ID: Sample Name: xnyjv5cbuw Cookbook: default.jbs Time: 07:26:31 Date: 02/07/2018 Version:

Size: px

Start display at page:

Download "ID: Sample Name: xnyjv5cbuw Cookbook: default.jbs Time: 07:26:31 Date: 02/07/2018 Version:"

Adela Joseph
5 years ago
Views:

ID: 66387 Sample Name: xnyjv5cbuw Cookbook: default.

1 ID: Sample Name: xnyjv5cbuw Cookbook: default.jbs Time: 07:26:31 Date: 02/07/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Networking: Boot Survival: Stealing of Sensitive Information: Persistence and Installation Behavior: Data Obfuscation: System Summary: HIPS / PFW / Operating System Protection Evasion: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Copyright Joe Security LLC 2018 Page 2 of 83

3 Resources Imports Version Infos Network Behavior Code Manipulations Statistics Behavior System Behavior Analysis xnyjv5cbuw.exe PID: 3380 Parent PID: 2960 General File Activities File Created File Written File Read Registry Activities Key Value Created Analysis drpbx.exe PID: 3424 Parent PID: 3380 General File Activities File Created File Deleted File Written File Read Analysis firefox.exe PID: 3468 Parent PID: 1432 General File Activities File Created File Deleted File Written File Read Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 83

Analysis Report Overview General Information Joe Sandbox Version: 23.0.0 Analysis ID: 66387 Start time: 07:

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 07:26:31 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 5m 37s light xnyjv5cbuw (renamed file extension from to exe) default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 7 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal88.spyw.troj.winexe@4/85@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): svchost.exe, dllhost.exe Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryDirectoryFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: xnyjv5cbuw.exe, drpbx.exe, firefox.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 2018 Page 4 of 83

5 Confidence Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Copyright Joe Security LLC 2018 Page 5 of 83

6 Signature Overview AV Detection Networking Boot Survival Stealing of Sensitive Information Persistence and Installation Behavior Data Obfuscation System Summary HIPS / PFW / Operating System Protection Evasion Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for dropped file Antivirus detection for submitted file Multi AV Scanner detection for dropped file Multi AV Scanner detection for submitted file Antivirus detection for unpacked file Networking: Found strings which match to known social media urls Urls found in memory or binary Boot Survival: Creates an autostart registry key Stealing of Sensitive Information: Searches for Windows Mail specific files Searches for user specific document files Steals Internet Explorer cookies Persistence and Installation Behavior: Drops PE files Data Obfuscation: Binary may include packed or encrypted code System Summary: Abnormal high CPU Usage Sample file is different than original file name gathered from version info Sample reads its own file content PE file has an executable.text section which is very likely to contain packed code (zlib compression ratio < 0.3).NET source code contains calls to encryption/decryption functions Classification label Copyright Joe Security LLC 2018 Page 6 of 83

7 Creates files inside the program directory Creates files inside the user directory PE file has an executable.text section and no other executable section Parts of this applications are using the.net runtime (Probably coded in C#) Reads ini files Reads software policies Sample is known by Antivirus Spawns processes Uses an in-process (OLE) Automation server Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Uses Microsoft Silverlight Creates a directory in C:\Program Files PE file contains a COM descriptor directory Uses new MSVCR Dlls Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug directory Binary contains paths to debug symbols HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Creates guard pages, often used to prevent reverse engineering and debugging Malware Analysis System Evasion: Contains long sleeps (>= 3 min) May sleep (evasive loops) to hinder dynamic analysis May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Hooking and other Techniques for Hiding and Protection: Icon mismatch, PE includes an icon from a different legit application in order to fool users Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 83

Hide Legend ID: 66387 Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Sample: xnyjv5cbuw Is Windows Process Startdate: 02/07/2018 Architecture: WINDOWS Number of created

8 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Sample: xnyjv5cbuw Is Windows Process Startdate: 02/07/2018 Architecture: WINDOWS Number of created Registry Values Score: 88 Number of created Files Antivirus detection for submitted file Icon mismatch, PE includes an icon from a different legit application in order to fool users Multi AV Scanner detection for submitted file Antivirus detection for unpacked file started started Visual Basic Delphi Java xnyjv5cbuw.exe firefox.exe.net C# or VB.NET C, C++ or other language dropped dropped dropped dropped Is malicious C:\Users\user\AppData\Roaming\...\firefox.exe, PE32, PE32 C:\Users\user\...\firefox.exe:Zone.Identifier, ASCII C:\Users\user\...\drpbx.exe:Zone.Identifier, ASCII started Antivirus detection for dropped file Multi AV Scanner detection for dropped file Searches for Windows Mail specific files drpbx.exe 45 Antivirus detection for dropped file Multi AV Scanner detection for dropped file Searches for Windows Mail specific files Simulations Behavior and APIs Time Type Description 07:26:47 API Interceptor 1x Sleep call for process: xnyjv5cbuw.exe modified 07:26:48 Autostart Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run firefox.exe Antivirus Detection Initial Sample Detection Scanner Label Link xnyjv5cbuw.exe 78% virustotal Browse xnyjv5cbuw.exe 63% metadefender Browse xnyjv5cbuw.exe 100% Avira HEUR/AGEN Dropped Files Detection Scanner Label Link 100% Avira HEUR/AGEN % Avira HEUR/AGEN % virustotal Browse 63% metadefender Browse 78% virustotal Browse 63% metadefender Browse Copyright Joe Security LLC 2018 Page 8 of 83

9 Unpacked PE Files Detection Scanner Label Link 1.1.xNyJV5cbUw.exe.c unpack 100% Avira HEUR/AGEN drpbx.exe.ed unpack 100% Avira HEUR/AGEN drpbx.exe.ed unpack 100% Avira HEUR/AGEN drpbx.exe.ed unpack 100% Avira HEUR/AGEN xNyJV5cbUw.exe.c unpack 100% Avira HEUR/AGEN firefox.exe.10d unpack 100% Avira HEUR/AGEN firefox.exe.10d unpack 100% Avira HEUR/AGEN drpbx.exe.ed unpack 100% Avira HEUR/AGEN drpbx.exe.ed unpack 100% Avira HEUR/AGEN Domains No Antivirus matches URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files Copyright Joe Security LLC 2018 Page 9 of 83

$No context Screenshots Startup System is w7 cleanup xnyjv5cbuw.exe (PID: 3380 cmdline: 'C:\Users\user\Desktop\xNyJV5cbUw.exe' 3BEE1D24189D4941F68B96DA6E207BE4) drpbx.$

10 No context Screenshots Startup System is w7 cleanup xnyjv5cbuw.exe (PID: 3380 cmdline: 'C:\Users\user\Desktop\xNyJV5cbUw.exe' 3BEE1D24189D4941F68B96DA6E207BE4) drpbx.exe (PID: 3424 cmdline: '' C:\Users\Herb?Blackburn\Desktop\xNyJV5cbUw.exe 3BEE1D24189D4941F68B96DA6E207BE4) firefox.exe (PID: 3468 cmdline: '' 3BEE1D24189D4941F68B96DA6E207BE4) Created / dropped Files C:\MSOCache\All Users\{ FF1CE}-C\ExcelMUI.xml.gws Size (bytes): 1568 Entropy (8bit): Copyright Joe Security LLC 2018 Page 10 of 83

11 C:\MSOCache\All Users\{ FF1CE}-C\ExcelMUI.xml.gws Reputation: EDD7DD980FA6108F2CFBE5437D23B4A0 3EF9EFB9C36EFA69E4555EF4B70D4552DDCFD391 FB9F76BCB91FC91F073B AF1BDA5AA589BB2FC51F22D388F29DC989A 7B41663CC2E5B9237E6C A7B64E38491DF8DFC87D90BDAB4724FD10507EAA926FBC55E1B88B D2A88DE0386A3054F2DBC271143FF1 low C:\MSOCache\All Users\{ FF1CE}-C\Setup.xml.gws Size (bytes): 2304 Entropy (8bit): Reputation: F9AEC13AF164DF127CDC88B126A755D2 B5F31C33200EFDDA797B4CC1B4AFC133AE4E979C C88B931710DDE77B818EE42A63BCFCD45D9B702F291A3282E91EB4E039A B32061FC914F94D01BAF1F43382DDCD24946BE7DBCBC65E5FAF18644D0631BE70C7D14C6AE21F47CFBBD6E7B 975F790E5C0C2CA720C99698B F2F159 low C:\MSOCache\All Users\{ FF1CE}-C\PowerPointMUI.xml.gws Size (bytes): 1568 Entropy (8bit): Reputation: D7A26C3C8A9A3F8333E20C495807F0A3 60E89D3432E03E6AB5EC7C1365F6BADBFA B95A147A4F621419B6B8F7232B624C6037E77568A3FF8F278F48F2931F49940 F788B1D27BC1B89BA1F18702EECD6DD28F2A B16BD036632D00B3E07B98409F689F8E04CB01EEFF0C 9A267951CB078AC6C3DC D7242B16D7C low C:\MSOCache\All Users\{ FF1CE}-C\Setup.xml.gws Size (bytes): 1888 Entropy (8bit): Reputation: E5E7AB24A217C4EC720BD306D6BABBD2 A278B6BE1B984AA477C576231A576C85447E8A2D F BED118D693EB565AFDFCED828773F17543A553B8F8CA7A97BD6141DE B DCFF32AEF4F82BBB4DB4395D17FB5D341F856BEE23F64244FECED9CDF1F92A92B47245CFFBE0B0928 A4093E64C0872F79712B5CC4410C low C:\MSOCache\All Users\{ FF1CE}-C\PublisherMUI.xml.gws Size (bytes): 1456 Entropy (8bit): Reputation: CA78A40A45D9797BE4612D46589DFEB4 A6BD3A29ACDD EE22B75B894A1E506F8E 4B7E2F586E88CBCE1C21CEF964B528EDE7E98A36B200E0CA5C A9BDFDC CCD34401B24AED66C87831AF8586DE2CACFA5B60DA5F608F6C46540B CA6E6268CD9F54126B4BB2F7B0 D7F22A08583CAFC2C FE598EE894D1FEE low C:\MSOCache\All Users\{ FF1CE}-C\Setup.xml.gws Copyright Joe Security LLC 2018 Page 11 of 83

12 C:\MSOCache\All Users\{ FF1CE}-C\Setup.xml.gws Size (bytes): 1616 Entropy (8bit): Reputation: DEFD42905DB21626DCDDA1A2FB61AC09 B3D4639BFD86CEB6F4C075EE8F DB929F0 7E5F87D93F4AE739070EC6F3354B0EDC197C65A82AD60323A9A8D7D8B A8E876B08C6EFF3FA52485CF51F097862AC910B637CAB02893BB2A2D5C2A0E4EA5E75E53712E9ECC805819EFD 1D575A65FF555E7E89D DD87DB799CD low C:\MSOCache\All Users\{ A FF1CE}-C\OutlookMUI.xml.gws Size (bytes): 3200 Entropy (8bit): Reputation: C3C03F424E96370F4A16D9D53508AD53 184E100248BFB909294AA4ABC9946BAD0657C9C2 CD59FD083133DDB8EC5F0756D2B351E8A70B7C849F E12538E0A4E636C 3F5DF5638CB568316EC F4CC603CBCAE7540CD6E3B601A48BF76B01B6F67CA5E8CCE1384CF79C3AEF 5F8E3B212AFC01ECEE90DEE393CE54F2F105C14 low C:\MSOCache\All Users\{ A FF1CE}-C\Setup.xml.gws Size (bytes): 4208 Entropy (8bit): Reputation: 6AA9E78FF3384DAD98F1FE52B44C4756 8A0C49FAFF D57586FFD79AC09A9B254B 8F72E2A C043C7C8A9DB1E32AECDCEEEC33DD62AA5D DEC34 F167767A6E7F67AC298019B28E73D9B2B1FEEA07D1F7089AE1A3CBBA6F4587D52E91D5F D6F64E051E DE5B96CA3485D BE7F44853B1EE69BB low C:\MSOCache\All Users\{ B FF1CE}-C\Setup.xml.gws Size (bytes): 2432 Entropy (8bit): Reputation: 1C78F871F4BD61F88B40942EBC7B89BD C77FF59474FEFF174B7199BACA65DB0001C20EB9 F82692BD5DACAAC931F317493CA0CB D35CB349DD84584DF0E573B CAE134CD088F8C C5680FBBC9BBBD58ABF378FC12D7CD609BA93BEFF56A94699CAFED1A5AC EC032213B1C1E7857B66B1A582EF low C:\MSOCache\All Users\{ B FF1CE}-C\WordMUI.xml.gws Size (bytes): 1808 Entropy (8bit): BC409ABEFA FB68EBD 78D0CC92974ADF310636BDB60C5A70DECC21DC3B AB779B971B61A9FD5D06B BAFD3C75B2F68E1C4DF6D21237DBBEA8 1FEAB19E17C13D7CC8E14AD92A85E7555CD0A5E58BBD61BAEC1222C784CFB06C9DFC35DC200D7C296F7727F0 B1803A5AE2248C9C8A F6A757BFA4602EF Copyright Joe Security LLC 2018 Page 12 of 83

13 C:\MSOCache\All Users\{ B FF1CE}-C\WordMUI.xml.gws Reputation: low C:\MSOCache\All Users\{ C FF1CE}-C\Proofing.xml.gws Size (bytes): 816 Entropy (8bit): Reputation: 8B536698C3181D6B05938A F A8C40C3A024D27D4B538A1D20547C9BCD 34D75A33394B7BB7F8B CD0DC4A969297F540D2BE2A52DED91A F279B41CAE4B0632D6B6CA60D6DAA10367A8FEA96D37E001EAB0E20B4F65A80F5ACE108317FF019C95665DF 04296D64C181D0DA0BEF37AFFE6814D6F1BC08 low C:\MSOCache\All Users\{ C FF1CE}-C\Setup.xml.gws Size (bytes): 5888 Entropy (8bit): Reputation: 197DCAE741D29F5A52A9A126E11BB449 2C A225556C6B EB4AD8 DBD90FF85611C DD599B511C75B1AD22774F B772C03B33E2 775F2DD8EA5861EBC0B74067D6F645CD2F294AAADBC9A201E01B31DFB4700DF6075A3E5F8AD647B0F67479C35F 4AE5AA62586A3C867EEF155C9B98B7E8C0E741 low C:\MSOCache\All Users\{ D FF1CE}-C\Office64WW.xml.gws Size (bytes): 4688 Entropy (8bit): Reputation: 0CE4B9841B18FDB3ED06CDE614B8F6B1 46C32D74B4C7FFFEC20F5F9C250087C9FD3F6C8B BDE70DF28BC817F6AC63422BB382D265F00496FBAAAEF2ABE8E7F2E7EE25CA3D 34AF77DDBBC2F1B1FA8EA3384C5FF17A01B49A1461E672E691A7684A20D2B60FE72D5660E7AD1C93257BF E600422D0DB028C04B8095A35EC910F8F3D low C:\MSOCache\All Users\{ D FF1CE}-C\Setup.xml.gws Size (bytes): Entropy (8bit): Reputation: true 6AF17C34444E92A4B499B0C0009D2C02 7C369C3297C45C2C37E26682B B9185A47 369AE7C589FBD7265E6BD2AD6435C30BC C0A75F4E80BC5DA3DE1CE8CB 2AC351EBED09A73B371D40A5B53E32FF8DDD9F6C7934D96BDA3B4480C475E3D154AB3BAEBE798B7EC365D6D6 7DCCD81DABF FDB33584B1EAABF990 low C:\MSOCache\All Users\{ D FF1CE}-C\SingleImageWW.xml.gws Size (bytes): Entropy (8bit): F2DDD5DB7CC3CF12E65A23B8F3231E 8BA6DC51CEA56C543DA111A392B45EA7FCF9C06D Copyright Joe Security LLC 2018 Page 13 of 83

14 C:\MSOCache\All Users\{ D FF1CE}-C\SingleImageWW.xml.gws Reputation: EEABA782DACA93630D5A8182CFE57078D1C E63F8C58B63146A91BEC A7AC4F3B3A BA1F166E12C42FDFE7A470AC19F5CFE26921A831023CCD9BAF B85A92F0FF 1C62EC C0E82CBB5A87C9E446BCF2 low C:\MSOCache\All Users\{ A FF1CE}-C\OneNoteMUI.xml.gws Size (bytes): 1616 Entropy (8bit): Reputation: 2723CE5614A7BA F0E14EBBE65 F1FB35EA9D351D816E8BD AB97A36A21B2 69C85EF8A20C0FEC5D9FBC5C34108F4D5DE6937BB450FFDFDC040E F2 F3B5B96B0F673C0558C5BE D6491BB101B32EA E6C62E67DDE06034E81606F8C D03489C0 3D1BCA095ACBF1B053F6F3C6F27F0FED160B low C:\MSOCache\All Users\{ A FF1CE}-C\Setup.xml.gws Size (bytes): 2000 Entropy (8bit): Reputation: 44C705A6A7EEB297448C75BC7AB52366 E B45822FA1CCDC07CE3D38D90534C598B E82626A40905D0EE431BF8B64AA85E95995E9BD8079C D985FF96B57F 7764C6BFB1853E6FEF6926B FC62C13BDBFED B0B11D534F0AC50EA C EF8ABFF C DDB71D3DEE30C3EF A16B90 low C:\MSOCache\All Users\{ FF1CE}-C\OfficeMUI.xml.gws Size (bytes): 5664 Entropy (8bit): Reputation: 5291F80A330B4F398C3781BEFC95BDF5 46DCAABC308D90F2B1220D22DAFA4A7CCC571F2B 5273CF654D F8BAAFD8D9F1DBD251997F061198ED68857C53513D E59028B378F963BB947BB4CE4633A2C009643F07BF739FD4E475E4F6C68E5FA66B576169E7CBA897E0DD 8DD91059C54CE0EE4B9C7D446E4D7C287BD5F low C:\MSOCache\All Users\{ FF1CE}-C\OfficeMUISet.xml.gws Size (bytes): 832 Entropy (8bit): Reputation: 909F7E84A0047D76C8285C91531ACA2F 4A4755DCFAED6AFBBA9EF3EDB32449E2D3CB4EEE 4FA0C2F7CE136F22B5E357352BD3F0CCB17D2FEAE89D6C2465BD3ECEDF AB9F26A85CB06EF91CBF5E19F87C819F997BDF9991AB9F7DF1FDB82CC205545EDEBAF2395F32CD131F56F34 A482D861F38E9A3AC1EA0EFF2BD6398D48826B5 low C:\MSOCache\All Users\{ FF1CE}-C\Setup.xml.gws Size (bytes): 9600 Copyright Joe Security LLC 2018 Page 14 of 83

15 C:\MSOCache\All Users\{ FF1CE}-C\Setup.xml.gws Entropy (8bit): Reputation: 197B3C5A53578D4F725D60F0FBB465C1 A5A4F4E73EE694BE D3562C55E636055C E01524A54442D9C05C44D83C23F9A2C4C565E8C80CEFE73FBDD8C39F1 EF5E7F39D17D60A1343D4EB63FD9F904FB851A01C7C18EB5FD4F5F C114E FEB E69 A4667F80385B45D034C15260B7B4A319BA039 low C:\MSOCache\All Users\{ FF1CE}-C\branding.xml.gws Size (bytes): Entropy (8bit): Reputation: true E3FF79A35B2785B8B29A431E5C13BBC3 0DE9BF69D1CA FA159DA4083C AC563A6FF9868FA E3056A07E132FD9B476F5F6B472FA13B274E00 FE68E8B222B3448BA EE7DA1BF4FA96AE2EC8A58D743E1846F607AAFEE D9C57F1071F6DE5D D321322E116CBABC0FF6C5821C DB85 low C:\MSOCache\All Users\{ FF1CE}-C\AccessMUISet.xml.gws Size (bytes): 832 Entropy (8bit): Reputation: AB94DA F FC28F3A255C 78D10A9B17ACCA2C4762F833B63DF31445D57EBE 0B84BCBB3B423EF2696DFDE8A5F9EDC8438C B7E0D6F8C538610A85A AA B73A4843A620EF7BA276DF0D47EBD58BD0DFCE3E5CC4708DCB132305A6E26CCC412DD0168E9A5900 F6C864415F74EB9E BA11842DE173FB2 low C:\MSOCache\All Users\{ FF1CE}-C\Setup.xml.gws Size (bytes): 2640 Entropy (8bit): Reputation: EE7BF2D6BACEFA345729CBAEF701D68E D1C03116BE70DE96B0ADA992A999C5E800D2929A E BB229DA D3B1431BB6F45BB27DE23AEF175C4A2BCDA0BA D005D1FBAD7FDE9FA190837FED62609A0D3B75C631B1C9B71CFEE9ADBF883ECFCAB5EA7FC736ECBCAA 8E84EEAF6818D8C2FFB C241060C51ED04 low C:\Program Files\AutoIt3\Au3Check.dat.gws Size (bytes): Entropy (8bit): Reputation: 252EB0A4A098EA3AF79E06921FA FEBA A6502E3D974C2A03CE887E 7884EED511D02AD46CFBE8FE8FD5A08E6080BABCFF7DBCDC8FC192D3D8A76CFA 046D D422D93AD004C9F52EA6B454B906841A E686D1E5E0B110B6D4B703EE3EEEDA190A812F869 A6E A23C8AD33A30C19EE3867B8820E low Copyright Joe Security LLC 2018 Page 15 of 83

16 C:\Program Files\AutoIt3\AutoItX\AutoItX3.Assembly.xml.gws Size (bytes): Entropy (8bit): Reputation: true 71B4C755DF9720B67821DE32F33E846F 87AF105AE2DE273786EDE2467B5BC26DF13F7D4A EAE9118B07403B8E88EF947EA6E4B78CD9DAE6F A6EDF3995E7F87F60B 1D8E47354AA34E82C3FD27A95B4FAF0309C5A4D2B81531AEE186C1E44E5E5328E67D7ED97FB8C14250F0AAA546 D8ABD3F953684B59BD A887CF5A14C0 low C:\Program Files\AutoIt3\AutoItX\AutoItX3_DLL.h.gws Size (bytes): Entropy (8bit): Reputation: 631CAAF6ACC08F FD6F0 AD919ABA74A9604A24BBD512D4EEC5CF71B3586B 528BEE6338A22C1B54ADFFBD9B45B2A89F8BD6AE1F591F5B18EE99EF55E4AF43 C778A22C2B103659EF2B8F6494E9F57A7954EA75F61FCD1C12A56AEF42524A809C829A1D86AAF4593D94A6E6B F C8D2D3D83D3877A95C08E low C:\Program Files\AutoIt3\Examples\_ReadMe_.txt.gws Size (bytes): 208 Entropy (8bit): Reputation: 7EE5135A3851E8D161F3AD5BFD3CED4F A8BBFF73E0D850AF0D6063E59A8DBFC9ED2DE80E 8C3D96FACE1ACE277609F277778ED3A93B845E88FFDA6369B59C26F830F4A6EE EC8481F47A62FADC340A D305865D99445DC C2FEA0534CA424D87C3DF7AD60AD09D6CBC3D9860 C8B56104B8874F3C2208B1AA732FC6A7E0365D low C:\Program Files\AutoIt3\Extras\_ReadMe_.txt.gws Size (bytes): 192 Entropy (8bit): Reputation: B11CE25051DC0B3B6B36F B48C 3E5660C42A43470B298294BC28C7BDC2DB51BC38 A91F6578D06D7FD3F77AD857C2055D6891E0A8671D410CB78B0E890FD46A9694 0BA4CC5F2B40A91C861F85BEB93618A5EA784C21EA82C3347F0891D34303ADD3907DA8C5650FF699F4C7CEED4B 62D550717DAC275ABB239E672D19281A6AB246 low C:\Program Files\Java\jre1.8.0_144\README.txt.gws Size (bytes): 48 Entropy (8bit): A865B18AD2D39E710A02788C7C097D 4FCFA6A80DDDD61CBEB0F128F3AABA186C4B F98C2D835AE391D3526BF78875DD09A80DD4DF40B8A07860ADB4FB6225 BB40605C43D4DAD8BA7E70A6A3DF78990BB0B230F9199D379B18B2FBA3A9F34A90179F2FD31AB39CA8179B18A9 8E4A7C DF3F7CAFC5363DF D4 Copyright Joe Security LLC 2018 Page 16 of 83

17 C:\Program Files\Java\jre1.8.0_144\README.txt.gws Reputation: low C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt.gws Size (bytes): Entropy (8bit): Reputation: true B56256FD6EC849CC361D78D0382B43D1 DB5B8FF45D47C492718CC F2D1FC50FA8E4CB527A2DF73C06CACC C8CA8F612313AC4AB9CFBAE 2A4511D61AD0BA184FD9F0EAE2AF F0F8C1ADEACAC17D593EFA61A62CF60D3628DFAC E B7778A509F431CC1AB9E43BEB0A32F low C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt.gws Size (bytes): Entropy (8bit): Reputation: true E5D7A2F70708AFC29A396D0AA3C6290F 883DC54E511535D625E0512B718EDD C6B03A2C57E33D76384FD3D7AD0DCB9BA11BCEA0DEE457A47F9209A0D0F9C7DC 7A4D D9F859B C0C A9631DC5E9802B2D47B8889D8F7598C251E65421A45B23B268D D49AA E445B6A low C:\Program Files\Java\jre1.8.0_144\Welcome.html.gws Size (bytes): 960 Entropy (8bit): Reputation: A26E1DF03A46E820034E01204E43954C 5042AA19F004E9CFBE641C824AF0DE0FA9A9D959 C9536BBA9A29701A08B9A04ED5EBD4E6351BC7B1B94D3ABDC29085C92BCA561C FAE29902B0CF38424CCD4FEEAAEC99EB B9BE1EA6E9A8CFB5C2E3F FEA847B393244D5B5A1 4CBFA00227C84B368F902C696B2F4B15A9B2B5B low C:\Program Files\Microsoft.NET\RedistList\AssemblyList_4_client.xml.gws Size (bytes): Entropy (8bit): E91C33CB4ED20C2166A71DFF15E23D6 E4EA6FDF6E078952C8FFFA14C06801A92D2995F FEA22C1DDB11A8C108776A3689D454AE97A74565D2571F1F67E7CD46 1A7DFEE3657C28E1DAEAF72332F4DF0B1823FC021A2CEF9A17DADF01DDAECEAB4FE1B C061675A44 06AA66B8C5EA73207B3A14C4C458A51BD2C2E83 C:\Program Files\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.gws Size (bytes): 8224 Entropy (8bit): F0DBA391F3E2D41FC09C4C6F7374CF B8EE10A23D1BD71BF502B3C5D0F2CC65E17DBEF5 Copyright Joe Security LLC 2018 Page 17 of 83

18 C:\Program Files\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.gws 4632E917EFF01EBC04F884857EAC00C B04F AB3B20EE9DC5 3D137F2C4A4E927208FC950E9B906D1FE35556FF4C DD7E78E506AA170CDA5823F4AAD45F A8507C89583F610B71D24A959EB4F0ABDB541 C:\Program Files\Mozilla Firefox\browser\blocklist.xml.gws Size (bytes): Entropy (8bit): true 1F6718CD9D028D4B5C5D DECA 0BFDA9CE77508D6FE5E58659E9AF8ABDBBC8D8A5 DFC1321AF521B1ABE8FEE0D31AF606E23B5323F1B14C65A7D5B C2B5C9 B2B5C53A35636D28F9C9974C7FBFAD26C1A2AE39DA769E0FA6FE1A9FB9A1A A77BFF590A2BC3E4FB08 A590DB756F1CA4D94CA5F021F9ADBC2A4767A05 C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.gws Size (bytes): 352 Entropy (8bit): CFBECEE88A DE284ECCEC3 1903D17A3D2FBA42EB6DAD6376EF38833FF145DF 4A0F F48B7744FB2A7879A862D779DF832B80D F49A FA4C6C6CE1703B E6B123CECFB A60DC931548C429112C5AB89084E1DFE ADAB D21CECCFDEC80136E53DC344C1B9BF6C569D9 C:\ProgramData\Microsoft\IlsCache\ilrcache.xml.gws Size (bytes): 416 Entropy (8bit): F60F114CE12B57DA2C370AECFCDC94B9 C449867B3B90C271F3B B7340AF55BAB6D 6F50061DFB9B4DE0DE18336D666FB54439D3FDDEA7B49B9FB570A652510E71C5 49A8C629A3DF32DBC9C0F2E420F4945B0051EFAE2C106D2893E44B972ADF555586D2E745D5F357FB425E2343DC EF100576A C0CA250A0A456F6CD185BF C:\ProgramData\Microsoft\IlsCache\imcrcache.xml.gws Size (bytes): 4288 Entropy (8bit): ACD3827C9202DCD5E9F90D2799FFCA4F DDC0693FBD29F75F0C2970EFFEDCAF9B37DA7473 FB9FC873F1ACB23D4094D0346A27D610BD5A63F71C228F25FC16E046F422160B 2C4D89C1C6E768D469E0BA24014AB49303B4E45547F06F605E96B3C42B1332C D01150C30174F307AE00 C911E39177C9A3571CC1ABFFB9FBE54A230D C:\ProgramData\Microsoft\User Account Pictures\user.dat.gws Size (bytes): 16 Entropy (8bit): C3A DF614575DC417C3CF9D9 2E71688B2013BC93B1C5C01E5FD902A32A62007E DA1F A03FEC57464A38B8BB928CAFD8FA E83A6DE555ED7 Copyright Joe Security LLC 2018 Page 18 of 83

19 C:\ProgramData\Microsoft\User Account Pictures\user.dat.gws EB740B56BFC85D2C5BE11AF614CB413A0F0E055D6D2311D4790D86AD71C59A2EC4F13E09D04A180E3279C22AC3 20CFA38892BD0F6A5E8E04299ED64B2D514C2D C:\ProgramData\Microsoft\User Account Pictures\WOUTempAdmin.dat.gws Size (bytes): 16 Entropy (8bit): C3A DF614575DC417C3CF9D9 2E71688B2013BC93B1C5C01E5FD902A32A62007E DA1F A03FEC57464A38B8BB928CAFD8FA E83A6DE555ED7 EB740B56BFC85D2C5BE11AF614CB413A0F0E055D6D2311D4790D86AD71C59A2EC4F13E09D04A180E3279C22AC3 20CFA38892BD0F6A5E8E04299ED64B2D514C2D C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.gws Size (bytes): Entropy (8bit): true 0B21519CE10D2E1E75E1C89F4699A31F 46EC70ADF0743F9EB831983AAEEA8876EB13863A FAF720F B22CADFC5FB866F80ABAD9F58276ED1513E800EF6855E9913 EA2B1171EC3992DD73C7A582B0E83A9A0CCD63471D6D7787FC2DEFD5B00EFCF63B41BDB6C7FEB0E10DD9CCB9 84B1FCFBE2E55AEE930B607BA96F0B68C4CEA4DF C:\ProgramData\Microsoft\User Account Pictures\user.bmp.gws Size (bytes): Entropy (8bit): true 707CEC556D765F91EC2F8637F58A8F7E 7838EE4E770AD3866E761695D DAFE6CEF FFA69A1678AF497C5CF6E1080B1DE4085F9BBF1E61B7681B0266F6EA B4FB25E700D1664AD1EEB87EB9CC3A2DD928C268C6F14D2963C5F2F632EBDF4D658100E1B717F63C029993EDF1 DC1ED679A22E AACAD0D3165FD85934D Size (bytes): C:\Users\user\Desktop\xNyJV5cbUw.exe Entropy (8bit): Antivirus: PE32 executable (GUI) Intel Mono/.Net assembly, for MS Windows 3BEE1D24189D4941F68B96DA6E207BE4 DCE911B1C05DA965C B88BC29D12756 A375201F22B6E71D8EA0F E4638E1754AEEE14059E9C5E39026D6C710 A40B01C630FF2C4B90A2E1BBF285C5D558193EE0FBA79A3210A CA E3202F65B8EB038A565 B1EA8A18D185864BA9DC4073A3633C86CA29 true Antivirus: Avira, Detection: 100%, Browse Antivirus: virustotal, Detection: 78%, Browse Antivirus: metadefender, Detection: 63%, Browse :Zone.Identifier C:\Users\user\Desktop\xNyJV5cbUw.exe ASCII text, with CRLF line terminators Size (bytes): 26 Entropy (8bit): F488E27DB4AF347237FE461A079AD Copyright Joe Security LLC 2018 Page 19 of 83

20 :Zone.Identifier 6693BA299EC D A0D2CB21F8E64 255A65D30841AB4082BD9D0EEA79D49C5EE88F D8D6156AEF11C F237C0C051EBE784D A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53B C731530C92F7327BB7DC9CDE1B60FB21CD64E true C:\Users\user\AppData\Local\IconCache.db.gws Size (bytes): Entropy (8bit): true 1BCAB696E0BE7971BDABC73B32E4A5BA F5EE873BC16BC9F7A02DAFB1AEB566205D6FBF F818A6AA20D354E6C39E4CF70892E4E8288DD4818CD790BA54FE E3935E9E83A8468D648D EA4806F48EED253789C0A30A3CB473D AE7C19F DC93A E4B4237A1691CCAC472AF9C3BE4C9 Size (bytes): C:\Users\user\Desktop\xNyJV5cbUw.exe Entropy (8bit): Antivirus: PE32 executable (GUI) Intel Mono/.Net assembly, for MS Windows 3BEE1D24189D4941F68B96DA6E207BE4 DCE911B1C05DA965C B88BC29D12756 A375201F22B6E71D8EA0F E4638E1754AEEE14059E9C5E39026D6C710 A40B01C630FF2C4B90A2E1BBF285C5D558193EE0FBA79A3210A CA E3202F65B8EB038A56 5B1EA8A18D185864BA9DC4073A3633C86CA29 true Antivirus: Avira, Detection: 100%, Browse Antivirus: virustotal, Detection: 78%, Browse Antivirus: metadefender, Detection: 63%, Browse :Zone.Identifier Size (bytes): 26 C:\Users\user\Desktop\xNyJV5cbUw.exe ASCII text, with CRLF line terminators Entropy (8bit): F488E27DB4AF347237FE461A079AD 6693BA299EC D A0D2CB21F8E64 255A65D30841AB4082BD9D0EEA79D49C5EE88F D8D6156AEF11C F237C0C051EBE784D A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53B C731530C92F7327BB7DC9CDE1B60FB21CD64E true C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\B8FYLGK9.txt.gws Size (bytes): 128 Entropy (8bit): F6D887E13864B588C44EFB1A2758C725 F8A567043D602BF32382D2F1E56BA0CEAEE89379 AC5D827F1C4B31797D96C1C7BD226E205E218B98A54DEBB453E0B15D698338F6 D08CA683B4A09A44312D7B779B54871C1F94D42F91FCE6B78D21E79805FA96077F73D41F9DCA329D4078B61AD9C 8FE24B984E1FAE81257AC38A4207A0A6F1624 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.gws Size (bytes): 16 Entropy (8bit): Copyright Joe Security LLC 2018 Page 20 of 83

21 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\container.dat.gws C3A DF614575DC417C3CF9D9 2E71688B2013BC93B1C5C01E5FD902A32A62007E DA1F A03FEC57464A38B8BB928CAFD8FA E83A6DE555ED7 EB740B56BFC85D2C5BE11AF614CB413A0F0E055D6D2311D4790D86AD71C59A2EC4F13E09D04A180E3279C22AC 320CFA38892BD0F6A5E8E04299ED64B2D514C2D C:\Users\user\Desktop\ATJBEMHSSB.mp3.gws Size (bytes): 1040 Entropy (8bit): ACF69AF3D6067D39E8D48EEDE027EB6 D9FF47F93013DACA66D98C34657A8023E1D76B37 B207E0859E47C1AD4FBC577C528E38926B158C59992F138F8BBD801BAE62F48F DDDD DC85A38EA7B234658FB48F421F90D658C7C2E6A16325BAC12DCAAE7B41934E1EC6A DFD3C91DD9ED450950B0CA078FF462BAFDF6AD C:\Users\user\Desktop\BQJUWOYRTO.docx.gws Size (bytes): 1040 Entropy (8bit): A2D2C063C674F28B6F90DE017EA5FA DF8DE7DB74CF84F261A BD82630A8C6AE3 FF410C43650D179FB42A8E5F63086A881A6023FE235DDB0E78213FA65FBDD802 74AEBE39F0A43763C4932EDFE305C7782E992F3CC521FFEEC249BBD2EF7F5A0C8A704F15C0933E2C010ED DC537D34CC5693FFADDE93D23CCEC7E899 C:\Users\user\Desktop\BQJUWOYRTO.pdf.gws Size (bytes): 1040 Entropy (8bit): A2D2C063C674F28B6F90DE017EA5FA DF8DE7DB74CF84F261A BD82630A8C6AE3 FF410C43650D179FB42A8E5F63086A881A6023FE235DDB0E78213FA65FBDD802 74AEBE39F0A43763C4932EDFE305C7782E992F3CC521FFEEC249BBD2EF7F5A0C8A704F15C0933E2C010ED DC537D34CC5693FFADDE93D23CCEC7E899 C:\Users\user\Desktop\BUFZSQPCOH.pdf.gws Size (bytes): 1040 Entropy (8bit): BD3AE61A9BCE8FBA55D3879F A62DF211B267A788B34C92BA73C9C72FE26CF3 2E35070E9C2805B25A1D50DA82C3F1EF6F A77B69235AD6C4515E8C97 B15E71FA338F3F27692CAFE279A29ABBE DE025A27002CA81ACB642731BF58B1D073FA315D2384EFA8BE 9004CF2D9D6F703A6D8E610CE9E86BA5579DDE C:\Users\user\Desktop\BUFZSQPCOH.xlsx.gws Size (bytes): 1040 Entropy (8bit): Copyright Joe Security LLC 2018 Page 21 of 83

22 C:\Users\user\Desktop\BUFZSQPCOH.xlsx.gws BD3AE61A9BCE8FBA55D3879F A62DF211B267A788B34C92BA73C9C72FE26CF3 2E35070E9C2805B25A1D50DA82C3F1EF6F A77B69235AD6C4515E8C97 B15E71FA338F3F27692CAFE279A29ABBE DE025A27002CA81ACB642731BF58B1D073FA315D2384EFA8BE 9004CF2D9D6F703A6D8E610CE9E86BA5579DDE C:\Users\user\Desktop\BWDRWEEARI.mp3.gws Size (bytes): 1040 Entropy (8bit): D6E2D9D3AEAECDCCE D74006D13B3F038328C13917D577D90A4E3156E9 76EF402C8FD00AD75C919B2CE17666FBCF4F2E5490AC31FA05F73A96A77E80F2 5E51270E0B0017D2B794B6688F1436C27D7F4E659EDFD33D3617D36F5D769C694AA75356A253E256E29F840F C7F EC71391AC22130EE C:\Users\user\Desktop\BWETZDQDIB.png.gws Size (bytes): 1040 Entropy (8bit): DD47A05EE20BCBA41BEC6CBC FA1B14629F337CE927F5D3622FA72B9A9A23BD8D 5FEB442B4C77E001A2EFAD0FAD03014C04E798C7E86A46D566242BC438B0CE57 13BC13AF63B2B294293A8526BB5344D09FA6F147482D509F C7835F428A7C3F358DAD8EC1FFB5981B57061 DE73F7449A BED2A437E7A209790C7 C:\Users\user\Desktop\FAAGWHBVUU.jpg.gws Size (bytes): 1040 Entropy (8bit): F6E5A AC28D672BE8F280DDFF 4B051F6AFC552E50D6CAA06F7CDEA615AD227A A80A5A04DC7D4FD21169A09F58EAD65AC171D84DCE1C945D6AF5A211FB33 803DAAD2818DBCC8F9D05C578DB70BF89A5B7157B4A7BE0F0C A3C33B B91150D764E D2AA620E401AABE694EB8C8C6CB46D90 C:\Users\user\Desktop\GJBHWQDROJ.jpg.gws Size (bytes): 1040 Entropy (8bit): D013CE6714AB1BE70BB04DFFEA01C01 52A811EF327EA24DC4DE2D56FE4051AB06D18229 FF90065DF046C7C359DEA3F89CEB66D3EBBAC EBA6602FB7E9 54B511A08D911A735090A8A2D4D C7E49568EF BC15ADC89BA0102DD406DE6193F D BFDE99CC2C7D690B82D8C58D C:\Users\user\Desktop\GJBHWQDROJ.mp3.gws Size (bytes): 1040 Entropy (8bit): D013CE6714AB1BE70BB04DFFEA01C01 Copyright Joe Security LLC 2018 Page 22 of 83

23 C:\Users\user\Desktop\GJBHWQDROJ.mp3.gws 52A811EF327EA24DC4DE2D56FE4051AB06D18229 FF90065DF046C7C359DEA3F89CEB66D3EBBAC EBA6602FB7E9 54B511A08D911A735090A8A2D4D C7E49568EF BC15ADC89BA0102DD406DE6193F D BFDE99CC2C7D690B82D8C58D C:\Users\user\Desktop\GNLQNHOLWB.png.gws Size (bytes): 1040 Entropy (8bit): D2C054A2D A909FD824D5DED5 77A83365E45C71E30B165DD0B4177FADDEAD2C92 F70E A4AAB94F11BD01F0AA0B0F482D6BBFDE46F E25122AF97 D6213D636C7C7A796EE64C E21E6E0729BF70E6D5A99A B79079EAFFD0A11918A459B32371 E143013D8F79D3AF41A4DC7213FF4142DE6C C:\Users\user\Desktop\GNLQNHOLWB.xlsx.gws Size (bytes): 1040 Entropy (8bit): D2C054A2D A909FD824D5DED5 77A83365E45C71E30B165DD0B4177FADDEAD2C92 F70E A4AAB94F11BD01F0AA0B0F482D6BBFDE46F E25122AF97 D6213D636C7C7A796EE64C E21E6E0729BF70E6D5A99A B79079EAFFD0A11918A459B32371 E143013D8F79D3AF41A4DC7213FF4142DE6C C:\Users\user\Desktop\IZMFBFKMEB.docx.gws Size (bytes): 1040 Entropy (8bit): DAA91A28404EE0CAF231FBD3C3B72F9 147CEE165E3327F89787DAAC8E4FD2AFA56088B5 6EC5041F267BC58E B9DD26B44968C F73A48381A5CF0A027 84AF82DBB42384BADFAFF9C3B70092DDB9FE765F33A2FB8640E59B55EBD208B11EC183DB48E0E7FBA8E234A05 E895464A76A1E93F7AEA5044F54B33A23483CCD C:\Users\user\Desktop\IZMFBFKMEB.jpg.gws Size (bytes): 1040 Entropy (8bit): DAA91A28404EE0CAF231FBD3C3B72F9 147CEE165E3327F89787DAAC8E4FD2AFA56088B5 6EC5041F267BC58E B9DD26B44968C F73A48381A5CF0A027 84AF82DBB42384BADFAFF9C3B70092DDB9FE765F33A2FB8640E59B55EBD208B11EC183DB48E0E7FBA8E234A05 E895464A76A1E93F7AEA5044F54B33A23483CCD C:\Users\user\Desktop\MIVTQDBATG.png.gws Size (bytes): 1040 Entropy (8bit): FF1CFD62F05665F B08E B A5AD27842C508F DDBF75 Copyright Joe Security LLC 2018 Page 23 of 83

24 C:\Users\user\Desktop\MIVTQDBATG.png.gws 848C0E26EB13DCF064EB1119FD7A28F76728DF0FB544F108030A318196F BC88A3BCC14E18F797A9C147743EBDD59728FE3EA630733F E91566A4A79DA82A E07EFE8 AD5F F45D332F167A5112B921F8769E C:\Users\user\Desktop\NIRMEKAMZH.docx.gws Size (bytes): 1040 Entropy (8bit): A DFABAFD6303ABDEDBF0 DBC20E412FAE01BCCD9FAB0D488BC1B99116A413 C99887C835FB147A279438D1693B7E D727D38F482ECDADC8CA4C E9E43E141683C43C96A9C3AD2AA74EED555E8B84F4B5A152981C9A99C82876A4FB CDD2DD E BC DEB076B95B94FA F2B3F2 C:\Users\user\Desktop\PWZOQIFCAN.xlsx.gws Size (bytes): 1040 Entropy (8bit): CECD E511122E4A1DB3230B040 6DDD24D262D3B0F73B1BFEAFBF3A55B4EB560BBD 304AC2BF906D1DF97D3D610B3DF CFA8CB1288E12D5C27AE07C CFAC19CF81E13D9C780ACB77C82D54B17F3D7710EE3F6EF31385D3A95F1BDDAFA7C155D0B92F68C8FF B4207ABA5EC1C402CF1E1A6A9AC9A4A50E0A6A C:\Users\user\Desktop\WHZAGPPPLA.pdf.gws Size (bytes): 1040 Entropy (8bit): E6C415506AE92016CEE3BEB7BB383A0F F742D4A9E2024B8240D07F7C5877EC171CCCE59B 8AAF6A82852E05ACEA324B9C9C76583F68AFED1FE150E18DA4C50E54E110E2A1 26D81F3323F5D07DA5E072CACBC0603BFA92E4E4BAB5A B9E9233A04D849F323DDC524C0F4ACE03FA2D 43BC499849F4FCBB379FD8B37A13180E8EA252C C:\Users\user\Documents\ATJBEMHSSB.mp3.gws Size (bytes): 1040 Entropy (8bit): ACF69AF3D6067D39E8D48EEDE027EB6 D9FF47F93013DACA66D98C34657A8023E1D76B37 B207E0859E47C1AD4FBC577C528E38926B158C59992F138F8BBD801BAE62F48F DDDD DC85A38EA7B234658FB48F421F90D658C7C2E6A16325BAC12DCAAE7B41934E1EC6A DFD3C91DD9ED450950B0CA078FF462BAFDF6AD C:\Users\user\Documents\BQJUWOYRTO.docx.gws Size (bytes): 1040 Entropy (8bit): A2D2C063C674F28B6F90DE017EA5FA DF8DE7DB74CF84F261A BD82630A8C6AE3 FF410C43650D179FB42A8E5F63086A881A6023FE235DDB0E78213FA65FBDD802 Copyright Joe Security LLC 2018 Page 24 of 83

25 C:\Users\user\Documents\BQJUWOYRTO.docx.gws 74AEBE39F0A43763C4932EDFE305C7782E992F3CC521FFEEC249BBD2EF7F5A0C8A704F15C0933E2C010ED DC537D34CC5693FFADDE93D23CCEC7E899 C:\Users\user\Documents\BQJUWOYRTO.pdf.gws Size (bytes): 1040 Entropy (8bit): A2D2C063C674F28B6F90DE017EA5FA DF8DE7DB74CF84F261A BD82630A8C6AE3 FF410C43650D179FB42A8E5F63086A881A6023FE235DDB0E78213FA65FBDD802 74AEBE39F0A43763C4932EDFE305C7782E992F3CC521FFEEC249BBD2EF7F5A0C8A704F15C0933E2C010ED DC537D34CC5693FFADDE93D23CCEC7E899 C:\Users\user\Documents\BUFZSQPCOH.pdf.gws Size (bytes): 1040 Entropy (8bit): BD3AE61A9BCE8FBA55D3879F A62DF211B267A788B34C92BA73C9C72FE26CF3 2E35070E9C2805B25A1D50DA82C3F1EF6F A77B69235AD6C4515E8C97 B15E71FA338F3F27692CAFE279A29ABBE DE025A27002CA81ACB642731BF58B1D073FA315D2384EFA8BE 9004CF2D9D6F703A6D8E610CE9E86BA5579DDE C:\Users\user\Documents\BUFZSQPCOH.xlsx.gws Size (bytes): 1040 Entropy (8bit): BD3AE61A9BCE8FBA55D3879F A62DF211B267A788B34C92BA73C9C72FE26CF3 2E35070E9C2805B25A1D50DA82C3F1EF6F A77B69235AD6C4515E8C97 B15E71FA338F3F27692CAFE279A29ABBE DE025A27002CA81ACB642731BF58B1D073FA315D2384EFA8BE 9004CF2D9D6F703A6D8E610CE9E86BA5579DDE C:\Users\user\Documents\BWDRWEEARI.mp3.gws Size (bytes): 1040 Entropy (8bit): D6E2D9D3AEAECDCCE D74006D13B3F038328C13917D577D90A4E3156E9 76EF402C8FD00AD75C919B2CE17666FBCF4F2E5490AC31FA05F73A96A77E80F2 5E51270E0B0017D2B794B6688F1436C27D7F4E659EDFD33D3617D36F5D769C694AA75356A253E256E29F840F C7F EC71391AC22130EE C:\Users\user\Documents\BWETZDQDIB.png.gws Size (bytes): 1040 Entropy (8bit): DD47A05EE20BCBA41BEC6CBC FA1B14629F337CE927F5D3622FA72B9A9A23BD8D 5FEB442B4C77E001A2EFAD0FAD03014C04E798C7E86A46D566242BC438B0CE57 Copyright Joe Security LLC 2018 Page 25 of 83

26 C:\Users\user\Documents\BWETZDQDIB.png.gws 13BC13AF63B2B294293A8526BB5344D09FA6F147482D509F C7835F428A7C3F358DAD8EC1FFB5981B57061 DE73F7449A BED2A437E7A209790C7 C:\Users\user\Documents\FAAGWHBVUU.jpg.gws Size (bytes): 1040 Entropy (8bit): F6E5A AC28D672BE8F280DDFF 4B051F6AFC552E50D6CAA06F7CDEA615AD227A A80A5A04DC7D4FD21169A09F58EAD65AC171D84DCE1C945D6AF5A211FB33 803DAAD2818DBCC8F9D05C578DB70BF89A5B7157B4A7BE0F0C A3C33B B91150D764E D2AA620E401AABE694EB8C8C6CB46D90 C:\Users\user\Documents\GJBHWQDROJ.jpg.gws Size (bytes): 1040 Entropy (8bit): D013CE6714AB1BE70BB04DFFEA01C01 52A811EF327EA24DC4DE2D56FE4051AB06D18229 FF90065DF046C7C359DEA3F89CEB66D3EBBAC EBA6602FB7E9 54B511A08D911A735090A8A2D4D C7E49568EF BC15ADC89BA0102DD406DE6193F D BFDE99CC2C7D690B82D8C58D C:\Users\user\Documents\GJBHWQDROJ.mp3.gws Size (bytes): 1040 Entropy (8bit): D013CE6714AB1BE70BB04DFFEA01C01 52A811EF327EA24DC4DE2D56FE4051AB06D18229 FF90065DF046C7C359DEA3F89CEB66D3EBBAC EBA6602FB7E9 54B511A08D911A735090A8A2D4D C7E49568EF BC15ADC89BA0102DD406DE6193F D BFDE99CC2C7D690B82D8C58D C:\Users\user\Documents\GNLQNHOLWB.png.gws Size (bytes): 1040 Entropy (8bit): D2C054A2D A909FD824D5DED5 77A83365E45C71E30B165DD0B4177FADDEAD2C92 F70E A4AAB94F11BD01F0AA0B0F482D6BBFDE46F E25122AF97 D6213D636C7C7A796EE64C E21E6E0729BF70E6D5A99A B79079EAFFD0A11918A459B32371 E143013D8F79D3AF41A4DC7213FF4142DE6C C:\Users\user\Documents\GNLQNHOLWB.xlsx.gws Size (bytes): 1040 Entropy (8bit): D2C054A2D A909FD824D5DED5 77A83365E45C71E30B165DD0B4177FADDEAD2C92 F70E A4AAB94F11BD01F0AA0B0F482D6BBFDE46F E25122AF97 Copyright Joe Security LLC 2018 Page 26 of 83

27 C:\Users\user\Documents\GNLQNHOLWB.xlsx.gws D6213D636C7C7A796EE64C E21E6E0729BF70E6D5A99A B79079EAFFD0A11918A459B32371 E143013D8F79D3AF41A4DC7213FF4142DE6C C:\Users\user\Documents\IZMFBFKMEB.docx.gws Size (bytes): 1040 Entropy (8bit): DAA91A28404EE0CAF231FBD3C3B72F9 147CEE165E3327F89787DAAC8E4FD2AFA56088B5 6EC5041F267BC58E B9DD26B44968C F73A48381A5CF0A027 84AF82DBB42384BADFAFF9C3B70092DDB9FE765F33A2FB8640E59B55EBD208B11EC183DB48E0E7FBA8E234A05 E895464A76A1E93F7AEA5044F54B33A23483CCD C:\Users\user\Documents\IZMFBFKMEB.jpg.gws Size (bytes): 1040 Entropy (8bit): DAA91A28404EE0CAF231FBD3C3B72F9 147CEE165E3327F89787DAAC8E4FD2AFA56088B5 6EC5041F267BC58E B9DD26B44968C F73A48381A5CF0A027 84AF82DBB42384BADFAFF9C3B70092DDB9FE765F33A2FB8640E59B55EBD208B11EC183DB48E0E7FBA8E234A05 E895464A76A1E93F7AEA5044F54B33A23483CCD C:\Users\user\Documents\MIVTQDBATG.png.gws Size (bytes): 1040 Entropy (8bit): FF1CFD62F05665F B08E B A5AD27842C508F DDBF75 848C0E26EB13DCF064EB1119FD7A28F76728DF0FB544F108030A318196F BC88A3BCC14E18F797A9C147743EBDD59728FE3EA630733F E91566A4A79DA82A E07EFE8 AD5F F45D332F167A5112B921F8769E C:\Users\user\Documents\NIRMEKAMZH.docx.gws Size (bytes): 1040 Entropy (8bit): A DFABAFD6303ABDEDBF0 DBC20E412FAE01BCCD9FAB0D488BC1B99116A413 C99887C835FB147A279438D1693B7E D727D38F482ECDADC8CA4C E9E43E141683C43C96A9C3AD2AA74EED555E8B84F4B5A152981C9A99C82876A4FB CDD2DD E BC DEB076B95B94FA F2B3F2 C:\Users\user\Documents\PWZOQIFCAN.xlsx.gws Size (bytes): 1040 Entropy (8bit): CECD E511122E4A1DB3230B040 6DDD24D262D3B0F73B1BFEAFBF3A55B4EB560BBD 304AC2BF906D1DF97D3D610B3DF CFA8CB1288E12D5C27AE07C2262 Copyright Joe Security LLC 2018 Page 27 of 83

28 C:\Users\user\Documents\PWZOQIFCAN.xlsx.gws CFAC19CF81E13D9C780ACB77C82D54B17F3D7710EE3F6EF31385D3A95F1BDDAFA7C155D0B92F68C8FF B4207ABA5EC1C402CF1E1A6A9AC9A4A50E0A6A C:\Users\user\Documents\WHZAGPPPLA.pdf.gws Size (bytes): 1040 Entropy (8bit): E6C415506AE92016CEE3BEB7BB383A0F F742D4A9E2024B8240D07F7C5877EC171CCCE59B 8AAF6A82852E05ACEA324B9C9C76583F68AFED1FE150E18DA4C50E54E110E2A1 26D81F3323F5D07DA5E072CACBC0603BFA92E4E4BAB5A B9E9233A04D849F323DDC524C0F4ACE03FA2D4 3BC499849F4FCBB379FD8B37A13180E8EA252C Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: Entropy (8bit): PE32 executable (GUI) Intel Mono/.Net assemb ly, for MS Windows TrID: Win32 Executable (generic) a ( /4) 99.23% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.73% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: File size: SHA256: SHA512: File Content Preview: xnyjv5cbuw.exe 3bee1d24189d4941f68b96da6e207be4 dce911b1c05da965c b88bc29d12756 a375201f22b6e71d8ea0f e4638e1754aeee1405 9e9c5e39026d6c710 a40b01c630ff2c4b90a2e1bbf285c5d558193ee0fba79a3 210a ca e3202f65b8eb038a565b 1ea8a18d185864ba9dc4073a3633c86ca29 MZ...@...!..L.!Th is program cannot be run in DOS File Icon Static PE Info Copyright Joe Security LLC 2018 Page 28 of 83

29 General Entrypoint: 0x45db1e Entrypoint Section:.text Digitally signed: Imagebase: 0x Subsystem: windows gui Image File Characteristics: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x56F2D6A1 [Wed Mar 23 17:47: UTC] TLS Callbacks: CLR (.Net) Version: v OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: f34d5f2d4577ed6d9ceec516c1f5a744 Entrypoint Preview Instruction jmp dword ptr [ h] add byte ptr [ecx], al add byte ptr [ebx], al add eax, h add byte ptr [edx], al add byte ptr [esi], al pop es push es Copyright Joe Security LLC 2018 Page 29 of 83

30 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x5dacc 0x4f.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x5e000 0x10f20.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x xc.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x5d994 0x1c.text IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 Copyright Joe Security LLC 2018 Page 30 of 83

31 Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x8.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x2008 0x48.text IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x2000 0x5bb34 0x5bc00 False IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x5e000 0x10f20 0x11000 False IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_READ.reloc 0x xc 0x200 False IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_ICON 0x5e100 0x10828 RT_GROUP_ICON 0x6e938 0x14 MS Windows icon resource - 1 icon RT_VERSION 0x6e95c 0x3c4 RT_MANIFEST 0x6ed30 0x1ea XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators Imports DLL mscoree.dll Import _CorExeMain Version Infos Description Data Translation 0x0000 0x04b0 LegalCopyright Copyright Firefox and Mozilla developers. All rights reserved. Assembly Version InternalName BitcoinBlackmailer.exe FileVersion CompanyName LegalTrademarks Comments ProductName Firefox ProductVersion FileDescription Firefox OriginalFilename BitcoinBlackmailer.exe Network Behavior No network behavior found Code Manipulations Statistics Behavior Copyright Joe Security LLC 2018 Page 31 of 83

32 xnyjv5cbuw.exe drpbx.exe firefox.exe Click to jump to process System Behavior Analysis xnyjv5cbuw.exe PID: 3380 Parent PID: 2960 General Start time: 07:26:46 Start date: 02/07/2018 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Users\user\Desktop\xNyJV5cbUw.exe 'C:\Users\user\Desktop\xNyJV5cbUw.exe' 0xc bytes 3BEE1D24189D4941F68B96DA6E207BE4 true.net C# or VB.NET low File Activities File Created File Path Access Attributes Options Completion Count C:\Users\user\AppData\Roaming\System32Work C:\Users\user\AppData\Roaming\Frfx \:Zone.Identifier:$DATA read or list directory synchronize read or list directory synchronize read or list directory read attributes delete syn chronize read or list directory normal non alert open for backup ident open reparse point normal non alert open for backup ident open reparse point archive sequential only non directory file sequential only non alert success or wait 1 1BA499 CreateDirectoryW success or wait 1 1BA499 CreateDirectoryW success or wait 1 1BAD3C CopyFileW success or wait 1 1BAD3C CopyFileW Copyright Joe Security LLC 2018 Page 32 of 83

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version:

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: ID: 45097 Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature