ID: Cookbook: browseurl.jbs Time: 01:36:57 Date: 12/11/2018 Version: Fire Opal

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 01:36:57 Date: 12/11/2018 Version: Fire Opal"

Abner Gardner
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 01:36:57 Date: 12/11/2018 Version: Fire Opal

2 Table of Contents Table of Contents 2 Analysis Report qs=4340ab88585a9d7b70ae09cba6b643e833dcc84b2567b03df56308f1adbebeeabe1befb8b40a9e f2324a031c4d83 Overview 33 General Information 3 Detection 3 Confidence 4 Classification 4 Analysis Advice 5 Mitre Att&ck Matrix 5 Signature Overview 6 Phishing: 6 Networking: 6 System Summary: 6 Hooking and other Techniques for Hiding and Protection: 6 Behavior Graph 6 Simulations 7 Behavior and APIs 7 Antivirus Detection 7 Initial Sample 7 Dropped Files 7 Unpacked PE Files 7 Domains 7 URLs 8 Yara Overview 8 Initial Sample 8 PCAP (Network Traffic) 8 Dropped Files 8 Memory Dumps 8 Unpacked PEs 8 Joe Sandbox View / Context 8 IPs 8 Domains 8 ASN 8 Dropped Files 8 Screenshots 8 Thumbnails 8 Startup 9 Created / dropped Files 9 Domains and IPs 25 Contacted Domains 26 URLs from Memory and Binaries 26 Contacted IPs 27 Public 28 Static File Info 28 No static file info 28 Network Behavior 28 Network Port Distribution 28 TCP Packets 29 UDP Packets 30 DNS Queries 31 DNS Answers 31 HTTPS Packets 33 Code Manipulations 61 Statistics 61 Behavior 61 System Behavior 62 Analysis iexplore.exe PID: 3232 Parent PID: General 62 File Activities 62 Registry Activities 62 Analysis iexplore.exe PID: 3284 Parent PID: General 62 File Activities 63 Registry Activities 63 Analysis ssvagent.exe PID: 3340 Parent PID: General 63 Registry Activities 63 Disassembly 63 Copyright Joe Security LLC 2018 Page 2 of 63

3 Analysis Report 7b70ae09cba6b643e833dcc84b2567b03df56308f1adbebeeabe1befb8b4 0a9e f2324a031c4d83a e82aef d6b17 Overview General Information Joe Sandbox Version: Analysis ID: Fire Opal Start date: Start time: 01:36:57 Joe Sandbox Product: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: CloudBasic 0h 3m 47s light browseurl.jbs qs=4340ab88585a9d7b70ae09cba6b643e833dcc84b25 67b03df56308f1adbebeeabe1befb8b40a9e f23 24a031c4d83a e82aef d6b17 Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: Cookbook Comments: Timeout CLEAN EGA enabled clean2.win@5/75@10/5 Adjust boot time Browsing link: urlid=msnprivacystatement&mkt=en- US&vv=1600 Browsing link: wa=wsignin1.0&rp snv=13&ct= &r ver= &wp=mbi_ssl_ SHARED&wreply= onedrive.live.com%2f%3fgologin %3D1%26mkt%3Den-US&id= &cbcxt=sky&lw=1& fl=easi2&contextid=2bf0993 E978ABEF5&bk= &am p;uiflavor=web&uaid=34853c e755d44ae098517e8a7a67df84&mkt=en- US&lc=1033 Browsing link: urlid=winlivetermsofuse&mkt=en- US&vv=1600 Browsing link: Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe TCP Packets have been reduced to 100 Report size getting too big, too many NtDeviceIoControlFile calls found. Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 3 of 63

Strategy Score Range Reporting Detection Threshold 2

4 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 4 of 63

Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter

encrypted data' cookbook for further analysis Mitre Att&ck Matrix Initial Access Execution Persistence Privilege Escalation Valid

Service Execution Port Monitors Accessibility Features Copyright Joe Security LLC 2018 Defense Evasion Binary Padding Credential

Application Window Discovery Remote Services Data from Removable Media Command and Control Collection Exfiltration Data from Local

5 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Mitre Att&ck Matrix Initial Access Execution Persistence Privilege Escalation Valid Accounts Windows Remote Management Winlogon Helper DLL Port Monitors File System Logical Offsets Replication Through Removable Media Service Execution Port Monitors Accessibility Features Copyright Joe Security LLC 2018 Defense Evasion Binary Padding Credential Access Discovery Lateral Movement Credential Dumping System Service Discovery Application Deployment Software Network Sniffing Application Window Discovery Remote Services Data from Removable Media Command and Control Collection Exfiltration Data from Local System Data Encrypted 1 Standard NonApplication Layer Protocol 2 Exfiltration Over Other Network Medium Standard Application Layer Protocol 2 Page 5 of 63

6 Signature Overview Phishing Networking System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section Phishing: Found iframes HTML body contains number of good links HTML title does not match URL Submit button contains javascript call META author tag missing META copyright tag missing Networking: Downloads files Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Classification label Creates files inside the user directory Creates temporary files Reads ini files Spawns processes Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Uses new MSVCR Dlls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 6 of 63

Behavior Graph ID: 89635 URL: https://click.mail.onedrive.com/?qs=4340ab88585a9d7b70ae0.

7 Behavior Graph ID: URL: Startdate: 12/11/2018 Architecture: WINDOWS Score: 2 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend authgfx.msa.akadns6.net auth.gfx.ms started Is Windows Process Number of created Registry Values Number of created Files iexplore.exe Visual Basic Delphi Java.Net C# or VB.NET started C, C++ or other language iexplore.exe Is malicious 2 85 wut-scu-prod.cloudapp.net vs.login.msa.akadns6.net , 443, 49207, MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS , 443, 49167, MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS 17 other IPs or domains started United States United States ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 01:37:43 API Interceptor 82x Sleep call for process: iexplore.exe modified 01:37:43 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link 1% virustotal Browse qs=4340ab88585a9d7b70ae09cba6b643e833dcc84b2567b03df56308f1adbebeeabe1befb8b40a9e f2324a031c4d83a e82aef d6b17 Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Copyright Joe Security LLC 2018 Page 7 of 63

8 No Antivirus matches URLs Detection Scanner Label Link 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 2018 Page 8 of 63

$'C:\PROGRA~1\Java\JRE18~1.$ $0_1\bin\ssvagent.$ 0953A0264879FD1E655B75B63B9083B7)

9 Startup System is w7 cleanup iexplore.exe (PID: 3232 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3284 cmdline: '' SCODEF:3232 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3340 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\~DF0206DF9399B0FC42.TMP data Size (bytes): Copyright Joe Security LLC 2018 Page 9 of 63

10 C:\Users\HERBBL~1\AppData\Local\Temp\~DF0206DF9399B0FC42.TMP Entropy (8bit): D5F4DC55B972AB2365A9ECFE4EBA56F C6668FAF845F79CADB79203EBE1BF695AEAA79F4 F17E76C409F32CA22DF13D6F F153BEB9B38C6E45CCEDCAFD6F2A32913 EDA023779F F949551B446929BBD49388D7F9392A2F1AFFA3569EDC1C46CCD0D9A068B7A9D966153B 098EA40E E0F844395E3CC896AB62 C:\Users\HERBBL~1\AppData\Local\Temp\~DF426EC6D895F3EF94.TMP data Size (bytes): Entropy (8bit): E A38C01F7A8CD32B9BC B9924BFAEDA9C6C25424EF C8B1A6 427AA1F763BB4C004A5C73DDAD8158FA15B0B0934B77A9D4362B328EFD2EC DBDDD858206FE3F21E5688C060BB7AFC75EDB800FF610A C9986F9998D30F74FE560BF7F4CD98EB D459D8B1A92742C6331D01E11BD29 C:\Users\HERBBL~1\AppData\Local\Temp\~DFFC5A05A611418B40.TMP data Size (bytes): Entropy (8bit): BA6DF0BE8E1472F8FFAE0DFE60D61118 E C6A90D0AF23B813CD46EA F7F42BF91D87313F1F6FF2E91ACA7D385A761124DDB10AA6BEEC048622F0 D5B97CF16956FC2AE0EDB0867C37EDDD CEA2D499512A519D33537EE0083FFAF0EB5EF36C96245AE2B45 86DEFF FBEF911D3514BC C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{29544AC1-E613-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): E9F6A B00786CB8CD0E4B5778F 9A36E8FCED89D0C93ACC4645F6396EC22CD079F8 B00473F228851CB5F98C4F480086B78B169798FDC32ACF8958DF8FE2468F7692 2BA37978BD45F646831DBDCB3FBB87B7BBB1C9C305CC10B8699F21BF2323DF7A83FD5015FAE3E78E2B EA52EFA81FD00051D8E98FD7D61526CE64A73 Copyright Joe Security LLC 2018 Page 10 of 63

11 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{29544AC3-E613-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): C99B0F0E3387CA0BE7C566E27661D 971E41F536046E430EDA294A0AEF5F400A17E6A5 9182C72F39E11364F1ADB7B977101CD1325B0C837FFAFFDA65B98FDD09C0994D FA72332A1DCE2E65FD686A579245F9533D610F3F3D85014E6D5F85AF2750F6C3E901816DE43CC02CAD9901E37C 7ED8CA23A7264B BD9ACB2E3BB4E5 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3094E790-E613-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): E1CC58CA6121D976C0370F0D5140D62 04F2BECD EA9433BD0F1757C61B89C1BDB 03A4B567BDA456FE27BB7B71A4D33D285A02BAE928C29437B E5FCB870 0B31D6B0152DDAB86C8955B296DF52150E94FF5E08E F408DFBD29AD2A486DB5F4FCFE EC 6FDA1BE7DDDB60D3B787AD7A23B7ADF2657E2 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data Size (bytes): Entropy (8bit): D25A25CBB12E9A55F04860AD0396F3 F AB40AE4C209C3199B1BB9EA3A98 33DBD5403AD67F BB4CC7FA3EFD8B5273A6AA591E204070CAD16014D1D 9A132B99C0B9DBF5F7F282061C8EDA B04EE13E9BA4D6D0DD8A6D88C7A9E1480F9FAF075BC7C9B891FE FE20B8009F93365FF791E26A5EC77E1ECA4C851 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\45NA9ZTK.js Size (bytes): 471 ASCII text Entropy (8bit): DA0F48C6CA1973B4BD563D01A3B2 519BFB4312C36DF48759F36CC5D8538DFB2F2FDB 028CAC CABCC56F7FF0CA1CA75B914E4DC558DF43A28A973D3AA58E51D 3804E3581A3A7051C605A3B15D8588E92D3D9ACE7CC1A825AF70589E70B6A09FB5364CE9A2F08E1B27DA05A884 A69BD1E279C3F45B278FA92CAE975043DECA78 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ConvergedLoginPaginatedStrings.EN[1].js Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines, with no line terminators A884C0F7D2D26E82CDBB65E7D9C3D DC878AD7818C5185B030F5A6D5327BEBBF 6D6DFF162F7C8DCD39A771AFF4A3A798B72862A54B811DE738EDF05323E8CEB4 D708DC66385C53E1C034369E8EA3DD712D3CAFC3CE580B96B8F03F99C1B7F69F58E239C41ECADAFA2F02105C CC57C8D1408ECFAE3AF70D21293F8E7D3 Copyright Joe Security LLC 2018 Page 11 of 63

12 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ConvergedLoginPaginatedStrings.EN[1].js C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\OldConvergedLogin_PCore[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with CRLF, LF line terminators 32F6D D918770B4736C6E EDC0A ACB77C661C7518D6DF B6 5FEEA135E53C1D7B B444EE578511E430F1D5F4977F8CA85191EBDD163 9C93464E6EB09A4F3887ADD9C5A7430AAE2C80177B18B209BF05132B4EE8C5148FE CEF54DB700D53F38 FEC339C3E6DF08C20EBFA73A7CB4DD84B6AB5D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\RE1Mu3b[1].png Size (bytes): 4054 Entropy (8bit): PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced 9F14C20150A003D7CE4DE57C298F0FBA DAA53CF17CC45878A1B153F3C3BF47DC9669D78F 112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960 D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF ACC2B41DAEFC25ED38FCC8D96C FED35C36A5017A11E63C8DAE5C487 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\app[1].css Size (bytes): Entropy (8bit): ASCII text, with very long lines, with CRLF, LF line terminators 7C593B06759DB6D D206738D6 0D4F76D B8DDECFFE A77A3C F7D9FB0479DE843CF3FB0B78FC56BBB9E30BF0A238C6F79D9209FA8B22EFB574 EF91B610CF17A17AAFB48984B4403EF175EB86096E3F12E23AE8D4C7C96EF60ED14DA3F69721E095CD2ACE3F0 A D BB906F7FB3576C2C1 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].png MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors Size (bytes): Entropy (8bit): E3DAC858061D088023B2BD48E2FA96 Copyright Joe Security LLC 2018 Page 12 of 63

13 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].png E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 90CDAF E C605D D348116D198F355A98B8C6CD21 C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0 D349B247EB4912EE169D C719CD01 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\jquery min[1].js Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines B8D64D0BC142B3F670CC0611B0AEBCAE ABCD2BA13348F178B17141B445BC99F1917D47AF 47B68DCE8CB6805AD5B3EA4D27AF92A241F4E29A5C12A274C852E4346A0500B4 A684ABBE37E8047C55C394366B012CC9AE5D682D29D340BC48A37BE1A549AECED72DE6408BEDFED776A14611 E6F B236FBF49422B2982EF18125FF47DC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\mscc min[1].js Size (bytes): 3560 Entropy (8bit): ASCII text, with very long lines, with no line terminators 5E9A1F4AA31D4AA60F6F899A2E45CEF8 460F6C21B08FA2723DBBC68613ABDF18213B2FAA C87516D7DD7077EDD467F5B7B085B035CD4803ECF049670AB19DE004E270ABA8 9AB7DAF8C AFEBA5A8F04A593DE C1A3FA071DCA0F51F9A9ACC12969C852CD8BF675744F25B 4FA0A5D1EA82BB22FE6C3887FEBC797E943E86 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\mwfmdl2-v2.98[1].woff Web Open Font Format, TrueType, length 21180, version 0.0 Size (bytes): Entropy (8bit): A9FD412E20ED1B2CDAE668AFC10DF644 C1AA23F61F14DC6229E92357B EE60320F DA5A BF0E4586DC AC3C B68115C341D53CA29101C1A6 F32D64266AE E7EF778EED70E3553C189F55A6DE6E0003E2B5B33DC869364BE3CB1D094968B48B3DC7A0 A AD5E915B909A669D44CA057C2BA6E3 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\preload[1].htm Size (bytes): Entropy (8bit): HTML document, ASCII text, with very long lines, with CRLF, LF line terminators 708F8CB8153E7F66D3400C6676D6D372 B316A B07DC67D7E83D8952FAD16BC7885 3FFBE50687D1AFD5C6DE2ACD62D9C554E2204EF08B118E07CB3336E4B344A4DF 2990D0A33D4D0144CBE38C63507D0A1C0D596BE6BC95CB2E0E FFBE6FC14921B4AEF527DCF68DD400CA 38286F0FDADBE43841C34FCEA0EC49E320D4EB7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\script[1].js ASCII text, with very long lines, with no line terminators Copyright Joe Security LLC 2018 Page 13 of 63

14 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\script[1].js Size (bytes): Entropy (8bit): CAEEAADDE772430F6D4C6BFB57D631 4F599DC9B764720A6E85E06BA228595DB0959AC4 E2AFDBAAE33821CC0792E905C5F3BDB1EB49789C66803C39B1028FF566C765E9 DF5E00BE2C96EA361336C4BA529A7C288FBA65FD6ED0832DEF15CBB AF7C24ED6FD4EA591E885932A7A 7F947056E7116D942A3D15B6ABA8F346E534B8F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\shell.min[1].css Size (bytes): Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators 1F9995AB937AC429A73364B4390FF6E DCC6407CEB5CEF236AD52B9F2A3A9528D3B 49E5166F40D F86E08AB76A977199DF A0E81980A804151C2A 6669AE352FF46DB734BB8F973D1C0527C3A5EC4119D534AAE4C33F29EFF970168ED5FE200A05D4E1B6A2EC0E09 0E B926317D489DC7664B0D9C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\style[1].css Size (bytes): 737 Entropy (8bit): ASCII text, with very long lines, with no line terminators E2DFF36BABBF100CDBF9B A44FDEBD15A39083CD6D0923E31626CAE881016A D4F CA28EA C0CE750A53D12FD394658DDB43325AEA A8F159D136346C D1E38DC7F500B4747DD258E704714B9412CB5E57A80D2AA4BEDC218EC48D5165DE5 AE6E8CBB53D3A7ABDD05D402C51D1927C5BDCC C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\a6-1fffa6[1].css Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): BDECB5E8BFE012FDFB10BC19C392EABA A7FE63646B58575E73741EAE873AAEF D20AE053DD D02EDE9EAEAB55A84349C20A42508A30B773D C22961E64B5FAAE721C88E5BA0BE819773F2DBC913BEB E61DD93B447B A30FAC2156C6360DAC 50AAC94A8272FA753DE3D0E7F811002ABFC5F7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\aria-eae6c86d[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with no line terminators EAE6C86D1484EEB4DBB23824FB1DC7B5 B261D928F29B30DDB27EC7A83D233EE6158EDD8F FF24CFE212B6C79FE6C23F174EC59EFA5FC352813CAB3503F0F1378FFF71F B028069ACD528E5C2B8B BB5D4EE6D110FDBDA060010A EB4EF35C9CDB750F316DFE B4F6AF731D50A25299CBCF7EADAA0204DB8E Copyright Joe Security LLC 2018 Page 14 of 63

15 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\favicon[1].ico Size (bytes): Entropy (8bit): MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors 12E3DAC858061D088023B2BD48E2FA96 E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 90CDAF E C605D D348116D198F355A98B8C6CD21 C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0 D349B247EB4912EE169D C719CD01 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\favicon[2].ico Size (bytes): Entropy (8bit): MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors 12E3DAC858061D088023B2BD48E2FA96 E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 90CDAF E C605D D348116D198F355A98B8C6CD21 C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0 D349B247EB4912EE169D C719CD01 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\info[1].svg Size (bytes): 342 SVG Scalable Vector Graphics image Entropy (8bit): EB1A3CBDDDF5A79E28D320CFE5A9 1C03296AD1C7EF88DD4115ED46EB8450DA28E93E F A6266F0FEE3C4437A BBAD1DE97BE20A578C07946A8ED41B4F 8F898C26DB923A0453E1EB3BE68A83B8DCD377439B278B90049D A8E2448B68885AD04460A81A1F258 BB34F34008BF6B0CBA3D286F8AD0B46073EE2 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1 RPw2[1].js Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): E55ECB02E7376CD010C764107EBD513F FA6D184DF01EC535628DC8FAF BAADFC B95A0ABE5D1F6EFE3ABE7B83A3265EACCD117DD948E523C044600C 099C665E1CEE8DF9C5D5C340A BD29E FF08E594B750CFDBF2CA8C9B45B584FCA21F87CBE6CD 8A170918CECFF8C9796AAFA3D89F0AA97509ABD C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\knockout_3.3.0_RcZl9zWsSPzSceyfD4X8cA2[1].js ASCII text, with very long lines, with CRLF line terminators Size (bytes): Entropy (8bit): C665F735AC48FCD271EC9F0F85FC70 D57F3E09B272DB08541A6801CCC96DF80C07A2A3 0481B1484C0BBCF93EB7FD40F1C88935A C99947FBEA2A0EC48A236F9 Copyright Joe Security LLC 2018 Page 15 of 63

16 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\knockout_3.3.0_RcZl9zWsSPzSceyfD4X8cA2[1].js DB A8667A309C6C15416AE D3D63BB26F9A9BF4C13C0C5EBD7EA09445AA9C85B6DC7AFC48 F9FA7FDDC34F09D16E96EB67E968082C3E906F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\latest[1].eot Size (bytes): Entropy (8bit): Embedded OpenType (EOT), Segoe UI Semibold family E812BA8B7E2A657F2B70CFACE93C7682 2F02CDDBB483F9B11BBBE74C3CA917A4C345FBAD 3330C1DEAC DD0C6BF902179A8731EDA8A208C7D01DAC0AB1EAE1BC9 354B2DB12BC1D67F26F94352B0B663DAD64C46C107454FC19CFEA01C54BB09340BC26C06DE1B96FF826F5287CE 246A BAE41B72B63BA86FDAF844BA94E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\latest[2].eot Size (bytes): Entropy (8bit): Embedded OpenType (EOT), Segoe UI family CAD76E4816AF6890C9BFD02A6D1EA899 9EDC91541C31034FCE0D83AABBAAD4C314CD3D33 D D1A062E5DBE6C34C1994C8CE3792B24AFD5218D0644CB1F53DA4BE A5856C2B4D8CBE2A4BD233A93B266A03D E1D1733B33B65AB7A504AF0AC31DE2F1E69F6FF8CCD7 A169CD D34FFF8DE4CB8C98DB2DB2C863 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\lwsignupheaderjs_4NYTMbxtFAmu44aIr74B-Q2[1].js Size (bytes): 2945 ASCII text, with very long lines Entropy (8bit): E0D61331BC6D1409AEE38688AFBE01F9 5971B99110C03B1F06D4233A E A6C C138804A8B5E EEB112DE8F5EDF8E0BD9087D4863B1 62D10BC02534F9877A86FE22A24F246F262A266E F076C3B98AC33E956DEFF2B452544CCEB A0C 8F6B21B8E3C623FC67BEAD4519B881C36E58 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\mscc min[1].css Size (bytes): 1417 Entropy (8bit): ASCII text, with very long lines, with no line terminators D8C2B180C40BCC7FFCBE2C68B57D8FA C029A A866FA9B25E5C45CDE2EA F76C4C35C17F2649B96868C0D691F1D78B107F7635D D0EE6880 CF3DF5F597ED1444C4A2F9FB0FFC5E2B5D27E0703C6D589CE3A9154FCF530CEFCA1D74427B3D EF93 E14CB1F95313CD62596B9C70620FE93A527B19 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\print-icon[1].png PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced Size (bytes): 173 Entropy (8bit): Copyright Joe Security LLC 2018 Page 16 of 63

17 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\print-icon[1].png 023F5AC6E0114AF1F781BE5D3C C166284B8541F1DE32DC5C4DEC635C296BF85C98 75D637BF6B6DFF D0BE7E0C90F012BB118C2EF19099AFDCBC630ADFC79 DAFA49056E3D3014DB CC05773C09938E2E EDCFF8EA2D7C769D377539C52DA70321B94F 4E8F045F565EC51BC2B701D95BB3213CC2203 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\servicesagreement[1].htm Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators A413FB0458B EC2DA FF51060F434CB39D67415FBAC25D06D73E97CAD9 F6432F881DA0E0DFA8F34C49B6EC45ECCD2C5CC8CD2E92384B8F3CFDFDFCA D5FA6BFD04F FFAD724E869364A60FDB929E6FD1D4C8900DBEBC2E8881A9BE06BF3DD6D60E8A48DD 523C6157B15FEFC ED964D504A589A1E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\spectreviewer-f0180cbf[1].js Size (bytes): ASCII text, with very long lines Entropy (8bit): F0180CBFF98388A C990DDA66C 0256E45F5970A190585A8E0658CD97D614C3A14D 2DD394A89B56218FF100B9AB12F7577F0C48E499D373F281585D76D4ABC1B8DE FAEE54351CA7ADDE345833E04D3BE FD20E83E41E67CFC0DA607FDB5FBF23EC0D6C2E7683A4C E0B3DCE9C4FE201C7FCB5F4F14755F1804D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\style[1].css Size (bytes): Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators 7FE737C60E B369EA7C04F A7DF046E80A719C353B3A F7D56A62 DB64E8DE20EF1B408A13418F992D48204ACA35BB08DD03D099EFA237BFB92CC7 7FFD01A5D6E5B479C1389DC0E5E3AE1E33BC9924A0210FB4F C0FC6918BBBE2083C175A90B82BE439 2E0DC08110B672C8CBCC962DB99DC20EF87C5F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\urlblockindex[1].bin Size (bytes): 16 Entropy (8bit): data FA518E3DFAE8CA3A0E495460FD60C791 E4F30E D37267C0162FD4A C C4B4E5F883F9FD5A278E61C471B3EE B6D129499AA7 D21667F3FB081D39B579178E74E9BB1B6E9A97F C165729A58F1787DC0ADADD980CD026C7A601D416665A 81AC13A69E49A6A2FE2FDD AA645C07 Copyright Joe Security LLC 2018 Page 17 of 63

18 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\0-small[1].jpg JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x28, frames 3 Size (bytes): 3006 Entropy (8bit): BCEE624FA04EF9B75E86211A9FE0D 23BBCDAAEBD6C9A6E57E96E44493B FCAB F89E BBF1F33B596FF4A2179B355A8E15AD02EBAA2B1DA11127EA D20765E5738F4AC5A91396B5F5D88057C3B BCE42039AC9D5D75B1C3FB9629ACA6290A475625DFE60887C F59D4FB52108D024FF4FA8094C9B8458F9F33 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\0[1].jpg JPEG image data, baseline, precision 8, 1920x1080, frames 3 Size (bytes): Entropy (8bit): A5DBD4393FF6A725C7E62B61DF7E72F0 55B292F885FFC92ABCE18750B07AA4ACFA4E903E 211A907DE2DA0FF4A0E90917AC8054E2F35C C26E51B4909F2BEB A05B67EF25492BD50A090F1EC0A0CC21DC4E4EFEB35E19CDC78A98F9415A FA02664EADE87F0E2 D8FA2A2958CD0D FC05689E01DC614 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\IRR2ATO7.htm Size (bytes): 6675 Entropy (8bit): HTML document, ASCII text, with very long lines, with CRLF, LF line terminators 39DE2876D3366F08A2801BD89DEC5B7C 8D0B9ACCF8CD16C3F08936FCD148CAF6398C57AC 1D17850FB3005A5D5D7BFBF2D34F7B3E592CB5AF57FE89F976FA44AAA2239D94 120E F26B9F7D3C9A9ED DB3F741E72A3897FE29B2F6CD1F30AD71107CE5AF4C5 A6CF355DEE7A7ACC16CA82075BF37FD5A880 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\ZC2K0IRQ.htm Size (bytes): Entropy (8bit): HTML document, ASCII text, with very long lines, with CRLF, LF line terminators 09F77C37A127564AFD542F8DE48B4EA6 9F468AD89E996D358D34A1F568A0E354D4371CF B F656C038FE65F3B0BB58A2B6129EFC6E57FBF278FDEB6AEF0C F33E2B70228C024A3785D00F59DB1427E25BCC1CC5238BB2BB50E93118C6E46AB95512AA6F7199C7DDB 9AE FF509A70765F7669D09766BDC81 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\arrow_px_up[1].gif GIF image data, version 89a, 7 x 9 Size (bytes): 829 Entropy (8bit): B65C94F57061E15ECC8304D3E578D5 A7483D668A780949FDA842F39877A3C08D0FC51C BDA2D6EB8E72B3DBCA5EEF F8A2BB B2C63295FCF23843D960 Copyright Joe Security LLC 2018 Page 18 of 63

19 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\arrow_px_up[1].gif B17552D90D A5F4E78DA553F CB25851F38996BFAB54906A898DE848FEFFD31E8D0BF0A32D CA7ED72D2F4C3AE47922C6F9D EF C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\converged_ux_v2_oC07vxeI8SVU2HV1gSfhLA2[1].css ASCII text, with very long lines Size (bytes): Entropy (8bit): A02D3BBF1788F12554D E12C 0CF7DCFE030A668387A49B B33EDD 34B7928B620D064DE966CD983E3F0431BD81CE1714CC9593C8BEF86D76239C6E 370CD83F0AAC5CA685E6221B1C55EADB97B25DBF0C7B21C2EF1D807BA9A9C8EED37C917924F45167E04FE0E15 332F1A8E53BA7F305C96CC677EA4F6F28A33FC3 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\convergedsignuptemplatespackage_2NarQ- Fongpm_PPUY_0rZg2[1].js exported SGML document, ASCII text, with very long lines Size (bytes): 3355 Entropy (8bit): D8D6AB43E1689E0A66FCF3D463FD2B B2F DD102132B98F373F597DD6 4A5831B70E6DD687D0B43CB964E32E19556EFEA15E95CEAD7D837DBC0433FA68 E3DF5162F6F70F0A294DF05B1AD5936F62DA11CD0203A45706D9CA83291FD10A1E570C7D17E1DA0E2FB4C268F3 E0014C8E944D2A910A36F0F51BF30C8CBCDBD6 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\icons[1].eot Embedded OpenType (EOT), icons family Size (bytes): 4388 Entropy (8bit): E1987DF3A0274C5A51E3C55CEE7C98 9B0FE96AF141AB09183F386F65BC627B8C EF04649D4D068673CF0FA47EF4C45C8BE291E703F4EC5FC0E507F AA2 B1E0CFB515FF BA D27B1FC043F66CC4E9591C504F88273B98697B99ED25955DB84986B39ED9F DC88064B14C29ADC020FBF6E295 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\latest[1].eot Embedded OpenType (EOT), Segoe UI Light family Size (bytes): Entropy (8bit): DFE73CB9C64527F7248B0A24DB317D B9239FCDAF038FB2D3A919E DBAA AD75FB92B2EBCE6C37640F03E1AB96A752F388BCE60C877ADE4780B13839E8C4 421B56D93E9BD5E4B4449DD0FCDEE8D531087FD484C91530AAF0A67EDEA33D5AC2F14A7F4966C528C0F130F17F 26629FCAB9F8AB47E950CEB5B9F1A827EA0728 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\lightweightsignuppackage_IIQCQkgCo-77EJPXly59bw2 [1].js UTF-8 Unicode text, with very long lines Size (bytes): Copyright Joe Security LLC 2018 Page 19 of 63

20 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\lightweightsignuppackage_IIQCQkgCo-77EJPXly59bw2 [1].js Entropy (8bit): A3EEFB1093D7972E7D6F 2DECE5DE619757DAE334129A3947E2EF05BD58AD 10324C1123E2F2CED4549D78158DF344BC B0BA245775BB8D3CE55F392 B2CE5FECBC254751C418DCC5CE740EC5D B0D4E9C03CEAF783F86A05B1E0E262438B261C947E3B26C98 1CDCD9F0B1817B7FEEB6C93247F B82C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\login[1].htm Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines, with no line terminators F62DC8F1C54561AD48BB9E C29 D2FCE4AF32CE72F21C7ABD D97FF3924B FB9AB46F1B77688EA2307F45F BD5CACA15CC77B5063F26C FD2832EFD7D377D6D4F1F39C961B B724DB117DE5FE550A787CBA B37F2C8EEC1A0 5AD42D9D E9ABF5217C9E C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\lwsignupstringscountrybirthdate_en-us_5K647cnxPf 8Z-1jWJbLIqQ2[1].js Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines E4AEB8EDC9F13DFF19FB58D625B2C8A CE218AA0488C0FDA2546AB21ABF5B9501B3 A62A5C950E4B03D613EEE94EBFF644FFB53BB65D E9586D258EA78B2 6821A8BC272C92750EB5BFA9AE50FA352EE2D454F7C0D8246E2CEADD79B662E0079A4A82F235534B5C651C01F7 9A72ACC5BFF0B2470CA308D1F6D6B9BC6356BF C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\microsoft_logo[1].svg Size (bytes): 3651 SVG Scalable Vector Graphics image Entropy (8bit): EE5C8D9FB6248C938FD0DC19370E90BD D01A B781338B5BBF9202B241A5F99EE4 04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE2 3D88B1B1FF60901F053113C5D7C D58 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg Size (bytes): 3651 SVG Scalable Vector Graphics image Entropy (8bit): EE5C8D9FB6248C938FD0DC19370E90BD D01A B781338B5BBF9202B241A5F99EE4 04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE2 3D88B1B1FF60901F053113C5D7C D58 Copyright Joe Security LLC 2018 Page 20 of 63

21 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2[1].svg C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\mscc min[1].js Size (bytes): 3560 Entropy (8bit): ASCII text, with very long lines, with no line terminators 5E9A1F4AA31D4AA60F6F899A2E45CEF8 460F6C21B08FA2723DBBC68613ABDF18213B2FAA C87516D7DD7077EDD467F5B7B085B035CD4803ECF049670AB19DE004E270ABA8 9AB7DAF8C AFEBA5A8F04A593DE C1A3FA071DCA0F51F9A9ACC12969C852CD8BF675744F25B 4FA0A5D1EA82BB22FE6C3887FEBC797E943E86 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\override[1].css Size (bytes): 476 ASCII text, with CRLF line terminators Entropy (8bit): F9E43729A5797BE1D45A779ED0105B7F AE4642A58A3AC4D850BCC4795FF E815D 1847E42E29F C9E85B C1400E7927BC4BB14572DD8BCD2670B 4C268CF8FF067D44FBFBDFDB EA583302A36F5CCE44D5B167C4769FFD0C13BF47F250E0E3889F119B04 C067F65CCFFCD462DF6643B512347E401090C3 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\pp1600[1].htm Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines, with no line terminators EA D0DD3A9D7E5B5EDC6DE4B5D BE36926D33ED6A8698DAEE987A A F8F407E0E47AFE FD524D4B19F7668B2A996249BBEE691B5114 9C09E9134D16D9B2D3F1BA16F14EB16B6BD DDED500260B7CC BC5E273D0C8CF26F264017D642E EDE78B3CD2997BECCCFAD294A825D16D0C931D C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\Converged_v21033[1].css Size (bytes): ASCII text, with very long lines Entropy (8bit): C7C24A76EC6AA950DB98BC9FBE1FFB5 E332F5AD22163BD3256E4F817AB3C6EE1D3E9CD7 A68B21292DA5623B3D489BECAA484854CD6E1623C342875C15D3AB91FBEC993A C0F85D3C720B308C2BFADED853425FA8967D3FABB645C69D9E7E4D63FB F963112A050F822B8 3339A9FAE3F080B70563BB5D6AE8D5BEC1869 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\Print[1].png PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Size (bytes): 476 Entropy (8bit): B8E8859FCD4E43D C17A3C7BD Copyright Joe Security LLC 2018 Page 21 of 63

22 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\Print[1].png F0CA023F26A FA0BF6935DE6A3B8AE6F8 DC15A37B4015D0DECF639006E4F9002E742DDBFD7C669EC0AE469057F238B78D 3605E4C4FE22E6E05553F89D34CFE8B3E5CA72FBDADCCD8B279835A0ECEFCD10B1BF2AD1ACCEEB168EE369E 23A8AD205720FBF33A184188A7F23AEA7B0F22005 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\PrivacyStatement[1].htm Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators 1DE1733EF6CC7F6310CB1C3BB88F1D ECB6F8747FAB83B74E D5C46FEDD16 9E567218F78FDB3E0BB495FA4B444D7F417FD10EBD6617A8FF6A5A510D3C8C3A 0899DC1F55F2726C16CE5C28AD4BCFB6E82306B4D2223A1CA640C9D546DE2C38FE7F351F971727B0E A7BCE EFECDE2BA78B4883EAFE7A115 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\a6-1fffa6[1].css Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): FF5AC2BAF36E92AAC6E0AE1A40E6240F 8516A2915B8F9D334AE9376A9D679BF343DEEDB2 411FE789C C2A4D44B FABC7FB71823E3EBB20779CC869D6E B2733FFE2D25200A2DF5A31A3616C1C2CDE7FB6C24B630977A5C2B18A4F1C4438B8B2BEB8CBB61069B605231D5 EF2A9FB3D FC14695D96B344EE412CD0 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\bf-d3d307[1].js Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): FEACE18A53472B3247DDB03A12400B E E B13BBF393585BA8C177A F2E4E654F9A7134A8FD37557F4F296DD388FD42624E E954D11535A011 F1505C724E78C70984E8C697A4A5A502A C4D233993F42FBEE3A105EDBC8B60367A489B4BC924BAB0E0 A14EC1A5EBEE02E9F5E6477F7A856D4CBC282 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\convergedbg_small_v2_Z9GCPpM7FVE8hxRSZ Uez6g2[1].jpg JPEG image data, baseline, precision 8, 50x28, frames 3 Size (bytes): 2903 Entropy (8bit): D1823E933B15513C B3EA DD34A6DBED1433C8472FC6CCD2FB7477CBBC8DA1 D36E606F9E0B062FE0AFC928875C99B8C5A931E9B29BE7EC19159D6DBADF8F5B C83C1AD6AFB5514FB1318C065718AEF0D12FB64F95F160B1B23FB5A9A99531FB3B26CA0714CE84AFE5B4694E69 66D104D6B1239EBF0B19E1F72B DE888 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\convergedbg_v2_pdvUOT_2pyXH5ith335y8A2[1].jpg Copyright Joe Security LLC 2018 Page 22 of 63

23 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\convergedbg_v2_pdvUOT_2pyXH5ith335y8A2[1].jpg JPEG image data, baseline, precision 8, 1920x1080, frames 3 Size (bytes): Entropy (8bit): A5DBD4393FF6A725C7E62B61DF7E72F0 55B292F885FFC92ABCE18750B07AA4ACFA4E903E 211A907DE2DA0FF4A0E90917AC8054E2F35C C26E51B4909F2BEB A05B67EF25492BD50A090F1EC0A0CC21DC4E4EFEB35E19CDC78A98F9415A FA02664EADE87F0E2 D8FA2A2958CD0D FC05689E01DC614 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\dropdown_caret_KXSZjGsyILZaoTf0sI9X-A2[1].svg Size (bytes): 224 SVG Scalable Vector Graphics image Entropy (8bit): C6B3220B65AA137F4B08F57F8 F4F08DA689179DE68EE40CD12ECDCC5AC54B D52BD03E244A44931A541A D638DD29EC14A87A78F2BE85D12D19A 6B4F2439CA99109A7C97828E5972A8E7C7FCA3745B2FB4738EBD9329A99234A8CD3BC4C0C48B5BAA917D4BAA6 4CDAEB5D74456DEFDDDA3E07FAA803283BE0287 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\ellipsis_grey[1].svg Size (bytes): 915 SVG Scalable Vector Graphics image Entropy (8bit): B5D393DB04A5E6E1F739CB266E65B4C 6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721 16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C C09F5E8D6E6 3A692635EE8EBD7B15930E78D9E7E808E48C7ED3ED79003B8CA6F9290FA0E2B0FA C00FB41D5710 E75D17C3C4D65D26F FB A406 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\ellipsis_white[1].svg Size (bytes): 915 SVG Scalable Vector Graphics image Entropy (8bit): AC590EE72BFE06A7CECFD75B588AD73 DDA2CB89A241BC424746D8CF2A22A EA9C281D69C4A3D78FF97BB61B9416A BABE5A0C5596F99AAEA B9135D934B9EA50B51BB0316E383B114C8F24DFE75FEF11DCBD1C96170EA59202F6BAFE11AAF534CC2F4ED334 A8EA4DBE96AF D6203BFD2DA69138F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\favicon[1].ico Size (bytes): Entropy (8bit): MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors 12E3DAC858061D088023B2BD48E2FA96 E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 90CDAF E C605D D348116D198F355A98B8C6CD21 C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0 D349B247EB4912EE169D C719CD01 Copyright Joe Security LLC 2018 Page 23 of 63

24 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\favicon[1].ico C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\jquery min[1].js Size (bytes): ASCII text, with very long lines Entropy (8bit): EAD7AD3BA27397AEDFA3D263B C215FE5D1EC081D83461BF4A711E ECD295D295BEC062CEDEBE177E54B9D6B19FC0A841DC5C178C654C9CCFF09C0 781ACEDC99DE4CE8D53D9B43A158C645EAB1B23DFDFD6B57B3C442B11ACC4A344E0D5B0067D4B78BB173ABB DED75FB91C410F2B5A58F71D438AA6266D048D98A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\mscc min[1].css Size (bytes): 1417 Entropy (8bit): ASCII text, with very long lines, with no line terminators D8C2B180C40BCC7FFCBE2C68B57D8FA C029A A866FA9B25E5C45CDE2EA F76C4C35C17F2649B96868C0D691F1D78B107F7635D D0EE6880 CF3DF5F597ED1444C4A2F9FB0FFC5E2B5D27E0703C6D589CE3A9154FCF530CEFCA1D74427B3D EF93 E14CB1F95313CD62596B9C70620FE93A527B19 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\script[1].js Size (bytes): Entropy (8bit): ASCII text, with very long lines, with no line terminators 2C8F27FBB4315EEDBB6DE54E66BDB0B5 0F150E83F064CE30832BED631B78A2724B C852F2D143B E2912A687AAA248567D92A3B AED311B3E32EA4DED5FB79C3F4E819EB64C1D2D225CE8F1C7552D9360EDE987A F8BCB6F28D47CCE8A9 FD A D4AC767CE3DA2071D66462 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\script[2].js Size (bytes): Entropy (8bit): UTF-8 Unicode text, with very long lines, with no line terminators A6A019C2FE42A22F3E82596F127FD465 49DE65EF5636B4D CFDB62DF53DE ED3E82673A4B8F7BFC48E3C1141E79DD4CE984751EC3FD9825E35464C8D2F8EB B8F058C3B2DD B56D025E1C804BD0D72778DD8B0758C348EB3F4B049DC6C05C9281C492815FE E0B0F8DBEBB3AE599D1F4E8027BB2180 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\6Q2AR3N6.txt ASCII text Size (bytes): 129 Entropy (8bit): AFAEE8D140B4375CD0FD936352A5C3C1 ED85A94DD81A693EFA4C9A6815AF5872CA41D2A8 Copyright Joe Security LLC 2018 Page 24 of 63

25 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\6Q2AR3N6.txt 6D158FB49BF17A11D93A3E3F4221FDDFF0DD30CFEDC124CCA14B34C42EEF7A5F BE4FFB2BC4C2B7760CE7F23DA7DC462AF4B2721CEE86641D252C7BBC12839DF75022ED3336DE4ACF B051AB5D8B5297E118438DD37CA679C2C5 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\GWIL0852.txt Size (bytes): 129 ASCII text Entropy (8bit): C2DAA8424CDDDA5A21F4AEB189A65 E30523B6A8B713F5962CFC5AD5F3AE8EA4126AB F8CADCC21E184A3E26B0C E EC5BCD6FFCF6A819B4FF8 8C1187FA0B04B80BD8CE63308F5E C690930D9F7291E902A9E49EE9799E30E209C AE3096BD457F 38BEFDB11A479BE6347A443D283896F8FC9C C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\LLZVZHIE.txt Size (bytes): 86 ASCII text Entropy (8bit): C D9EE8C283DBD0E14E06ED 30E5F1DBC AEC605D0AF433F C6870B2C5F3C6047EF7675B36F83FC3C91B3D66AB1DDCE73B501EDC42DD 0B060C7FC2F05462FBC8824BD5A9377AC8088D87205A73AB1416A3CA9FEF4A7877DA132E825F05FAC72E286B35 ACD247FB67DDB73CAE171CD AC023A56 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\VY0E8EWT.txt Size (bytes): 86 ASCII text Entropy (8bit): F7243E56EE04176C0C965967A7015C8C 19E70981F855DEC4C800F71D02F0C02BB7B616F8 93C3A14DA C5CFBF511A269EE50D3F07DA1BE6E62D1BC36 D33504C58A2E4D F92B3DBBE664659FFBB5661D6F43C7593F08EF06719EE3E97A70EF4E77CEE7953D5B65 4FD83FDEA6B59688C4EF6B37388EDD0AFE35B C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\WC38K2R9.txt Size (bytes): 63 ASCII text Entropy (8bit): E0D767EA641A284ED892B4DBF577 A2EC291A005367E74A8C97602D3134F186D2D9AA A7F87B0B9B57A10D719E651B43A901E44401DEED FE65D5955A80C629A 86AE DB789ABC3ADE176E90D25165BC D369D60A111B6039E502DEB1AC AAE2EA2538 E257D42B1A400E B24AD0A5ACF8EC44 Domains and IPs Copyright Joe Security LLC 2018 Page 25 of 63

26 Contacted Domains Name IP Active Malicious Antivirus Detection Reputation a1512.dscg2.akamai.net true high a1531.g2.akamai.net true high wut-scu-prod.cloudapp.net true high click.mail.onedrive.com true high a1449.dscg2.akamai.net true high vs.login.msa.akadns6.net true high statics-uhf-eus.akamaized.net unknown unknown high signup.live.com unknown unknown high onedrive.live.com unknown unknown high auth.gfx.ms unknown unknown high assets.onestore.ms unknown unknown high spoprod-a.akamaihd.net unknown unknown high img-prod-cms-rt-microsoft-com.akamaized.net unknown unknown high ajax.aspnetcdn.com unknown unknown high URLs from Memory and Binaries Name Malicious Antivirus Detection Reputation spectreviewer-f0180cbf[1].js.1.dr high servicesagreement[1].htm.1.dr high PCore.js ( pp1600[1].htm.1.dr high PrivacyStatement[1].htm.1.dr high imagestore.dat.1.dr Avira URL Cloud: safe servicesagreement[1].htm.1.dr high PrivacyStatement[1].htm.1.dr high jquery.org/license spectreviewer-f0180cbf[1].js.1.dr, jquer ypackage_1.10_5v7lauc3bnaqx2qq fr1rpw2[1].js.1.dr imagestore.dat.1.dr Avira URL Cloud: safe imagestore.dat.1.dr Avira URL Cloud: safe sizzlejs.com/ jquerypackage_1.10_5v7lauc3bna Qx2QQfr1RPw2[1].js.1.dr servicesagreement[1].htm.1.dr high PrivacyStatement[1].htm.1.dr high errcode=1045&mkt=en-us ZC2K0IRQ.htm.1.dr high aka.ms/kr4ndl PrivacyStatement[1].htm.1.dr high servicesagreement[1].htm.1.dr high opensource.org/licenses/mit-license.php) lightweightsignuppackage_iiqcqkgco- 77EJPXly59bw2[1].js.1.dr knockout_3.3.0_rczl9zwsspzscey fd4x8ca2[1].js.1.dr PrivacyStatement[1].htm.1.dr high servicesagreement[1].htm.1.dr high wa=wsignin1.0&rpsnv=13&croot PrivacyStatement[1].htm.1.dr high {29544AC3-E613-11E8-B7AC-B2C27 6BF9C88}.dat.0.dr PrivacyStatement[1].htm.1.dr high PrivacyStatement[1].htm.1.dr high servicesagreement[1].htm.1.dr high servicesagreement[1].htm.1.dr high view=folders.all&id=250206&mkt=en-us ~DF426EC6D895F3EF94.TMP.0.dr high PrivacyStatement[1].htm.1.dr high PrivacyStatement[1].htm.1.dr high getbootstrap.com) natedstrings.en.js lightweightsignuppackage_iiqcqkgco- 77EJPXly59bw2[1].js.1.dr pp1600[1].htm.1.dr high ~DF426EC6D895F3EF94.TMP.0.dr high PrivacyStatement[1].htm.1.dr high Copyright Joe Security LLC 2018 Page 26 of 63 high high high high high high

ID: Cookbook: browseurl.jbs Time: 16:29:51 Date: 17/11/2018 Version: Fire Opal

ID: Cookbook: browseurl.jbs Time: 16:29:51 Date: 17/11/2018 Version: Fire Opal ID: 91265 Cookbook: browseurl.jbs Time: 16:29:51 Date: 17/11/2018 Version: 24.0.0 Fire Opal Table of Contents Table of Contents Analysis Report https://mulhervaidosa.info/za-labour/ Overview General Information