ID: Cookbook: browseurl.jbs Time: 02:09:04 Date: 29/06/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 02:09:04 Date: 29/06/2018 Version:"

Hillary Ellis
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 02:09:04 Date: 29/06/2018 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Classification Analysis Advice Signature Overview Networking: System Summary: Behavior Graph Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted URLs Contacted IPs Public Static File Info No static file info Network Behavior Network Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets System Behavior Analysis Process: exo-helper-1 PID: Parent PID: File Activities File Read Directory Created Analysis Process: exo-helper-1 PID: Parent PID: Analysis Process: sensible-browser PID: Parent PID: File Activities Copyright Joe Security LLC 2018 Page 2 of

3 File Read Analysis Process: x-www-browser PID: Parent PID: File Activities File Read Analysis Process: x-www-browser PID: Parent PID: Analysis Process: which PID: Parent PID: File Activities File Read Analysis Process: firefox PID: Parent PID: File Activities File Deleted File Read File Written File Moved Directory Created Directory Deleted Symbolic Link Created Owner / Group Modified Permission Modified Analysis Process: firefox PID: Parent PID: Analysis Process: firefox PID: Parent PID: File Activities File Read Analysis Process: firefox PID: Parent PID: Analysis Process: dbus-launch PID: Parent PID: File Activities File Read Analysis Process: firefox PID: Parent PID: Analysis Process: lsb_release PID: Parent PID: File Activities File Read Analysis Process: firefox PID: Parent PID: Analysis Process: dbus-launch PID: Parent PID: File Activities File Read Analysis Process: firefox PID: Parent PID: Analysis Process: firefox PID: Parent PID: File Activities File Deleted File Read Analysis Process: firefox PID: Parent PID: Analysis Process: firefox PID: Parent PID: File Activities File Deleted File Read Copyright Joe Security LLC 2018 Page 3 of 65

Analysis Report Overview Information Joe Sandbox Version: 23.0.0 Analysis ID: 66102 Start time: 02:09:04 Joe Sandbox Product: CloudBasic Start date: 29.06.

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 02:09:04 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 3m 25s false light browseurl.jbs Analysis system description: Ubuntu Linux x64 (Kernel , Firefox 59.0, Document Viewer , LibreOffice , OpenJDK 1.8.0_171) Detection: Classification: CLEAN Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Classification Copyright Joe Security LLC 2018 Page 4 of 65

suspicious suspicious suspicious clean clean

Adware Analysis Advice Sample HTTP request

5 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample is no longer working Signature Overview Networking System Summary Copyright Joe Security LLC 2018 Page 5 of 65

6 Click to jump to signature section Networking: Downloads files from webservers via HTTP Performs DNS lookups Tries to download non-existing http data (HTTP/ Found) Uses HTTPS System Summary: Classification label Behavior Graph Copyright Joe Security LLC 2018 Page 6 of 65

Behavior Graph ID: 66102 URL: http://204.48.24.

7 Behavior Graph ID: URL: Startdate: 29/06/2018 Architecture: LINUX Score: 0 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend Number of created Files Is malicious , 41740, 41780, 80 PRIMUS-AS6407-PrimusTelecommunicationsCanadaIncCA United States transfer.sh , 41180, 41184, NETRIX-ASNetrixFR France 19 other IPs or domains started exo-helper-1 started exo-helper-1 sensible-browser x-www-browser firefox started started started firefox dbus-launch firefox dbus-launch firefox lsb_release 5 other processes Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Antivirus Detection Initial Sample Copyright Joe Security LLC 2018 Page 7 of 65

8 Detection Scanner Label Link 1% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link transfer.sh 0% virustotal Browse pipeline-edge-prod us-west-2.elb.amazonaws.com 0% virustotal Browse ghbtns.com 0% virustotal Browse balrog-aus5.r53-2.services.mozilla.com 0% virustotal Browse api.github.com 0% virustotal Browse www-google-analytics.l.google.com 0% virustotal Browse googleadapis.l.google.com 0% virustotal Browse a19.dscg10.akamai.net 0% virustotal Browse search.r53-2.services.mozilla.com 0% virustotal Browse gstaticadssl.l.google.com 0% virustotal Browse github.map.fastly.net 0% virustotal Browse widget.uservoice.com 0% virustotal Browse locprod1-elb-eu-west-1.prod.mozaws.net 0% virustotal Browse by2.uservoice.com 0% virustotal Browse camo.githubusercontent.com 0% virustotal Browse fonts.googleapis.com 0% virustotal Browse fonts.gstatic.com 0% virustotal Browse URLs Detection Scanner Label Link 1% virustotal Browse Screenshots Copyright Joe Security LLC 2018 Page 8 of 65

Startup system is lnxubuntu1 exo-helper-1 (PID: 13200, Parent: 12442, MD5: c27a648e34ba5ce625d064af015be147) exo-helper-1 New Fork (PID: 13204, Parent: 13200) sensible-browser (PID: 13204, Parent:

9 Startup system is lnxubuntu1 exo-helper-1 (PID: 13200, Parent: 12442, MD5: c27a648e34ba5ce625d064af015be147) exo-helper-1 New Fork (PID: 13204, Parent: 13200) sensible-browser (PID: 13204, Parent: 13200, MD5: a5909f49ad9c97574d2b4c49cc24905d) x-www-browser (PID: 13204, Parent: 13200, MD5: 42b33a4578e4a51d8a5d1010c466a9d7) x-www-browser New Fork (PID: 13208, Parent: 13204) which (PID: 13208, Parent: 13204, MD5: unknown) firefox (PID: 13204, Parent: 13200, MD5: a f73e7450b27eeb48d0d5f804) firefox New Fork (PID: 13211, Parent: 13204) firefox New Fork (PID: 13245, Parent: 13204) firefox New Fork (PID: 13258, Parent: 13204) dbus-launch (PID: 13258, Parent: 13204, MD5: e4a469f27d130d783c21ce9c1c4456c3) firefox New Fork (PID: 13268, Parent: 13204) lsb_release (PID: 13268, Parent: 13204, MD5: 18cba7de7bfedd0d9f027bd1c54cc2b2) firefox New Fork (PID: 13287, Parent: 13204) dbus-launch (PID: 13287, Parent: 13204, MD5: e4a469f27d130d783c21ce9c1c4456c3) firefox New Fork (PID: 13315, Parent: 13204) firefox (PID: 13315, Parent: 13204, MD5: a f73e7450b27eeb48d0d5f804) firefox New Fork (PID: 13377, Parent: 13204) firefox (PID: 13377, Parent: 13204, MD5: a f73e7450b27eeb48d0d5f804) cleanup Created / dropped Files /home/user/.cache/dconf/user Process: /usr/lib/firefox/firefox File Type: very short file (no magic) Size (bytes): 1 Copyright Joe Security LLC 2018 Page 9 of 65

10 /home/user/.cache/dconf/user Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 93B885ADFE0DA089CDF634904FD59F71 5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F 6E340B9CFFB37A989CA544E6BB780A2C78901D3FB A30617AFA01D B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB2 93C324A D4E5C38438F0E36910EE false low /home/user/.cache/mozilla/firefox/v9nzj3nw.default/activity-stream.tippytop.json.tmp Process: File Type: Size (bytes): /usr/lib/firefox/firefox Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: ASCII text, with very long lines, with no line terminators false 99D2ED2F9CD4EE0B112A7D49BB48FF FCC58F4CA5E93B43C433432E9C3070F8 57FF8AE76A8F86FF4BD30A5B651FF50764CE785E B1EB778987F73 93D1BFF48F46A38A6980DEF4D91CF33580B AFF18565DCBE815072D43B3FA97A89587F22EA5237FDF918 D3AFB051F0C211EE0AA6F4F74F5664E0F91A4 false low /home/user/.cache/mozilla/firefox/v9nzj3nw.default/cache2/entries/28000c1d9bde7e5af0447bfa b610769f Process: File Type: Size (bytes): 1975 /usr/lib/firefox/firefox gzip compressed data, from Unix Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 45399B711C2418E99C12C30325C3BD46 98E2B55A6DCFE9B3CE19124F3B3B802485B26F63 6F258E1FFF378A8F6E A4F7DE21A6D732C7D7993D990BE11DF50689F7 65AAD2C1FBC390D0EBFCCCBA2D2BEE6C529CD1426C534C57E84E73EB66F059994AC22EF7A17B429CF8223BC7 09FA366570F25B137B9CFE22D A8E2296 false low /home/user/.cache/mozilla/firefox/v9nzj3nw.default/cache2/entries/85d679d5a35c7b886b0327ecef8a5fe0396a358e Process: File Type: /usr/lib/firefox/firefox data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 5F89D497A67E1B7224C C727 6B565492D2884E5215DBE342D80B5BB542E AF49C56D9BBECA0C40F712390B8172ED209AEDC588B4EB2C9B339266C173BA B45CB5F9A6185A0C3DFDE0EA719F118CDEBA48D CC AA EFEE B80DA4 B10A8EBF1BE3FD940D27B9F5753DDE1B640F4 false low /home/user/.cache/mozilla/firefox/v9nzj3nw.default/cache2/entries/fdc728d7c79370d9c6f7e4f5148d414fe09e3e61 Process: File Type: /usr/lib/firefox/firefox data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 288CD4ABE67D311BE26F627E010D FED1F9ECB9923F1C6F8F127898F4076CF26F 1A93B173FBF876E022F3DA54316AC619903FC40E C4029CD70669C F211513CF2D3466F761DB33E3A8EA9C26A A5D7A996DCD82D94E773B570E8BF765E6DA3040DE 4FB6C806CC B300128B1DA0DA99775 false low Copyright Joe Security LLC 2018 Page 10 of 65

11 /home/user/.mozilla/firefox/v9nzj3nw.default/cookies.sqlite-shm Process: File Type: Size (bytes): 16 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: /usr/lib/firefox/firefox data false 4AE71336E44BF9BF79D2752E234818A5 E129F27C5103BC5CC44BCDF0A15E160D445066FF FFF7719DD5979EC875D56CD2286F6D3CF7EC317A3B25632AAB28EC37BB 0B6CBAC838DFE7F47EA1BD0DF00EC282FDF45510C CCFB C4DA743D9C3B954EAA1B0F86FC98 61B23CC6C8667AB232C11C686432EBB5C8C3F27 false low /home/user/.mozilla/firefox/v9nzj3nw.default/favicons.sqlite-shm Process: File Type: Size (bytes): 8 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: /usr/lib/firefox/firefox data false 7DEA362B3FAC8E00956A4952A3D4F474 05FE F125559E7C9AC558654F107C7E9 AF5570F5A1810B7AF78CAF4BC70A660F0DF51E42BAF91D4DE5B2328DE0E83DFC 1B7409CCF0D5A34D3A77EAABFA9FE BE EE9522AA1BF4046D4F CB1A7348EDCAC4 7EF0D9E2C924130E5BCC5F0D C42F1B false low /home/user/.mozilla/firefox/v9nzj3nw.default/places.sqlite-shm Process: File Type: Size (bytes): 8 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: /usr/lib/firefox/firefox data false 7DEA362B3FAC8E00956A4952A3D4F474 05FE F125559E7C9AC558654F107C7E9 AF5570F5A1810B7AF78CAF4BC70A660F0DF51E42BAF91D4DE5B2328DE0E83DFC 1B7409CCF0D5A34D3A77EAABFA9FE BE EE9522AA1BF4046D4F CB1A7348EDCAC4 7EF0D9E2C924130E5BCC5F0D C42F1B false low /home/user/.mozilla/firefox/v9nzj3nw.default/places.sqlite-wal Process: File Type: /usr/lib/firefox/firefox data Size (bytes): Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false C2D00BEC52CBFF987AA88580C477E7C9 B68271EEFCCDF8368DFD32D088F3BF8E49379F1E 2ACAB44951F6D03EAFA15D10858D2FAF CCF3E80496A4839CE2733BFB 3B3243CBAFDD7AB9257C0D23B14BED73F060FE61A034FB74AA580D041EC7C5546C66482AA0A4F2C828261FCD5 DC5CF9EF1DD2FAB42757BA4CD2AC8304F659B85 false low /home/user/.mozilla/firefox/v9nzj3nw.default/prefs-1.js Process: File Type: Size (bytes): 6823 /usr/lib/firefox/firefox ASCII text, with very long lines Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: false 50A02709EF4B2A8D96764F049AF2B5D3 C3ECD5F375499CA617DB4655E011E514B7DBB50E 271E3D070402A1DC481016A0465ECE21E3E76514EA14DAB83AB862A42432CA4A ABB78063AB9D7CE9EDE04B64CF4DEC71166A1E7A928EBD32F83FD05CBC2BB3FAE2982AFADB3A5135F60C0FB 00F35EC649C93D55670FA2E30D4499E3D119EA3E3 Copyright Joe Security LLC 2018 Page 11 of 65

12 /home/user/.mozilla/firefox/v9nzj3nw.default/prefs-1.js Malicious: Reputation: false low /home/user/.mozilla/firefox/v9nzj3nw.default/sessioncheckpoints.json.tmp Process: File Type: Size (bytes): 143 /usr/lib/firefox/firefox ASCII text, with no line terminators Entropy (8bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false C0E4C22C50DD21142F57714EF49B B77307DCA5C889EA279243E74730CBC10801BE 6FE46B65B76B3DF32D B35ED75B6E23F4FBD6F45F3EFA1D496E6717 A4516B4F15EDB429F7B8CE3EA709D3777BFCC590838B1E113147E6BFB4DF0F34F0F2B24F6185D4E4277A77F7571 1BB470461B86AA507921AF037A6D22DF9278E false low /home/user/.mozilla/firefox/v9nzj3nw.default/storage/permanent/chrome/idb/ piupsah.sqlite-shm Process: File Type: Size (bytes): 16 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: /usr/lib/firefox/firefox data false 4AE71336E44BF9BF79D2752E234818A5 E129F27C5103BC5CC44BCDF0A15E160D445066FF FFF7719DD5979EC875D56CD2286F6D3CF7EC317A3B25632AAB28EC37BB 0B6CBAC838DFE7F47EA1BD0DF00EC282FDF45510C CCFB C4DA743D9C3B954EAA1B0F86FC98 61B23CC6C8667AB232C11C686432EBB5C8C3F27 false low /home/user/.mozilla/firefox/v9nzj3nw.default/storage/permanent/chrome/idb/ sdhlie.sqlite-shm Process: File Type: Size (bytes): 16 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: /usr/lib/firefox/firefox data false 4AE71336E44BF9BF79D2752E234818A5 E129F27C5103BC5CC44BCDF0A15E160D445066FF FFF7719DD5979EC875D56CD2286F6D3CF7EC317A3B25632AAB28EC37BB 0B6CBAC838DFE7F47EA1BD0DF00EC282FDF45510C CCFB C4DA743D9C3B954EAA1B0F86FC98 61B23CC6C8667AB232C11C686432EBB5C8C3F27 false low /home/user/.mozilla/firefox/v9nzj3nw.default/webappsstore.sqlite-shm Process: File Type: Size (bytes): 8 Entropy (8bit): 0.0 Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: /usr/lib/firefox/firefox data false 7DEA362B3FAC8E00956A4952A3D4F474 05FE F125559E7C9AC558654F107C7E9 AF5570F5A1810B7AF78CAF4BC70A660F0DF51E42BAF91D4DE5B2328DE0E83DFC 1B7409CCF0D5A34D3A77EAABFA9FE BE EE9522AA1BF4046D4F CB1A7348EDCAC4 7EF0D9E2C924130E5BCC5F0D C42F1B false low Contacted Domains/Contacted IPs Contacted Domains Copyright Joe Security LLC 2018 Page 12 of 65

13 Name IP Active Malicious Antivirus Detection Reputation transfer.sh true false 0%, virustotal, Browse high pipeline-edge-prod us-west- 2.elb.amazonaws.com true false 0%, virustotal, Browse high ghbtns.com true false 0%, virustotal, Browse high balrog-aus5.r53-2.services.mozilla.com true false 0%, virustotal, Browse high api.github.com true false 0%, virustotal, Browse high www-google-analytics.l.google.com true false 0%, virustotal, Browse high googleadapis.l.google.com true false 0%, virustotal, Browse high a19.dscg10.akamai.net true false 0%, virustotal, Browse high search.r53-2.services.mozilla.com true false 0%, virustotal, Browse high gstaticadssl.l.google.com true false 0%, virustotal, Browse high github.map.fastly.net true false 0%, virustotal, Browse low widget.uservoice.com true false 0%, virustotal, Browse high locprod1-elb-eu-west-1.prod.mozaws.net true false 0%, virustotal, Browse high by2.uservoice.com true false 0%, virustotal, Browse high camo.githubusercontent.com unknown unknown false 0%, virustotal, Browse unknown fonts.googleapis.com unknown unknown false 0%, virustotal, Browse high fonts.gstatic.com unknown unknown false 0%, virustotal, Browse high Contacted URLs Name Process unknown unknown Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs Public IP Country Flag ASN ASN Name Malicious United States CLOUDFLARENET- CloudFlareIncUS false United States FASTLY-FastlyUS false United States GITHUB-GitHubIncUS false France NETRIX-ASNetrixFR false United States AMAZON-02-AmazoncomIncUS false United States AMAZON-02-AmazoncomIncUS false Copyright Joe Security LLC 2018 Page 13 of 65

14 IP Country Flag ASN ASN Name Malicious United States AMAZON-02-AmazoncomIncUS false United States AMAZON-02-AmazoncomIncUS false United States GOOGLE-GoogleIncUS false United States GOOGLE-GoogleIncUS false United States 6407 PRIMUS-AS6407- PrimusTelecommunicationsCanad aincca United States GOOGLE-GoogleIncUS false false United States CLOUDFLARENET- CloudFlareIncUS false Static File Info No static file info Network Behavior Network Distribution Total Packets: (HTTPS) 53 (DNS) 80 (HTTP) TCP Packets UDP Packets DNS Queries IP IP Trans ID OP Code Name Type Class 02:10: x42c4 Standard query (0) 02:10: x4a2a Standard query (0) 02:10: x33a3 Standard query (0) 02:10: x567f Standard query (0) 02:10: x1740 Standard query (0) 02:10: xc40e Standard query (0) 02:10: x70a0 Standard query (0) 02:10: xc11b Standard query (0) 02:10: xe539 Standard query (0) transfer.sh A (IP address) IN (0x0001) transfer.sh 28 IN (0x0001) fonts.goog leapis.com fonts.goog leapis.com A (IP address) camo.githu A (IP address) busercontent.com IN (0x0001) 28 IN (0x0001) IN (0x0001) camo.githu 28 IN (0x0001) busercontent.com fonts.gstatic.com A (IP address) IN (0x0001) fonts.gstatic.com 28 IN (0x0001) ghbtns.com A (IP address) IN (0x0001) Copyright Joe Security LLC 2018 Page 14 of 65

15 IP IP Trans ID OP Code Name Type Class 02:10: xfc70 Standard query (0) 02:10: x989a Standard query (0) 02:10: xb61f Standard query (0) 02:10: x92c4 Standard query (0) 02:10: x7841 Standard query (0) 02:10: xf807 Standard query (0) 02:10: x1117 Standard query (0) ghbtns.com 28 IN (0x0001) widget.use rvoice.com widget.use rvoice.com A (IP address) IN (0x0001) 28 IN (0x0001) api.github.com A (IP address) IN (0x0001) api.github.com 28 IN (0x0001) by2.uservo ice.com by2.uservo ice.com A (IP address) IN (0x0001) 28 IN (0x0001) DNS Answers IP IP Trans ID Replay Code Name CName Address Type Class 02:10: :10: :10: xffd6 No error (0) locprod1-elb-euwest-1.prod.mo zaws.net xffd6 No error (0) locprod1-elb-euwest-1.prod.mo zaws.net xffd6 No error (0) locprod1-elb-euwest-1.prod.mo zaws.net x74 No error (0) search.r53-02:10: service s.mozilla.com x74 No error (0) search.r53-02:10: service s.mozilla.com x74 No error (0) search.r53-02:10: service s.mozilla.com A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) x42c4 No error (0) transfer.sh A (IP address) IN (0x0001) 02:10: x567f No error (0) fonts.goog 02:10: leapis.com x567f No error (0) googleadap 02:10: is.l.google.com x33a3 No error (0) fonts.goog 02:10: leapis.com x33a3 No error (0) googleadap 02:10: is.l.google.com 02:10: x1740 No error (0) camo.githu buserconte nt.com x1740 No error (0) github.map 02:10: fastly.net x1740 No error (0) github.map 02:10: fastly.net x1740 No error (0) github.map 02:10: fastly.net x1740 No error (0) github.map 02:10: fastly.net 02:10: :10: xc40e No error (0) camo.githu buserconte nt.com googleadapis.l.google.co m googleadapis.l.google.co m github.map.fastly.net github.map.fastly.net CNAME (Canonical name) IN (0x0001) 28 IN (0x0001) CNAME (Canonical name) IN (0x0001) A (IP address) IN (0x0001) CNAME (Canonical name) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) CNAME (Canonical name) x70a0 No error (0) fonts.gstatic.com gstaticadssl.l.google.com CNAME (Canonical name) x70a0 No error (0) gstaticads 02:10: sl.l.google.com IN (0x0001) IN (0x0001) A (IP address) IN (0x0001) Copyright Joe Security LLC 2018 Page 15 of 65

16 IP IP Trans ID Replay Code Name CName Address Type Class 02:10: xc11b No error (0) fonts.gstatic.com gstaticadssl.l.google.com CNAME (Canonical name) xc11b No error (0) gstaticads 02:10: sl.l.google.com IN (0x0001) 28 IN (0x0001) xfc70 No error (0) ghbtns.com 28 IN (0x0001) 02:10: xfc70 No error (0) ghbtns.com 28 IN (0x0001) 02:10: x989a No error (0) widget.use 02:10: rvoice.com x989a No error (0) widget.use 02:10: rvoice.com x989a No error (0) widget.use 02:10: rvoice.com x989a No error (0) widget.use 02:10: rvoice.com x989a No error (0) widget.use 02:10: rvoice.com xb61f No error (0) widget.use 02:10: rvoice.com xb61f No error (0) widget.use 02:10: rvoice.com xb61f No error (0) widget.use 02:10: rvoice.com xb61f No error (0) widget.use 02:10: rvoice.com xb61f No error (0) widget.use 02:10: rvoice.com A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) xe539 No error (0) ghbtns.com A (IP address) IN (0x0001) 02:10: xe539 No error (0) ghbtns.com A (IP address) IN (0x0001) 02:10: :10: :10: xf400 No error (0) www-googleanalytics.l.google.com x9fd5 No error (0) www-googleanalytics.l.google.com A (IP address) IN (0x0001) 28 IN (0x0001) x92c4 No error (0) api.github.com A (IP address) IN (0x0001) 02:10: x92c4 No error (0) api.github.com A (IP address) IN (0x0001) 02:10: x1117 No error (0) by2.uservo 02:10: ice.com x1117 No error (0) by2.uservo 02:10: ice.com x1117 No error (0) by2.uservo 02:10: ice.com x1117 No error (0) by2.uservo 02:10: ice.com x1117 No error (0) by2.uservo 02:10: ice.com xf807 No error (0) by2.uservo 02:10: ice.com 28 IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) A (IP address) IN (0x0001) Copyright Joe Security LLC 2018 Page 16 of 65

17 IP IP Trans ID Replay Code Name CName Address Type Class xf807 No error (0) by2.uservo 02:10: ice.com xf807 No error (0) by2.uservo 02:10: ice.com xf807 No error (0) by2.uservo 02:10: ice.com xf807 No error (0) by2.uservo 02:10: ice.com 02:10: :10: :10: :10: :10: :10: :10: :10: :10: x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x114e No error (0) balrog-aus5.r53-2.services.moz illa.com x3872 No error (0) a21ed24aed de648804e c84 088fef4ff5 e70f e9.r17.cf 1.rackcdn.com x3872 No error (0) a17.rackcd 02:10: n.com x3872 No error (0) a19.dscg10 02:10: akamai.net x3872 No error (0) a19.dscg10 02:10: akamai.net 02:10: x1dcc No error (0) a21ed24aed de648804e c84 088fef4ff5 e70f e9.r17.cf 1.rackcdn.com x1dcc No error (0) a17.rackcd 02:10: n.com x1dcc No error (0) a19.dscg10 02:10: akamai.net x1dcc No error (0) a19.dscg10 02:10: akamai.net 02:11: x1fa No error (0) telemetry- incoming.r53-2.services.mozill a.com 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com a17.rackcdn.com a17.rackcdn.com.mdc.ed gesuite.net a17.rackcdn.com a17.rackcdn.com.mdc.ed gesuite.net pipeline-edge-prod us-west- 2.elb.amazonaws.com A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) CNAME (Canonical name) CNAME (Canonical name) IN (0x0001) IN (0x0001) 28 IN (0x0001) 28 IN (0x0001) CNAME (Canonical name) CNAME (Canonical name) IN (0x0001) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) CNAME (Canonical name) IN (0x0001) A (IP address) IN (0x0001) Copyright Joe Security LLC 2018 Page 17 of 65

18 IP IP Trans ID Replay Code Name CName Address Type Class 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com 02:11: x1fa No error (0) pipeline-edge- prod uswest-2.elb.amaz onaws.com A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) 02:11: x97f8 No error (0) telemetry- incoming.r53-2.services.mozill a.com pipeline-edge-prod us-west- 2.elb.amazonaws.com CNAME (Canonical name) IN (0x0001) HTTP Request Dependency Graph HTTP Packets Session ID IP ination IP ination kbytes transferred Direction Data 02:10: OUT GET / HTTP/1.1 Host: User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/ Firefox/59.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1 Copyright Joe Security LLC 2018 Page 18 of 65

19 kbytes transferred Direction Data 02:10: IN HTTP/ OK Server: nginx/ (Ubuntu) Date: Fri, 29 Jun :10:07 GMT Content-Type: text/html Last-Modified: Tue, 26 Jun :57:07 GMT Transfer-Encoding: chunked Connection: keep-alive ETag: W/"5b31b993-a8a" Content-Encoding: gzip Data Raw: d 0a 1f 8b ad f d3 48 0c 7f f7 a7 10 c6 e a7 a5 a5 71 5d 68 cb d2 83 1e bb 5c 0b a5 fc 5c c7 1e 8f a7 f1 31 8c d2 6c f6 b3 af 7c d8 76 e1 61 f3 12 8d a f e 6e 3f 30 0c c5 0b dd 34 b3 dd be e ec 7a 10 c5 49 ca cd ee da fa f3 8d cd 17 5b 9d dd bd fd d7 bf bd c 3a 7e 7b 72 7a 76 fe bb e b1 bb 9b ad f5 6e eb c5 7a 6b bd d e e0 b3 cc 4b 85 df 68 c c0 d4 6c b f 02 f1 c2 14 8c 04 b b9 f7 6e f7 ec f5 f9 e9 23 6d fa b0 3c cf 7a e6 ac d0 4b b9 d3 77 b3 d0 d6 1a f5 c3 4d cb e9 db 44 5a ce b5 cd c3 52 ee a c 6d 19 5a 0e b3 25 2f c fd 54 ae a8 78 b6 88 2c 27 b0 d c9 8a 9c d8 7c ae 9d d3 f2 09 3a bf a2 10 da 21 ba e0 db de d a5 99 dd d0 37 e2 71 eb 9a 53 1d 90 9a c1 a2 35 6b 6d c1 5a ab 58 4d c dd 3e c9 b9 dd 50 db 32 e6 2a a8 ed 91 2b 2a f2 8a e7 fe e5 05 a4 da 34 e7 5f 5f 7d 9b 29 7e aa 78 3e 68 8c 2b 22 c6 fb 01 c8 74 e f a c7 e1 ca 4b e3 d8 4d 7c ec 0a 5a ed a9 ff f1 5c ab b3 00 be c b be e 7a c b 6d f a c0 d0 a ae 36 1a cc ee 58 6c 1b 73 5b 17 cd cc 62 4f 9f 36 9b e b 88 ad 6a 0b 5a 9b d6 9a bd bf a 95 c2 dc 5c b e3 eb 2d ce 7c 98 a3 b3 e4 cc 45 e8 04 c6 3b c6 c4 1b 22 be e a0 e d3 19 5c 5a f0 b8 be e fd e6 be 4a f3 94 d4 b9 d0 e6 e5 a5 94 c8 6a 8d 5b b9 d0 1c fa f0 17 e4 1e d 7e d d5 9c af dd 5e 42 d4 d6 0a 8b c6 39 a6 68 f9 3c 89 ee 30 e0 6b de fd cf fb 9a e3 c1 fd cf a7 3f 7f de 21 9a b8 cf 46 ed 91 b6 d0 33 3e e7 b1 89 fa 19 f1 41 cf da ad d9 f8 da 31 b6 be 5d 36 5b 4b ea 49 fb d2 bc ec b6 75 c a0 ae 75 d4 5b b0 cc 8d 1a 1e a a d f 85 2c 4e c1 c8 08 3f 20 b7 0e 0d fd be 58 f5 67 a0 df f aa df f2 7b d5 54 4b 90 ef c9 ff d5 24 b6 cd 9d ae f c2 5a c1 22 e2 f0 a1 74 8a 3e c5 1e ca 1a 2b 41 3d c3 8f c9 7f a c 4d b5 e8 60 2f 8c 53 1f aa c3 21 5f e c 4c fc 90 2c 4b b1 e2 ad 29 3c a 4e 05 6a 18 6f 40 6f b7 db fa e2 3c 2a f bc fc a1 f6 57 3f 35 ab 9f c a8 95 8d ae 85 6d a6 ea 5a c1 ca a b a7 4c a5 f0 dc 82 5f f0 c2 2a 0b 15 df ef ac dc f5 Data Ascii: 51fVYHpq]h\\1'ql $ivaiin?04zi[98<:~{rzvb)r>nzkuai&khtl6f`iin#m<zk3%!wmdzrtelmz%/etx,'dic) b9:t!r6w 7qSt5kmZXMi">BP2*+*US)4 })~x>h+"to2km 0FZRI\0Y C(z!QH;mqJ6Xls[bO6e!0#9jZVZ\E- E;A"CN8AY\Z6~V8JHQj[W sqm~sw-psx^b9h<0k?!c5'f3>awa'p1]6[kiu$u[hc(b}`1o,nh? XgRoU{TKC$9t5gpZ%5B"t>+A=1' tlm`/s677w I!_d!L,K) <1:Njo@o<*uWW?5r mzgwcdl_*yt! 02:10: OUT GET /favicon.ico HTTP/1.1 Host: User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/ Firefox/59.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive 02:10: IN HTTP/ Found Server: nginx/ (Ubuntu) Date: Fri, 29 Jun :10:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: d 0a 1f 8b b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b f0 cb 2f cb 2f cd 4b b1 d da e e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c a3 0f d e5 e5 a5 67 e6 55 e8 1b ea 19 1a e8 19 2b e a 22 ab d5 07 d d 1f ea bb 71 b5 b d 0a 30 0d 0a 0d 0a Data Ascii: 8d(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU+h&j"2]Req0 HTTPS Packets 02:10: IP IP Subject Issuer CN=transfer.sh CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Thu Jun 21 08:48: Wed Sep 19 08:48: Raw [[ Version: V3 Subject: CN=transfer.sh Signature Algorithm: SHA256withRSA, OID = Key: SunPKCS11- NSS EC public key, 256 bits (id 1, session object) public x coord: public y coord: parameters: secp256r1 [NIST P-256, X9.62 prime256v1] ( ) Validity: [From: Thu Jun 21 08:48: , To: Wed Sep 19 08:48: ] Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US SerialNumber: [ 045d75cc 2440e219 b7dacb2c fc5013fc 9b53]Certificate Extensions: 9[1]: ObjectId: Criticality=falseExtension unknown: DER encoded OCTET string =0000: F F1 00 EF D4 C u.U : A EA 0B 9B 57 3C 53 F0 C0 E Copyright Joe Security LLC 2018 Page 19 of 65

20 IP IP Subject Issuer.6.J...W<S...8xp0020: F A3 AA 1D 07 Raw13 D3 0C %../...d!0030: 50 CB D D E5 B4 P...F0D. ]..0040: AE 4B 25 CB A C F2 65 1F 8C 73.K%..1..r8..e..s0050: 20 B4 B A C 8F 18 2A B...g...*..0060: 86 E AE E1 FF AE 83 2F DE C CE...V.../.$.&..0070: AB 0B C 51 D CF F8 02 D8 D LQ.(...$.0080: C C BA AA 50 FC v.) <Q.T.9e..P.X.0090: D4 B7 6F BF 58 7A DC A4 C3 0C F4 E o.Xz)r...EG00A0: F CB C x...d!P...G00B0: E F CE 6C 0D D7 2D AE 8B 0E. 3B 09 8A D6 C5 80 B5 1E F3 D2 CE 01 F0 D2 ;...00D0: 1E 7F B E3 0B 03 B9 A4 60 D4 47 FF...!...`.G.00E0: E1 11 DD DA 03 7F EF 0D C5 B4 CF E2 q!...x...00f0: C8 8B 99 D0 DF 53 5B...S[[2]: ObjectId: Criticality=falseAuthorityInfoAccess [ [ accessmethod: ocsp accesslocation: URIName: accessmethod: caissuers accesslocation: URIName: ObjectId: Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: A8 4A 6A D DD BA E6 D1 39 B7 A EF.Jjc...9..Ee.0010: F3 A8 EC A1...]][4]: ObjectId: Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][5]: ObjectId: Criticality=falseCertificatePolicies [ [CertificatePolicyId: [ ][] ] [CertificatePolicyId: [ ] [PolicyQualifierInfo: [ qualifierid: qualifier: 0000: 16 1A A 2F 2F E 6C E E 6F sencrypt.org], PolicyQualifierInfo: [ qualifierid: qualifier: 0000: E 0C 81 9B This Certi0010: D F 6E 6C ficate may only 0020: C F 6E be relied upon b0030: C E y Relying Partie0040: E F 6E 6C E s and only in ac0050: 63 6F E cordance with th0060: F e Certificate Po0070: 6C F 75 6E licy found at ht0080: A 2F 2F 6C E tps://letsencryp0090: 74 2E 6F F F F t.org/repository00a0: 2F /]] ]][6]: ObjectId: Criticality=falseExtendedKeyUsages [ serverauth clientauth][7]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature][8]: ObjectId: Criticality=falseSubjectAlternativeName [ DNSName: transfer.sh][9]: ObjectId: Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: B CF EF C E FA 0F Wi;.6v...6Su..0010: 73 0D 17 D1 s...]]] Algorithm: [SHA256withRSA] Signature:0000: 4C E1 A2 BC 99 EC E E 15 A2 62 EA AB L...q.e...b..0010: F8 9C E8 9C 95 7C 41 EF 87 A1 48 3D 94 8C 49 1F...A...H=..I.0020: 5E 6C 3F 6F 12 AA 3F 6D C E ^l?o..?m.p...a.0030: A F2 C4 C2 FE 25 4F FA 4D A2 (.J4U...%O.g.M.0040: 33 D0 70 EA BB 9B BD 8E CA E1 57 F7 2E AE 3.p...H...W : BE BB CE AC C C 14 2F 92 A8 DB B5 C0...bHP../ : AD A9 C3 E0 8F DE B 89 CB 2E 61.G...5@...a0070: 7F D2 3C 9A B8 1F 13 FC A CB.8... <...x").0080: D2 D7 2A 46 E0 BE E0 CF A7 Copyright Joe Security LLC 2018 Page 20 of 65

21 IP IP Subject Issuer EF 7A BE F *F...z..qQc0090: 30 B8 Raw7C D A9 B4 3E C2 EF 97 C4 2F 5B BE 0...>.../[.00A0: E EB 5C 7C 3D 1C 1E A D8 5D FA.5..\.=..7)Bj.].00B0: 19 CB 2F AC CB C DD D9 A3 23 BA 4E../..Gef8...#.N00C0: D6 10 C3 9B C2 6B 33 F5 13 C AC 8B 3A AF 76 C3 FA B9 C0 76 BB B8 8B F F.E.v...v...)D.00E0: 0A 1C 80 A0 49 DF A3 C2 07 F B FD E I... [...00F0: 1F 32 9B BD 35 F2 B2 20 8D A6 A E 05 4C L] Copyright Joe Security LLC 2018 Page 21 of 65

22 02:10: IP IP Subject Issuer CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co. Thu Mar 17 17:40:46 CET 2016 Wed Mar 17 17:40:46 CET 2021 Raw [[ Version: V3 Subject: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US Signature Algorithm: SHA256withRSA, OID = Key: Sun RSA public key, 2048 bits modulus: public exponent: Validity: [From: Thu Mar 17 17:40:46 CET 2016, To: Wed Mar 17 17:40:46 CET 2021] Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co. SerialNumber: [ 0a a0b 85eca708]Certificate Extensions: 7[1]: ObjectId: Criticality=falseAuthorityInfoAccess [ [ accessmethod: ocsp accesslocation: URIName: accessmethod: caissuers accesslocation: URIName: ][2]: ObjectId: Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: C4 A7 B1 A4 7B 2C 71 FA DB E1 4B FF C ,q...K.u : `...]][3]: ObjectId: Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: ]]][5]: ObjectId: Criticality=falseCertificatePolicies [ [CertificatePolicyId: [ ][] ] [CertificatePolicyId: [ ] [PolicyQualifierInfo: [ qualifierid: qualifier: 0000: A 2F 2F E 72 6F 6F." 74 2D E 6C E t-x1.letsencrypt0020: 2E 6F org]] ]] [6]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: A8 4A 6A D DD BA E6 D1 39 B7 A EF.Jjc...9..Ee.0010: F3 A8 EC A1...]]] Algorithm: [SHA256withRSA] Signature:0000: DD 33 D7 11 F DD FB BE cX8...U.v0010: 56 B A B C F1 5A 1F V.pH.iG'..$...Z.0020: 4A C B8 CD E5 J.)7$tQ.bh...pg.0030: F7 A4 BC 4E CD 9B E8 AE 87 9D EA D8 BA 5A...N(Q...Z0040: A1 01 9A DC F0 DD 6A 1D 6A D8 3E E A6 1E...j.j.>W# : A FF D7 05 CA B7 1F 3F C0 0A 48 BC 94 B0.b...?..H : B E0 C1 54 E5 A3 2A AD 20 C4 E9 E6 BB DC.eb..T..* : C8 F6 B5 C3 32 A3 98 CC 77 A8 E B CB w..ye : 28 FE 3A CE 52 0C 2E 5F 83 E8 D (.:.R..R.._ : FB 77 6C CE 40 EA 32 9E 1F 92 5C 41 C1 74 6C 5B.wl.@.2...\A.tl[00A0: 5D 0A 5F 33 CC 4D 9F AC 38 F0 2F 7B 2C 62 9D D9 ]._3.M..8./.,b..00B0: A3 91 6F 25 1B 2F 90 B D F6 7E 1B A6 7A..o%./...F=...z00C0: 87 B9 A3 7A 6D 18 FA 25 A E0 F2 16 2F...zm..%.../00D0: 58 B0 06 2F 2C C6 4B 98 CD DA 9F 0C F9 7F X../,h&.K...00E0: 90 ED 43 4A E 6F 73 7A 28 EA A4 AA 6E 7B Copyright Joe Security LLC 2018 Page 22 of 65

23 IP IP Subject Issuer 02:10: CN=*.googleapis.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=Google Internet Authority G3, O=Google Trust Services, C=US Tue Jun 12 15:19: Tue Aug 21 14:13: CJ.DNosz(...n.00F0: 4C 7D 87 DD E0 C RawA7 87 AF C3 34 5B B4 42 L...D...4[.B] [[ Version: V3 Subject: CN=*.googleapis.com, O=Google LLC, L=Mountain View, ST=California, C=US Signature Algorithm: SHA256withRSA, OID = Key: SunPKCS11-NSS EC public key, 256 bits (id 2, session object) public x coord: public y coord: parameters: secp256r1 [NIST P-256, X9.62 prime256v1] ( ) Validity: [From: Tue Jun 12 15:19: , To: Tue Aug 21 14:13: ] Issuer: CN=Google Internet Authority G3, O=Google Trust Services, C=US SerialNumber: [ 735ee34f f7193eaa]certificate Extensions: 9[1]: ObjectId: Criticality=falseAuthorityInfoAccess [ [ accessmethod: caissuers accesslocation: URIName: accessmethod: ocsp accesslocation: URIName: ObjectId: Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 77 C2 B8 50 9A B1 2D C2 86 D0 83 A0 7E w..p.gvv : A6 7E BA 4B...K]] [3]: ObjectId: Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: ObjectId: Criticality=falseCertificatePolicies [ [CertificatePolicyId: [ ][] ] [CertificatePolicyId: [ ][] ]][6]: ObjectId: Criticality=falseExtendedKeyUsages [ serverauth][7]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature][8]: ObjectId: Criticality=falseSubjectAlternativeName [ DNSName: *.googleapis.com DNSName: *.clients6.google.com DNSName: *.cloudendpointsapis.com DNSName: cloudendpointsapis.com DNSName: googleapis.com][9]: ObjectId: Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: C8 D A1 E2 DE C 1B 3F 01 2E 26 7B...xa..?..&.0010: 2A 87 B6 F1 *...]]] Algorithm: [SHA256withRSA] Signature:0000: 88 2D 46 4F E9 8C B 83.-FO.`i...v..p+.0010: 2A AE 82 B0 D1 19 4A 5A 15 2B 2C 6D 60 2D FD 0A *...JZ.+,m` : A0 AB D8 7E 0B BE C2 DE E1 AE CF F3 9C AF 4B : BA C9 2C CC AE 28 E8 35 CC E D1 F6 26..,..(.5...&0040: D6 5F 14 A4 0D 86 D A F5 5D 0F._...c#*.C.].0050: D4 40 0A B6 E1 F3 2E 6A 30 C7 C C 25.@...j %0060: 7A 8F E F8 9E CE E 05 2C FE D0 z.i2t...8c..,..0070: F B 42 C5 33 FB BA 5E 2A 0B 4C AE 80..sh[B.3..^*.L..0080: E B6 C E D 84 B5 00 A6.)i..U..^.G : B5 84 D4 25 4E 5A 9F AE F3 FB FC 3F 9D E %NZ...?..t400A0: E E6 15 BA D5 82 F EA C v..5Xc00B0: B C5 A7 1D CA 7C FD 6D 2E A9 1F 4D...m...M00C0: 99 C5 5E 54 7E 62 D7 79 8F D 1D 29 CE 56..^T.b.y...).V00D0: A FF 38 E0 50 D5 F3 CB 91 6E F9 C4 64 AE...8.P...n..d.00E0: D DA FC F0 4C 5D 49 DD C0 EE X...t...L]I...00F0: F3 D6 B3 01 7E D3 2E 5B 50 D6 CB C2 DC 60 F7 5A...[P...`.Z] Copyright Joe Security LLC 2018 Page 23 of 65

24 IP IP Subject Issuer CN=Google Internet 02:10: Authority G3, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 Thu Jun 15 02:00: Wed Dec 15 01:00:42 CET 2021 Raw [[ Version: V3 Subject: CN=Google Internet Authority G3, O=Google Trust Services, C=US Signature Algorithm: SHA256withRSA, OID = Key: Sun RSA public key, 2048 bits modulus: public exponent: Validity: [From: Thu Jun 15 02:00: , To: Wed Dec 15 01:00:42 CET 2021] Issuer: CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2 SerialNumber: [ 01e3a930 1cfc f9a53 1d]Certificate Extensions: 8[1]: ObjectId: Criticality=falseAuthorityInfoAccess [ [ accessmethod: ocsp accesslocation: URIName: ObjectId: Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 9B E C 1E C0 6A 06 DE 59 B4 9A 2D DF...Wg...j..Y : DC E...]][3]: ObjectId: Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: ObjectId: Criticality=falseCertificatePolicies [ [CertificatePolicyId: [ ] [PolicyQualifierInfo: [ qualifierid: qualifier: 0000: 16 1C A 2F 2F 70 6B 69 2E 67 6F.. 6F 67 2F F F F og/repository/]] ]][6]: ObjectId: Criticality=falseExtendedKeyUsages [ serverauth clientauth][7]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 77 C2 B8 50 9A B1 2D C2 86 D0 83 A0 7E w..p.gvv : A6 7E BA 4B...K]]] Algorithm: [SHA256withRSA] Signature:0000: 1C B E4 53 ED BB EC DB A F 2C A3...S...2..,.0010: CD 6D AD B3 B8 E6 C B 57.m.B.w...R`.W0020: 27 C6 11 B5 3F 67 0D 99 2C 5B 5A CA 22 0A DD 9E '...?g..,[z." : BB 1F 4B 48 3F 8F 02 3D 8B D 6D F5 FF..KH?..=.!.E.m..0040: AC CD 64 E2 D6 D6 5E 40 C2 8E 2A F7 EF 14.h..d...^@..* : D3 36 A F FB 7E 9E 53 EA.6.@0.2...v...S.0060: C2 76 FC 39 AD 88 FE E9 1C C4 38 CD 49.v.9...f.&...8.I0070: FA F0 5D D6 56 4D 81 D7 7F F1 C2 DD B0 4D.C..].VM...M0080: FE C3 2A 6E 7C 9F 6E 5C ED E1 F7 36 EE..*n..n\.bB : 14 8C 2C 20 E A C0 A0 C6 4A 88 FD..,.F.Zw...J..00A0: A 18 EA 9C A5 C7 5A 08 8C E4 05 7D B F E 40 3D 12 E8 BB _.6V.@=...5r00C0: ED AF E B0 BB 2E A9 9B E4 FB 1D 3E 0B 63...VN...>.c00D0: C8 9B 4B C0 14 B4 96 F0 DC 2C 57 3F..K.DfW...,W? 00E0: AD 95 AA 7D 4D D0 F2 0C 9F 9C 40 E8 D6 55 R...M...@..U00F0: 73 BA 3C DF 90 CB 00 5B C2 ED 32 1E DE s.<...[!.g..2..] Copyright Joe Security LLC 2018 Page 24 of 65

ID: Cookbook: browseurl.jbs Time: 13:58:58 Date: 09/05/2018 Version:

ID: Cookbook: browseurl.jbs Time: 13:58:58 Date: 09/05/2018 Version: ID: 58705 Cookbook: browseurl.jbs Time: 13:58:58 Date: 09/05/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis