ADFE2A3056E84E26BD1C519824BDB A6BBA9075DEFE5459C5F04EE7A7CE07 7F69F F CF059576BFBA45D0D9DD5EBF611A52040B2B68C E7B78C69A0B14030BFFCCCC4489F871FAD E DAD25DAF795BA7EE CD26FFDF9F EF0F14F83B0775C91534D5ED3FAE3FEA8D978D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9CMFZC4R\urlblockindex[2].bin Size (bytes): 16 Entropy (8bit): data FA518E3DFAE8CA3A0E495460FD60C791 E4F30E D37267C0162FD4A C C4B4E5F883F9FD5A278E61C471B3EE B6D129499AA7 D21667F3FB081D39B579178E74E9BB1B6E9A97F C165729A58F1787DC0ADADD980CD026C7A601D416665A 81AC13A69E49A6A2FE2FDD AA645C07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\Letters%20Logo[1].png Size (bytes): 5808 Entropy (8bit): PNG image data, 199 x 56, 8-bit/color RGBA, non-interlaced 72B2501C EDC5C79F181402A33 C DF528872B2EC11AAA5A671728F1CA A09EF42861F2579C269B3AC C1C992CA2D0595D6C0FE10F48B 1D58F85E92045D463E76325FF22990CEF8F1AFA41F2789AB17E97459B562D302375CB96AD910A2A2CD17E4D562D EB98256A0FE11A32CB5AE4AF7F70218D882C9 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\analytics[1].js Size (bytes): Entropy (8bit): HTML document, ASCII text, with very long lines 64615ACD5DA6E5ACBD0A54B34174AEFE 8DB13CF86FA09D44B60D8E3E480DA B00E 3FAB1C883847E4B5A02F3749A9F4D9EAB15CD D3B2904A1A4C8755FBA3 E FC0A3B8380E9F8DAF79BB521DAA5EA545E9DDB01DE8FD38F70E30C224FD8018C349EC8F32AA9CEC7 470F204378A70DB59EF3EB E Copyright Joe Security LLC 2018 Page 25 of 155

26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\analytics[1].js C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\favicon[2].ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\login[1].htm Size (bytes): 710 Entropy (8bit): HTML document, ASCII text, with very long lines, with no line terminators 4F3A56FCB97DACCA023296ED91D0DC2B D9B89CDABDCF41DF9A16B0E10B46C9F70EDB98BE E F8E58E80E41E0635D686DD099A5AB0F4F4A82D2D383A A5CA97B142274A1F53EFC3D359C070A4DE1E54CB56718FE0899E5953E63E81FBD8E7AA56227B7C6026F0B61E0D E5FB080377CBF194B58D96E29582C3C82F29AD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\ui.widget.helpWidget[1].js Size (bytes): 992 Entropy (8bit): ASCII text, with very long lines, with no line terminators 947A A2C1928D688D55CC501 E06EE51634A11ADA4FA81BE1A512759E6A4E924B 8E1ED2C33A2D00FBB2777B6284E3A7A7164AA0A6978DB1A9EE0224D09EDB9D61 0CF AE ECD8A02E38AC202F12FB2697D2DC1DA099D63896BA8240B7730A6BEF0636E52E3488 A07E3584FD55F385F3AC35345E3CC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2PG59KZ\ui.widget.lsfOrderedSubpages[1].js Size (bytes): 2501 Entropy (8bit): ASCII text, with very long lines, with no line terminators 8C0804BF5891A DBEA99D1A5B 41B6FFA35FBED7FAE09E99E8CB080AD73A1022F1 AE7948FFF1834F5F4A90861D0CD1AD895069ECA836FB E3924FE22B1 39FED8179C14E5FDA1B4D4DB94B1AA64BE6D007D77B63F7F9C5C27164E6F2260B2B6B889FB4891EC02F5EA6422 9E6DF698FEDC78F53485DB0DE278A44AAC4CD1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P3GRP7RI\ favicon[1].ico MS Windows icon resource - 1 icon Size (bytes): 4286 Entropy (8bit): C09648CCB3CCCE3A32D76CDA5276CE68 Copyright Joe Security LLC 2018 Page 26 of 155

27 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P3GRP7RI\ favicon[1].ico 2CA31C73A16C21F5947E674ACF78C4B016F8D7C2 424C292BED8FA251C817C2B840CB2654D3D2C FBE9D2D78F37C992E5CB EBC48852AE93F377BAF7961D242C3268EB98538CB2A79847FD28E5073A771E9506EE A5AFD6BE67FAE9E 8E78955A5DEB1B4B94F36789BCDE2FA846BD65 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P3GRP7RI\FileSaver.min[1].js Size (bytes): 3845 ASCII text, with very long lines Entropy (8bit): D8F6EDABADA552D8F8E0FAA1AEB FFC9AF1BA1FAE3ED85E460F48D4EF F9558E341D25A922FB813D8E6F77F2AC6100CA13E DCA2AC7761ECBA 3B9650FFB A87A64B25C8BE8D93ADB50909AE04440FE E16E129EAD9B3F AC35CF986 E3CBD5D9C1A08316AAAC39653BB988EF12B86 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P3GRP7RI\jquery.signalr min[1].js Size (bytes): C source, ASCII text, with very long lines Entropy (8bit): B2C1B92D9DD64C9C F631C037A C08F985A0C6452D64D77A216C14215D04B038CAF 0CC0D31A DD302A096E3E5FEC3C42AEB9D38ABAF5C8EA190C B8 F2547E35C6F0AA56E446A A1C89B0D3003B26D7413EFDF713FBC084E7E1B2DF2F09E7D64036F62DC6FA C391D6BA57A0964FE C25AF15E32D7C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P3GRP7RI\webchat.min[1].js Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines B7DCAAC4457AE14E6C9BA37D0EB2C09C DB9623C1A06CD6BD3E196CC575ED7EE1552A0A4C 27D172C00598B1EB207F9E F2C F86025A49EBAF6B53C7F06E0B D251A4FB65CE FEBD6D83E96D61B90F75C A581B6A61A7632F C53F717A2D5F3EF20FF5E 2B981CB80D5286C2113C86D8E97A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULEAKRVD\ logo[1].png Size (bytes): 8527 Entropy (8bit): PNG image data, 300 x 71, 8-bit/color RGBA, non-interlaced 6DDC03F46FB4B7A4458F DEF4E2BF6C4B5CDA869AE94387B151B95A7 9DD9D25DDA BBD96013DC542C6CEEB3DAB C25A51ACC2D0B7F71 3C BA36D8B64BF807E997F8596D364B076AC69CAACFADCCEB7737B7B DFB CCA6C53E 7D612AAFBD0AF4ABC0F727C75BE1AFBBA6F742 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULEAKRVD\mindtouch[1].page#thumbnail PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced Copyright Joe Security LLC 2018 Page 27 of 155

28 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULEAKRVD\mindtouch[1].page#thumbnail Size (bytes): 2754 Entropy (8bit): C53F2063D57217C3406B7E335161E85 C41A407CBE E7CCB3D438BC5D92E11D E7129C52E357CA5011D129DB0F7C6CCC7979F460C11ADB981D98ACFEBA AD37E7CA0878CAB8D4E250D06C549A30F923BA489DE5C67E130C648A2AACF1ECEFCDBA4EF0FA9853A112A1EF 25A8C5D1611AD671DC5A0636E CA9CB26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULEAKRVD\serviceworker-register[1].js Size (bytes): 347 Entropy (8bit): ASCII text, with very long lines, with no line terminators A1AA840A6A410BCEFEB DEFA 6D46C594E3BE92EDCC75FE99DBA112BB83595D09 3ACA925FBE7D5BA24AD7220D289F9C30EDE BA99E958A978BEB01DA CA8DE1D6FC56B9DEED48484E8A49448B533BD6C72AE395EE626A75580E73B12472CCAD EF A FCD1CF16E1CCC DC3950AAC0A7F58C0D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULEAKRVD\skin_elm[1].js Size (bytes): 8399 Entropy (8bit): ASCII text, with very long lines, with no line terminators 3813A1EE2F DEB7296EEBC89F2 C CEE F1886C4117DD4C 78BB23D817278A6BE98B5AF824AA3DEA2F8F5843FCB81A8A946B BD 07B6BFF9DF64E4BA72F275DD8860A951757BCF7BCA82BB8A EE09C0023DE86855F3950A7918FE40E059D 871F2A22CE5C1CFE76B275B7F014329D982A6B C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\0QQY37UN.txt Size (bytes): 394 ASCII text Entropy (8bit): CE3C8EBE5E6FADFD3E29D11726D770A A5D5D3994BEAB00AA909FC78D078CE4D778919E3 C02710A0CFED2DF3EB DAE231F841A C95D3CFFE933588DE2 7B8F668C7712D334BA F4B4F754D1425F31691F92B89D869CD6BCCF7B6754CC3F36C114EADB0B09C581 4D551D32CAD9FC9032D0EAAE72C5C51E7A7C3 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FFGW7OHN.txt Size (bytes): 219 ASCII text Entropy (8bit): A811EF8C4BB71171BA8CA0F C6C7A58FB3505C088F3E6CE67FA76AC09 02E432EC161EBC13BF20A DF5ADB67AF2C14D916F9F8F629172AB 9E7D7FF77F09F9A6462AAF078F6E5A931A747B26FEFBE06A5FD8099F B2803DA4F5E00CD5B6E65CB3C7 D14F79BABE547851F0C1284E5350FAFEDA6543 Copyright Joe Security LLC 2018 Page 28 of 155

29 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\FRGADMJW.txt Size (bytes): 319 ASCII text Entropy (8bit): EBC61E7ACE313155F79A38A26A87E674 D3344BB8A268CDCE6299C5095CB5B1496C9987A2 8F94232F27F6E53B10C2B8D4E69B13E898A342E385F2E248A8EB30DD694C47AF 1BAB C4E149D69669E24D227E252E61110CB055DA255CA582BC49E0EA ED5C91FA92C6B8B81D7 11E94A44481A4507EB647C0A126FFE2347BF9 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\INP5KSBY.txt Size (bytes): 95 ASCII text Entropy (8bit): E1E3034E1834F11F7EF0B4D016D3D710 0CB91A1BDFC8126A97B2421ACF9BD03C192313B CEAA481602A1DCB39421CBE7B94202E421EDE9BD3CD C7 D72A3F681AE4A5C47AC895CCFBE52ED20B9FF01A BC34C9AC6C22AD52EDD4EECF4471CD2CE7CAC C99C855D929F16DBBFD E C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\IW78TBFA.txt Size (bytes): 190 ASCII text Entropy (8bit): DD0952ED4E7DCCA8D38C02C85E0E8D5 5F921E353BB2D3CC6B4CBD98AC2B22D09C6BFC5D 10EEF6F07885C5A990CC304DCF02C440D5A09E5FBF6DB51C526E64C9CE2E3B56 26C2DBF464F06D E0E55A3893E2B02EE1740D5A181771CB0BB409E8C991F1141DDC10E04911D14F5915 A4F5E2977ACA6A9F3AB3B704F1EF4B977C6A5 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\M7M63JX9.txt Size (bytes): 119 ASCII text Entropy (8bit): D7B1BDC2E6A7DEC502BAAE973EC407F 8B9CEA3491A554AB132DB98E6F569A22889CA A34EA1D700483D58282C956959DB3CCBCBBBAC1F6F50E09F114D E543A0C3772EBF1AEA88EA983AE28C435A7B531C0E5AE0FA221714A331E637E5FC F13F66E087AAC0B1B FADE2FD237ACB372E0AA5CC2D26B4B4EB40256 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\WXOXQ97Q.txt Size (bytes): 190 ASCII text Entropy (8bit): DD0952ED4E7DCCA8D38C02C85E0E8D5 5F921E353BB2D3CC6B4CBD98AC2B22D09C6BFC5D 10EEF6F07885C5A990CC304DCF02C440D5A09E5FBF6DB51C526E64C9CE2E3B56 26C2DBF464F06D E0E55A3893E2B02EE1740D5A181771CB0BB409E8C991F1141DDC10E04911D14F5915 A4F5E2977ACA6A9F3AB3B704F1EF4B977C6A5 Copyright Joe Security LLC 2018 Page 29 of 155