ID: Cookbook: browseurl.jbs Time: 03:47:54 Date: 05/05/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 03:47:54 Date: 05/05/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Statistics Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Behavior System Behavior Analysis iexplore.exe PID: 3344 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3432 Parent PID: 3344 General File Activities Registry Activities Analysis ssvagent.exe PID: 3512 Parent PID: 3432 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 454

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 03:47:54 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 7m 47s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal48.phis.win@5/360@51/18 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Failed Failed Copyright Joe Security LLC 2018 Page 4 of 454

5 Cookbook Comments: Warnings: Adjust boot time Correcting counters for adjusted boot time Browsing link: faxpediatrics.com/locations/# Real link is: axpediatrics.com/locations/# Browsing link: faxpediatrics.com/locations/# Real link is: axpediatrics.com/locations/# Browsing link: Real link is: Browsing link: faxpediatrics.com/locations/#greenbriar Real link is: axpediatrics.com/locations/#greenbriar Browsing link: faxpediatrics.com/locations/#centreville Real link is: axpediatrics.com/locations/#centreville Browsing link: faxpediatrics.com/locations/ Real link is: axpediatrics.com/locations/ Browsing link: faxpediatrics.com/locations/ Real link is: axpediatrics.com/locations/ Browsing link: faxpediatrics.com/patient-portal Real link is: axpediatrics.com/patient-portal/ Browsing link: ebook.com/fairaxpeds/ Real link is: Browsing link: Real link is: Browsing link: faxpediatrics.com/#home Real link is: Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 2018 Page 5 of 454

6 Confidence Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Copyright Joe Security LLC 2018 Page 6 of 454

7 Sample HTTP request are all non existing, likely the sample is no longer working Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section Phishing: None HTTPS page querying sensitive user data (password, username or ) Phishing site detected (based on logo template match) Form action URLs do not match main URL Found iframes Suspicious form URL found META author tag missing META copyright tag missing Networking: Social media urls found in memory data Downloads compressed data via HTTP Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Posts data to webserver Tries to download non-existing http data (HTTP/ Not Found) Urls found in memory or binary data Uses HTTPS System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Copyright Joe Security LLC 2018 Page 7 of 454

8 Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Behavior Graph ID: URL: Startdate: 05/05/2018 Architecture: WINDOWS Score: 48 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend None HTTPS page querying sensitive user data (password, username or ) Phishing site detected (based on logo template match) started Number of created Registry Values Number of created Files Visual Basic Delphi iexplore.exe Java Net C# or VB.NET C, C++ or other language started Is malicious iexplore.exe khms1.googleapis.com , 443, 49215, GOOGLE-GoogleIncUS , 443, 49249, GOOGLE-GoogleIncUS 25 other IPs or domains started United States United States ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 03:48:45 API Interceptor 4890x Sleep call for process: iexplore.exe modified 03:48:46 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample Copyright Joe Security LLC 2018 Page 8 of 454

9 Source Detection Scanner Label Link 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Source Detection Scanner Label Link cdnjs.cloudflare.com 0% virustotal Browse 0% virustotal Browse maps.googleapis.com 0% virustotal Browse i.ytimg.com 0% virustotal Browse 1% virustotal Browse facebook.com 0% virustotal Browse fbcdn.net 0% virustotal Browse khms1.googleapis.com 0% virustotal Browse clients1.google.com 0% virustotal Browse translate.google.com 0% virustotal Browse googleads.g.doubleclick.net 0% virustotal Browse crl.pki.goog 0% virustotal Browse maps.gstatic.com 1% virustotal Browse translate.googleapis.com 0% virustotal Browse ocsp.comodoca4.com 0% virustotal Browse static.xx.fbcdn.net 0% virustotal Browse s.w.org 0% virustotal Browse 0% virustotal Browse 1% virustotal Browse ocsp.pki.goog 0% virustotal Browse fonts.googleapis.com 0% virustotal Browse 0% virustotal Browse connect.facebook.net 0% virustotal Browse pki.google.com 0% virustotal Browse fbsbx.com 0% virustotal Browse fonts.gstatic.com 0% virustotal Browse static.doubleclick.net 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Copyright Joe Security LLC 2018 Page 9 of 454

10 Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 10 of 454

11 Startup System is w7 cleanup iexplore.exe (PID: 3344 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3432 cmdline: '' SCODEF:3344 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3512 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\~DF521165CC2DBA8E40.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): B18221EA7CFD93D6B4F117A08CE90FF3 9460B894D02FEAD6DB92535AADFEB59F27659CFE 535AF FA3D1FA560F9CF89E4E2F6378D6A66E6D92F22DF8D1FA3B A90148F6C942968E6EB75E1D312D6B AFB6455CAE5D32BAAE50517A CE0D635C77F0 2C220BD94EE850785D8C243997F67530B702 C:\Users\HERBBL~1\AppData\Local\Temp\~DF825A48A1794BB7C9.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): DB7C702F36FD90AF4B3ADE A848C77664B401806C82C850BF0FDFC FF2B88202A87CD5F41BEDEFCCDBAFED75993BFCC2107BF66EA9F918F5DB6 E75EE6ED41781BD6BB5607FB7D592F483493A2882B010F8CC015C32E08EC5B4721E306C6CFB7C119A961C4952C 29E40CD96553B142EDE32E52B7D979495EE3F4 C:\Users\HERBBL~1\AppData\Local\Temp\~DFE3FCC72CB10B1936.TMP data Size (bytes): Entropy (8bit): D7A5EF626F1058D7A9882E0012A48E 6E38B87549EDB78088B B56A1AECC311F4 E3CD6CEAA13CC19E00AF2DB20C651A89CFA3272A0A9D9011A4442F5D0AF E79FF73902D9AD8921ED08D2BDF2F9165D8C9A88085B F821B29814C37F5A5A028A9C20340F163D12 D7627EBEE13462FA3552CDBC55A7123D8A9E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 593 Entropy (8bit): B9B889B9EF82B6094D75D2F8CD3AC79 CD1AD6B634A0C40D1D46267DF58B806D9B5ABE B41E28B58A5852DCD609BF54D1C6BA5825E1A6C14AAC06857F6EAC688D0F 4B B2EDA93D8D2AE098FD4AFA85B360D1F4AB4FC9D0BED A983F894F1BBF58AB835B25C1B0 3F D76FBF614ED870D30ECBADB Copyright Joe Security LLC 2018 Page 11 of 454

12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ F846F08BEFE0DD8112D932FEF data Size (bytes): 543 Entropy (8bit): B9B4F88D68A9E4B614DFFACF8F56C357 5A709BCC5C2A CEB496A77DF5B AE9B71CC1F3781CF EF0DD8C3489EDB2AC0A71CABAB3F3C240FC6A255 C71F49875E681AC4EAF1C3E627B878E8C890764B855966E47F33FC12238B8E3110FA C18A87E50A3BB3 CBE4A07B9D26EC1D2108C02D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ C60AE785DBDEF5542B4B6F5 data Size (bytes): Entropy (8bit): F0CA156A2712F76F910B0911E4442E09 460BAF2D9342FDF05C7BB120B89CD389B2AAE9EC 4F9002AC309F7132EED616D7C9B43B7FC33640E995E81FE34FECDDCE71FED E6C6AF407A2252AA4575B92DAF424548A7EFCD9DB1E4300E840485CBA706178AF654F69EBA236A14261D4D3 B991B966E8A65ABBBD3B30A9B1CE971F2DA1E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 325 Entropy (8bit): C9F83285E07DF3F EB2BA90 73AAED9501B10A30A7B3E065F6F9D307C BA70FA6ECF842B869C47089E86B479E15A548FE9BC F22A0279DE48 08C3BAFF28F49B3310F3FA5F BF4D2789E883D7BAC16DEF54F3383EB4A5AC80B41E A4651CDC0 C2B7BF793D FB67B3416F5A94FA916ED C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF D1D277A171D8DF7B_F2DE72102A14736B534BA AAB62F0BD4B data Size (bytes): 471 Entropy (8bit): DF66D20D96A20E21AA74998B5BBB AAF3A6FD234EA4C47E8170A72632FCE1C9 1DEF3A5AFEE6DA6E440631FBFCF54EF4A5FDC37BBA0730AB185C9D3705F34D1E D3B482E5D26BBC09D07D0AA4AF36021B1AA66CDB14C2573B015ACD43589F33EA0D02E19EEC3B19A5C835270E5 14D0D302B0946DE30BFB773F23D22D09D1F43C8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Microsoft Cabinet archive data, 6509 bytes, 1 file Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 12 of 454

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 B95F90C3BEA1D0E7ECA664B8FA01A720 A2ED44DF03C6971C0A7C335ECEF8D996D6BC0652 D82B D19804D73473CE65D84C4F7D64E453041A9B30CF96C738AA0C 4DB9F495F3B3E39D89685FEDD1F0C715E3C3B0D FB3F51D2B454943E7AC34B1F871C435299B799FCAF3F8 13DAA3BB67C33B221D27C721CCF0F4D67C033 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data Size (bytes): 314 Entropy (8bit): F0F8A076657E58A66E6249DAF9E58F1B 7B05F2C0D33C70879D0F5F6206CB93AAFABE95B1 9F4B580503EB1D38F5EA0B3C59E67DDE5E5068CBA311D86D569433C1EFB4B490 9C8AE1E26A4451F3886F296799FFF982A6BDC2F66FAA330BE5EAC7091EF89E7738D86FE3025A62432D9C5AE B0A545A36BD6AC E5CD81D7B4A4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 471 Entropy (8bit): B888F6ACEDF622DFC0182A8197CCE4 F96CB2A18EDEAF9CB9755EDCF5ED77ADDDA02F32 C0DCF3DF26FEA5DD85A9429DE3A8F1AF2BC34FD092A21A951CE08EDE2B44C9EA B96343B16789B2E97AA678E14F73F72FB8C28841CF93F0B2C63E2ED9CE53255F5BBD8EBA101405FEDBD2 CDA0969AFD5DC254F22DF179E50BD5E6F208E9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\739F2FF4259CDC6CBE7B90F1A95601EF data Size (bytes): Entropy (8bit): E D EBC1AA9A74A92A EB62B7176D083ECBD345DF7A6EB378E864 F7FB189F2BC01D35A4D701B7AC66961B3B70F9D312DF632B0DAF1A5BA023C71B 8A66B5BC1EF1E43892E71113C8BBA7615C0E80B3FC69FE64F50249E3B8E4DBCB7A2F27BF29171B7ACF3203FB8 DF0355A593EF8EE917D E AABA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, bytes, 1 file true 781D21D8FA90334B1124ABB8FAE2D451 ACC2C199307CD2B265ABF33698AAF09E7E8C5B24 60D51BF555D2792CAD001CE546E9AAE7E0D1E860B905E75356EB29F9C86CBAB3 F91F9FD6EA28001B1C A DC65C697FB25ACF62CC607613BDB663C9FBC0D9BD07D56C83D1 A9794EC97A B7D5A000649DAC82863F7 Copyright Joe Security LLC 2018 Page 13 of 454

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_D0D81BAC EADEF5A854CE7856 E data Size (bytes): 463 Entropy (8bit): E76B1CAD2BE5C7620A9C200788CBCE3B F19C922E5480B6891CBEFDA8F CD8E295 BF2AD9D00A2D9906E43642CBF01598BCF6AB667F7CF44A962B24D0ADDAC8C599 18CB067CF9B833D4A1E4FB47A9D6FFF89A4BB2567F2B341134CFEE7FEE0ABD2C4405EB175946D10C25060F6E62 84F83261A15724DB5BAA36E1F2ABEE21545A2E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 data Size (bytes): 1391 Entropy (8bit): BF94D8454E53287EB3D9A3816F013FB2 3C6CFCF98F7E31B12B5A534B64EA01EA43DC5E5E B14D5DB0ACB2673CFB416CACE22AD258C01FA9C785A54B0DE9C4330D33E4E146 C0BFF1AC0CEA B3073F7B2D2D8766E3BDC7629F11E809B06F1E733C7934E78EA0175C4D5B5E4651C998A C83ABE7650B EC9C0C5837B4C52767 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4405 Entropy (8bit): BF2FFE7C12AF123F5B26546A50D05E C2566C AFFCB CF75E5819AF7771 F C1FC0281C842B1EEFF057750C956B863D0AFE9A3B1576F4F 62CE0C385A944315F13368CC5FAAB608089C1B AF0C5EFDCA5137FEE4590BDE4EE5C7EE4115CED9 63EBA D019C89CE64CFC6D E5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): A99E19642F AC33AF33D1B8A C8CCEE43E0AB479AD0542E3F8B715F13FD461CDB CD2A BB D34703AC4174C38AD925652F23467DB98A14C640 9F422752A3EFD97A A08E3147B67813B7C497CF580437C68FAE4B459F2A737DB326F7B6E2C5ACF53 BE5F88C998831AD050307AF8D09F7BC820EF7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC D220C7448 data Size (bytes): 596 Entropy (8bit): A200036B8165B24075E1B22 F93D2EC79D80DCE E208FF8A41CA2358DB FEB456CCDFC6ADB64EF3433A29F5638EF6DABE836ACE3CB936EE484FC363269B Copyright Joe Security LLC 2018 Page 14 of 454

15 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC D220C7448 C672364CAE5DDE117B651EACD828CA8543B3BF72439EBD88DF4A506127CBFC21AB2FEE5579D6CA3FED62346E FAF678C63042AAD714E130A115E035A8E448AA52 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A6E643304C5FBB7CBF4025F1978D6EED data Size (bytes): 356 Entropy (8bit): D583A9F5CAD487BA0ADD B ADF7ADAF06D239738CF2340EEA87996EC3B8694E C67A8D21EFDE14B229256F91B706051C9AF57AE4436BAC57EAD2FD4F3B61465B FB526E651BB F3371B603E6905EBBAFC74BF9A523271DE188E74E7EC839D86FDA95F36D5301F0A C42817DBC37CBF789BC7333E07D2674B3DC04 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B data Size (bytes): Entropy (8bit): E D EBC1AA9A74A92A EB62B7176D083ECBD345DF7A6EB378E864 F7FB189F2BC01D35A4D701B7AC66961B3B70F9D312DF632B0DAF1A5BA023C71B 8A66B5BC1EF1E43892E71113C8BBA7615C0E80B3FC69FE64F50249E3B8E4DBCB7A2F27BF29171B7ACF3203FB8 DF0355A593EF8EE917D E AABA C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): BF50EC404FB4A8B4A94BE8390D CAAAB7704D6221ABC5E A4928CEE50B1C 63B592179B1E9A528344CE1D430B9479FC55F43420A468EC35AAEAA9DFF911CF 0A92BAB2CE F1245B2D240D2CFDC84E2D1C484F9C7E36FBFC E0236F3D68E4F20E09F B029FDF859F965E5E446F47390DC93CF815 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7B4E43171BB9E412497B0377F4343E7 data Size (bytes): 665 Entropy (8bit): C0FC7EC6D88ECC67E0923EE47D40E10B CD441B B732BB92E3B22F62F4 B4B70625D79853B396A7344C8481CCB068A115DC9B442303C40B26999A86DD6E 63C93C1B2E363824BABDD F973EC3FEF8E3CE0347E7F55D E2B351CB401B016CBA962D2B B8F79AA7E7693A28ECCF0A695C1C2A9FFB3670 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5A B data Size (bytes): 471 Copyright Joe Security LLC 2018 Page 15 of 454

16 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5A B Entropy (8bit): C76E14E3052D5B93C2A55BAC538964EA 8BB617EE3FE384C4091F41AEF95EC49B FD0F1ED5ED505DD4838D2BD E1EDB4E754BED7A945DCF2D07DA7 5E872A8DB734E5057B04D43E EF31A6FDF29C541F7A5F043B21DC2BCBDACA0AD4F D4AC043C D059CE956FA9E4D9715D4782AD2B C53C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F12703B35B1F82C21160A C84_B39E0740E3A585756BF22C109A9EF7D1 data Size (bytes): 471 Entropy (8bit): EF6540A943B300476BAB38E7D5C8A77 DDBFC4AF5C4D9E930FAA97A04E2C4AF3FDF4C EE8E5495CA366D853A5A3FE F248B3E8D17EE C1F9AE9E72EC6F8A2D3BACD9DBEF0121AF7CA440927DFFB4971BE31F59FD0D12466C1C6C9D85C0684D 4B3DD57A EB0FF8AE9C035E7EE041E311 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_9CE57C1AF2E6D58DAA0CA B9A826DF515 data Size (bytes): 463 Entropy (8bit): A7B D4B865BD561AD3EEF18 CA6C90F481E93B1DA7B0555EE8D7759EBF58BEC4 7D72D2EBC04956FD6664B5184EECA1D772E4C8B16D1BD6EF360680BD21E61AE DFA90E38B261F3BE9BCECBB8947FD733D8D45C11E01CE61F8E2BD9B3E0210C7B474D387D6DCFE10C43 7B107A7C06B15E418B6D75EC D97A6F61 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F7E34C2974A5D01D347705C76E2FF5D7 data Size (bytes): Entropy (8bit): F0CA156A2712F76F910B0911E4442E09 460BAF2D9342FDF05C7BB120B89CD389B2AAE9EC 4F9002AC309F7132EED616D7C9B43B7FC33640E995E81FE34FECDDCE71FED E6C6AF407A2252AA4575B92DAF424548A7EFCD9DB1E4300E840485CBA706178AF654F69EBA236A14261D4D 3B991B966E8A65ABBBD3B30A9B1CE971F2DA1E C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Entropy (8bit): AE5A8387EEBB81D5A03AD17F27 ACFEC593F317DE0A6777A63C8AB4E4E84C97DDA5 2DDEB5D9F19E2F4DA16CAB27F5CCF E57109B8E6100AC0AB365864DA 09B54A9B4C953986A7659AE67D7FA25419B723AA3410F713AB099E1D62CCB7F7E8CFCC92A5FEB C F3E8A527A6FC4764C30115D0947CBC81A90C Copyright Joe Security LLC 2018 Page 16 of 454

17 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ F846F08BEFE0DD8112D932FEF data Size (bytes): 234 Entropy (8bit): C1136ED7271B17C2F9B93EC44D601A DDFA1CB3F87C6E B496499D276FBBA 128BBE2B6CA4FA654688DD4B8D9F5C6D952C C3F2E3535E8F20567B909 17D5C63F09F01FEE868EDFE4E9A533A011EBDC728A65E955F7ABB3B5521B430AAFB E7AF84AB4464A5B 8038F25E37C054C9F54A9C41DE331C7DE3B64BB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ C60AE785DBDEF5542B4B6F5 data Size (bytes): 210 Entropy (8bit): AFC19F7C2CBF8BA6949FB743BE2EE3 CA30705E12D4D50F9EE2C117F56FD8CDA04972C1 69FE1093AE0B174F9814F7C4A052F E2CF69719A6AD73753A4CB270B42 9A5D E7C5CC41F1AAF68F101DBB91CE9FE9E2D659B48E865140BE120C8EB6D8A457762CDF9B61B10C 7A8B471AAC8174E41DC7D6118ACE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D data Size (bytes): 584 Entropy (8bit): DA8F2C31886F303BC CA33 2C88E0A16EB2FC E616BF104E3CA FE0FACC33AF3B83A2452EF690ACE16A057BE ECE283DB3CAD9BF F687C0CBECA03CBED7A920E9FA3B4344ACCA68D8491D701EA2E068E82D8E99D25FC6812C90E39330F193 B90A63DB229B17F1F39F926FAEDFEF622D9F486 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF D1D277A171D8DF7B_F2DE72102A14736B534B AAAB62F0BD4B data Size (bytes): 876 Entropy (8bit): A9B2E7B5234FA05FACFE2525FBC72B2 9CC6447B996871F0D7D964A DDE E86CEFA985E40E22DF2FA11C81BDE319D6CF0683DB558A472D1A4F7A9E50B5 FFCB38CB9C1D9ED2C956141F6AFF59FC933DB35CE5EECD00130DB0B4A8286ED4FFEA9FC9BFB913B0FCAAA58 5E6F5222BEC10EEF0BACC2D95D2059C1984AED981 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 684 Entropy (8bit): Copyright Joe Security LLC 2018 Page 17 of 454

18 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 FB84CC2C99120BE7B4F829E20F7EEE47 3BE2AD61604B8A7E5AD2F79453A5CB219B71FF93 CFF6D2A314DEC9DA31E264D0C FDEA820DA53F58439DBC7BDCB2ADD3C1 1E6C31DBA4D5D3FB551ADF01D50899C EE662EA1558D7369B3F0A BD3F77D1253D4B7E01 155DE5273C1E4836AA EB7AF8B8CD37 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A FD38A8C0F9F data Size (bytes): 406 Entropy (8bit): CEC5545F D7A7DFCF54F1CF4F8 C B80A3F6B14B3289B276E33A6222DDE5 488FB931C0F70A804C1EF22D5F A9046B0F5BF72A D3B29A9F 8DB2D7520BA0AA50D68DD900DFEA6CA17D4E46EE691420F3D14CD425C8B8C7C50BAE2BDDD268C173818FD0F1 1BBA685DAFAB1B8ABE5C709C77608C1C9DA64316 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD AD517DA data Size (bytes): 438 Entropy (8bit): ADAD082266FD F8DFA5915C44 7C78CAACFB78CD9B430A3FF4A78A989E2919B414 DD D8991DB0EB3E4BDF6AD371F E90081DC84F97B460E08 38AD41C641C9462A90A7C1D8F2857AF8F09C15BDDA360C4D AEDBAA9FE86A0C86E7272D0C5FA3AC7CD5 2C08D0F70077F844A6C2C85DF08FB7A116AD315 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\739F2FF4259CDC6CBE7B90F1A95601EF data Size (bytes): 210 Entropy (8bit): E4FA3AF A87DB9A50AD A7D43A7E2B9AEB607AD3ABC6E8CF7E480377A4C 448E427D7B53CAC D2C44FDD167732D72B3CB9C4B3D4E74F6035B5E F7171E52E9A0D5AD BCE33E93BAE74CFD5ACAAE F74F13236D8F2E030A7E2A53A0B4B12 304B7839A88E C16CBF2FAFBA06832AD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 2640 Entropy (8bit): B228536D8EE13DE640EB24826EA095 F22002CB296B04913FFB342FAD6BB2DEA31DB411 7D31ABAE C2525D9CFA78980BDE2180B2FEF64E55378FF7848D E6F2B66A17EF061CD9F3A7D981A3F4F68823B1680CAB2557F75F3992EC84FCC63D8DD32FD859E6A7024E3A23F6 18E41D497628A2EA538383A993BCD771C30716 Copyright Joe Security LLC 2018 Page 18 of 454

19 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_D0D81BAC EADEF 5A854CE7856E data Size (bytes): 772 Entropy (8bit): FFD831394B E89CA D3A00ABDCF6F9F34C747BB4EB1F622F 791FF77AEE93AE5CF08FC68678DC78DE897B794523E21CEF62A1E778D381CD00 39BA75DCE9F75C4742DC71348BB210065B3C7F692C9EFF59CD6FC27D01CC0897C3FB31191FB80058C2D588CAC DC18270DB1D4C571C2DFDD8C29278D413D15A2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ EA C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D 56 data Size (bytes): 384 Entropy (8bit): BA335FFC C426A11F0207B7FD 73CB39064FDE1D BF8CD4A520E CC380165CF579EA1E93C ACE63F5E097A652D3C06040E57E4435A 83E387183C26FB1382A4396F672D1075AFBC2350FAF64C6C20FF120BC7BADCDC77149C A4AE6912E 99EAC1131C04E55FD3360B792F7215B1EDA10 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 452 Entropy (8bit): FFB7DD05C624F5A18CD02CA860C958C 2A5EA3E7F B35219D71E97F2639C6953A 30FB85BD328FBAC BE7090DBF1AA2F120D97B4380D97B34BA1AF3B2 FB03E0D4D5B2EA9D9E19E6FB4CC903B F67F9DA61A7D10D2BEE9ACE246251FC23FF07DB96766DAD16FC C16A03FF D8D680F4D35865C37B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 184 Entropy (8bit): C9965A CFD2106CF B7D4FEDBBA2DFF6137FEE07CB0FA15421C3CC763 DC851C028DFA1F9A98F096685D88FA000847D1681FD337D1989DE86E27F782FE 1292CD4819A24A5D3712C8686EEF3D2C224DA AFFB5402AB9D446A7C52FA117F40399DA8479F8AC E827002AC0DCCBEF7115CA57CB3AF28B0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC D220C7448 data Size (bytes): 180 Entropy (8bit): EB9D0D AC88A0344B10EAA 779AEAEE40FA0EBC25A0EF4A79122CE12D871C9F 0FF C F6AA372FF5994AA5DA4AE42945CF339EA936E82 Copyright Joe Security LLC 2018 Page 19 of 454

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC D220C C2AD1AA895B0E26710A75D04B1366C1B1A7C1EEC842FD6D2FF6E860C3CB2D426C9A7C6F51AAF629FF4F063 17D F FB888AB15F990989F4195 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A6E643304C5FBB7CBF4025F1978D6EED data Size (bytes): 236 Entropy (8bit): D05FA8CFC86C998507F1CAFB4738D8A5 7A02868E CB3354D90698D8746B20A86 26C0600B0C30D932644BA120C ED9C741E163ECC31D7E D4A6B EB145969C3D380D6A5D66CD31C780C2648C7394CF87EB0CB08EDE AF6715E EDBA3C5D9F25B BE E531E0EF4F80A73A9D82 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BEC6224B02D155A396218A2504F3EE0B data Size (bytes): 236 Entropy (8bit): CDE E64AABCA A8D066 D0B8601A82947CFA2F EBA85DBB0D 5F73D84233CE0BFF853ADFB0546D8D0EE486F423BEE1B59FC63B71770B06F57C 51DB13F385B26C FC4E470E3D1E2F2AE092EB391E45AB54AC3EE61AE2A70F659ABE3E45D9D49E4BCEA 7038C75C7DB0338FBF1B6DF20DDCCD1C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data Size (bytes): 804 Entropy (8bit): E1E28AD31DE546351F535E D8C8EF346726F9BB6AD F1D40CA 25410FF67E3A6281BB81C520A27C53D86B836DC9F2BD320C3AD092D8AED16959 CF B7B898FFFF9760FBFAF4FD3F9EB53D E4E27F4199F2E665CC278596C30E63BF429D4F8F4 5048FE4E7268FB6200CA7A0B013DC0D299E6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7B4E43171BB9E412497B0377F4343E7 data Size (bytes): 564 Entropy (8bit): FCCFCE96D0ACE88279A565E77A6EE 4FC2079B4AE5D1B31AD34887B0BB65F2435E751A E8A F604D72A5BCA43FF9CFB642047E2AFDB2A7B3E3C8C8FB6E3 2348F451E1F321ED47B4FC3BF75BCCEA7F7E64E2EAD6CD95F1345D256E84F6AAEC1BD310E942BBF AD FBECF1B966F5F22D980B3301DE33A0A2F C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5 AB data Size (bytes): 852 Copyright Joe Security LLC 2018 Page 20 of 454

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E B_C20E0DA2D0F89FE526E1490F4A2EE5 AB Entropy (8bit): E5972C390F11B5E832EF26E55809F687 E23965E68A5A751CFDD1A8E0AE36A302C7D4EDB1 586E4408C3AFA202D4DD6C341A449E B45C5CB8ED3C775C2C7A8B3B1DF C09DE516CD86AB0C22C66186A5D0CA647B2C407FE44B00785A180865EC67967B1D86DE783EECAEAC31AAE35C5 4403B06B28ADDF243CEDA4DB540D17242B122C0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F12703B35B1F82C21160A C84_B39E0740E3A585756BF22C109A9EF7 D1 data Size (bytes): 876 Entropy (8bit): ED3A141AE95AC684C14F0AF291BA FC4B30D8A58AE6C BD8621DC9B BEE98989DF30D1E5D46E6272EC0E895E5C0AEAE078E76463A506A8DA7CE C9C36CBAA C3A5D14E6B8338D08E486A1B9B2214C6BFD41F935E0D5A5EC3DB6952EDBD3C9743DC77 959A5DA2C81F9E64D44EE0E0AE7683F8AF2F5B1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_9CE57C1AF2E6D58DAA0C AB9A826DF515 data Size (bytes): 382 Entropy (8bit): FAF959037AA5155FB83F669596D26A5E 9A57187F2A051B38F7F1C96AB596099CD4998C9E 79867CF0F2BB3BE1B2314A1825A E0D75BD7DC1F26E886F2C5E168E 5F3090A66CD56B45BAA4EC713EF2C81F6C229407AB1FDE998D8F21A8C FFE87A0221BCB93216B82B9C75 BA6AA1348A4195C83E F901207D41A3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F7E34C2974A5D01D347705C76E2FF5D7 data Size (bytes): 236 Entropy (8bit): E7FCF2A2F8172E3679B8DC55A7B134B0 09D63B27F0052D371C FA19309AF7 A4CD5D6F9EE1A05A2DB15B30BE48CC87CFB60ADFA F772DD71ACEEB DAF3F88B0C5E01202C53A478BB89B C2ECE45385C300EFA0A65133D1A89BD880CE065C0178ED7D42F35C C0BFBB684406D4BC1E2243E2498EDF C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B Copyright Joe Security LLC 2018 Page 21 of 454

22 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\FIWHC0C6\ Size (bytes): 209 ASCII text, with no line terminators Entropy (8bit): FAB1D1F5780CEF90AAEC8AABA8F9C3A 1F FAA770AA1C50F4FFF69084CDF5416 1E6A63780DCC3C3110E834DE3FDDF8E598B219A7D30C2B C315F28CAB 870FE393C41354CC24ED4552F5750D662FAB6D109373CB45DE45681D2B3C90A459283F5116EA7D68675F548C5F2 B2011DDC9B285BBC45920A7BDFBB3480EEB5 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\HKAS5MZ6\ Size (bytes): 800 Entropy (8bit): ASCII text, with very long lines, with no line terminators EBDF2B F3CE296ED74F1BA6808 7B1C32E2EE5ED65CCC5101E33E0A2F1D0334C15F 8BDD1DFCB54BD1B525FF5343BE770D ECC7CD52D87530D7F00C623E 9A7CA6896B1A0487F4442D1B042AF88C054F42EBB0FAB00B3DCD3B924C2B88241B0F35A E30E3AA F10ADF8C2864F862F388DDC7349EDF250E9 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\YNDWNJC6\ Size (bytes): 171 ASCII text, with no line terminators Entropy (8bit): A4CADF7459C15AE877C48ED45D30302 E174F62F35BAF557E4B1921C867131BA52FC37E4 8D5EB23437A4038F0E834F9ABFEA1D2F4125E7A44765A681B6E F09482 F09170EBB0EED81347E38D3065EEC8464A038729FBA00A1B24A78C83D99BED7F81F320F075036E98B562FC1A429 EFFF9D43E32ABE45E49F76F98F89EDECEE67C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators Size (bytes): Entropy (8bit): DC14A068EDC0E9B6D9A7BCDB8E0D6 Copyright Joe Security LLC 2018 Page 22 of 454

23 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml D04F177AAAAF52B820E5E32D5732EFCD87 C0DA754614C3C4253F010E321E223EE925C605EB22DFE730B9B8B3223E3B6B07 01D57D9F8B52276D4BEB1F00425FB830B381ABF6D2DADDD C9A6493CB D869B50298B B D5F221BDCC80C5FF303F5B152B2E3F5EE33FF C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{71A8F E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): A65735AAB3425E271F26DFF83D5BFBCC 29F0BEC443A765C7E570185D5DA4E5A E7DEC C1DEBE6DBB06B1D2DB59E4B9BA8697FEE82E2835EE021F95518A 083F02BF7BDC82E363CC2D0FC711354E430D6EFEF40B7F0D0A908B621DDBEDCF0BE F04CDD4EDAC5C6 F CC00B E009FF DBF C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{71A8F E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): B55BDE8F0E5B4F C29ECE3297 1D144E7FD9F00DB0EF71FB84F4CC957275CBD259 97CA741EBA006C97B89354ADE040A58C3BD6E0C9935DE5721A6AFE2E3B4EB BD101225BDDCDF17DC628E08DA890E32277F8E F1FBD0A82D9B D2DDF6C4CD926599F74 085BF0EC B4C1D1D0C5D78BC2ED6817 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B89EBE E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): CAA7AE2BF299095FE4D92B80D C AAF529BD016067A0DD6FB284F7E94BD 3F30C65B71346ADF79D3099B92FB2E4106A7CF3CE61E91E994F1C3CD24166C32 20D1CC BCE08227A2A8E33D78498E2FF44B9F8B6875B FD615E B E9F483A3C0 DB4BD19DA73D25B7A58A6CD37434D367C3F C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver4EE1.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED97 0E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data Copyright Joe Security LLC 2018 Page 23 of 454

24 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat Size (bytes): 1034 Entropy (8bit): B4EA37D1202BD8B F EE8A73A1F56EBA7ECF19ED E289C8BB4 AFFDD01CC70DAA04ADC703106BB A CBA4D94F3D3F5FF43E7A 3FD028D1831FEB70C910B0932E97ED5B7B3A2A5879C B2056DCF693C4910FD428A B151A65DED B56EC6480CFB B16D1C76EE6BE87BC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\1BjrYUERys4[1].js Size (bytes): 501 ASCII text, with very long lines Entropy (8bit): AEEDC17BC3E604B70F86052C56C481F C864A4662A4C8553BAAE0D9023A01E7DF12DE4A AA4F2606E2941D860FBBFD1F8490BC6E32C68A85C4DAC316B05AE65DCF7 B74457D57862C6C949417ADC4F678971A683CF5A7D60EE70FEA FFCF3E6B6CF1AFF01923EE0C1493DF1E E21A404C3AD594098C1B0D25B048B2 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\AuthenticationService[1].js Size (bytes): 48 ASCII text, with no line terminators Entropy (8bit): A77F4DD1015A365F8A6C23BF839E5159 BEB8646C42863DAF60FA614EA1AF541DDE11F79D C54EF3DE8D44F12262ECBE64DE4BE86609BE39D2044F9D977FEE030203D5DEB0 46B6A80B231724C81F0DF2FF50F17445EC103D79E9DCFB92B8C50A68CCAA515144D EC29B51FBDEE80 D60813F4CD32DACC D54D8E2A4FF9F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\DVTZiMC2MF4[1].js Size (bytes): ASCII text, with very long lines Entropy (8bit): FF1BD47B42D1CE8170E EC61E5183FBC52927A0927A A058 67BF89A9E8F6DAADCD B9890DFA91B48CFD73E524498EEF89F9A3BD3 C4D8949AB17A DD807FE1CCE1752B80261D7F770444C93CF43B98A74AF21097C6E53649C1037F2DF0DBC 4E4BB42FD FEDBE36707B8A1E754D3C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JTUOjIg1_i6t8kCHKm459WxZqh7q29U[1].woff Web Open Font Format, flavor 65536, length 34548, version 1.1 Size (bytes): Entropy (8bit): A23705B28989D065E4CF02C0 A565A5B53BA3F7D7F4AB4A4F77A0ECFC586ADD49 B9AA6A020419D10026B8ECC01586D6741F8A5F F49B0A85CA6C252F714 5B1D95C2AD978F05AB4152BEA74BAB98F7B4281B4FD04FFD7F9B4A1EE27B0B9424D3900D37B27DFDD97EA0AA C9FD F59443A1B15AB90EF986C Copyright Joe Security LLC 2018 Page 24 of 454

25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JTUPjIg1_i6t8kCHKm459WxZOg3z8vZ2[1].woff Web Open Font Format, flavor 65536, length 36364, version 1.1 Size (bytes): Entropy (8bit): E74523BE D3767EA4CFE29E4 4C9A375BB4F3D640C55C543B05F1A7EA4B21DA7A 18CCBCD03081AAC9FE3B0ADE10491FC55C16E358F83D742E D 5E17DB1D74EA EBD3185E B D457C7B63D94A540994EDD74ED5FE9B3AD1570DE8E 800AFEF99872F4BA29E0CBB38D38EC48A1FA5 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JTUPjIg1_i6t8kCHKm459WxZbgjz8vZ2[1].woff Web Open Font Format, flavor 65536, length 36540, version 1.1 Size (bytes): Entropy (8bit): E0E5C7A3C548C2E6146B3F218849CE62 969A17BD790705C77147A05CAB51B44E4DA FBA4773C3F248FD81DA2E34B4D08DEEFEE5691BCEC8D87C2CB99AE962ADDD6 224B83EDA945F12B3FAEDCB5B9A0B97A042637E42B BE0D8A572A8C689A9F77B6903A06CCB8CAE070E 555DF851A30876E7F5EDD7D6E1EE89CE6465C6E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JTUPjIg1_i6t8kCHKm459WxZcgvz8vZ2[1].woff Web Open Font Format, flavor 65536, length 36600, version 1.1 Size (bytes): Entropy (8bit): F97B0B6DCF5A9B73FD64A6BE4D3251C 4C23F1BC272973EE3F257533B5E9104E4E4AF12D 7EB40E090A59D6CAA8166E802DB5F4557D4D76A9ACAD47E74D883C8DAEE0FDB BB66694F0646DCC36DC677178ACF0DE1659F560B96CE50B60B6E366C95DEB7F771DE53D204BE61CB36 E7635FC53D5AAA8DA2A6EAB31878A97B1439B1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JTURjIg1_i6t8kCHKm45_cJD3gfD-A[1].woff Web Open Font Format, flavor 65536, length 35040, version 1.1 Size (bytes): Entropy (8bit): DBF49D52D7ED03499BA0A75EBFA3DEFE 3E633A4E4F8A1AC44DE6F11C AD C7FC649255D77CD043641FAD12EE03D1FA43BB267702D55830FD9CB8DBB D8F101CB9AC5C1A178DCDC62E4E2DDB1D0DB2B83E3B064373DDEEB794604CA0C943A583FF8780F3EEA3953A7 68CED0D108C0DA98A9B0C5CFC4AECA58E51C0799 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JTURjIg1_i6t8kCHKm45_epG3gfD-A[1].woff Web Open Font Format, flavor 65536, length 35164, version 1.1 Size (bytes): Entropy (8bit): D B0316D784 52A22D5DFBFDEC74222D8713A0BE9806F35683A3 329F71BF58BB5389C4BA223B3049A5615A27C17B94FC27C054A32AD9B0E29666 ADF95F385C784FE4E80048C7202F5D56099D04E0F DD77877D535FA348A68C7673C51A66CAA7396DFA C96679F422EED4DF37B446D5DED4A13068B6B Copyright Joe Security LLC 2018 Page 25 of 454

26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JTURjIg1_i6t8kCHKm45_epG3gfD-A[1].woff C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\JymZj0IFCmJ[1].js Size (bytes): ASCII text, with very long lines Entropy (8bit): C2FAB18CB37AF4C84A8E1C298C976E9A 512F11643F823E2DD63B AD3DAA851CD1 131A179D6DF79D7400CDE FEE9DE4C680731E1AE E9E09F52F 1B8064A B1AEE1D37B5B2F6A29729CF7EDD E02331BA2356CEDA7AE1B07147A69A45467AF0541 AD863DCED434C58971BBE6078D65B005C65C8 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\MXNvdqs_Alf[1].js Size (bytes): ASCII text, with very long lines Entropy (8bit): C0C5D88E3B4D037BC337A760CCB61E0D 074F207E7C B2B57D2A39D7A746523FA88 4BCA9EA11CB69A18DF2FFE269AF7F E9DB601777CD525FCC126A8014B 56DB863E408EDB F64FA0B54C4F2757DC5D16A89FF4D8E732BDF1CA7D7FD6EA06CEE939C7ACD8D85D B61980A9263E989914B9772F2B72601D173993C5 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Pe-icon-7-stroked41d[1].eot Size (bytes): Embedded OpenType (EOT) Entropy (8bit): C0C7AD6C1E7D5C77E8AC292FBA5 6C09F9B01A2F8A9D672292B2D41D94E639EAF13D D AEB729A67C4BC12F2A51EE970C37EA079EE30F856FD2807FD3E9C 73FE02EEE448798B286797B79EA29B0087DFB28790E1A2F6B22636C934335B2C2D267CE5D E8460A5A0B0 4A3148C2DF7DB2A6C7B348761FBD345F039CB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\PyLs1KWISl5[1].js Size (bytes): C source, ASCII text, with very long lines Entropy (8bit): E3D88B3100E2E74921B8BFEFFE0E7D7E 2444E62B082B628D60C08F1BA5A3700DCC25160F 3D4B63313CE3AD6BA259FE73365A0764B172232DA71766CF0A6AA9BF81A137DA 264F91D4C139DD9A6899D63C03D316D8FC20F4B37B1DBD9A3B4C AD12CC42AFE3879CA305ADD761868F 87CBCD155C23D69A6C C041A99D2E904 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\RLTXBB5W.htm HTML document, UTF-8 Unicode text, with very long lines Size (bytes): Entropy (8bit): E297BBE459D6C57DF3CF39D1E41B00D Copyright Joe Security LLC 2018 Page 26 of 454

27 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\RLTXBB5W.htm 3C5A5D37B726AB175DE A56294F8720B3 92CC8550EAAF6E07D811DF7CAD0FC20BE5B4D6BD5429B222577AB25CDB F417F334D7314BDB1E2E8BE5ECDCF9F5A587A79D D5710CFB F932C43F63D3696BA7972 DB0C30FB3F15A062EAB2232D73C388F9130D7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ViewportInfoService[1].js Size (bytes): 3237 Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators 3EDEB6D BF15763D7D571BC43 706FB2F50EEE848FC970D1F30DB3193D1D19C8A E35C8BA400CDF4E1DC1851B4E115ECF96960E365C4B6D894EDCEC5916 8D21E1B9E3FFC2ACD94849C871C9A6C930DC7F54C4F7EC73C7118AE EAAFF490F643EA7FB882F578B94C 32EC3E6B7D6A4DDD7DC002A B4E95 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ViewportInfoService[2].js Size (bytes): Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators BF8BB7F4AEC1D4F1246DE7B12E2CADCD 74E503AFE73359ACF319C6478AC6FCBD3BB95314 DF28EAA739287FC846D9C072C608024C449649A1E9866BBD3F72C28F535859E5 AB89D265ADC46851CAC2EBFBF76BD96208D8D318224B312F159FD68B9D5D31166F2E9DEA9EA32D563D047F9CD E CE124603A3CBA78E0C2E651BAFD4EE6 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ViewportInfoService[3].js Size (bytes): Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators D670D4E696C1CD3FB689A615BF662BB0 1152DA6D0F2BF36D614500ADE270EA4DE4F D37CBF7AA7D309D5F3A85021EE62B BC30BF5CBB3FEAEDF4F329DF B51911A3790D6E48C5B58141CDA673139E72BCE354F56261BB2099C130470B00359B3F5599D47294B8 0B ABC02D3CD5DF20855E72A63 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ad_status[1].js Size (bytes): 29 ASCII text Entropy (8bit): FA71744DB23D0F8DF9CCE6719DEFCB7 E4BE9B A036F97CF26EBAF703AD2067 EED0DC1FDB5D97ED188AE16FD5E1024A5BB744AF BE A6C54B9 17FA262901B608368EB4B70910DA67E1F11B9CFB2C9DC81844F55BEE1DB3EC11F704D81AB20F2DDA973378F9C0 DF56EAAD8111F34B92E4161A4D194BA902F82F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\bg-doktorka[1].jpg JPEG image data, EXIF standard Copyright Joe Security LLC 2018 Page 27 of 454

28 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\bg-doktorka[1].jpg Size (bytes): Entropy (8bit): E82940D6A0C26162F486A54D02 E775029C24CA1A3F2C2C1D295A1D50DED6841A2C 955E484B606234E29C7722A1D6A3E58B224BAB32F5ADF31DF591464FD0783FED 2FD5F718A72007C C3F32F85314DAF6D30AAC1FB8A832034F6A00132DC1CC337CEF8AB18F99317EDE17D 52F7732F0CF0FD E2FD2B21BFD1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\css[1].css Size (bytes): 5425 ASCII text Entropy (8bit): C9D1E1831ACE3199B71CB4B1851D298A 62151E9B9BE6D87FEF2BD9B41B4528C59436CD18 AA6DD420C60F02F37B491F411E851383A4A A317A7D1C6CFF515CF6 0B009469D7AD816A68576CB77DEA DD1FC4E8E810C FE970FA045154B1E F41D1A AA29E0490F95D775E544 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\css[2].css Size (bytes): 892 ASCII text Entropy (8bit): D7A2B803B391190BB130B80BF112BD0C EDC DEA2A704C292FCA2A BD623ECCA69C79CD5351B9BFCAA E59C4A8FF800C6E D882DA2D50A516F543E0385EA6BBB5E954105F676A3E6E09BFD588A7FA038DA889C0AD9B65FABC168F6A DE00C FCD B43FF3C4D4B1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\customNoty[1].js Size (bytes): 2179 ASCII text Entropy (8bit): DA C1CBE00D505AE08F0 16D243E035F93BFDA7D700FBEE39EB0C1B5A58E8 A8C49DBB22B7D33F75DDE6F23010B64C4E C5F4CD B3EC8B2DD A BE3E65C9CF9593AA0C0DB88E948A027A5F294755C04D02A42C E20A7B0707CE7A29CCE95DB9A 4D9DE1AEBB63CED5FB0C4F9AD85FF7BD846FD7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\dir.hover[1].js Size (bytes): 6578 ASCII text Entropy (8bit): CBDB8F475281CA8FF B96DBDA29945A5D CE927EC6BEF40872B 8E4E3B761B60D43384FDF6A5B CE552FB BF92E4E96CF6D424F 3DED69E574AA576062D20B2B B9E1084F20D3E26ECA7FC83DF7E30CA82B21FD3D6A1ADD9896D4F6086F DF1A253BEA0EE5C7C14296D63AF39AD3 Copyright Joe Security LLC 2018 Page 28 of 454

29 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\duplicate-post[1].css Size (bytes): 709 ASCII text Entropy (8bit): B36F0790ED4B0707CB F87C677EEEC01E0058BB7BBFD0617F41E9D AD945CC3017E BB3034CCC8D3F3D71F05E79CE2DFBB93F391E150 AC306809E6FB18E C2B FF6F7914E8CA2B62D233BEA0BE96559C8BD30B30AA1BACF0A0382D4 CA7FE3FBE9CCD30EDCA1EEA266EEA740B256A4 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\element_main[1].js Size (bytes): Entropy (8bit): HTML document, ASCII text, with very long lines 39394D581FBDB66B6949D5DCD6EC FCFF8ED7B2DBEC6E7723FCBC0E A D66B32DB9FC82DA CBBA423D08934F4E36E72F07DD5C39C7693F307 05E0212EB895B685CF2E38FB2639CD43B8CAC1E430DFC2A070615D473BD7FF4310B266E99FA6CB2C5C6A26DB0 6DC3DD84CF45D12F7A3DFB647D84C29E245B905 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\embed[1].htm Size (bytes): 2385 Entropy (8bit): HTML document, ASCII text, with very long lines ABD9276E0C6767E90A4F1F1BB5D011BB BCC5F898ABDF4B5CAC458A304E0B518FCA0E7FDD 354DAF0B4FF9F A48A2F890D56FD3D532C9087C72C7DAFD35D4C7470B3 085C8E708F65C8D86C6D4FCE1ED6F E363DF209A79A1F2C710C3C0D739956EA8D6408F1A B70E 43E6B1EF46B52CFE12B322AF1C27819D12DDB C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\f[1].txt Size (bytes): 3299 Entropy (8bit): ASCII text, with very long lines, with no line terminators C9065EBB6EC0DA38DC7EA6DBC03CE011 E2B5D7962F3FC5C56ABE84B073F6099AFBB47EA0 CFDD38B514A6EA2B2269A11B9FB76D3936FBEAE2F88E94106C EB7F9B 925EDA950F197AA1BDED5CE47B75E0A4DCA25F9701C5628B9D0925E09B0C01F4FF89526C99AB3CD B1 106CC084B391B065D5DA55BF7B5A9EED3A8C7A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\f[2].txt Size (bytes): 5016 ASCII text, with very long lines Entropy (8bit): C206056B1BBEC77675D5E156F431F 16EBC8D0938A E0D1F7197D5FF AC3B97FA F9140ADAF6B235F102502DAFA5D8850DFC13C2128A5BE0C DC4FFCB35C41B2C7A564057E4CC8C9EAFD8DF9FE4D36439D47C63C428488BFBEC38F8BBCF09AC DFE 63AF BE3F5BCE3532F D1A Copyright Joe Security LLC 2018 Page 29 of 454