ID: Sample Name: CCS Projects.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 19:48:41 Date: 14/06/2018 Version:

Size: px

Start display at page:

Download "ID: Sample Name: CCS Projects.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 19:48:41 Date: 14/06/2018 Version:"

Theodora Stevens
5 years ago
Views:

1 ID: Sample Name: CCS Projects.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 19:48:41 Date: 14/06/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Software Vulnerabilities: Networking: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Private Static File Info General File Icon Static PDF Info General Keywords Statistics Network Behavior Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Statistics Behavior System Behavior Analysis AcroRd32.exe PID: 3480 Parent PID: 2984 General File Activities File Created File Moved Registry Activities Key Created Key Value Created Analysis AcroRd32.exe PID: 3532 Parent PID: 3480 General File Activities File Created File Deleted File Moved Registry Activities Analysis iexplore.exe PID: 3748 Parent PID: 3480 General File Activities Registry Activities Analysis iexplore.exe PID: 3804 Parent PID: 3748 General Analysis RdrCEF.exe PID: 3856 Parent PID: 3480 General Analysis ssvagent.exe PID: 4028 Parent PID: 3804 General Analysis RdrCEF.exe PID: 2648 Parent PID: 3856 General Analysis RdrCEF.exe PID: 2380 Parent PID: 3856 General Analysis iexplore.exe PID: 1960 Parent PID: 3748 General Analysis iexplore.exe PID: 2020 Parent PID: 3748 General Analysis iexplore.exe PID: 3672 Parent PID: 3748 General Analysis iexplore.exe PID: 3700 Parent PID: 3480 General Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 109

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 19:48:41 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 14m 59s light CCS Projects.pdf defaultwindowspdfcookbook.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 16 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal48.winpdf@23/91@16/7 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Cookbook Comments: Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.pdf Found PDF document Simulate clicks Close Viewer URL browsing timeout or error Warnings: Show All Max analysis timeout: 600s exceeded, the analysis took too long Exclude process from analysis (whitelisted): WmiPrvSE.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtSetValueKey calls found. Copyright Joe Security LLC 2018 Page 4 of 109

5 Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 109

Ransomware Miner Spreading malicious malicious malicious Evader Phishing

Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use

analysis Signature Overview Vulnerabilities Software Networking Summary System

System Evasion Malware and other Techniques for Hiding and Protection Hooking

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Vulnerabilities Software Networking Summary System / PFW / Operating System Protection Evasion HIPS Debugging Anti Analysis System Evasion Malware and other Techniques for Hiding and Protection Hooking Language, Device and Operating System Detection Copyright Joe Security LLC 2018 Page 6 of 109

7 Click to jump to signature section Software Vulnerabilities: Potential document exploit detected (performs DNS queries) Potential document exploit detected (performs HTTP gets) Potential document exploit detected (unknown TCP traffic) Networking: IP address seen in connection with other malware Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Potential malicious clickable URLs found in PDF Contains functionality to call native functions Searches the installation path of Mozilla Firefox Classification label Clickable URLs found in PDF Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols PDF has a JavaScript or JS counter value indicative for goodware PDF has an EmbeddedFile counter value indicative for goodware HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Copyright Joe Security LLC 2018 Page 7 of 109

Checks if the current process is being debugged Malware Analysis System Evasion: Queries keyboard layouts Hooking and other Techniques for Hiding and Protection: Disables application error messsages

8 Checks if the current process is being debugged Malware Analysis System Evasion: Queries keyboard layouts Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Hide Legend Legend: ID: Sample: CCS Projects.pdf Startdate: 14/06/2018 Architecture: WINDOWS Score: 48 Potential malicious clickable URLs found in PDF Process Behavior Graph Signature Created File DNS/IP Info Is Dropped Is Windows Process AcroRd32.exe started Number of created Registry Values Number of created Files Visual Basic Delphi 9 25 started started Java started started iexplore.exe RdrCEF.exe AcroRd32.exe.Net C# or VB.NET iexplore.exe C, C++ or other language Is malicious cs9.wpc.v0cdn.net , 443, 49177, ANSBB-ASNNET-1-AdvancedNetworksServicesIncUS United States www3.l.google.com 15 other IPs or domains started started started started unknown unknown started started iexplore.exe iexplore.exe iexplore.exe iexplore.exe RdrCEF.exe RdrCEF.exe graciously.tk ow.ly gstaticadssl.l.google.com googleadapis.l.google.com www3.l.google.com , 443, 49165, , 49163, 49164, 80 started , 443, 49208, , 443, 49200, , 49202, 49203, 80 ARUBACLOUDLTD-ASNGB AMAZON-02-AmazoncomIncUS GOOGLE-GoogleIncUS GOOGLE-GoogleIncUS GOOGLE-GoogleIncUS Italy United States United States United States United States ssvagent.exe Simulations Behavior and APIs Time Type Description 19:49:43 API Interceptor 932x Sleep call for process: AcroRd32.exe modified 19:50:01 API Interceptor 6823x Sleep call for process: iexplore.exe modified 19:50:05 API Interceptor 1x Sleep call for process: RdrCEF.exe modified 19:50:07 API Interceptor 1x Sleep call for process: ssvagent.exe modified Copyright Joe Security LLC 2018 Page 8 of 109

9 Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link googleadapis.l.google.com 0% virustotal Browse gstaticadssl.l.google.com 0% virustotal Browse a767.dspw65.ak 0% virustotal Browse cs9.wac.phicdn.net 0% virustotal Browse ow.ly 3% virustotal Browse a1621.g.ak 0% virustotal Browse www3.l.google.com 0% virustotal Browse a1363.dscg.ak 0% virustotal Browse cs9.wpc.v0cdn.net 1% virustotal Browse crl.pki.goog 0% virustotal Browse ocsp.pki.goog 0% virustotal Browse fonts.googleapis.com 0% virustotal Browse fonts.gstatic.com 0% virustotal Browse URLs Detection Scanner Label Link lcnaqum%2bihv2cchsbqbt5ztjot39wzhi4cdqhjqtac%2fhigod%2baux0%3d 0% virustotal Browse 0% virustotal Browse JKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCBkI1RFpfx7k 0% virustotal Browse 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Copyright Joe Security LLC 2018 Page 9 of 109

10 Joe Sandbox View / Context IPs Match Associated Sample Name / URL SHA 256 Detection Link Context malicious Browse malicious Browse malicious Browse sendgrid.net/wf/click? upn=xdxeyfdu3aoz6r L524yTTw7O DKebxteoDB RPM2JFnjSotRVkdrMT- 2BCcQmZ0gC4 emt9wuuqwp MI4X4VOM2c vmwawkn-2bx4g- 2FBNCjLywKt4h3-2 BMQoeuDez8 ZV6eaQD-2Fil2i_nZ9qD 6XHYEGbRUS fugl4gqfjpuqvtev- 2BEy4MnaaSpqe 1JURIYq0dFF0kluU71jV bc0c0muniq oofc8umnuzegr- 2FDx9SQqF-2FiO8-2FtwdEyfkU OndAc1yZGh XBmQBFZrO2t58-2BmgzsHniLgJQZ10 XokzseqRXT ky0ddcixfh bbfcldg2ye 4W0iDRLAnV VvKfvtOZYg mmwjfmpyuy ukt2odnvq-3d-3d sizer.com/picresizer.exe CAPTIVA HOME DESIGN.pdf Scan0011.pdf lmeet.com/guestdeskt op/globalmeet_guest_ Desktop_Setup.exe m/source/backup.bin ya.com/irs- TRANSCRIPTS- 046U/71/ pdf malicious malicious 51ea9b171910a684f345e519dbb malicious 0ebc186ad2b83b2f131d954154a 0fd78edc51 98f9a18c61696ca54ff78ed287b8 malicious 14fbf afd950ad4a90f833 b8ee6aa malicious malicious malicious a67ad48dcadf1c2718ebabdb834 malicious 7453a2aa1e5ea98734d72dda4ad 8b9f7f7401 Browse Browse Browse Browse Browse Browse Browse Browse Domains Match a767.dspw65.ak Associated Sample Name / URL SHA 256 Detection Link Context sizer.com/picresizer.exe CAPTIVA HOME DESIGN.pdf malicious Browse ea9b171910a684f345e519dbb malicious Browse ebc186ad2b83b2f131d954154a 0fd78edc51 Copyright Joe Security LLC 2018 Page 10 of 109

11 Match Associated Sample Name / URL SHA 256 Detection Link Context Scan0011.pdf ya.com/irs- TRANSCRIPTS- 046U/71/ pdf 98f9a18c61696ca54ff78ed287b8 malicious Browse fbf afd950ad4a90f833 b8ee6aa malicious Browse a67ad48dcadf1c2718ebabdb834 malicious Browse a2aa1e5ea98734d72dda4ad 8b9f7f7401 a1621.g.ak EMS Tracking Digit.exe 6759fb8bb59194d261f57492d12f malicious Browse c6ddb679870ca324a4c73640d0 c605d3848 Wilhelmsen Invoice pdf P.O scr INQUIRY ORDER DETAILS.PDF.exe scan3_print3_documen t3_29_08_2016_3c3262 a25d227eff9a29e1d4f8 c06a2a43b611.exe 877ec6acddceba56fdb8cd760a4 malicious Browse a633cb514a93dce60622a9b3b 6c9409ed85 d71c1c7ee31d86f0fdda malicious Browse f714a d8f203d75f6beb 3a f05921aeb0a5f00a439e3189c malicious Browse c7f3337b6613e4cb9d8b05aed3c 788a55e ba9a3789dddf56acf malicious Browse fe7d0b b7d000b51cece4 15ac5352f Gerador de Crypter.exe 52d6aa77ac041e35eb891d9a7e5 malicious Browse fb6759e31844acbed59c76dfe62e df4334de2 EMS Tracking Digit.exe Office-Voic .pdf new file.pdf scan001.exe CourtSummon.exe SAMPLES.exe PO exe 6759fb8bb59194d261f57492d12f malicious Browse c6ddb679870ca324a4c73640d0 c605d ce085e620b776ef96228e6 malicious Browse bd819423d231b686dfb7ea2d2d7 c6ce6f6b50 f9ceec81f52040b0c41dd06e1c25 malicious Browse e6aaaa50a4da42141e9deeeaf07 46e9c5ede 7b0831cc18af4246aa10d5cc9d6 malicious Browse fb4af07500d6919faecd32c deeeaa9467aaa879df8 malicious Browse a2048de1b2eed2eec0bbe9b3c02 417c452d4f b3aac810dc97b2ed6a957294e11 malicious Browse e8e2b ecbbb5d38b11 5af6591cbc 83df6619bcfec886eb238500d238 malicious Browse dca c81eff3ec c 2f56fd4c ow.ly new file.pdf f9ceec81f52040b0c41dd06e1c25 malicious Browse e6aaaa50a4da42141e9deeeaf07 46e9c5ede Locked.pdf Please see d attached document.pdf #verify-doc.pdf C pdf YWv5 k7fa?f$9fk45ft987h 294f92b a19beef malicious Browse d190e9afc f4a dba330 21b593a f532b575e340b malicious Browse b07b4b44635bb43edeb8ca64bfa 61dfd8a b025d c2bff8f2c1 malicious Browse afc251f6c88d51618f0f82dd50bdd befce31 14b536b64230b1292b52a70584b malicious Browse f799234cc7d11ad1 7783ed9b99 malicious Browse malicious Browse ow.ly/u8cg30gnek9 malicious Browse message html1(1).pdf ACHIEVE-1 CONTRACT.pdf 3SCO 795a85fadb6b7a42e876925fd711 malicious Browse ea ff397fddf9bf463072e9 ae06b27 24bea02fcf153e6c4ff26fd45fb25 malicious Browse f6f807a27458b4ba3a5bd22675d 972c68f malicious Browse Copyright Joe Security LLC 2018 Page 11 of 109

12 Match Associated Sample Name / URL SHA 256 Detection Link Context 9a835a425c8321c22d5a 216ed64f5174d27e0b97c2e2603f malicious Browse cb5f020abaaaaf e7cf80fee68237d0811f 6ac876f5762ec613392f4242cc7f da0fcaa2 cae.pdf scan pdf b18fcb666119dfc746c7c38976b5 malicious Browse d7563e82062a882348c72dc1cb9 4bbe7d13c NEW QUOTATION.xlsx 8754ace26341c7e26bf5416b4da malicious Browse f5293fa0d21e1ae262dbde1290 acdd9098e tp3o pdf TR4-6A6201-N.pdf malicious Browse effa478623ebf0c0b0d18d95 malicious Browse c11822b604b3bc75ecf4936bf43e ea b7577bb422c8dc3a9bdbcf9b8a malicious Browse ed85cf f8c944dd3 874b2d664 malicious Browse cs9.wac.phicdn.net malicious Browse malicious Browse malicious Browse sizer.com/picresizer.exe CAPTIVA HOME DESIGN.pdf Scan0011.pdf m/source/backup.bin m/end/index.php ya.com/irs- TRANSCRIPTS- 046U/71/ pdf os.com/captivahomede sign/acrobat/managem ent/adobe malicious Browse ea9b171910a684f345e519dbb malicious Browse ebc186ad2b83b2f131d954154a 0fd78edc51 98f9a18c61696ca54ff78ed287b8 malicious Browse fbf afd950ad4a90f833 b8ee6aa malicious Browse malicious Browse malicious Browse a67ad48dcadf1c2718ebabdb834 malicious Browse a2aa1e5ea98734d72dda4ad 8b9f7f7401 malicious Browse ASN Match Associated Sample Name / URL SHA 256 Detection Link Context AMAZON-02-AmazoncomIncUS 53Payment.exe 753baf9f3312ab82986b62a35395 malicious Browse b8c0ac03ba6476bcf6a9f571a 21a41892 ao87si5uju.apk jones@ricohforensics.com 13orders exe 6341be988be00042c698511fd88 malicious Browse c97c618e6109afac40fdf5bed523 83bcdf18e malicious Browse b5aac54456a037d240f malicious Browse e9962db f4cb7fa3f6b09d ed258345f wccftech.com malicious Browse malicious Browse keyserimpactseries.com malicious Browse com.affinity.red_sox _ apk DashlaneInst.exe 69894f963d a4e4 malicious Browse c16c2e6c838db482abc1 0bb7a3453a 0cbf83f1b879561d0041a0fef26d5 malicious Browse c570a b9ca7ecd9e5ae 4d9474c4 empireofdeceit.com malicious Browse Copyright Joe Security LLC 2018 Page 12 of 109

13 Match 3PO# exe ics.be/kjsdch Proforma Invoice_d ocs.exe 66Bank Receipt.exe ddobeflpla yerbrsetembro F exe m/affiliate/referral.asp? site=rea&url=po p/en/ukc/1&aff_id=58 43_27027_1 9234_535127_1_357_ /educational/famzoo/ YXOpwUgugb.exe YxgDiqRWX.exe i111.tripod.com/ c6ec8728f7e909af51fa9a364a2f9 malicious Browse f61b5ec613dc37b18c95df2177f3 da9910b malicious Browse e765b41b0aa21f4e2313bd22 malicious Browse e9efb167b5ac8c2955f355f526aa ef6baaec1 8755e9c426db1f40ff1a68f100cb0 malicious Browse f33eb65a99b aad810bc4 0a5f9cb6 malicious Browse malicious Browse malicious Browse b61ce3d5d75fe4a cdfa malicious Browse c47ba6543fc568ab3293ed339 83ff717d8 60c5156e56e93c8ba14bee4af94 malicious Browse f2963be8c8d7bf469a892a1751d efd malicious Browse ARUBACLOUDLTD-ASNGB malicious Browse ANSBB-ASNNET-1- AdvancedNetworksServicesIncUS Associated Sample Name / URL SHA 256 Detection Link Context Drop_New/drop3/drop2 /drop/drop/ 7/quotation/index.php o/login/drive_pdf/in dex.php kk/outlook/index.php Review.pdf malicious Browse malicious Browse malicious Browse malicious Browse aeb53f191df20d5659bb364d9ed4 malicious Browse e2c25a48438a7f71b6d325dd24c 6fe6a99ea malicious Browse Doc9.pdf fd/seekfundzdropboxn ew/index.php cc/doc/office22/360% 203/index.html d3d59f04f0d0c57e17d4ec25174c malicious Browse a66b2e0f520200c47a030d3470d 88cc91d50 malicious Browse malicious Browse Copyright Joe Security LLC 2018 Page 13 of 109

14 Match Associated Sample Name / URL SHA 256 Detection Link Context ks.protection.outloo k.com/?url=http%3a%2 F%2Fapp.getresponse. com%2fclick.html%3fx %3Da62b%26 lc%3dbw39w b%26mc%3dj H%26s%3Dj5 CEaV%26u%3 DhcQ2C%26y %3Dx%26&da ta=02%7c01%7chenry.t homan%40ru shcard.com %7C29524c3 0422b43dc4fa908d5aec 79c55%7C8f 0d3053db3142f785f7ab e3945bff0a %7C0%7C0%7 C & sdata=nnvnyecejnq3r8 ITCTSxGVs7 AOPuvuha9G GDDMIqK3k% 3D&reserved=0 malicious Browse malicious Browse ks.protection.outloo k.com/?url=https%3a% 2F%2Fiatsetrainingtr ust.us11.list-manage.com%2ftrack%2fclick %3Fu%3D4a eb89cc8e1c496f9 2d%26id%3D f2d12f969a %26e%3D439 6c89d76&da ta=02%7c01%7chenry.t homan%40ru shcard.com%7cf9cb b43ca4d4008d5aeb a14e1%7c8f 0d3053db3142f785f7ab e3945bff0a %7C0%7C0%7 C & sdata=dywp YtvMySded2 ijvbwgqprt 7i6UOCkkkG UzS4VEByA% 3D&reserved=0 m/l/mobile?wt.mc_id= OutlookAndroidSignat ure malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse Copyright Joe Security LLC 2018 Page 14 of 109

15 Match Associated Sample Name / URL SHA 256 Detection Link Context sendgrid.net/wf/click? upn=xdxeyfdu3aoz6r L524yTTw7O DKebxteoDB RPM2JFnjSotRVkdrMT- 2BCcQmZ0gC4 emt9wuuqwp MI4X4VOM2c vmwawkn-2bx4g- 2FBNCjLywKt4h3-2 BMQoeuDez8 ZV6eaQD-2Fil2i_nZ9qD 6XHYEGbRUS fugl4gqfjpuqvtev- 2BEy4MnaaSpqe 1JURIYq0dFF0kluU71jV bc0c0muniq oofc8umnuzegr- 2FDx9SQqF-2FiO8-2FtwdEyfkU OndAc1yZGh XBmQBFZrO2t58-2BmgzsHniLgJQZ10 XokzseqRXT ky0ddcixfh bbfcldg2ye 4W0iDRLAnV VvKfvtOZYg mmwjfmpyuy ukt2odnvq-3d-3d sizer.com/picresizer.exe CAPTIVA HOME DESIGN.pdf Scan0011.pdf thysd7 ko.co.ke/modules/ow/ lmeet.com/guestdeskt op/globalmeet_guest_ Desktop_Setup.exe m/source/backup.bin ya.com/irs- TRANSCRIPTS- 046U/71/ pdf PDFXCview.exe malicious Browse malicious Browse ea9b171910a684f345e519dbb malicious Browse ebc186ad2b83b2f131d954154a 0fd78edc51 98f9a18c61696ca54ff78ed287b8 malicious Browse fbf afd950ad4a90f833 b8ee6aa malicious Browse malicious Browse malicious Browse malicious Browse malicious Browse a67ad48dcadf1c2718ebabdb834 malicious Browse a2aa1e5ea98734d72dda4ad 8b9f7f dceec2c8fbb1912f8eea malicious Browse be449d1e265f0c be8b34 e5403e731 Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 15 of 109

16 Startup Copyright Joe Security LLC 2018 Page 16 of 109

17 System is w7 AcroRd32.exe (PID: 3480 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\Desktop\CCS Projects.pdf' CB6643A25A7ACF3DDEEF0B94DFE17A01) AcroRd32.exe (PID: 3532 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer 'C:\Users\user\Desktop\CCS Projects.pdf' cleanup CB6643A25A7ACF3DDEEF0B94DFE17A01) iexplore.exe (PID: 3748 cmdline: '' CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3804 cmdline: '' SCODEF:3748 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 4028 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) iexplore.exe (PID: 1960 cmdline: '' SCODEF:3748 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 2020 cmdline: '' SCODEF:3748 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3672 cmdline: '' SCODEF:3748 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) RdrCEF.exe (PID: 3856 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor= AFD03A53C1FE02E04974C9D99B1CF67) RdrCEF.exe (PID: 2648 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --primordial-pipe-token=2ff651452d2 7B6ABE2B CC lang=en-us --lang=en-us --log-file='c:\program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --productversion='readerservices/ Chrome/ ' --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image -texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0, 3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3 553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,35 53;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;4,0,3553;4,1,3553;4,2,3553;4,3,355 3;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15, disable-accelerated-video-decode --disable-webrtchw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=2ff651452d27b6abe2b cc renderer-client-id=2 --mojo-platform-channelhandle= allow-no-sandbox-job /prefetch:1 7AFD03A53C1FE02E04974C9D99B1CF67) RdrCEF.exe (PID: 2380 cmdline: 'C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --primordial-pipe-token=bb18846de79 238A50F315613DAE5498F --lang=en-us --lang=en-us --log-file='c:\program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --productversion='readerservices/ Chrome/ ' --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image -texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0, 3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3 553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,35 53;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;4,0,3553;4,1,3553;4,2,3553;4,3,355 3;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15, disable-accelerated-video-decode --disable-webrtchw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=bb18846de79238a50f315613dae5498f --renderer-client-id=3 --mojo-platform-channelhandle= allow-no-sandbox-job /prefetch:1 7AFD03A53C1FE02E04974C9D99B1CF67) iexplore.exe (PID: 3700 cmdline: '' CA1F703CD665867E8132D2946FB55750) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\~DF09904B59A8E36D73.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Reputation: CD73D7BCAA A3DD9828A7BBCCC F6245FB16D4AB8EAA DB1F6E255380C 870E12CCB322CE5DCFFAD3359C86AEA980F4CE954A A67BA994E64FC B A20E98041C20592EB58F79D20303FC21EC105C8D45BBCB62CEBC83DDA06C605807EDB1AEC8536A E5BE5D530B80F4542E FE915C019928A low C:\Users\HERBBL~1\AppData\Local\Temp\~DF3728CF4E3E TMP data Size (bytes): Entropy (8bit): Reputation: F42E2ED23B2090CC6CD26D99C5EE5D27 4CEC8E604C67CC A72249A25D737AC6783 B282AD32937F04BB3F98ABE3317A20A9E40E3CD46CDCB92D9B6A87146AACB B33EE81F9AE7770FA60BE41934E735273CCACB84B736C13C2F90D690649ABADC A0AB1E7D05E B12F31A6D82FCE4612D88295DF43069 low C:\Users\HERBBL~1\AppData\Local\Temp\~DF75AA9E3F1C3218BE.TMP FoxPro FPT, blocks size 258, next free block index Copyright Joe Security LLC 2018 Page 17 of 109

18 C:\Users\HERBBL~1\AppData\Local\Temp\~DF75AA9E3F1C3218BE.TMP Size (bytes): Entropy (8bit): Reputation: 73A27D926B61909E85A6D7D522A9FE7F DA7327AE85B2D361ECB41CF837365C4FB79A152A 7B41DF14E16D0B1AC5E2B970A86B85124C447715AB34707C65E7C6D8F2A286B0 978AC77FB12CEA ABDE8DABB13C EEACE486EE2D68FB001FE9010D3B9DD24E057D89C19F8BF 8401FFF1F601BD41C33421F100369D0EB93843F low C:\Users\HERBBL~1\AppData\Local\Temp\~DF785C05C73A79FB6A.TMP data Size (bytes): Entropy (8bit): Reputation: 98EAF63A512A9AC54B1603AFCDC5786C CE5DD3C1E83A8B00BF58FE6C44C02AA7A90F90C5 B7A34B52FA1AEBA70806C648D1E61A69B082585D9714D9BBD3A7E4B0B0015C91 803C DF01A7AE17A6E279691CC95FBC0507D8A4100B2E159C531342D B9CE802982B881AA73CA82 A4F63DD1DCAB4BAA0F69D4E2219F5A17C7782 low C:\Users\HERBBL~1\AppData\Local\Temp\~DF8CEBE58A95AA03D0.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Reputation: E96E0EAF9F570044E3EA1D92F3A928E7 EFA966B787A0F5EF33F735B2C5A2A1A27B BE70E3FB5CF2662CB31285DDE9DF97C6515D4574AA260A2985B172EC6DB9F602 6C16226D6D8F9E3F966E04AF F588BD5D78E7FAEB17573FCAE315489F59319DAFA300E69E5013BAB1AED 38B7391CABDDACC4081D339D57F6F6F22D881C low C:\Users\HERBBL~1\AppData\Local\Temp\~DFC50F2DD7884C6DC1.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Reputation: B0470DE11262B EB883FC1DD05 D943174DF5D0E90D2B0B34BAE19AD84C5DFCD3C8 1987A1DB2B6E5A2BFD8D5FE96AA7E772B31B801431E7D4C2BE70E27E112B295E B75DC6D579D0EBA8E015D03BCC4A6C20111F A5DCC8C93083DE2DC847A8856C74ED56283ED82B35E4D A9CE9DA81520E24BA24209DDB7BB125198D3AB3 low C:\Users\HERBBL~1\AppData\Local\Temp\~DFDE9E6ADC965B5841.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Reputation: 5DAD7C46E0FBBB F6202BE58A5 9532F7B22F43B35F35351C256FA38677C78F6971 CEDAEB8EF6D3F291A4ED29EC573F732A8CBD8031A3A6A8107E6A8BA9A2918E98 8BF4A3AAB8434CA7FFB7EBF2AAB3DBD26941A9AF6CDAE89FA7EEC086639BA259B5A2BB72CB13AEC51BE1E71 C423EE4D229E67FDABC733C90692A7645D low Copyright Joe Security LLC 2018 Page 18 of 109

19 C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages Size (bytes): C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe SQLite 3.x database Entropy (8bit): Reputation: 8B790A6119F82CC590A152F672BDE5EE A4BD31151AF99B958CAF149D5AA6882CC FE522EBE0720B BAAAFAAF15B9801ADF77FA07E17E27015B4B5F8A84B 9BB60766B78B5BF4BD6F8F5C1E79C78063A9BB EF F99EF760C980570DB1D D8AC1A B68BCC3828F471B36DC E10C3 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe data Size (bytes): Entropy (8bit): Reputation: 0EF0B96FF3B8A C7B675349BF0 65C69C8EA612BD0E779F0C78EB621FC6E242746C A091D37C5C029CBE4125C2132D0410A829D897E088FBF1B38A9F56E520105EF7 E86DF0B88B0DD9778E35A33F5D8DE021A1669FBD40C30468ED5FA90B77F38B87F93F21246E FAB80978B B7D1E0CE A3AA21139C3F low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 593 Entropy (8bit): Reputation: A4E5AFC294D0CF0DC99E827104A659F7 F96AD9C327E4C0CB9E2856EF7979A2622C0A85FD FB538786C7109B3BCC399EA0FD8708EF3A6B4A013F426BD0DC6C2D9C51EC0F53 5E1470CAA8619CE0C3006B3BDC23ADDA500F5AE445525B0AC66205BF7A5B8A06EA4A39B796FD2983FECF8519C 7B3081E4B2E3F559D7761EAC763C1FB2120F884 moderate, very likely benign file C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, 6509 bytes, 1 file CE371CD7EF9CC216BB EBD518D1A89C6F0079BE759A38869DE9ECC399A D858B12945B35906DD709A2FA9EAFEDA3CDE7E342041AEE65BBD43CDF783C C5FB7B6ED27E52F6EF48754DE5D1B9A756961A EB086135BD5C5420D CC8C1D82D845E8AEBD 50ACABDE23EE17A DB0A13C30E2CC1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Size (bytes): 471 Entropy (8bit): F0210FCA CC216A E2 D10B86C6F353C30D98B55BFCAADD40E7D493397C 397AD878DB2D20AFD65BA634252E B089E1C9526BD D1221F9 C5CA0CE0D36CB0716ECC6E37F96C261EF4E992C6C6B03D7EF703252D5494DE7AAFB222089C8BEC0A52ECD39D CF B994898E994C7D29C8C513BB690DA Copyright Joe Security LLC 2018 Page 19 of 109

20 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, bytes, 1 file true FBF75EBF1592EE C3CF63B9 FF7EA302F9C1DEC6CD2CF79909DBB8F563BE1998 CF9C9F1C30AEBD6D D39370FF309359F82B4ED38F3E7C2553F5C930DF CD0BF65782DD6193B01ABFBFE4C4B08DEEAE4288AAF7CF29279A586F3A701BCCD5C2D43626C7133F37 F8D81DB58505C68ACA21DDAC4101BA9FB9F666 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4451 Entropy (8bit): CC16E9EC39581AD2A78559BC94C405 F6FDACEB7ED846FDE1AB F71A E003BC8BC529ECBFEA8959C133419A17DA67B69BC835BA5B237040AF3FF1 DCE5A7DE47BA3BC14FDA89BCF76F5E0208EA B03C157A1A3D92A2BDCF10E33AAF4479EE31A66DA069 EE62815C22C71C9DC3AFEA81128D6E B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 815 Entropy (8bit): BC66A157E3E9EE64D62B3D2597B8278A 82C3F11D62F2E3C5FA23E093C7ABEA7C84CFEDEE E70E62368F94E96BC2DB007C7F09233A2AD20C4B9D7C006550D060483D7913E4 272CF63EEDBAC3ACA64B2A7F41DD4CCB81EE6F096D35819E0B5B4DCA07D6CB33BD799F8DCEF29AFA6734D67 C1AB9B56D12609B4B441AD1F41B283836C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F82 1 data Size (bytes): 468 Entropy (8bit): D9D754520AE3340AA37CCA6115EEE05B A D99C762CB2EB4B37F776625EF1B33 7DC8284C51C9A38DC1BF03BD28857EA5336E8F5C564EDDBB1C9082EE43C F6A9EA2CE5ECD1FD7CB3D122A6F5F108550D71A9FF5F88F235BE F95C75F66CCF716AC2A EDBDBAFBD114EFF0AD3D98E3DA6A30C94 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_2A4E1D3B424A9AB9351F05D083A data Size (bytes): 463 Entropy (8bit): C7882A7A3317D31AA43F3D7D30EBF74B 5F883A877A4130C76D9A8521B98B8C96DC FC0209FBEFDC0C58FC417F5F583008E5FF5A58D3E832E5F21D44BED73311A9A Copyright Joe Security LLC 2018 Page 20 of 109

21 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F5F320A94D4D2B4465D8F17E2BB2D351_2A4E1D3B424A9AB9351F05D083A F25C88C3C8C97395C5713CCC7E7BDCF353B63024FD9367FC0C75B8313A46E87FD0CB9AC ED8B289C0CC BD473DE9503D783DF2A42BAAB08F10F172594C7 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01B16CDBADE7DB774141D7E30D50EC69 data Size (bytes): 364 Entropy (8bit): E A18835F7D10E7B620F827D8 8E7E8352E2C9F5C50AB9C53E62F6B9E4178B6C79 929DBD0E75B3D00224AC4B3C03C8FA2664DBA49E791E32560AA8A CECB DB4E4DF70ABF28DBDB18A89F4D589EE9087DD501816B60F2AF01FB08C9031DE4C215B98D6E7D89A0D104EC5B7 F99F19619A30F4DADEEA658D26ACB6FAA04B249 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 1368 Entropy (8bit): E ED14ED801223DFE6668EA E8703F525B A3B2B6CBADE598B 88386E932C800AD8EE72F2F71B234000BD0A8FA73D17C6E6CC1EDE47B64C17D2 6C0AC2C110CCB15C236FEBF1B2466C29C6AC17982B5757FC82B7073E D56530E3734DAF E026 0C93122C253D81A232E04AE CA21FC C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 data Size (bytes): 434 Entropy (8bit): E4C7D8B502C5CB53A7BE5780F50ADD D ABB737209F0B781410F4E7 2BD61D7A4F5878F3AEAA2CC1E1F053F56295D16F05573C1401C706F9B05375C1 27D7DB F04014D99B6A3F4A64F6BB4B0C04C25D1AE29264F3D5DC0222BF BF954D7DEC5A0BE1 FEDD44680ED71692BB283BC3FEFBFDAD28E0B0 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 656 Entropy (8bit): B3591E386EAC496296DB2C1060F733D 5B45FA82F1A62B705076A213A565F5B2C3235EA3 F80FEDDE265AC1E2A6A932064B6D69605EE54D520FF3E5078CBD2B75F11CE0B7 8512A0C F98FF7C1B83AF62E15ACC35710DF35557D0163B5D5F8EF3FF53BABC F61A725FE3 E33788DD0C3B46C2D01D24A8BB C5F9 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 452 Entropy (8bit): D6B B67CD47C1 C E5E1BA89AFE97A4A3F39F0E AF97D42D5B4FBC8A768A43E840EF538D3B0776F5BA2FE93A90B372EF8FE47809 Copyright Joe Security LLC 2018 Page 21 of 109

22 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F 2EFEB2E94A8F1EDA727D254E9A714118B034BD966AAAF368DE03ED14BE0A7D05F25E59C1E35395F63FEC2B63E 0A C4F2B78602DF3E6BC5CFE5B7EC3EF8 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\85B3F147E3624A14E6A20DB4F6C2C5D9 data Size (bytes): 184 Entropy (8bit): BF7DFE2B46E64AEE78DDE7A02CFF6A84 39D48A DAE457AB445956D2EB52BA8 5AA51C28B48BE702445B DE6CC3D486FBA1FA148CEDD007F3513D9A A5C14DE C35DD3DEC1154C27F50D4910C0C2935B43DD5796D9D308C4B30C7DFA965D3BD EC03C7E82E06CC5A53D4B1F98CF0C118B C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_FDB E72EDD3FB3D65568F8 21 data Size (bytes): 804 Entropy (8bit): FB7A5118B0F195B0BF3FB2050B63AF A C34F929D15A18FC9563BB0785CD D606A4479ABA1B908D BA31E443D7FC142B65413CCBBD61C8 F40EC3D7897BEC62AE CD4E0DB67C16F0073F0D007F9EE2DAAF2B43C D685417C61664EB C3C012FD51E B4C886E6463AB8168D1 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F5F320A94D4D2B4465D8F17E2BB2D351_2A4E1D3B424A9AB9351F05D083A data Size (bytes): 382 Entropy (8bit): F8362F617BC2E71B5DBF3A C3A616C996812F22341AEF36DD61F4FA606106EA 7DBF5068FAF7E443D D2B97BF0FDC076F3079D34D1F1108BAD8DC4A A10FF6C2D80E4978ED4DA190F0E60EC123D88BC76D83E3791E652D09229B75E79BEB64F29CF4E575F7EB1B90CB 930FEA4C4680A000294A5616A062FB321B17F7 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico PNG image data, 16 x 16, 4-bit colormap, non-interlaced Size (bytes): 474 Entropy (8bit): B296C9568BE4B40F DA56A3CE F4B7D1E31B78D81A F951E27745CE921CB 27D67BA98E8641B6A8B5BB9CCDA13FAB5B0E0C8D231311BD39C4915DC71B3159 AF25BC3A74CF1B4F914BB54D65A834020CF81DF369B6892E546EF51DB5A58769B44BA2E33C7B29C3D4B23454F7 5007E9EB88F454CF51459DB2099F361E3272A9 C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.3532 C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe PostScript document text Size (bytes): Entropy (8bit): BF1970D9DB8804FE9BD FEB8ED36FAC209E820E23C179E7D A53EE Copyright Joe Security LLC 2018 Page 22 of 109

23 C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst E3E101A1C FE23FE3CB41559B1B29FC655DF18C1F9EB68361B2D565 8F AC7BEB7AC63FCD958380CBF490ACF58D73529EE59DF76D E04E23B95B09A8D791CD3BAFFD0 BAE14FF18659A48C29F1D3D BF94B4FE C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe data Size (bytes): Entropy (8bit): E4F4CF2F222E32C572DC62B436ABDB1E 528CF7B94A68944FA623EA D1FC3 FA2145F0649BCC4A EDFE74BD416EABCE7C628D EABFF965 E35D4E1D302130BD CD60ABBD6377CF12322EE4E683AFC CA6B13E694CC D515AE7B A6FF17BF5B7D87C24B F8EA4F23A440 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5BDBB3F1-6FFB-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): F880FF55252EE8E44876E9A2A1BA2 90F9A3EC6739C5ED89CE17A6B14BE3B1E810D523 DC8471E6FFEFA437C479ABF30D12788CF69B5CEAE7EA9F4D65C086FE91CF80BF 0940F6FFD77C6C5BE5C64268FA3D99E3F3A110C266E5F BC35D5872BF8163EE8632DFEBAB5BD0C9 FD261FED07A5CF4EC84ADD3B DA128 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5BDBB3F3-6FFB-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): E0AD5F205CC604E F4BEB 56A24F30C0109F1A1EADC0E765CF3B1EEA54CD3E 56D39600AE490A4FB1955DA6BC0899AE4C0FD0B41B261CC FDF42B8F3 61A97D1D1E1EF0332DD7E23BE56760A6162D67882ECE77FB4690CE8AAEC3FF6EFB85C13D8DB2ADDFB5602D460 39BD77AEF5C00F BA9DBFB5B71228DC52 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{68285BE0-6FFB-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): C404BF54F02FA013A441CA B1C018218A235ABC5605B DF2F466ACA7DF77E269BC CAB8D0E7B934F9A6968CCFBC2B0A 9A4961DECD5EACC963A97893A0DE704FA08BD4C6C729FAA92E5066B199ADA4916F0CEEF84BBD23934CA C5AB9048C0AE15AE20EAF2E406881F21F8E689 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D FFB-11E8-B7AC-B2C276BF9C88}.dat Microsoft Word Document Size (bytes): Entropy (8bit): ED43C3647D363475BAFD028FF D594EBA0AFD6C5127B570995E4BFC7C8E0 Copyright Joe Security LLC 2018 Page 23 of 109

24 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D FFB-11E8-B7AC-B2C276BF9C88}.dat 3C45705AC1078B1E760B73F4CBBA20E009F501DD4EDEC54CD05E3A9DEB46F5CA C9059E10A8C25A6A FF2124AC66AA66EDAE992C54B AB18F4CE00F8C520A7C 4A42FC61BE8B84DF68420A4B01C4B124549C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D FFB-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): AAE0B5230D2CF3688E332AC03 3E0A283365E332B1DB59E1DBF06FDAD8F4699BD2 36A76C F3D001DB0EAFFD2A21BD55EBD21DB577EA9CB03B20B8E1BA64 6FADECBFCBF2908E8BBD215FDD45B35E2A601BE790AE1D299FD1F5E3C03F45DEE518E51E4493BD7000EDFCAF B56CAB3A6258AB53B4D486C7514EBBDCFABB75BD C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7D FFB-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): E0F A D09137A9CDC 73F49EC D2A10B2D3692E56864F49EA814 4A1CB6A36252C37FEB5F46540D75C8E4BC3BAA9A85D997E41B56A9C6D7DF EE01F5A9F8079DFE4FB5B99FD79183D8397E1AD7C3C60EADF7FFD7468FC7B27C60B86B8298CE7FA1525C F4F73B54D11ADAC1DEA3A429A1956A5 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8800A530-6FFB-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): F0F4E20E045A5967CC46C1F92AF1AB5 0946E28C5F4F2AD47EA27FE2AE0CAAE1431DE963 FD70BAF7D9218E842B8C91B396139F0209DC1CEC904E00AE82E6C60B2D9E996A 2B407ED79A58ABDF6F82DD A E88B1D0F2E139C4021EDE1590E2983B22B521B727D32A0573C06F5 3079CE733EB8CC66B0D07931EA98C021A08F0 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ErrorPageTemplate[1] Size (bytes): 2168 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators F4FE1CB77E758E1BA56B8A8EC20417C5 F4EDA06901EDB98633A686B11D02F4925F827BF0 8D B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F 62514AB345B6648C A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E BFAC A416C09733F24E B96843DC222B436 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\down[1] PNG image data, 15 x 15, 8-bit colormap, non-interlaced Size (bytes): 748 Entropy (8bit): C4F558C4C8B56858F15C09037CD6625A EE497CC061D6A7A59BB66DEFEA65F9A8145BA240 39E7DE847C9F731EAA72338AD B957859DE27B50B6474EC Copyright Joe Security LLC 2018 Page 24 of 109

25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\down[1] D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE AC191F8F F76 8F4840BCD5B62CB6A032EF292A8B0E52A44 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\errorPageStrings[1] Size (bytes): 3470 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators 6B26ECFA58E37D4B5EC861FCDD3F04FA B69CD71F68FE35A9CE0D7EA17B5F1B2BAD9EA8FA 7F7D1069CA8A852C1C8EB36E1D988FE6A9C17ECB8EFF1F66FC5EBFEB A 1676D43B977C07A3F6A5473F12FD16E A1CB9771D0F189B EE79480C33A010F08DC521E57332EC4 C4D888D693C6A2323C97750E C3F4 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\green_shield[1] Size (bytes): 810 Entropy (8bit): PNG image data, 14 x 16, 8-bit colormap, non-interlaced C6452B941907E0F0865CA7CF9E59B97D F9A2C03D1BE04B53F2301D3D984D73BF BA122F4B39A33339FA9935BF656BB0B4B45CDDED78AFB16AAFD73717D BEB58C06C2C1016A7C7C8289D967EB7FFE D9205A37C6D97BD51B153F4A053E661AD4145F23F56CE0AEB DA101932B8ED64B1CD4178D127C9E2A20A1F58 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\httpErrorPagesScripts[1] Size (bytes): 8714 Entropy (8bit): UTF-8 Unicode (with BOM) text, with CRLF line terminators 3F57B781CB3EF114DD0B B7B CE6A63F996DF3A1CCCB81720E21204B825E0238C 46E019FA34465F4ED096A9665D1827B AD82E98BE01EDB1DDBC94D3AD 8CBF4EF582332AE7EA605F910AD6F8A4BC FA84F08943A72CAC2CF0FA32B6AF4C20C697E1FAC2C5B A16B5A64A23AF0C11EEFBF69625B8F9F90C8FA C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\invalidcert[1] UTF-8 Unicode (with BOM) text, with CRLF line terminators Size (bytes): 3084 Entropy (8bit): F927FC64C6CCF8F9E508B5C8510C8D26 9AAAD2E C151FF294A116D66D7286CC052 D1122EFA5A5D7CF93E9DA4CB8525CC7E6CCF50B9FA16C167A5D7E A5FA Copyright Joe Security LLC 2018 Page 25 of 109

26 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\invalidcert[1] A70CE43D8497EF7D91D8C2C78DFB52FAE9AA1C39691D46D8EE3A2E65D82482E8F2916C39B3D85CE8B8F9A0647 FCCDC831C1FD6824FD300AA91818D0191AA4C50 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\mail[1].png Size (bytes): 1694 Entropy (8bit): PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced 34C474722FC5046A7F984C D 1995EDB41E576CEB3C8A1ECED59C1D8813F5108E A2B00DC7E4FF8539CF742BF8D295C111DEA08ACF D E70A 53636BF7C605F133BAB85DF11BDC90229FEE29ADC E01E1B2F6671B9115B775F08FDFFD98918E901BAED BEF1EEEED0CFFF39A506FEC276BD84F1252BBD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff Web Open Font Format, flavor 65536, length 18296, version 1.1 Size (bytes): Entropy (8bit): CD5320F8937D337B61D5117CF9D7B EF7AC55BA93AAA033FEFDB7CA4D57DA44AD E19B28AD1AAFCB23735D02CBEC4E2697EBBF7D608CF47FB8F8565DEF01B28C2A 9DBD69E362FE4144C686ADC1C53E0D55EFE9AA173C E14A4ED505A00FC6D5AC95B1E0259D26EFB9B 846C E1D EA5CE89D300D9008 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\oneDrive[1].png Size (bytes): Entropy (8bit): PNG image data, 212 x 44, 8-bit/color RGBA, non-interlaced 3C056ADCE9C03F44BC6EB31227E5232E F6A575918F5FBEBB8036A49CA1252AE63D6B96C7 AF6B42EDFADD722F3C918BFA04F C95EA4E14F23A7D9CA A2CD D1F8934AE490B7395C31DA3D2BB951AF1977E0222E0B4042BE4F6B569AC0842C19048BF670ED0BA53FC 67C11A318F7B0F6A41CCB16FC105C12834F77 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\red_shield[1] Size (bytes): 810 Entropy (8bit): PNG image data, 14 x 16, 8-bit colormap, non-interlaced 006DEF2ACBD0D2487DFFC287B27654D6 C95647A113AFC5241BDB313F911BF338B9AEFFDC 4BD9F96D6971C7D37D03D7DEA4AF922420BB7C6DD46446F05B8E917C33CF9E4E 9DABF92CE2846D8D86E20550C749EFBC4A1AF23C2319E6CE65A00DC8CBC75AC95A CAB1536C A 8739B D0BA562F48F4D3C25104B059A04 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\6d0fecb66fbca13ec8bea4e3d33d5a40[1].htm HTML document, ASCII text, with CRLF line terminators Size (bytes): 2108 Entropy (8bit): AA59CE6A4FB B2C947C3A667 1B4CD561C3F2FEF3A79B218B719C05976D371DA9 01CF48A4991CFF46680B1EF44B60B282C95D3E1B5096D265E8CD39DABC592BE1 Copyright Joe Security LLC 2018 Page 26 of 109

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version:

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: ID: 45097 Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature