ID: Cookbook: browseurl.jbs Time: 23:25:27 Date: 29/08/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 23:25:27 Date: 29/08/2018 Version:"

Meghan Nelson
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 23:25:27 Date: 29/08/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Spreading: Networking: System Summary: Hooking and other Techniques for Hiding and Protection: HIPS / PFW / Operating System Protection Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Domains and IPs Contacted Domains URLs from Memory and Binaries Contacted IPs Public Private Static File Info No static file info Network Behavior Network Distribution TCP Packets UDP Packets Copyright Joe Security LLC 2018 Page 2 of 299

3 ICMP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Statistics Behavior System Behavior Analysis Process: iexplore.exe PID: 3200 Parent PID: 548 General File Activities Registry Activities Analysis Process: iexplore.exe PID: 3252 Parent PID: 3200 General File Activities Registry Activities Analysis Process: ssvagent.exe PID: 3304 Parent PID: 3252 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 299

4 Analysis Report skzh0f Overview General Information Joe Sandbox Version: Analysis ID: Start date: Start time: 23:25:27 Joe Sandbox Product: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: CloudBasic 0h 6m 25s light browseurl.jbs skzh0f Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: EGA Information: HDC Information: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean3.win@5/435@42/31 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Failed Failed Copyright Joe Security LLC 2018 Page 4 of 299

5 Cookbook Comments: Adjust boot time Browsing link: retpath=https%3a% 2F%2Fyandex.ru%2F%3Fdomredir%3 D1&nosync=1 Browsing link: retpath=https% 3A%2F%2Fyandex.ru%2F%3Fdomredi r%3d1&nosync=1 Browsing link: Browsing link: origin=yandex&retpath=https%3a%2f%2fmai l.yandex.ru%2f%2f%3fmsid%3d %26m_p ssp%3ddomik&backpath=https %3A%2F%2Fyandex.ru Browsing link: t.yandex.ru/registration/mail? from=mail&origin=home_v14_ ru&retpath=https%3a%2f%2fm ail.yandex.ru%2f Browsing link: msid= &mlid= glob_225 Browsing link: Browsing link: ndex.ru/story/putin_smyagchil_ pensionnuyu_reformu--47ae54e16 ca9416e6cc66d a6?lang=r u&from=main_portal&sti d=fn_vucmwa5ms4szrd8ab&t= &lr=10515&msi d= & amp;mlid= glob_225.47ae54e1 Browsing link: ndex.ru/story/ssha_nachali_spo r_s_rossiej_v_vto_iz-za_poshli n_na_amerikanskie_tovary--e176 adbb51463b10d23bb8248f2a9204?l ang=ru&from=main_portal&am p;stid=0deeyg6k3n3bolsttsfq&am p;t= &lr=10515&am p;msid= &mlid= glob_225.e176adbb Browsing link: ndex.ru/story/docheri_poroshen ko_ne_postupili_ni_v_odin_iz_vuzov_ukrainy-- ddf01635ea7a47f150b8c122e477b039? lang=ru&from=main_portal&stid=wblew p2gzysszkt_zdvd&t= &lr=10515&msid= &mli d= glob_225.ddf01635 Browsing link: ndex.ru/story/avtovaz_pokazal_ koncept_vnedorozhnika_lada_4kh4_vision-- d4ed8d7e5bcff067e6909e53db48cfbc? lang=ru&from= main_portal&stid=rr_fllpbdzolqvuuwnu&t= &a mp;lr=10515&msid= &mlid= glob_225.d4ed8d7e Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found. Copyright Joe Security LLC 2018 Page 5 of 299

6 Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold true Classification Copyright Joe Security LLC 2018 Page 6 of 299

Ransomware Miner Spreading malicious malicious malicious Evader

Banker Spyware Trojan / Bot Adware Analysis Advice Sample is looking

Launch the sample with the USB Fake Disk cookbook Uses HTTPS for

encrypted data' cookbook for further analysis Signature Overview

7 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Spreading Networking Summary System Hooking and other Techniques for Hiding and Protection Copyright Joe Security LLC 2018 Page 7 of 299

8 HIPS / PFW / Operating System Protection Evasion Click to jump to signature section Phishing: Found iframes HTML title does not match URL META author tag missing META copyright tag missing Spreading: Checks for available system drives (often done to infect USB drives) Networking: Connects to many different domains Social media urls found in memory data Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Abnormal high CPU Usage Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Tries to open an application configuration file (.cfg) Found GUI installer (many successful clicks) Found graphical window changes (likely an installer) Uses new MSVCR Dlls Hooking and other Techniques for Hiding and Protection: Copyright Joe Security LLC 2018 Page 8 of 299

Disables application error messsages (SetErrorMode) HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Behavior Graph Behavior

9 Disables application error messsages (SetErrorMode) HIPS / PFW / Operating System Protection Evasion: May try to detect the Windows Explorer process (often used for injection) Behavior Graph Behavior Graph ID: URL: Startdate: 29/08/2018 Architecture: WINDOWS Score: 3 started Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend iexplore.exe started iexplore.exe Number of created Registry Values Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious yastatic.net api-maps.yandex.ru , 443, 49170, YANDEXRU , 443, 49224, YANDEXRU 41 other IPs or domains started Russian Federation Russian Federation ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 23:25:45 API Interceptor 62x Sleep call for process: iexplore.exe modified 23:25:45 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Copyright Joe Security LLC 2018 Page 9 of 299

10 Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link 1% virustotal Browse URLs Detection Scanner Label Link 0% virustotal Browse 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% virustotal Browse 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% virustotal Browse 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% virustotal Browse 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% virustotal Browse 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Copyright Joe Security LLC 2018 Page 10 of 299

11 Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Startup Copyright Joe Security LLC 2018 Page 11 of 299

12 System is w7 cleanup iexplore.exe (PID: 3200 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3252 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:3200 CREDAT: /prefetch:2 MD5: CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3304 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new MD5: 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\CabA012.tmp Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe Microsoft Cabinet archive data, bytes, 1 file true C80707FEAA56B9F5F9F299A70A89A675 2DD4AA8EB8E0AD265AFA6FDEF00FCC1625CA959C 8573C2B9348FD9364D6DF901D44C5BD80E33278D4D4AD705D22C9757FA2B52B3 4E955F122EFDB59443FD78DD5F599AA7C3E03A0014A B382AE85E40304D2DA68EE402E007424F596682E7 86C7E53E2A1D224342ABFB06F545EBC1A3B1F low C:\Users\HERBBL~1\AppData\Local\Temp\TarA013.tmp Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: CD81F6A51AEC72583E68BF A6C906D3953E7B92BD5CC12DAE27C772E3 540CB7459D0FD892B5C540F293E04AA3A049E65C0FB17F3B2E6245B37530C1D0 33FA38041F42317B1E36F673A7E BA691ECA127EDC0A191D9B4F6F663AD44E8AF84948B77A13FD64D4DF C0CB7A178AF64CA16D5A714F41B E2E low C:\Users\HERBBL~1\AppData\Local\Temp\~DF3BF6C9033ADE0185.TMP Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: A85296D954238D67F11A69D85B0A762C 4EA51225BF0D3F737AB74D3A15449AB5DC3AA E4D1466A4756C6166A3E8D1C5CD9EE3298B FD8B73F1C4D9D4AA7 3655F452254DEFB53CECF78E97C218F9FABB06DD3D18C130B2B77F18FB BA2F0A288B6C9CD6E01A5B6E A2B7717BFF3A1D225E046A9292A53ABA low C:\Users\HERBBL~1\AppData\Local\Temp\~DF5101D849AFF97AD8.TMP Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: D66231A93D4C69A1EF12BE B0B 96EA420FB542CECC84E77BE03CE9AA7C82A1E7F6 8F D94B936203A8D39CB36EA52B285E08CAB33AA85F8D B00 8DBE582B45EBDEE28352BB7BF87568DCA88F1BC10A52895FF7DFE8814C41FE070C6F74104E77669F590E4888E9 D8547DC50473DD5A95B04372F00FD824F371B8 low Copyright Joe Security LLC 2018 Page 12 of 299

13 C:\Users\HERBBL~1\AppData\Local\Temp\~DFCED776BEE0CB3461.TMP Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 0671C34D F212B B9D C9D4F55C0901B615ED8E76E77D1E72AA A9150DFEF786A12BD2791C911E FD9AC581ABE373FB4EAB13AA92 CD47C5E5BB9C EF92F248F0E68EF905F5CA6E502554DDA28CBA0D9ABB752FE71005F006F441FF50EEB3 B7176A915E AC78DA0E004F857BD3B low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\000F7F8FAB2D96E6F8CBD5C9A3B4EC90 Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe data Size (bytes): 6272 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: DA1D99AC373A1C39B00D17FFFBAC B0EE544E78D081DFD821A B9C1 220F FE714456D6CCF62CC5E4A9EDA8FF719CD3AF106F8B6A7A24 2FF8AFAE CB14EFB78CB37126D4BD19DC3ACA520D868EBBC4F3C2051E313D64EBB760333BCFDFFED 769D5F5A E78FDA9E486C019DE0AEBEC low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ CBC2077D43D7D17A33C868C4F Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe data Size (bytes): 1918 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: E26375EB A29C2A6AECE2A5AF E8C31446BF3BA767A22D09DA17C6BF6C21592D75 92E13DC1D227318B0CF79C7B12C7F91DC2C B233610C8A95F0D2D80BFC 792EC67938A56A3837A F5153DCE94EECBDF328B362FB92E BA293CC9E91EC1937F33A129B7CC3 F555BEAC9E804428FAC5555D5AC79714A423C low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe Microsoft Cabinet archive data, bytes, 1 file true C80707FEAA56B9F5F9F299A70A89A675 2DD4AA8EB8E0AD265AFA6FDEF00FCC1625CA959C 8573C2B9348FD9364D6DF901D44C5BD80E33278D4D4AD705D22C9757FA2B52B3 4E955F122EFDB59443FD78DD5F599AA7C3E03A0014A B382AE85E40304D2DA68EE402E007424F596682E7 86C7E53E2A1D224342ABFB06F545EBC1A3B1F low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\000F7F8FAB2D96E6F8CBD5C9A3B4EC90 Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe data Size (bytes): 1824 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: 4B797D17779EC784CADD7E16A68DE2DC 9B09AFCB9AD4937B47CCC9DD617C511E931CC2A8 74A124D3942F6E5276FD472C1D F5D4C78E5878E9C2AABA1 83CEB120F19182E D22AE5AC478B148C92E08E9832C1865A4CB24E45AE95D5525F5ABC5E92CBE4F7E7B1 C3FBF51C1843D3C338AF CC8BBC96FE Copyright Joe Security LLC 2018 Page 13 of 299

14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\000F7F8FAB2D96E6F8CBD5C9A3B4EC90 Malicious: Reputation: low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ CBC2077D43D7D17A33C868C4F Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe data Size (bytes): 468 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: F7F701A4F1B8262B4FE4FA08A4789C E5064C018BB5EF185E30787CC4901EFBCCBB 2F47BF62BC A5E4EE B0A761D0039E72AC8CEF3D53F938E3 F71C821E3EDA B1196D1C7DEA4C8268F502AFE231F7C1F8F6D455899F39BA167D590C199D6ABC128B4D 0A889E1F376ECC53BDFD C21B0961DA low C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F Process: File Type: C:\Program Files\Internet Explorer\iexplore.exe data Size (bytes): 328 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: DDD012E54F50B22931D6A5A84A74A7BE DFDC545FB216BC2DB848D6E384A232E81D D734CBE72A3E198B A936782DDB7FC5A369A18F87B9B7B709902FC83F7 287F7E0A69D965E092C707C86AC664A4F2C984932FC03F342695BA6C8C F20CAEA4A0684F53CDBF48850 D7D85FF21D137F30747C6267C52F65F7EDF04 low C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Process: File Type: Size (bytes): 237 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B low C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\6RDNM5N0\news.yandex[1].xml Process: File Type: Size (bytes): 878 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with no line terminators E36FDA1B59448B5F3E628DFDD06E1CC6 6AC13D9A49E93202B D00A2EB67A7EC D5FE3A4EEF29B367988BE218858FD6DAE8CBE16531F F021C948993C2E 75B AA6F2EA4E8B9E3E9EB8C8EA01D0583CF5FAED2362B AF5B F7B5B8B98A2CD35 CDEF01AFA8FF9FDC52A426C2681EE EB low C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\7CFNOU7L\yandex[1].xml Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: ASCII text, with very long lines, with no line terminators Size (bytes): 8016 Entropy (8bit): Encrypted: MD5: F69A96680BD664CC4DCA65BDFAF94E2C Copyright Joe Security LLC 2018 Page 14 of 299

15 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\7CFNOU7L\yandex[1].xml SHA1: SHA-256: SHA-512: Malicious: Reputation: E3FB03DBC242256DA40F77EC05FC5D05 C3C1F20B4E4BBCEF917457E86107AEB0ED50CE19261CF5291F07C407667DDDFE 4031D62980E6F7A82F1D6A833DF575BD854B748AC0ED9C26EF16677FBBC5B12582DBA51A817E61E1001AB08E7D D0B81206DFA20AC48D4D40DD8F E95 low C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\ALX62EEL\passport.yandex[1].xml Process: File Type: Size (bytes): 4749 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with no line terminators D1F BEC7D6EF0F93E0E FD9A262BB7C9C2323C28D8FB2ACAFED36F A21A22D92B29CEA0991C287EAC54D181FED7E393A1D D5A00CEA4107F CF230F34506C9321EB7E312B AC7DCF4F357014FD13496D22CBFFE7317DAC7F42B06CC364F191C2B9F387 AFE1C6E1BB7AAB56698D8EC47CC3BCD7CE682 low C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1610CBA1-ABD2-11E8-B7AC-B2C276BF9C88}.dat Process: File Type: Size (bytes): C:\Program Files\Internet Explorer\iexplore.exe Microsoft Word Document Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: B62C4CB8D95C2AEA032F2364D5B07B1E 4246DFC165E75A7A EFBBB3B6D6FA1A408 2DAC307E051F95DE6F47A542526FF4FA361C147B52B7F6ED27B35BD4C4FAB573 86EE71AD07ED3D6A13DCFF51D1346A1EE0C343FA4D0A1DB58383A46841FD5C00ED062BD90C6E39FE5FA455BC1 4B060B9BCC B6BBF4B56A51D104A6EAF7 low C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1610CBA3-ABD2-11E8-B7AC-B2C276BF9C88}.dat Process: File Type: Size (bytes): C:\Program Files\Internet Explorer\iexplore.exe Microsoft Word Document Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 3F639A44AE0BD35BABA046E7F450732F AC94281C12B021C87757F7AD0CE8A2676D2F87E2 C5D8EFE4E0D194ABC3F6B5BBC32D EFF65067E2D F01BD232F8 E926795FBB55C7D4CE6C756BCA843261A7B781A6FC BD5CC7547CF0B79D541D0F0AAB93844BCEDB3F3 0D55919B0B602B4CABEF46BAAD952D7DF8F7934 low C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{206D8920-ABD2-11E8-B7AC-B2C276BF9C88}.dat Process: File Type: Size (bytes): C:\Program Files\Internet Explorer\iexplore.exe Microsoft Word Document Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 24736CE8A70ACA0550A13A4DE0D33D12 FAE8CD8D52B03DD041ADF10581B7F08D3FCFF541 C7EA E77A7E4C63BAC13D8B71B16BBF070184ED B3359F1547 8D5CCBAE9CB52DDE46A5406B0551F6EC2D652F698C3B6C771AEF6B0DF35E2DC3FE08DF5B24E60927EC0C80AF 6DF6C626BC1AEF6FA6CFD4D9B98A12AC9F53AB89 low C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: data Copyright Joe Security LLC 2018 Page 15 of 299

16 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: E66E95B4DF0FCADB381C114469D10C7E 56BF898D94FBB0BA4355EEAB7865BFA8280E379F ED9A1471BCAE14A5C2D319F95A225528FEAE3AD0AFF16160AA779B7C15A269F6 CA11A2E3635C0B49A2002E76B4FCC40D63CC3CE1FA8C0D523310ED5EA3B91EC44797C11F473B1BD0A3E66D6C0 FBC2A28F09A98EC9B0A FA8CA68A39B6 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\1815-back[1].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): 3018 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 942A6EF D5CBF80A2288D063D F491E1EFB48A6FB59D47252B9116BB26510CC D B35D9B04F1D39D F3D1EA1AB708B7905BB2C1B69F14F3 30A4FD8625EA B06A84E873DCA8611E3C8FA7D57A204CFC47D36727FCA75D146CF77AF4534B4D E0760FEFF442AA88DF05A BEA69A low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\1815-front[1].png Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 408 x 230, 8-bit/color RGBA, non-interlaced 24FC4F87E88F CAADBB588BD51 A5FD49F9FA91C826FAA63B856A90A7F7502BF7BB 243FC5D272BA04522E69DA57878A4E0D021E0AE5E4D3C2DAC6059D933EC5C3C7 5AC689C678BF5AAE2BDE34359A464C4EBE5405CAA5780FF4F ED76362FC594CB7DFB879BAB20637AAC DCB8AEFF746C49D5FF1D15B878369DAE0AFBF62 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\185x100[1].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): 7621 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 3AD9F3CC997257BF8EB4A39F297D322E 2A23E1787A6AC4FEF5034C2246FBB6483F52ACA1 208F D339C8AF8FB E8765E6173D05F3D570D C9D4 1D ACE1835CD77E51B857F09EC2D2C57A5E43A086B186421D0C9B5CF7A9A82C2CC4E341D38F992E B5F11D32EAD855EA4F960298CC1A72F8FAF low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\185x100[2].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): 8365 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 332C16E3812A986DA3FC5EB5C81B9C79 AB185C89B14D8ED8379CBE451C8B799D22C8CC18 7E5386C4424F487EFC663910A64B0C696FE3313C71BDAFB6FB0A755D2A08774F 15C44B7DBEE9429AC8AC3722C76A5AD9C5CA57DC70F39E96B7B1F417F2BC15F61A87B61E5A17E437C97ABCE26 3A82438BEDA2495BD5D6D029E7C6372C349D167 low Copyright Joe Security LLC 2018 Page 16 of 299

17 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\25-front[1].png Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 408 x 230, 8-bit/color RGBA, non-interlaced 6BA7D2C0B FBBEB764D800D0B1 4B852A3C DEFA285BBCCD3438D7ADB1 D7472E3AB0F16916E3A2F06A769A A CDA1060B96C796ED0B 3EFEDBC30A03562F4336F57C7A21EFFE33E97F2650DA93E952CF2C1299A4AFB286C7B8EFE787711A56E766FB B15BE8D A1DB829E0CD06AE6 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\256x140[1].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: F939E972F42E52401EAEE3AAD155CEC8 38AD77A02E1C151B61C681A2C67C963A096D127C F5E0E5C76D2329CA0D61D058F342C3284BE1CEDDD29CA2B9F4DE5B5EABD9BA4D D3251B6E003B368D2BBC7FA323D73D812AF18A7D497E DF7C4FEB1D4CE2AADAE628E041E59959AF97B1 20B3574B883EA0DF0DA10B D3DF10687B low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\256x140[2].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): 7827 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: CF412EED71A85ACFE41BE28DBE6930E B4DC8A2E5D65C425426C33B3CFF2C2F91 AD910CE7BCF380D2C0F927BBCFC625E6DEF34BFDBEA4255D26DBC2724FD1D6FC 271C3571CE982EBCFA3C69F7344B451F9DAD51FB226EE83353C46250AAB721C5CDCE1684D3E50EEB3E3B41377 A47F7EE282CA2B4515E7FA39E42A8F09AAD471A low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\256x140[3].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 9D4505EE60E369262AE9D2D0342A55A C8D42D705478E85E C166C75BD4B 8FC26819A4486CF682F545FC9A E60FA33B42796B72D02D00A42B6DD CF68505D2C07FFE7FAB4F01D19AF DECC4DCEB3DD0C063BFDD2C72507ECCD04CF7C551BB726F 16D767F C4978F6F6D32E0FC2A32B1C08 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\256x140[4].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: 5D9E BEE364F4323F39F2CED 5E68F54D84AAB8F28C83FCD30AB2F94F3ED62F30 55C5C9B00E7272C3D018D94EE AB26854A67C95E332EACCC8982F0721 EE16A35AC6E1B83A EC34280CC493BF6752D06096A8B04FB8927D16C7B8BF59C2BCE0EE6D FF078B2DC7AD2E61F D50359EAD9C3 Copyright Joe Security LLC 2018 Page 17 of 299

18 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\256x140[4].jpg Malicious: Reputation: low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\275-back[1].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 237DFE414CDCFEEA8CAE1233F3C00E6D A DF77B1B6106BA8A BAA5AABA7BA462E1CF818F7DF840A8A B559562B307A7CC44ACBA5EC96 DA516FDB861822A DF363082ED3AA44EF2A D29A3C5B42ED180E0F841CB0E1B7E93F44AE89A C8E324CEAB25847A97F4444AE2D4EB8AEE8743 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\563x304[1].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: CBD693D8CA7B2492F3A83D59A DA1087DE531C547121D63526CBD34BC234D 340AFE32C36F355EAC613D38E0BD D3D83E4EF4B61AEC0ABD0BAC22CA D87DC9B718B6EDFA91B28D0C083662B199EB36701C51EA2BBDE20C0FFA09348CEE972648EE0DDBC6CF9D A241ABCA885F14B62489E8504D5AAE23C45 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\563x304[2].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 3AEEB7F25D152BF61BEFE8D287A3B75F 43F2D768277C7E6B64FEFC5B4991F575914EE062 6D17DDF155005EBC6583D7B417AEA A62105DDBF637E E853EC 08995B12DEBA25037EEA86A63BC5E57E6F8E833D0393C F91AD2DFDE19164BD3436C92E55ECDA57A8610 E08F861ED35FF2671B82BC3DB625CAA97223FE low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\563x304[3].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 20DD9780CDA4680E6DA2101E8CBEAFB6 0DC5FD3FA69F96D686BD91784A4B194FBBE36D03 CC3F F02FE DC7C6CE E41F0F0B7B8FA5260C E 2BB25C70299B9EF29212A18E6C28DAA1613ED79002E4D73DBDC64DB418F0462B99699C90DCC9DBA53D535004BB 765C151DE5E3F814BD592029E9CE9B16C59727 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\563x304[4].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: 535A2C130C61BE9BF34FE788B64516BE Copyright Joe Security LLC 2018 Page 18 of 299

19 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\563x304[4].jpg SHA1: SHA-256: SHA-512: Malicious: Reputation: DA428169BB1DE6FF07AD950305B53A0FE498DC4A 096F584C076335BFBA185F93583E04A0E3CF379AAEC76C3A9AEC1B21B8FE6B10 EE4A91CECECC678BBDD56699F27C FB1BF D8AF98ECC415CCF6BC162BD8D7E51A730A BA BF91778BDC060C5BE A6 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\563x304[5].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 479ABC6763E374AA1BA8C32EA3F9643D 1631B9C7E929A9FF2DADFD422158C11A13638ACD E2B4E C7D438F6E5965A8BFDEB5EDD1FADC498B16CF51F438C6 0E2A27CF21798C1391D42F31371F30E51024F457F42AE78AFB267923ED46F47F0E02BFBEE52BA6F6267CA226AAD DC9EB9C688E8C10957B283DEECD02E7 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\563x304[6].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 503D35A94F79E6E058ACD1DF4FA3CB89 71D993CE6D3F A04B101CBCE151845E28D A145B30DE8A81770DCD D6F3AA31BA81A75DD1D25B6CA98BB FB4BDA6EBDDA B80D37FD905601F2F2D8741DD96E65453BA910F54FC63CFCA9D71FECBD2FC9A 022D7D BECF3907BD04EE37BC6F034 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\8lFaTHLDzmsEZz-5XaQg9iTWZGE[1].png Process: File Type: Size (bytes): 850 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced D590A318360C F973A998C84 F2515A4C72C3CE6B04673FB95DA420F624D F AC5A362EF14184EC67D8A12FAF6A734C7C5D46FF1913B892 EE3AA2413A660B929EED9BD0280A95C9B3993C7095C673866AFC6EFA483FE9EF55DEFF72333F09F42D307158E6 0A339A5FAA0105B69C431B5BC75C31F low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ [1].gif Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: GIF image data, version 89a, 1 x 1 Size (bytes): 42 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: D DA2D9510B64A9F031EAECD5 D5FCEB D0D84FFE09C40C481ECDF59E15A EF1955AE757C8B966C BD3A30F658CED11F387F8EBF05AB D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A E0DF38B62847F B771463A0124EF3F84299F262ED9D9D3CEE4C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ [1].htm Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: HTML document, ASCII text, with CRLF, LF line terminators Copyright Joe Security LLC 2018 Page 19 of 299

20 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ [1].htm Size (bytes): 455 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 931C8B17780DED539F70B7DF913DB EB2B5115ED75EFB325EE A D7A034648C2BAAE403573CD208A892E2252CB5C00EDC8F26B7B5656B 402BDA DB E59B7D4F68491E6B6F9D288C78C634E98CEE16E5C21023FF778E3B8A4647C52309B85 CD28549CD0C016D100792FD9EDF0ED2FB437 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\ [2].gif Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: GIF image data, version 89a, 1 x 1 Size (bytes): 42 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: D DA2D9510B64A9F031EAECD5 D5FCEB D0D84FFE09C40C481ECDF59E15A EF1955AE757C8B966C BD3A30F658CED11F387F8EBF05AB D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A E0DF38B62847F B771463A0124EF3F84299F262ED9D9D3CEE4C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\??????%20[1].svg Process: File Type: Size (bytes): 1088 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with no line terminators 6E8B7F63C9FF1731FBABC6A9C46CECEC 06115D1B57032E10BA5C9F1D3FF56D0B595F0FBC E29A4BEF3E79FCF1D84FE48216ACDC8F515EBD13F61AAAD2EE7ADF3FB85CAC30 FC5D39DB14BA0909EBA2AD2F4F7EAC5C14E3E CF6F93475CB50D95F374B678AF719D230B3B65F363C7 9971FD7BF2AF1E2C8B65651B50E4D108E51550 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\?????[1].svg Process: File Type: Size (bytes): 1320 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with no line terminators 1CC304858D7C33BBD075AA E4E C71A5BF9B7DEDC66302CF EE75E0D41D06 35F46719E387F06E3A2D959AE06FA194AE6C9735CAE22DCEF1E57A40F031ADE9 015A3A232A8BAFF6D6E7255E19105B8007C874749C5ABB95BBD357A8DA8E10345F60C9CC126461F61FF08BDBD7 120F0BE3FD3C40577E4E84C74DCB BF low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\B_GHi1n15TIonEBlfjSOiyj2Km4[1].svg Process: File Type: Size (bytes): 329 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with no line terminators 993E75149D965CE2D F550DB9 07F1878B59F5E532289C40657E348E8B28F62A6E 125CC357E8DBFD8B9D2BA654221C971F2BB34623E05D E354B13A5 076DCDD1B7AEE20201BDF08F13845E767A73754C76497DB41A102C9F2E8DEBB2E B3AF573B1B3B622FE1 4E1700D9A75AD99C A3DE low Copyright Joe Security LLC 2018 Page 20 of 299

21 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\FodYPkgsduyz0F6CQ4J7j6918[1].css Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with no line terminators 4F5EA30CE4FFC2B4C211E526032B9426 CE E482C76ECB3D05E B8FAF75F 2105F3A6F36AF36A1DACB69DBC45C0E20F0A7D117A691E186B7C2A3B85F05FB3 39AF5D73403A474237C470D3D86DE928549FE CA4DE0DB6A3E653F743E1A14548A2C76E8541B565E4EA0F 69BFB4A329AFBF87B5CE4204C1F9B18F3970C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\GEE-sBdQgic786DXgETWfn35A[1].css Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe UTF-8 Unicode text, with very long lines, with no line terminators F168D BDD404998C51EF17F EB BF3A0D78044D67E7DF90 BB58D390EF258B20DFD1709D43F8264E4B33BDB246B DAE00F9596C6D 9B597EF2A9E13BBD41A7385A6924AB1E23F7D67F59704B6401C30DC4CF2B8C6FE0ABB198B90DE FDE8A A6EF7F154DD866EAFD11E22760AE F3 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\GmxoaNBGBwZJQ_L6OxNu-vPTM[1].svg Process: File Type: Size (bytes): 712 C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 4E1D3E8918DFD A A A6C6868D F2FA3B136EFAF3D33 04CF20D199666B29CC7BFF B3D8300C11CE7ED4762DC A6DAFE 9A1BA44C8A0CE5C511C0AA38DAF140AD96B519E69D6821E EE88C422093FEAF0D5E577AF836232A9667 0B1E72D08141D9A52B9C B low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\Jy-b3BgSC_rSXwEgmmoYVtrdE[1].svg Process: File Type: Size (bytes): 595 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with no line terminators 1BFF233CC E4D9128DCF542 CB8272F9BDC18120BFAD25F01209A6A1856DADD1 9B444EF99AFBF6E82197C5C73257AC6F50FC463404FB8BEEB1B1E567984F58FD C33D D9FC237EEE392CDEA84296D5980EADCE FC8F706413C9BA48A3BD9B530FA45 D973320F5C67DF05AD3A4578B81390EF612BE low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\LqV2raroFHhfp6v6nvArL37XghU[1].svg Process: File Type: Size (bytes): 1107 C:\Program Files\Internet Explorer\iexplore.exe SVG Scalable Vector Graphics image Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: 3FEF4A09BDCF5CDB68820A64410CFAF3 2EA576ADAAE814785FA7ABFA9EF02B2F7ED FC8CC12A2F619939AFB31BEF44462B6BBBC3F83A4CE4FDB7E01848F9EE3FA89 809DD5FD7B108E4A0E38B8EBDF6035CA81C91185E5A8E25F290E824F6DD3F73B45CDCF140FF31A81C3E537D48D D5F61DB7A28E480B343B350783A1C13A8F1958 Copyright Joe Security LLC 2018 Page 21 of 299

22 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\LqV2raroFHhfp6v6nvArL37XghU[1].svg Malicious: Reputation: low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\RJA1VPRK.htm Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe HTML document, UTF-8 Unicode text, with very long lines 8D773CC343552E3377EE B473 F4C0BC316B CA5724B86510D5ADA89B F91319B8EC1B47CE15762ED7DBFE974748ABC0E8FBFC040187F5D812 F542AD6DE767AFEC8C71F F037F6A B8CB0760AE00B94E5F571D650C DA66DAA93B8 7C23B8A6343E703D686E6B05106CF9FFC3FC8 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\S120x120[1].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): 3884 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: B34EE6978E42BF CCB3C13424 A99CB3780C4FCCBD3772B9A607EA6CC4D65EC5D8 77BE81176E0974F545F684B4569C3901C4337E14DB15A031D0303E15DAEEC679 A E03F6E0F2D2BFA80FEC8E76ACD0704D7FE9962F9ACE52A547AF958366BCAF2BAB388BF30FFAB8EE85 CAFE0DCFB25BAB2942C3B65C68E31E94F128C44 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\TUYqSq5R7b0_GJSp0iAEpkp1HNU[1].jpg Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: JPEG image data, JFIF standard 1.01 Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 1CBA6C B5CBFD04F9F7538F041 4D462A4AAE51EDBD3F1894A9D22004A64A751CD5 B60EA53D9E4226D2E643CA833E9C9A0DC3529E1037BA0EAD5F015BB39FF5944C 7A844B5EBF4C954559F0A3DF50C96E00500B028B8F21DDD3D8B26EB93C585D9AA96EF1AF4CD8982D D2 3692F8F0FB2EA661B8EA648D5A0DAF5B39FF1C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\VbfmkqrM1YeBY4l1cWwNaiKtAuc[1].png Process: File Type: Size (bytes): 133 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 14 x 14, 8-bit gray+alpha, non-interlaced 79D9A6950E63A02ECD7D99CF7E25AC73 55B7E692AACCD C0D6A22AD02E7 6EB1791A3D8DACD8F19F52130C4781AD6360D015E8CA90CAB42970DD48C5CCEF 46802CCACF1A74B11092DAC A5D60EF571166E D7BB4A2FBE1EDA74BA48944FDBD84AA D0FA15850A2B5357DCC85204D9C22B20D6D8D0 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\XvlxO4ojcc7AAPo_1Z0bi1e_S4[1].js Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: UTF-8 Unicode text, with very long lines Size (bytes): Entropy (8bit): Encrypted: MD5: 4F3D BE3186AB7E87109F Copyright Joe Security LLC 2018 Page 22 of 299

23 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\XvlxO4ojcc7AAPo_1Z0bi1e_S4[1].js SHA1: SHA-256: SHA-512: Malicious: Reputation: F97BE5C4EE288DC73B0003E8FF56746E2D5EFD2E F9CD90FCD45CF0BB1F8603B5FFC6E57C519AC49A669712B0B12CC4870BFAA F ABEEF72A05F3C4B33858BAA6F2863D B4CA84FA4A4DE42AB4F4D9B7F2E BA438 9D0B088A7EEA31BD99B771DD E0D9 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\_[1].gif Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: GIF image data, version 89a, 1 x 1 Size (bytes): 43 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: EA05EC BF2413A6192A245D D36405C92765ACC00A3F0B73C F439D2F 7E928161CD626935D39FF08188CAA3F3A918811CA DEDF28B697CE6FD 19F4A1311D2346A335DC2BE4B014BEA2B2E2EBCF8A243B4735E45FBB26628C4D9AA11EFD3122BAC7AA846D1F9 90E8D EA5A402712A7AB63DF8022A012C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\_[2].gif Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: GIF image data, version 89a, 1 x 1 Size (bytes): 43 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: EA05EC BF2413A6192A245D D36405C92765ACC00A3F0B73C F439D2F 7E928161CD626935D39FF08188CAA3F3A918811CA DEDF28B697CE6FD 19F4A1311D2346A335DC2BE4B014BEA2B2E2EBCF8A243B4735E45FBB26628C4D9AA11EFD3122BAC7AA846D1F9 90E8D EA5A402712A7AB63DF8022A012C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\_[3].gif Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: GIF image data, version 89a, 1 x 1 Size (bytes): 43 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: EA05EC BF2413A6192A245D D36405C92765ACC00A3F0B73C F439D2F 7E928161CD626935D39FF08188CAA3F3A918811CA DEDF28B697CE6FD 19F4A1311D2346A335DC2BE4B014BEA2B2E2EBCF8A243B4735E45FBB26628C4D9AA11EFD3122BAC7AA846D1F9 90E8D EA5A402712A7AB63DF8022A012C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\_[4].gif Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: GIF image data, version 89a, 1 x 1 Size (bytes): 43 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: EA05EC BF2413A6192A245D D36405C92765ACC00A3F0B73C F439D2F 7E928161CD626935D39FF08188CAA3F3A918811CA DEDF28B697CE6FD 19F4A1311D2346A335DC2BE4B014BEA2B2E2EBCF8A243B4735E45FBB26628C4D9AA11EFD3122BAC7AA846D1F9 90E8D EA5A402712A7AB63DF8022A012C low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\data[1].json Process: C:\Program Files\Internet Explorer\iexplore.exe File Type: ASCII text, with very long lines, with no line terminators Copyright Joe Security LLC 2018 Page 23 of 299

24 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\data[1].json Size (bytes): 1006 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 51AEA261DC06984B7B4B1D2DDCCC1FA4 E6F7FD26E CE5B0C54BF707E20CDD 3F5D697193E11D40DD9523CD5B054F3544B3613EE2183A5940CC547964D2A C5565EE5E72C6BE3D62DEF4F2D574FF676DDA8F4ECBC16982AFE5749D31D64F316960DA84FADCA1D4E175D F89A0D9126EC10188BE56D17C1CAD5A2FE691B7 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\disk[1].png Process: File Type: Size (bytes): 5840 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 227 x 150, 8-bit/color RGBA, non-interlaced 17BD949656A0793DCB5ABE2244E60AAE EFAC76FDBB9CFD888ACD1B79B3F157F06 0D6B F16963B089DA897C41FD3BC47956CC4C7A94434E2469B49DE1D7A 1A9DDCAC33BA611C6B55AB9D8925E944F97EFAF52CF15F93AE46F EA2978CF930ABBA E298577E 6DA9B6535F3A017C0BD52B1C3D0CA7FE7D5074 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\dk[1].js Process: File Type: Size (bytes): 35 C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with no line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: 93164B690319BB82C5ED9158B01751D8 7BBB3F3860FA4038B63A3BFB16B9936E0F2486E9 8BAF8B56EC2E3534C5BB540A86DEB07FC824589AF01AE515E6A C2157F 382CD3D71F01F4FD CC89BFA5D896DEFD0EB4EF7E91E9BBF3BD05744B95E31246D5746AA78A7B798570A E34FA951D93C698FF136DB04535DC766D2A82E low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\export[1].json Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe UTF-8 Unicode text, with very long lines, with no line terminators 0CA E5D555992BA375B91FD3 586F20B3D252B471664C0C18A AD7B4F CB2223AD32E E9E36E65DE4BF1E8E1F37AB A414D2A26C F5AB4530AEEC24A3643B392F A6A543BEC459E8FC778C6553B34EB0C4D C9E9FD2A061B9DC 55B3290B26C6A86AB670BECDA70FD2C4E0B612 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\hsqxNmQW0uad0LRpR2aAF19Lyrs[1].svg Process: File Type: Size (bytes): 606 C:\Program Files\Internet Explorer\iexplore.exe SVG Scalable Vector Graphics image Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: AB19BCE2C6DA5998B3EBD0D8BE474E0F 86CAB D2E69DD0B F4BCABB 8BB20B1A9F6A476516D31DD47CFEBAC901BF86C528C18B8D1500C1B6B AE0B112CD98A0F74933F4B36312C00881CE39EC951FCCABA5119DACDB20F06DAB668F6B529EAF28A9FBE94 5DD5D867CFAF9954CDC118A0E830B1747FE351D low Copyright Joe Security LLC 2018 Page 24 of 299

25 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\jquery.min[1].js Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe ASCII text, with very long lines, with CRLF line terminators E E4728F98923C79B034B67 8B6BABFF47B8A9793F37036FD1B1A3AD41D38423 BA6EDA7945AB8D7E57B34CC5A3DD292FA2E4C60A5CED79236ECF1A9E0F0C2D32 BF28A9A446E50639A9592D7651F89511FC4E583E213F20A0DFF3A44E1A7D73CEEFDB6597DB121C7742BDE92410 A27D83D92E2E A19803E72A168E5656 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\loader[1].js Process: File Type: Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe UTF-8 Unicode text, with very long lines 3EC332EBB421FBD CB148AA 2A482E40D503B424A3B47BB6656DD312CCFA9E29 B7B727BCA4EE35A FE00F2FE9E52886D E9E9A06FF6DD7617B7 CC60AF565965DEAA9CC632533D E676DCE3A46FAE77AE51D7C795E4D465F9F652A6386ABD5144F384E2 9158E476821DE1FB97BD01E1CAFDFAC low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\logo-square[1].png Process: File Type: Size (bytes): 1206 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 40 x 40, 8-bit gray+alpha, non-interlaced ABBB2964C0AA5F2FF830C9AEF A4F90F092EC2B7DD26FF980DE60F D7 DA25A95DC869832B564BA8F636D61F9D2E06EFEBE319A6FA4D35E3CE23BD3EF3 28B13F3AAC8D C4CB126BE239253C130A8D681828D5F3D47835E2CB6926B4E6D43653DA4614EF8B3B B0369E52525E D0A3C4C3CFAD low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\logo-square[2].png Process: File Type: Size (bytes): 1975 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 40 x 40, 8-bit colormap, non-interlaced C F22C2D88B4CBB946C 9DF6A080C1F AE6863FB435C04BCF66954 AEE1F EC0D23AC1E777B1CDD4634C3726E6F7DF282F87EFBF43D70F6A9 C9C5ACC475AFC B636F320C74B4732B50485E28F80FEF7CBBFB2C3337FBFEB9C2940B0FA634861E12BC9 2B6FAD F0FD5BAE C5C02 low C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\logo-square[3].png Process: File Type: Size (bytes): 740 Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: C:\Program Files\Internet Explorer\iexplore.exe PNG image data, 40 x 40, 8-bit colormap, non-interlaced 1505CD5D6EDE4FB6808BDA65D544C06E EB2A3BA26E0C99746D013719DF3E2C0715EA4BCF BA488E24F8BC946775E8E8C6B69AA33502E108C185D5C9B5EB8FAB64BE059D06 57E0FC8C6F2009E A5B1FE73AAF5D6A9D05435DD515B78B726A5ADC8AF77C44DEBC83AC36E016D26 EFF8D5696FC25C4482AE96D85C8F90C9677EE7D Copyright Joe Security LLC 2018 Page 25 of 299

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version:

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: ID: 45097 Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature