ID: Cookbook: browseurl.jbs Time: 21:43:32 Date: 28/11/2018 Version: Fire Opal

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 21:43:32 Date: 28/11/2018 Version: Fire Opal"

Tamsin Hampton
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 21:43:32 Date: 28/11/2018 Version: Fire Opal

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Mitre Att&ck Matrix Signature Overview Phishing: Networking: System Summary: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Thumbnails Startup Created / dropped Files Domains and IPs Contacted Domains URLs from Memory and Binaries Contacted IPs Public Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Statistics Copyright Joe Security LLC 2018 Page 2 of 142

3 Behavior System Behavior Analysis iexplore.exe PID: 5184 Parent PID: 688 General File Activities Registry Activities Analysis iexplore.exe PID: 2908 Parent PID: 5184 General File Activities Registry Activities Analysis iexplore.exe PID: 4540 Parent PID: 5184 General File Activities Registry Activities Disassembly Copyright Joe Security LLC 2018 Page 3 of 142

4 Overview General Information Joe Sandbox Version: Analysis ID: Fire Opal Start date: Start time: 21:43:32 Joe Sandbox Product: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: CloudBasic 0h 5m 30s light browseurl.jbs Analysis Report Analysis system description: Windows bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java Number of analysed new started processes analysed: 9 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: Cookbook Comments: Timeout CLEAN EGA enabled clean1.win@5/442@26/21 Adjust boot time Browsing link: country=ch&lang=en Browsing link: Browsing link: Browsing link: Browsing link: Browsing link: Browsing link: Browsing link: Browsing link: Browsing link: Browsing link: Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, ieutil.exe, conhost.exe, CompatTelRunner.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtWriteFile calls found. Copyright Joe Security LLC 2018 Page 4 of 142

5 Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold true Classification Copyright Joe Security LLC 2018 Page 5 of 142

Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan /

command line switches require additional characters like: "-", "/", "--") Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its

Management Winlogon Helper DLL Port Monitors File System Logical Offsets Replication Through Removable Media Service Execution Port Monitors Accessibility

Discovery Application Deployment Software Network Sniffing Application Window Discovery Remote Services Data from Removable Media Command and Control

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Mitre Att&ck Matrix Initial Access Execution Persistence Privilege Escalation Valid Accounts Windows Remote Management Winlogon Helper DLL Port Monitors File System Logical Offsets Replication Through Removable Media Service Execution Port Monitors Accessibility Features Copyright Joe Security LLC 2018 Defense Evasion Binary Padding Credential Access Discovery Lateral Movement Credential Dumping System Service Discovery Application Deployment Software Network Sniffing Application Window Discovery Remote Services Data from Removable Media Command and Control Collection Exfiltration Data from Local System Data Encrypted 1 Standard NonApplication Layer Protocol 3 Exfiltration Over Other Network Medium Standard Application Layer Protocol 3 Page 6 of 142

7 Signature Overview Phishing Networking System Summary Click to jump to signature section Phishing: Found iframes HTML title does not match URL META copyright tag missing Networking: Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Classification label Creates files inside the user directory Creates temporary files Reads ini files Sample might require command line arguments (.Net) Spawns processes Tries to open an application configuration file (.cfg) Found graphical window changes (likely an installer) Uses new MSVCR Dlls Behavior Graph Copyright Joe Security LLC 2018 Page 7 of 142

Behavior Graph ID: 94091 URL: https://tvaction.info/chuyen-muc/bratislava-slovakia-chri... Startdate: 28/11/2018 Architecture: WINDOWS Score: 1 started iexplore.

8 Behavior Graph ID: URL: Startdate: 28/11/2018 Architecture: WINDOWS Score: 1 started iexplore.exe Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Java started started.net C# or VB.NET C, C++ or other language Is malicious iexplore.exe iexplore.exe rsc.cdn77.org cdn.onesignal.com dailytrendsonline.net horny-honey.online , 443, 50139, SUPERNETWORKSK-ASSK , 443, 50161, GOOGLE-GoogleIncUS 27 other IPs or domains , 443, 50173, CLOUDFLARENET-CloudFlareIncUS , 50169, 50170, 80 CLOUDFLARENET-CloudFlareIncUS , 443, 50171, AMAZON-02-AmazoncomIncUS Czech Republic United States United States United States United States Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Detection Scanner Label Link 0% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link rsc.cdn77.org 0% virustotal Browse n.ads3-adnow.com 0% virustotal Browse n.ads2-adnow.com 0% virustotal Browse Copyright Joe Security LLC 2018 Page 8 of 142

9 Detection Scanner Label Link tvaction.info 0% virustotal Browse sync.users-api.com 2% virustotal Browse log.user-red.com 0% virustotal Browse xl-trk.com 0% virustotal Browse n.ads1-adnow.com 0% virustotal Browse n.gftnk.com 0% virustotal Browse dailytrendsonline.net 0% virustotal Browse tdt2.user-api.com 0% virustotal Browse cdn.user-api.com 0% virustotal Browse st-n.ads3-adnow.com 0% virustotal Browse URLs Detection Scanner Label Link 0% Avira URL Cloud safe 0% Avira URL Cloud safe fasttrac1k.info/?user_id=124&offer_id=4322&s_trk=cgijvqccn3ro0xcl35efcxje_pvfbq 0% Avira URL Cloud safe 0% Avira URL Cloud safe 4AAAAAAAClp4AAAAAAAAESQO42QA&s_trk=CgiHzVN0qhOSRRDxuv8zGKD8-98F&subacc2=T 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 4AAAAAAAClp4AAAAAAAAESQO42QA&s_trk=CgijvqCcn3rO0xDxuv8zGMT8-98F&subacc2=T 4AAAAAAAClp4AAAAAAAAESQO42QA&s_trk=CghdaIBThkycMBDRipLBBxjI_PvfBQ 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe AAAAAAAE50kBAAAAAAAAAAQUQFkPAAAA&s_trk=Cggd6OrNuxOOvxCjp7mBBhjE_PvfBQ 0% Avira URL Cloud safe 0% virustotal Browse 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe fasttrac1k.info/?user_id=124&offer_id=4322&s_trk=cggfp52n-fzmobdq_qvkbhjk_pvfbq 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe lxdu0_enbhjm_pvfbq 0% Avira URL Cloud safe 0% Avira URL Cloud safe % Avira URL Cloud safe 0% Avira URL Cloud safe Copyright Joe Security LLC 2018 Page 9 of 142

10 Detection Scanner Label Link 0% Avira URL Cloud safe 9IrA.ht 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe % Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe 0% Avira URL Cloud safe fasttrac1k.info/?user_id=124&offer_id=4322&s_trk=cggfp52n-fzmobdrypx7chjk_pvfbq 0% Avira URL Cloud safe Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Copyright Joe Security LLC 2018 Page 10 of 142

11 Domains No context ASN No context Dropped Files No context Screenshots Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow. Copyright Joe Security LLC 2018 Page 11 of 142

$Startup System is w10x64 iexplore.exe (PID: 5184 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding 6465CB92B25A7BC1DF8E01D8AC5E7596) iexplore.$

12 Startup System is w10x64 iexplore.exe (PID: 5184 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding 6465CB92B25A7BC1DF8E01D8AC5E7596) iexplore.exe (PID: 2908 cmdline: 'C:\Program Files (x86)\internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:17410 /prefetch: CC2E3DF41EEEA8013E2AB58D5A) iexplore.exe (PID: 4540 cmdline: 'C:\Program Files (x86)\internet Explorer\IEXPLORE.EXE' SCODEF:5184 CREDAT:82948 /prefetch: CC2E3DF41EEEA8013E2AB58D5A) cleanup Created / dropped Files C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\9K719AIK\horny-honey[1].xml File Type: Size (bytes): 13 ASCII text, with no line terminators Entropy (8bit): C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 35E3224FCBD3E1AF306F2B6A2C6BBEA9B B71E4D B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB 6BE8CEC7C862AFAE5B37AA32DC5BB A DA41BF808A4EF92C318B355E616BF45A257B995520D72 B7C08752C0BE445DCEADE5CF79F FED Copyright Joe Security LLC 2018 Page 12 of 142

13 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\9K719AIK\horny-honey[1].xml C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\D1YBPPLZ\tvaction[1].xml File Type: Size (bytes): 13 ASCII text, with no line terminators Entropy (8bit): C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 35E3224FCBD3E1AF306F2B6A2C6BBEA9B B71E4D B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB 6BE8CEC7C862AFAE5B37AA32DC5BB A DA41BF808A4EF92C318B355E616BF45A257B995520D72 B7C08752C0BE445DCEADE5CF79F FED C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CA73D563-F399-11E8-AAD8-C25F135D3C65}.dat File Type: Size (bytes): C:\Program Files\internet explorer\iexplore.exe Microsoft Word Document Entropy (8bit): A14E8758EDB66CBAB781938CEB1DB 1D86B68F65AB1A1682C1755D24B2D59C54215F0F 51BDBCD3402D1433B770DB675D78183CD8B5BE89FD1F71341B98C5AA629D4E09 824B833775F62828A8A1F3C5ED4D2228F983274C3BF4C97093BE730156E829D789A43EA2B5B46919A99DB7FE93A D7D1E86BB392B2233CE2D F4558BAF5 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CA73D565-F399-11E8-AAD8-C25F135D3C65}.dat File Type: Size (bytes): C:\Program Files\internet explorer\iexplore.exe Microsoft Word Document Entropy (8bit): CC34A4EF5EFA059FA094A11C8D7E0FB6 C735C9891D0ED3D9156BEEF0DFE59CA94C20117E BEA5B70C3977B0884AA752DC8EC982D9F6CEEF1A4DC238838A EF E62FCB7C FA4AD924CEC7BBA656C75BA51BAE FD349DA7DD60917B734DCF21F1 CAEBAAA52C17D40D0AD2E166E52CF9DD2E11B3 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D1724EA9-F399-11E8-AAD8-C25F135D3C65}.dat File Type: Size (bytes): C:\Program Files\internet explorer\iexplore.exe Microsoft Word Document Entropy (8bit): D116B D6D9391F9A10EA BD6B48D202BFD6ACFBA F9499C66537C9 4D6F0DA69D9218C3BA06AC036BD6F3A71E36C06B79D80B9C580203FCB7FDAC3F 62DDB127CF DB880D6BAD21D37B DF56F534317F9FD0B4A0A1C3A93F1EB2C183D70CA D6B36DB C7DB AA620278F C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F13F18A3-F399-11E8-AAD8-C25F135D3C65}.dat C:\Program Files\internet explorer\iexplore.exe File Type: Microsoft Word Document Size (bytes): Entropy (8bit): EC96DCB2D83B036CA8DE9D08D6FFD6 F559E FC D6400E0BE55E3F85 Copyright Joe Security LLC 2018 Page 13 of 142

14 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F13F18A3-F399-11E8-AAD8-C25F135D3C65}.dat C60C9FEBF0E5F8165AC1F0568B66BBE9818B01B29997E8C4BF4ED3FC10F4B304 40A888A5AD2F908EE74742E5D1D129CCA83052BDDBE1FA2DD4D C055B8DC9CC9B87503BD1B40519DB CE73A07D5EB992C27571DFD A03F915E C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F13F18A4-F399-11E8-AAD8-C25F135D3C65}.dat File Type: Size (bytes): C:\Program Files\internet explorer\iexplore.exe Microsoft Word Document Entropy (8bit): F373DDFA9C3EAE777582EEBBB C2C E81B9A3953F11068A89AC492C DECBD A2BBBA2A24A0285CC9657B8F06B6A6D88944E814EA95501 D8B46D4A627436E244BE22ED36C3B0CCDE33923BBE726ABBC2850FEE943878B2650BF15899FCB74E6E C22BAD4F48119FCA79B2E8BC67EF C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 656 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators 9505B A7491F5B020CBF79F0C 43C29E1EE568ECF8312BA14F9D5C13DA B 0E3233CA0FDF157B7D9E3E3D9A59ACD6C00CFB451CA5F60E42123B3A5F F CBA8ACBBA4DE43672C0E61C39668A37E55D241AAC074F1B2C09DBDA1F2A61DF10B50FE5CE2EF5FA2 5482DD84D5AD1D855C35058F46B105B1D1A825C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 653 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators 0854EFE DF9B47B E1E685FF917CB49F48E7169B12F9C51BEACC B35F76456FE281F6BE54D8827DD252846F029803CA F345C46CA5 571BCC3BE62AE3F08F75B018C6F345B63AD74FB119DD387CFFFFFDAD31AAE0428FB4065A2D1EA9D92CADE19D 3BB888A7D3E0792E676057F8B8C1D42808A1936C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 662 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators 7C44A2DBC BB1FB7E7196B6ED 7101CCD86882B200E61C30A6EA2C2E6B2EB2376E 8144DDF28ECBD431267CE15B7AE309E8694BF249C12B9C0FDA403454DAC92C65 7E6774E6451E99901A37A0EE350DFEB2BAE8994E5DF7FB872F3A87C3D5750BCA8D946DCB6896E51F F86854ADB A8AA4B1190DE5D16AA C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml C:\Program Files\internet explorer\iexplore.exe File Type: XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators Size (bytes): 647 Copyright Joe Security LLC 2018 Page 14 of 142

15 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml Entropy (8bit): CBC96DEFB40BE5332F8EC89456E 174C AFA D8FCF C0714C C2A080C9C2E1DDDB7244B159642CD49E8F93FA3A18A8B7D611D77EE1F B613EB38BF6365A055A00876CD EBF3C76EC4C831A10EE11FAFF2DF6F312BA1F85C199C2F2176BC7D 8190A93ABC8A88DF337DE43760D364E19D27B3 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 656 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators C08135D0DA8F2EA5D7F36FAF898C973A E4BB9505B2041AFC372C884F56EB7B513E14D890 F4633F6D91EC7B12B E1FDBE7CD59B1BE9D241BDBE6F4A D71EA6A545D ED0900F86DB8799EC474C3B60CD1E45CDD004B0A BB648A01D358846D8E4 D9B523489F6934C4F623B4ED26009F C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 653 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators D7A2F8850E21D BA7AB9F481FC 49D3075B1DD CC F5C691F38B9F A24214E0752ADE7CD4B29A268B9C33AE950999DA DC5F3FE380BEAF9 8C12B CD8F4CC120F05F39AF8FB4691A97A2ECF83BCC2CF BB66227F4BD EFEA6E013 B22018BE DFF22D8593CCCAFE680B1C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 656 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators EEF9D29BA54B8F FD9321B C AF86D1694EF244E185F88DAEAA 3968BB406142A5F72EEDF07B5A62FC8F2B6AA010CA52CA F6A7826CCC 66CC9F2D65EA5F4D688DD7741D8DC7D933C31DEFCDFECDAFE1D24AF5EB57EFFD182B0E0CE018E6B9BA5BFFC 0156DC63EC8C9A1AE497DB0FAF1E02BE9D C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 659 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators 9BCDAB06E8B00173C85C97056F8440EF 55604A5D6001ECC9430ADC8DB50AD300388ACA8D 8ED3BCAE2425BAB04636E90FFAFE5C09FB908E5C52587ADC6EDFCC3EEBF1C575 0C255D6A4FF1A3FF8E0252D33933BD8AC237AE1EB13B656E1FC28E9EE56FAFA532E5D5E0FFA2C074ADBA917C BE5E48D858646CA23AA BBC427694D11BE Copyright Joe Security LLC 2018 Page 15 of 142

16 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin \msapplication.xml File Type: Size (bytes): 653 Entropy (8bit): C:\Program Files\internet explorer\iexplore.exe XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators E011849A12F22FD82150B147A348A2A0 D833BA0FED566D7D5DAC486182B2B068472D23A8 2F453B8FAF1E14C1EC4BE9FAFC71838E3B3A09ECE71E9A014D66D282C0243FF6 A1395FE74DF4C466314C23707ECD8ED28AE09C8C28760C6BB4B6C4BCDC80D2D1D5A72B859C586A8F817C546FE D91F658F0ED1DAC3D42D5791E631EB2BDDAF7AF C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\6aw4uvh\imagestore.dat File Type: data Size (bytes): 5752 Entropy (8bit): B8869F2B7B69C6C991C D470A40140C5D069CC692C916721B1F444F507B F77F1D910C181F A19481BE C49C0C95D178C1F98BFA5E72F 524E111F73D9A45FBA15882F4FDC1E15C4DBF8ABE526C23BD3CFB4DD1C3FC00A07D8F9619FD4BC E0D 46B A2DAAA25851F8AFC04CBDE8B36B C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\ [1].js File Type: Size (bytes): ASCII text, with very long lines Entropy (8bit): C785E1E03E7312A9A62D98EB528A2BF 67E9DEB45457D72668ED7E624980A81356CBA225 0BD87D81DC99436D9F05378A8E B422FB56C2A60C9E819D3764F A77C3B473649E1CAB835202A61425C6FAB7B6B46F20A3EF8D5E477974DCCDEDBA05DA492A97DC0CBAB0F94 198E0255D062F CD DA C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\Brsln3[1].jpg File Type: Size (bytes): Entropy (8bit): [TIFF image data, little-endian, direntries=12, height=676, bps=158, PhotometricIntepretation=RGB, orientation=upper-lef t, width=1600], baseline, precision 8, 1600x676, frames 3 FDC42DCC83F401A80FA99DEEDBEAB3F B946D017D12DFFA262BA438D3550DC CDDBF6BEDE694268DE0FD9E177EF399223B55A401587C7FC15EB5BB03E73D3 8D CFE5E457E785B1CCA D9F E02FA57BABC3673C6C78CE7F0A575430F923F9C BB3C23FD90BC406C15652BAEBC3F67A6FBA9 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\Geometria-Bold[1].otf File Type: OpenType font data Size (bytes): Entropy (8bit): B57D0B12CF26A49709AAFC7B4C8FC8 2562C2F85A6DB12CD4F14675CD04AB9BCDCB9179 CFDAB2FBD9DF03ACD45C4F37B62466FB4AC63D0FC43C0AD94AF12C7FF0E0C611 Copyright Joe Security LLC 2018 Page 16 of 142

17 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\Geometria-Bold[1].otf DBF6375C450AD771CC554BE40593DE14A9DDBA5DEBF9B42F94E8985F03C35B0BAA1017BAFE24A CBDF 1588F3210C55153CB0C23F8B3178DB243B082FF C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\Geometria-Light[1].otf File Type: Size (bytes): OpenType font data Entropy (8bit): AE854C3DFF2E4D95ED819F06B28052C8 32D3A100549BC697193DBCCF1D080B6635CC7E52 7A52E59F0F25C E74CC EBD7B53E20FBFEF50C310E733E FC0BFD4DE29F98FFA4BB3A620A5D821BCDFCEC227DD1D61832D1BD447B5E186AF BF4B0A59D2F8D8F5 04E7DD65F869177B2D81AE59F8219F9B3156BA8 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\Geometria-Thin[1].otf File Type: Size (bytes): OpenType font data Entropy (8bit): AC1A925DA6FAA2D2D947A0EE8BC1EF82 27EA51C08EC581CB3ECEEAE5F8CDE39488E0480B 771C9F4A3D55DE8441B5C6BC82277FB1F1AFB5FB6192B2A3600EDA4E0F152DDE 50DB6E840705FC2A8AD4D4B18CB5BEA1A1CAE92FDBA4A2F4F6D05F4D726C878EBA25A125912BF6AFC0CA9278 4C95D79E7E248114C925D1E55D127F4300ED8CC7 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\HMXGJIA6.htm File Type: Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines E8F241B367F1809D112AC6EBF7 3222BA1FF5DEF81D357495A E45561C D63BE5EDCE8EA81015E3BF335A1508F9F8BC8C326A17158B0389EF6D D4DCE521C8798ACDB1AF081336AA4281FEF8EC8B3600C216A9A B21F9532A2E365B8BB11B359112A9C ABF02D24FE485CD3F4B878FD549EB41CD5A758 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\OneSignalSDK[1].js File Type: Size (bytes): UTF-8 Unicode text, with very long lines Entropy (8bit): E406F8F7734C1D9A4FB82F9C46A447BB 82C2047AC5C1FCE2CF1C1816EC8850DE6489E3DF 3794CA6FE44805DB3193B46404F3C610668F7FA4E3388FDD6B553459F34F D5CFE A1D D0187AD70D38171CCD037F59DFC051BD5088D7D041C9EB012CB C7F4CD3 3EC9A5E9CB60E21836B01E3117E6C566850E7 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\a[1].js File Type: UTF-8 Unicode text, with very long lines Size (bytes): 8477 Entropy (8bit): Copyright Joe Security LLC 2018 Page 17 of 142

18 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\a[1].js 156DCC53AA5E29CDC16FFA05CB030FDC 6C824FA AA225792C729870F128E204 C60C0760B70FF2F35C94B8D6330B4E BAA3D62B93C69FB3C7CDC8ECA6A 1C6CB39112BE55F6E1BAFDDAF CBC9AAF4F92FDFC07B495AFE3AD60AD9D9483B6E4F26F20BD6C4 A877B0326E724930CD23C023A8A6AD5A5B0D8744 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\a[2].js File Type: Size (bytes): 8486 UTF-8 Unicode text, with very long lines Entropy (8bit): C6BBD173C83760A3F B805 7BE0AE87D9074D39D7A1C81292B21C20FAA24EF9 3C4F2D0F62FC7260A64EA8AF280128BAF8CA5C9FB82971B8C005E851ED272B12 E9189D7B0964EF8B799686A BCE3EE2B73A89A545E31980C6E60D997961D9372CD4E38F1E0296A0BE065E 0F0BAF3E0B850994CC868AC34C36D384A8BF2 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\a[3].js File Type: Size (bytes): 8518 UTF-8 Unicode text, with very long lines Entropy (8bit): FB339BC334D12FAF32D270EFC97EDCAD E73C854BCBE1C6786B4D95F2A837EEEE2949B26C 2DBE36446EAE302C6522A954BF564736F9221CC EE A6CD3331E DD92F7AAD69D5B08BA7EDE0BE368B6792F42C2F7B9DFDC218CFD59574DB782EF494ADF6296E7B968D145E48A2 587B3603F11EB9E47663AC0A747A44E2B511C1B C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\a[4].js File Type: Size (bytes): 6696 UTF-8 Unicode text, with very long lines Entropy (8bit): D3247F586A172F393CAF359A007A86D 27F4CE32B0A83D99389CF3B0B1F4E44E5FC D5FFACDF4AA18994DF94369CFB08A87FB1AC25271F80986E3FF09A4FEB2E7AF B8254FDBA5ED80E87E9880AAD49326EB9DA124DA71D82DC701983FE2DF1B634BD8D94AC91F68790BE A 30A070A9A27F703289B8D7ECA3799C1FF77521 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\adnow-mini-v2[1].png File Type: Size (bytes): 1590 Entropy (8bit): PNG image data, 127 x 14, 8-bit/color RGBA, non-interlaced 8097FCBC90702C16DEB9C7AB9FA A75C4342D55F826D6E714F639E90072D9E6B 59B5E3F2EE98460D0D815072C15C6683F9614E7EBAA614DC104F2AB03FF41B7C 2AEE0BD30CB487A73035E32CF5341A9F2FF181615CC7823B576894ED30D117B04CD1AAC5D1A1FF221D86AA2329 E1356B07C1658CC77AA4D57AF A43BDD Copyright Joe Security LLC 2018 Page 18 of 142

19 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\adnow-v2[1].png File Type: Size (bytes): 2263 Entropy (8bit): PNG image data, 77 x 55, 8-bit/color RGBA, non-interlaced B475B193CEF8FC2D6643A9F9D661A9C E429D1507CB65E5BB6A70D45A7194EF2D B713D400C06DEC06177E59622EBFA6AE56091C024EA C53569B290250B E2E9CCC322A54B561BBF3D9D1CA42484FBF2BE099DB908872C664A304C71300F5D5C0DC11772E550FE84 E81A866175DBE0CAA950B319C18C3DCFEC38CE C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\adnow[1].css File Type: Size (bytes): assembler source, UTF-8 Unicode text Entropy (8bit): CD24DCDB25855C09E13C620886CD2E DB64A AB1B A220CD3D8586BA E7C2F311375EE6C975DCD7E AFB1515A976A908A8217BBFB5EB FD2E3D1A96DC7C619B118296E44BCB5EF4733E705B4ACF6CCD C4EF02B18718FAD0B41F8FA000C42E9 CE12F935F02D72908B8A86F5D4DDE16ECA30BF1 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\antiadblock_news[1].jpg File Type: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1600x676, frames 3 Size (bytes): Entropy (8bit): BF144526FD718BE75DEA745747CFE 0926CEA51D1933C63BC8EE0FCDDA6E910C FCE672E AE8A418E70FB00416CFF2E E548F292C04B17 085C1D453C85C129718B4A2BAC34690B9E777437F316ABFD7FC21B5617CCE1FC0CEB67AED0857A2FF7F C93338D E B75F56B3F431 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\baby-dolls-and-dog[1].htm File Type: data Size (bytes): Entropy (8bit): C8D3129E0A16A0749D3F FD6E C50EB0AFC15764C7B00B92705E4A 49BA271A7B0F15476FDBD954F5EDA670C1D412C6B07F9E63C672BDEB2927E202 5C3A805A23243D13B9C233FE79C21DEF89430D4DA73636D672A15055F0CCAB5EDAAB FAFB FA8 5A7CD4EDFC2CD5F905A6E051D0401F4985C941 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\bg-1[1].jpg File Type: Size (bytes): Entropy (8bit): [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, s oftware=adobe Photoshop CS3 Windows, datetime=2016:02:18 05:26:37], progressive, precision 8, 1600x631, frames 3 68C1961D4DD7D9E68399D9C091D684A4 7F76DB365D046AECA0F2CDE5063BC3F97FD11ECE AE47907AB0FBDACE48C4665D29837C0FEABB11CE1419C3B74E24D59A821EA257 Copyright Joe Security LLC 2018 Page 19 of 142

20 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\bg-1[1].jpg DF8A787D809A65BB4478CBC0DF9FB98B921780FE76E9ED6F83B529BE9DEEEACC3A825033F4732A75A7D BDBD408870BCC9F434F23F80BC003D08F6B89BC C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\bg cd565019c850e43da966f69[1].png File Type: Size (bytes): 105 Entropy (8bit): PNG image data, 4 x 4, 1-bit colormap, non-interlaced 8B19853D67EB694FC3F7332E627187C0 408A F18E8579A5BD05B23839B97CB2BC1 BE631C466EC3F131E95DFA94BEC084ABF67264BA5B1210B589AF44B4387F784E 46570F7B647E E190006D82A519DC8320E519BDD963788A9603A409F78AEA9E771BEE38996BA9D440D971A 98C9D3282FFDFF78A1D15049AF3FDDD6B93C C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\bootstrap.min[1].css File Type: Size (bytes): ASCII text, with very long lines Entropy (8bit): FFE54E0B3F14E4649F3E68DC62D2 ED D1E5B199DA727AC6EB846848AD191F 8ED ADC6163E6A3EAC19BF3BA7FCEBFE7A6060E01D4A14D58B0CC9C70C 03EE9179B9DEACDA438F6FBC2449C C4A8DC4023BDEDDE7E5E73A6809BD8881A0D7212DFA3F85818C8 F3802E407B96A7100C49731DCD FB97 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\bootstrap.min[2].css File Type: Size (bytes): ASCII text, with very long lines Entropy (8bit): E09B9D916BFCC675EEDDA912FF91C8 B10DD888B2AD7E7955BF97778B152B90B639D4B3 2F8F331FB60122FD4C479BA04CF E13D6DF049E088AFC173CC9D07AA7C 9ABA4F71BDFE88B041C638C53F71E1B03E02DD5E4C0F639397DD9D173E ABE116A584E8A8F5A36F CF7E5555B349272CC0B2B232C07F07CBB465FF C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\bratislava-slovakia-christmas-market[1].htm File Type: data Size (bytes): Entropy (8bit): FA9E2A36142D56DE4D161FFCC62FCE9A D420812E986613F748511BE9068D96AC5B AE C27A40EA75DC34F6CC24B911E11D53BC5F41A E CDFC11DD85C460FC39510AB512FFABC74D A5D0C62AB9384AC541F972E0958FCCBEB C07A34DB8495BCC2247A98981EAA9727A03A83 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\btn-bg-violet-light[1].png File Type: PNG image data, 287 x 39, 8-bit/color RGBA, non-interlaced Size (bytes): 3476 Entropy (8bit): Copyright Joe Security LLC 2018 Page 20 of 142

21 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\btn-bg-violet-light[1].png F3981F99F005FF5C72A818AB1ADE93B7 E338DADABFB8E7F2DBB817F4182AC38724AA EED16F8F2B9C3FFA018D0F518F9DB5C3B768530A6567DFBEF77A0E69872E 5BD1AF14BBDBA4E920EA017CB0845CE7D CA01D9AAF59BC7A912B9A91FC029BDDB36BD486F4271AB EDBFDA0A60EB2FFDDF2BE2D4A D21 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\btn-black-left[1].png File Type: Size (bytes): 3115 Entropy (8bit): PNG image data, 50 x 39, 8-bit/color RGBA, non-interlaced B41E23D5331EC292F0FB D00 5FAA5CA17F89F5A57A9E201F0561E6E0DA31E047 9E8E278CBC881577AF470E64CDC214719EFD9141E94457FF1916DB98C37DB6BF 2BCE1C4AA5FB6C343AA76512A777678D79F8D6C49AA082963A8C774A2CD1CA3275A0201B61912B46952F424DCF 008EE2CD0CA182DE87E5E0271CCEBBCB0525C1 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\btn-black-right[1].png File Type: Size (bytes): 3092 Entropy (8bit): PNG image data, 50 x 39, 8-bit/color RGBA, non-interlaced 0C1095B54DCC753F33CE751CF2DF1736 4CAD7B28C2C6F08AFBEEC62A7E0A75E80232E0B4 14EFD795F6A1CB5C02549A704FE77BDE19F88D186E536DE37B04FA7A6C EDF5B76E96B7253B10354BE0BFCE160A12619CE3B481A68DF147A0939E80393E5CDAA41D24E3151A8595AAF 5797BE1BE22F556217E826D368A8B B7 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\contact[1].htm File Type: Size (bytes): Entropy (8bit): HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators 449F9D0A9548DBB3A936BBB6871A8033 8B6F2A75136F8A16A85166CA99B22ED7BF16E A9F4722EAA152F8E5C0C7A680E03A2B0C59F89C64A12E7EFF39D55A4 A056D11DC880C392432F77CF31C1F713F28DEF51E42EAEABE4F9B727B29CBBD896EAA B91353A5DF9A2 A5B85B3907A EF8EE5CFFFA C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\dvert-1[1].png File Type: Size (bytes): Entropy (8bit): PNG image data, 220 x 387, 8-bit/color RGBA, non-interlaced 23F18F5EB7F09FEEAB3A C92 B8F283F6847CF211B32BC85BAB0AFEF07F7E3A3F B643944A758563F13107E403C1122B94A787EA2C40C4F415B73BC2A5585CC3AB F887EAAE21B6E CE025E58D65FB907851B97509B85E430B2BA21C69D2C AE3FE00DABDC6CDF3 96F7271CF97FBA3B7AA3B4D85CD31B6D4B750A Copyright Joe Security LLC 2018 Page 21 of 142

22 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\dvert-2[1].png File Type: Size (bytes): Entropy (8bit): PNG image data, 751 x 443, 8-bit/color RGBA, non-interlaced true 2B7D6DEF A916AE099C41D4AD 14EF21C1D6AAF B7B0C98436CDFFF6F29 900D8E8979DFF8BC2E61778ED F4D5DF0C649E340A16938DB9D7D E88EC97BDE2EBB303449B895D4D790B3C858B1A55E13A00308CA1866B32DA6F15BAB37B4DDB D54536 BFC6EAA81595A2C275816D5A73698EF4CFB7AD C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\e[1].js File Type: Size (bytes): 64 ASCII text, with no line terminators Entropy (8bit): A140CD32A3548EC97C3FD32E9D1AC51E F D2F2862B59B865A8D9EF61B9C473B F66A0ACD36CC4D007A9954DBD6741EF F2E72E24BF BB3D14 E53D9AE83DE287D312B3B606E42C30CFCC41E8C3DC73DCFCA08815F71806F8938AEA47FD8B77148DDB0500B43 4B695880E7E3CCD D54D8F15BA52C129E C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\epayments[1].jpg File Type: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1600x676, frames 3 Size (bytes): Entropy (8bit): DE24D3D17A F527D52067D4F0B D5BBFD14D85CA4779AC6779C3E980F97926DC30E C1C9DE312B9FBBDC4AAB85887BE7A287FEE D1CFA2AEE5A329AE6C08AE 7AA C3A799B92D58FACE4C619F2D20ACDFBD850B5B77930E3F3DA03B4E E8BBD517D104F41 AC45AFEB7C9ED16AA9ED061796C975D08012DC C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\fbevents[1].js File Type: Size (bytes): ASCII text, with very long lines Entropy (8bit): F03E4B9A7E514CDB436346B B8D907259ED5263F8BAF3F43733D A029 9DC88E47157F6FF1B7BE134D51CBACC7638CBA2E7455B0AC0D1186E50191BCD9 E02DC939E53D5446F132543C4783F7F0B6E96E728A502408A89E23BFE6D510BE6C3EB7E4EE0BB51E9C365478E5 BCA BC82379A8EC8BCCEC77F1C36 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\fontawesome-webfont[1].eot File Type: Size (bytes): Entropy (8bit): Embedded OpenType (EOT), FontAwesome family 32400F4E08932A94D8BFD C EED8DCA049714E43EEEBCB A4BEC76D E219ECE8F4D3E4AC455EF31CD3A7C7B5057EA68A109937FC26B03C6E99EE F19282F19CFC7A40A31C6AF428F100C B46B415556FD9B65D48DA2783DC22B101A6A89D95B05CBCE E625652C87D421A83D40AC7482C2B0B3D86A2 Copyright Joe Security LLC 2018 Page 22 of 142

23 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\fontawesome-webfont[1].eot C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\grid[1].png File Type: Size (bytes): 3338 Entropy (8bit): PNG image data, 243 x 237, 8-bit/color RGBA, non-interlaced E49F5D8E32E1286D87794C426CF4E35C 79CF900A76851C3FEC2F0BD153F BD5B894C20B29B43C0D1280E8F9CCDEEA84311F942B04D5174AFD4ECAE0E 1DDA92EEF4FEF58E774C75F5F1B74D9572D FD1D85F9CC853B1DFE811FBBD3DC765974EF4986CE7C9A 02F908609BF044A6B4360ABBFBF32373C7C0F9 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\home[1].png File Type: Size (bytes): Entropy (8bit): PNG image data, 983 x 590, 8-bit/color RGBA, non-interlaced true 5E6D BDB960D645B5A7ADA9381 3A16C4F47D1421E940F1EB614AF1BB38C046E7B7 52B71EC189DEA6D133F5F40030DCFBBF72DA6A1F55BA9EC83F113954D9277A B1A0FBBBA6D67FB5A656BECB8BE B62CB796D11B5F94C99FDD152C BBA5D8CA 4E0F194BE63E0DBEC6D64D CA4AD2 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault0N6N309I.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): E2E82BF14E31F729C9852DB5D0E7E7E D6C8EC02E6AB0D E3BDF706C 03FC6FF955E977AF3F937B4EE C6CFB63FFE1F0A6837C8AC208CF0E108 13B0E3DF74D4F9B06B911FB88DAD60B62CCAA72806E6BF3D10F73267D182CE0BC220845F9C8E1AAB7939E5D31 A66F594A2D17C E63BB2270DDC06AB980 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault0QL8D84G.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): B CAC9F17AF546AA7135BBF47D 6C04CDC7865C888FC028D5DC422BDCA5F0CEA0A FB459C5869B67565FA02A1318B666C538BAAC3CB49CC218E2E1A197778F 0B831B9D1234CBEA9735E ED265F16C2FC0C EAABD98AE6C77F35102B4351D9EE3DBE913E0D640 B E06E3127D845B8F85B524B59C01864 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault1NRR3YDT.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 23 of 142

24 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault1NRR3YDT.jpg 325EC3EB59540E648DEB8ACCCCABCAE6 89F97BB4ADDFEAA AD7BD9906C30B0BD4 66AF6A70B76C9D1D75C69BB22E4985C7C3476CA58F6A6809A46C337DAFD3D355 C2B778D7C9BF861ADECCDC983C73A8EA6E21F3CBBBB0289A52298F488E1DB4626F4B6C600EA660AD4F F361218C91A643FDF12EBD632079E67B0FE1E80 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault2J7QKCXK.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): F209D02991EB9DD5E6270D2F83E4D217 AFF7BC485BB43C51E234C3F3AC6FC72D9FE42C82 A5B82542A3A86E83EC2C A5C741854C43651CA7BAB38D0B246B67E41 3E80A C5D8F7C4C7C132FA1640B76D83DF07955DFC9C19034E97486D06D82925D828273A765BD30A5BEFC 9882DDFFE6BF163D1C8978AFFDF628731EAFF C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault3BC9CULY.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): BB9507AF C5EDE2A42661AAE C8CF11C6C8C63A808280C0A323EDD17140F9A23E 0AF7BD8C906D57697F5DD962CA4E02EF68E47A94D719F4084FE4F67CEEBB C1093FC545E23892DB8D7D00B783E6E6D34BA9A01B69BA621B6A0C2468F3819F7F6D859585C5F4DBAB1B47 D2A8D8A2FD8B6AE2D EA1F007 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault3ULGDG1Y.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): D803CE7B47275B2AA486F589411D0DB7 421FE79C30790FE417E71FFE5295DB5C1EC06465 D5F1B CEDEB7497BE5ED5A05223FA1DA899181A73CB3DABE384B C0772DDE63AEA3624D9F4848E9082B021D0BCCF97CAB46208B67BBC7FB4210F136E061DE F0EC DE2A4490A BBFD711F59AD924A1314D C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault43PHV3XN.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): E10D1E3B9D3B756615DEB937B6DD6C 03AF91FF7145E03A6C345DBFA02C6637A1F604BA 3E32039B99AE2964DF609B874A573E045EA98721A46B5DFAE9393DCBC996F C5D2C D268D2AD4C208D37F5FCAABD9C92351E F17AA88648F96A246884F220E21F49094D1 8153FA91BF38AEE2D2F8EFDBE39D76ED156F Copyright Joe Security LLC 2018 Page 24 of 142

25 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault43PHV3XN.jpg C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault5JC12XTZ.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): 6759 Entropy (8bit): E758CA892BFBA453D07A6EDE786B33 F8E8F581CE3189CD437CBBCAE7C15E1CCC09AEED 18575B D81FB0A0DFC1BE106AF6345C521ADC7D176DC7E0C901249F111 DCFB04E0D435CB95E261CC1485C06BDBD8195D6844C B1B089DC23F81D337B7DB8A94AA8EC14CBA8D AA05ED0640C098FE80E2B7A087399B1CE97A7DF C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault5KV1L6JH.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): C0BE9ADE8A89C111A0CD34B ABA10164AC44AF9FD85F0F486C6D2E54CC4C11F5 BD575EBC7E5CECA2E7A1EBED5366C206A7FC4CF943A6DB853E4CFC16798FE56D E4006F72BEB90A41B0D6167F27884F35FE7DEF4165FB729118E9449D888D2BD7B13FDCEBE10E4D4F16CF735A36 92E1E60E9D0F48AC8763F6E7CB473D2F73E896 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault5ZR8NRCF.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): A77A817437E406877B8220 E76D7CB64AE77C4E5672B52381AAC32575FABE2C 8E51A7378B087B28B9F9AE726A063CBC2E76D23AC6B68F23FBB4D9FE5B47D A5EAD87EC92F35D C94D41E0BD4A99CA30FF567C7F4968E38520D049A33197C9E6FAF14264DD1FF 8C547BAD0B1B5C8E291CD3C CEC577 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault8NP4SLJ2.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): FA7874D03EF8DCD EABF98670E 82377A143E5985BB579CE1B79EA815212BD7FDE1 57A36300FFFA492253D3D2B5A531C99DD7541A065AC35E CC D7D6CADBE254993F259903E696F FBE557C966D7672F2A120C48D1DFFD9FD7AF459AFB3C56C7330C 34215E021C411B640058D1E4E8276CC548B32 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault959KGOQV.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Copyright Joe Security LLC 2018 Page 25 of 142

26 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault959KGOQV.jpg Entropy (8bit): DD1AD442165EFC33D87B3CEC6C0ECE34 7BC226AEDA2E349D99EE7D666F99DB570C49F198 ACB8479FB31C619FFCE49BD456C45C E2905CDBD59C3C93C0F6AE9A DF1476CB4CB479A73ADE45B3E530D82098EC4C06DA25CD900DBD08501B3CC09D9A204142CCE8AE8CCC957D2E C3988B1BFED39AC3F5A64398F587E0E463DEFDFD C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault9A3GLXWY.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): A11B5F2FADD633FEA843EFA7E69662EE D6C831DC6DF4167E05C5BA4FF64CEA04FE27943D A36FAA1F F95CE69C66B4388DD58CE2063F1FBE B628C59424A7 F3CC2F6FFF37624D8F29C3347AB92F63224B1662BFC7FE966EFD4EB536EFA8F1CEE0DCB3E983FADC5CC1839BD DC0BC4789F E6334ABA18DD41B9F1 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault9QDI9S4D.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): A452DCC5CB3D0E7283B A548F D4CE6BDB19F026D5B93D315988C8C4EAFCB27629 D3D15B22A3F7D1B602190DB09CBF0824E367D163CAD F9F84921C72 8AB48B4DFBB75D67BAA2AB F37826B F2EC7C8A66A9196D80491E710B1DDC59B5C2CC4608A27E EA7EC7A944D663D916AEA89836E9AC559B722F C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefault9TUH5GED.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): F82F5FAD2C29FAAFA51C E 03EDF47D4CA5D3DF85A9A64CB0E35219F AF05CEAE00A6C7D023FC4BFFE63907E41C6DC061602BF6E4ABF0E494F943B DA038992A27196C4EA12B9E4BD0E96090AA02F44841B6CDC743986FFB31ECAB38A4D A3AB9855A410 FBD4DFF0655B766551B461F32B37376E884A9 C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\hqdefaultACMMJSMD.jpg File Type: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 340x190, frames 3 Size (bytes): Entropy (8bit): D53B045F2329BE774F7C2473CCF877 CC727E9E149DF1ABF8C6B4C65DD65CA3FD1F8A EC3A7D98CFD D1A E0326BA7C2BC93D206E79921E DE589F1F177306A63E0D80F120730BD64D2C1BBC8E630DF43AC2A3AA5D EED9076A6C323E0C23039E D500F2FC168DFB DEACA Copyright Joe Security LLC 2018 Page 26 of 142

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version:

ID: Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: ID: 45097 Cookbook: browseurl.jbs Time: 16:09:48 Date: 05/02/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature