ID: Cookbook: browseurl.jbs Time: 09:15:48 Date: 09/01/2018 Version:

Transcription

1 ID: Cookbook: browseurl.jbs Time: 0:15:48 Date: 0/01/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Phishing: Networking: Data Obfuscation: System Summary: Anti Debugging: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Statistics Behavior System Behavior Analysis Process: iexplore.exe PID: 3236 Parent PID: 548 General File Activities Registry Activities Analysis Process: iexplore.exe PID: 326 Parent PID: 3236 General File Activities Registry Activities Analysis Process: ssvagent.exe PID: 3360 Parent PID: 326 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 2

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 0:15:48 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 4m 37s light browseurl.jbs a= llery.com/student.health.verification/sick/bay/room/234/ HzZoYoANETLcisu2hgwLeLBYK8e7daACw,,&typo= 0 Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal48.phis.win@5/23@6/2 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: Successful, ratio: 100% HDC Information: Successful, ratio: 100% (good quality ratio 85.2%) Quality average: 64.5% Quality standard deviation: 36.1% Warnings: Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, dllhost.exe Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Copyright Joe Security LLC 2018 Page 4 of 2

5 Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Threshold Classification Copyright Joe Security LLC 2018 Page 5 of 2

6 Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample is no longer working Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Phishing Networking Obfuscation Data Summary System Debugging Anti and other Techniques for Hiding and Protection Hooking Language, Device and Operating System Detection Copyright Joe Security LLC 2018 Page 6 of 2

7 Click to jump to signature section Phishing: META author tag missing META copyright tag missing HTML title does not match URL HTML body contains number of good links None HTTPS page querying sensitive user data (password, username or ) Networking: Downloads compressed data via HTTP Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Tries to download non-existing http data (HTTP/ Not Found) Urls found in memory or binary data Uses HTTPS Data Obfuscation: Contains functionality to dynamically determine API calls Uses code obfuscation techniques (call, push, ret) System Summary: Uses new MSVCR Dlls Binary contains paths to debug symbols Classification label Contains functionality to instantiate COM classes Contains functionality to load and extract PE file embedded resources Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Searches the installation path of Mozilla Firefox Anti Debugging: Copyright Joe Security LLC 2018 Page 7 of 2

8 Contains functionality to register its own exception handler Contains functionality to check if a debugger is running (IsDebuggerPresent) Contains functionality to dynamically determine API calls Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Extensive use of GetProcAddress (often used to hide API calls) Language, Device and Operating System Detection: Contains functionality to query local / system time Contains functionality to query windows version Behavior Graph Behavior Graph ID: URL: Startdate: 0/01/2018 Architecture: WINDOWS Score: 48 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend None HTTPS page querying sensitive user data (password, username or ) HTML body contains number of good links started Number of created Registry Values Number of created Files Visual Basic Delphi iexplore.exe Java Net C# or VB.NET C, C++ or other language started Is malicious iexplore.exe 20 student.portal.forums.dicussion.boards.craftdistillery.com , 4175, 4176, 80 AS-2646-GO-DADDY-COM-LLC-GoDaddycomLLCUS Singapore linkprotect.cudasvc.com , 443, 4167, 4168 AMAZON-02-AmazoncomIncUS United States started ssvagent.exe 6 Simulations Behavior and APIs No simulations Copyright Joe Security LLC 2018 Page 8 of 2

9 Antivirus Detection Initial Sample No Antivirus matches Dropped Files No Antivirus matches Domains Detection Cloud Link linkprotect.cudasvc.com 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Copyright Joe Security LLC 2018 Page of 2

10 Screenshot Startup System is w7 cleanup iexplore.exe (PID: 3236 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding CA1F703CD665867E8132D246FB55750) iexplore.exe (PID: 326 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' SCODEF:3236 CREDAT: /prefetch:2 CA1F703CD665867E8132D246FB55750) ssvagent.exe (PID: 3360 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 053A026487FD1E655B75B63B083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log ASCII text, with CRLF line terminators Size (bytes): 8 Entropy (8bit): E46C A7A4BC7EA1B E5AA4CDE1FB7E3D5A02FB75B4C5FB2 38D7EF51FE2181C41D40C60AF866AF6A0AC5D145C8A5FDADB676F Copyright Joe Security LLC 2018 Page 10 of 2

11 C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log E151B264E3104E18D273F70C480EA357B584386BE4F6AD7451E4BBFB BF6051D5A1B1520BE34CC B4CCCFEC03317C20CD B37433 C:\Users\HERBBL~1\AppData\Local\Temp\~DF15E0438DC2F75577.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): 3185 Entropy (8bit): E48C46AA780A5A75F0AA5F8FC4DE6 E7F240F0AE4EC702827C1C46CA302E2E BCEDF2525B232ABA30E031D4B216E52E77DC5F825C58652F21C2CFD356EB 36527AC AA8307FF03BC34D7FCA871D3D5CD388F8ACAE C446C731BF64CBA7116DB4CE5E81 EFE870FC8DE78E4685A006EADBFBFA7BB6C7AB C:\Users\HERBBL~1\AppData\Local\Temp\~DF512B1A1C7AD16D2.TMP data Size (bytes): 2745 Entropy (8bit): D8AB583EB11061D072267F E38E1FCF204FA4FF2C07AF7627B F2 530CBC4C4B1CD72C3187CEA1E8125EE3A60B02F335CD07BB7212B6313 6DA406F44EEF8FE6406ED46CF30A43EBF7BCE34587ED611DA3B2462DB706CA6F55412DE1506D30B66 62FAC36C4C0F352112E0BBF28BA224215BF3 C:\Users\HERBBL~1\AppData\Local\Temp\~DF512E3756BE5E16.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): 1310 Entropy (8bit): E75F1C338143F1DA7B7676BC16440 F55C37A6FDE8F8AEC1743AFA6A A52E 3E6FEC237B4EE7D5034D2AC762844A44862CBE7FE127803CBC1BBD1BDC5C B277E6DF663A6778ACBA47D64DD8D8BA808E238D8722A6BE553ADAA1DB8816FA25741B64B585AAF54B46 B3D613B1B6664C826F2E2E7D0DD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA874A10C4BD62CC21D13E43B18_BEB37ABADF B472417E0 4 data Size (bytes): 471 Entropy (8bit): B556CDACB7DD3505EFF20407FE6AFAA FF06CBEB2C5BFD8CCC18DFF827536E438C A23EDF84DAA4D7206B8DAADDD1A4BF61EF5E5E65CEB0B0212BA8D81 6AD75673D2B840E20D416BA6FBC156447E07DDDFD48873EAFF788AC5635A7D D1EEE6CE 1077CD1ACCE3F2F01D700F8775CDB5EEDBE C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB070B4_EFE1845E61ACAE3C15C8 B528F0C176 data Size (bytes): 471 Entropy (8bit): AF46B74FB38C1448A378FD5FB44A1E4 C056BA50A40EA3A0FA50C68CCC17CF148BDE4E D6E45C8A04D8C374BF64D01DE5EB530B714FCF5FC7671B46DB337352E856F Copyright Joe Security LLC 2018 Page 11 of 2

12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCE3BDBF5BDD86E2AB5B471CB070B4_EFE1845E61ACAE3C15C8 B528F0C176 E26887A175B16F03AC70082EFF4E114C2D8014E01580BBF1B1CB4D1A84AE0A7BBF72A688BFB4EC767A5AE E E40FB15ADB5C3130A332D86E2F67 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A7E1E38234B_C20E0DA2D0F8FE526E140F4A2EE5A B data Size (bytes): 471 Entropy (8bit): DBE58B47825C8BBE7BAA8BB B11485E8BEF0B3D6B0CD286C0DF0D6F1E21E6 3E24F3BFAD204CFB8F4A6C4AFD0024F2F06E84B64E71BB60E6BAFD0EA A5CBAF56ACF4840F834B3FF8D5E3E27F0E4B13866A1E20DDD24605B87232E6F72A16BC4C6AD43E53 A7282B0B6F7011DAE8AB1B205BB661C64FA4 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB5DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 340 Entropy (8bit): FD62DE4ACDF36FBD30572ACB2EDE F744FD014FDBDC4A737EE4D000CC700F274FB644 1E6C11FF38EF660736EB5413EFC38052B4F6A1BBD60F0AEAF14F5637D061F40 180C BA44450CB73F631FBB05B37C520FBFFCC55125D614BA DBC2C3B240EB0D26E38C6 AD35D2D663AD002683CB83BA325CD C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA874A10C4BD62CC21D13E43B18_BEB37ABADF B472417E04 data Size (bytes): 868 Entropy (8bit): B725DCB031E180C2854C28C 145E3EB37830FC0547C415AD02E47BEA7222E1BF C71A05EF637422D6C2BC3BD24D825D56B00BF14556D0B8121E238E27BA1EC2 685ED584061BFC4F52A447DC1AA5A0115A30D024AA33B23C7DE23A A473CC24C1C2D0CDA5C51D4 3D6CAA0C126E357E026FC506CAAE455B74 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCE3BDBF5BDD86E2AB5B471CB070B4_EFE1845E61ACAE3C15C 8B528F0C176 data Size (bytes): 876 Entropy (8bit): C576EF5DA245B305FF5385AD 86E56E276B3E662CEC318A0F6B7EEABF7F012E1B B805C150B81CF818DAEF73E11F240CD4D46C060E3BDC4BD053612A B763D18EDD640745A8E315A147EFBCA433FDEE3E14B4774A40340B8570E3F1CDB3F466ACD4AD3680BAA 61B01ED7CDA4E75A03863DF8FBBE2BFF1EB C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A7E1E38234B_C20E0DA2D0F8FE526E140F4A2EE5 AB data Size (bytes): 852 Entropy (8bit): Copyright Joe Security LLC 2018 Page 12 of 2

13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A7E1E38234B_C20E0DA2D0F8FE526E140F4A2EE5 AB 82A763345E06BAD2DD C256 07E8FFDCFF5D33A62582AC637E84B2FA55E2E6 3EDD34B7DC AA36E2E4EAFF38E16D8A42225A5E3CA46828F D AA3645A86E552365D85780F622B038104F3BC64F538DD6C3F B DF ADF16F178108F8AE15024C44BF4533 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE3-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 300 Entropy (8bit): PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 5B18804E3BC E7AC4A4A 6607BA DF3A A5E83BA8683D 507C647828E8B817E23D0C7BE73B3105C32B00147D0647B35046A32BE1016 BF5DBC8CBAD84CA240A2DDAD2DE73BFC43413A4F A E8C2DAA6B0C568C702FD DF2816F74561CAE1F8C73C0DDD1AFF7 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators E6306BB52BF6F6D5D81BD0B1E36F14 3F40FAE3E27D6465D77FF7B2AF3EE06024C4 1E068EB5D61EF203FEE7246B FE54DF36075FA0F2CE1B4677 0A13C7C1546F85CF1B1738D865FDEA38DBBFE4D5B30808EDA1AA27CB4BC80ABDD1BDA4D46515D D3EA5850BDA06AE81D5FD6854D87614C5CD8 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5DF32C01-F515-11E7-B7AC-B2C276BFC88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): CE50FCEC31AA7AD4D83CCB663FFCAB B0526E3F28275A3E6AC5E4C74823AECF75BA670 BB1D6CA D335CD7B4DE50FDFCB66BA52A1DC36B6BFF7E43F74C56334 DD60A0E7CCA376321D6F84A D2CBC287FB3A55E C BC4C534ABEDC842FE1CC365 D53E1EB7FB6A671E37C41B25EE62BB26BD2 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5DF32C03-F515-11E7-B7AC-B2C276BFC88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): C10C50CD1DCFB6D5AFD3CC6047B FF0DF5DF34FEEE2A60F6534B11D7C564EF0673 AA332DEEC60D6C74A266DACBC5744FF8ED560A18FABB5E5F5B66A71DB67D D6878A6C32E BFC70C7F7B61D CB2186BB D488C6BE2D80CD7727DF174A B7ECE2A5BCCE7F08132E5AF8E1A3C7 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6815D860-F515-11E7-B7AC-B2C276BFC88}.dat Microsoft Word Document Size (bytes): 1032 Entropy (8bit): Copyright Joe Security LLC 2018 Page 13 of 2

14 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6815D860-F515-11E7-B7AC-B2C276BFC88}.dat 4B2B4C61483C63D1FA52E1CA24EDE B0DD8CF6DA311A428867C0535AD5201A008B 7CBB03163F64C5EE5F1A2C F784382DCBCD7D07C08B06AC6E0F47 E5C26607F268E216161AF2A1B131DA48F3AB05C5B46BC5F063D0BE08D08A3684D504AA808BF7AB3BE38A B0FFFF3A2DF4B152B4E22526ED0704B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA7C7.tmp Size (bytes): 1578 Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators A37D5835A4A14CBFAD788C3B71F3C F21CF355B4515C0174F5D5E5BADBF331DD70F0 F0B53707B CA2C3C782DD32BCB60DF70313A02D605B71AC1BF 07F412666F02FE3F2AA4DEC7CBC22B1BE70B71037C304001B66EA5A68050C8E2DDEE64D2DD34858B44A 4C7A8CE53660F482068FD31047E4ED08A25C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Size (bytes): 2711 Entropy (8bit): HTML document, ASCII text, with very long lines CBA0B55644BDF4DD3034F407FD677A0 540FD3EA0EB00A B0733F2CFF052DC2F 33F222E5ECD C0C755382C4AF01123A26BE11381B8DBA8E87B4C4DF 3B46126DEE6535DE4EBD4FD4225AE21545BBF7FD6D2E0FB3A7B3BCC7E1254BD74EEC6F46DE5FAD50A7E F8B2D6663CA55D8A7C07A6415FF10CBECA4A6F C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\urlblockindex[1].bin Size (bytes): 16 Entropy (8bit): data FA518E3DFAE8CA3A0E45460FD60C71 E4F30E D37267C0162FD4A C C4B4E5F883FFD5A278E61C471B3EE182636B6D124AA7 D21667F3FB081D3B57178E74EBB1B6EA7F26502C16572A58F1787DC0ADADD80CD026C7A601D416665A 81AC13A6E4A6A2FE2FDD06738AA645C07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTXDT\favicon[1].ico Size (bytes): 300 Entropy (8bit): PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced 5B18804E3BC E7AC4A4A 6607BA DF3A A5E83BA8683D 507C647828E8B817E23D0C7BE73B3105C32B00147D0647B35046A32BE1016 BF5DBC8CBAD84CA240A2DDAD2DE73BFC43413A4F A E8C2DAA6B0C568C702FD1 5663DF2816F74561CAE1F8C73C0DDD1AFF7 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\iecompatviewlist[1].xml XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators Size (bytes): Entropy (8bit): Copyright Joe Security LLC 2018 Page 14 of 2

15 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\iecompatviewlist[1].xml E6306BB52BF6F6D5D81BD0B1E36F14 3F40FAE3E27D6465D77FF7B2AF3EE06024C4 1E068EB5D61EF203FEE7246B FE54DF36075FA0F2CE1B4677 0A13C7C1546F85CF1B1738D865FDEA38DBBFE4D5B30808EDA1AA27CB4BC80ABDD1BDA4D46515D D3EA5850BDA06AE81D5FD6854D87614C5CD8 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\5WX2H8MK.txt Size (bytes): 75 ASCII text Entropy (8bit): E30C8E33552B577B2DC7AA572B8B7 CB2257C2F4357DAFC D0DA2F424E7C6F 1537AC8E3C7A3C8E47688D57A5EAF10A223445B0BBCA8D8FF78F185CE03525 BE28E418AA001681EFE78E8073DA15AE045107F1C1456F B25E1EE7070C187CD35E41DEA0F182C3 0A58D E7A44F3D2B856C60373BD6 C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\7OSP1WY0.txt Size (bytes): 36 ASCII text Entropy (8bit): F118D21C68A54D02F33573D76C742 1F080F56F5ABB76A7D87DA0B64DB1A CECF32F70E2BD1E E6AF5C3BA E1C707447E342EC5 00A4A150E A2F6A43A8E EFFF1D0FFFBDB7DABC52234B12C7870FB67D408502DCBBDC 031F7E1C5A7CB8E78ECEDB6D4373C12A50 Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection linkprotect.cudasvc.com true 0%, virustotal, Browse student.portal.forums.dicussion.boards.craftdistillery. com true Contacted IPs Copyright Joe Security LLC 2018 Page 15 of 2

16 No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious Singapore 2646 AS-2646-GO-DADDY-COM-LLC- GoDaddycomLLCUS United States 1650 AMAZON-02-AmazoncomIncUS Static File Info No static file info Network Behavior Network Port Distribution Total Packets: (HTTP) 443 (HTTPS) 53 (DNS) TCP Packets Copyright Joe Security LLC 2018 Page 16 of 2

17 Timestamp Port Dest Port IP Dest IP Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Copyright Joe Security LLC 2018 Page 17 of 2

18 Timestamp Port Dest Port IP Dest IP Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Copyright Joe Security LLC 2018 Page 18 of 2

19 Timestamp Port Dest Port IP Dest IP Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :17: CET Jan, :17: CET Jan, :17: CET Jan, :17: CET UDP Packets Timestamp Port Dest Port IP Dest IP Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Copyright Joe Security LLC 2018 Page 1 of 2

20 Timestamp Port Dest Port IP Dest IP Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :16: CET Jan, :17: CET Jan, :17: CET Jan, :17: CET Jan, :17: CET DNS Queries Timestamp IP Dest IP Trans ID OP Code Name Type Class Jan, :16: CET xcad Standard query (0) linkprotec t.cudasvc.com A (IP address) IN (0x0001) Jan, :16: CET xcad Standard query (0) linkprotec t.cudasvc.com A (IP address) IN (0x0001) Copyright Joe Security LLC 2018 Page 20 of 2

21 Timestamp IP Dest IP Trans ID OP Code Name Type Class Jan, :16: CET xcad Standard query (0) linkprotec t.cudasvc.com A (IP address) IN (0x0001) Jan, :16: CET xcad Standard query (0) linkprotec t.cudasvc.com A (IP address) IN (0x0001) Jan, :16: CET xcad Standard query (0) linkprotec t.cudasvc.com A (IP address) IN (0x0001) Jan, :16: CET x6a64 Standard query (0) student.po rtal.forum s.dicussio n.boards.c raftdistillery.com A (IP address) IN (0x0001) DNS Answers Timestamp IP Dest IP Trans ID Replay Code Name CName Address Type Class Jan, xcad No error (0) linkprotec 0:16: t.cudasvc.com CET Jan, xcad No error (0) linkprotec 0:16: t.cudasvc.com CET Jan, xcad No error (0) linkprotec 0:16: t.cudasvc.com CET Jan, xcad No error (0) linkprotec 0:16: t.cudasvc.com CET Jan, xcad No error (0) linkprotec 0:16: t.cudasvc.com CET Jan, :16: CET x6a64 No error (0) student.po rtal.forum s.dicussio n.boards.c raftdistillery.com A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) A (IP address) IN (0x0001) HTTP Request Dependency Graph student.portal.forums.dicussion.boards.craftdistillery.com HTTP Packets Session ID IP Port Destination IP Destination Port Process C:\Program Files\Internet Explorer\iexplore.exe Timestamp Jan, :16: CET kbytes transferred Direction Data 46 OUT GET /student.health.verification/sick/bay/room/234/bunk/003/owner/info@crown.com HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate DNT: 1 Connection: Keep-Alive Host: student.portal.forums.dicussion.boards.craftdistillery.com Copyright Joe Security LLC 2018 Page 21 of 2

22 Timestamp Jan, :16: CET Jan, :16: CET kbytes transferred Direction Data 48 IN HTTP/ OK Date: Tue, 0 Jan :16:48 GMT Server: Apache X-Powered-By: PHP/ Cache-Control: no-cache Set-Cookie: XSRF-TOKEN=eyJpdiI6IkUzWkM3eHVXVFViemNrcHVYTTlhNHcPSIsInZhbHVlIjoiSVpCTUZIb3h 2Q1VQdXFIS2o5WEZ3QkZzbVNQSFZDZFwvWnNKbUc4UVNzWHFDbmJKbkhqYjh0WitlcFoxK2hRSlZWTzU rogflceuetbzqtjdm2vtmlprpt0ilcjtywmioijkztvkyjfinde1nwqwodlhywriymnlzdbkntqxogz lnge3ogrhmdewodm5odnlztixm2uynwzmmduzywm4yji0in0%3d; expires=tue, 0-Jan :16:48 GMT; Max-Age=7200; path=/ Set-Cookie: laravel_session=eyjpdii6ilwvdxiyk0k5zgfwawvky1o3wgfpegvrpt0ilcj2ywx1zsi6imjwdf BlbFJxUWVRUExySDhJaEkrQWN2VFBHS211VUUxYzdzUDNXcHdzQmtybEthXCnUDBlWjRaWDJmWU3Uy trdkxps0vev051ekers2jzcxg0nlg0zz0iiwibwfjijoiztjlnge0zthhzwnhmjm0ndqzywjhyzllowrinwzkyme0 OGZjMWYzZTI4OWU5NGE5MTBmNmNlNWY1M2NjODFhNSJ; expires=tue, 0-Jan :16:48 GMT; Max-A ge=7200; path=/; HttpOnly Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 120 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b d 53 e fe 1c 7e c5 62 e6 0a cc e0 38 e1 a5 77 0d 4e a6 1c 07 1d 3e 70 7 e1 e5 66 e8 7 8e 62 2 b1 8a 2c b 2 1c ce 74 ee bf d 0e 84 7 c b bb ab e7 d 5d 3d 76 ba f e5 db e cd dd f4 0c 72 5b 88 c 46 da fe b bd b d 8 1d 47 5 d c7 f a2 6e 5c d a f a5 d c 4 cb 24 da 71 c 2d c 3c ec 0f 56 3e ee 27 a6 cc 64 a 7 6 2b 3 8e 8c ad 28 7a 81 ad ac d2 e8 05 2e bc 6b e5 23 5a 6e 05 b 5c 31 ab 3 5b b 5c c b a6 37 d0 d0 d8 5a 30 b d fb 61 3 cc 8 c8 cd f4 1c df 3d 8 2 5a 03 de fd 8b 67 af 20 7a c1 e c7 ee ae 24 d4 05 6d 6f e7 c8 31 e b 7a 04 c d 1b fe c dc 2f 7f b8 b1 f 2e 3c e5 cb 3e a2 1 6d ec 07 4e 6d 3e 82 c3 c b ed e e7 47 1d c be c0 0c 6 33 fd 1c cb b0 75 f 1 ec 7e a e c e8 78 a1 0 e5 e8 b3 b3 45 3b 8e 8e f6 60 6b ee 3f 7b d0 5e ed bd 1e 7e ab 16 5c a6 84 d a e6 c 0 8a c5 6f 6d 66 4a b 4 e0 14 b6 32 ea 8e e3 d5 6c ec d ca b8 50 8f f1 5b 73 ea ad 0 a d8 aa c f e7 21 e 0e cd Data Ascii: VmS6~b8wN>pfb),tw%qbK]=vr[F1B'`@mGn\%g6LI$q-'"6l<V>'d+(z.k#Zn\1[22I\YA0i7Z0ux-a=)Zg z$ mo1z!yf0/.<>mnm> u$gi3u~u%xe;`k?{^~\#uomfjsfck2ltfp[srqxudp! 50 OUT GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Host: student.portal.forums.dicussion.boards.craftdistillery.com DNT: 1 Connection: Keep-Alive Cookie: XSRF-TOKEN=eyJpdiI6IkUzWkM3eHVXVFViemNrcHVYTTlhNHcPSIsInZhbHVlIjoiSVpCTUZIb3h2Q1V QdXFIS2o5WEZ3QkZzbVNQSFZDZFwvWnNKbUc4UVNzWHFDbmJKbkhqYjh0WitlcFoxK2hRSlZWTzUrOGF LcEueTBzQTJDM2VTMlpRPT0iLCJtYWMiOiJkZTVkYjFiNDE1NWQwODlhYWRiYmNlZDBkNTQxOGZlNGE 3OGRhMDEwODM5ODNlZTIxM2UyNWZmMDUzYWM4YjI0In0%3D; laravel_session=eyjpdii6ilwvdxiyk0k5zgfwa WVkY1o3WGFpeGVRPT0iLCJ2YWx1ZSI6ImJwdFBlbFJxUWVRUExySDhJaEkrQWN2VFBHS211VUUxYzdzU DNXcHdzQmtybEthXCnUDBlWjRaWDJmWU3UytRdkxPS0VEV051ekErS2JZcXg0Nlg0Zz0IiwibWFjIjoiZTJlNGE 0ZThhZWNhMjM0NDQzYWJhYzllOWRiNWZkYmE0OGZjMWYzZTI4OWU5NGE5MTBmNmNlNWY1M2NjODFhNSJ Copyright Joe Security LLC 2018 Page 22 of 2

23 Timestamp Jan, :16: CET kbytes transferred Direction Data 51 IN HTTP/ Not Found Date: Tue, 0 Jan :16:4 GMT Server: Apache X-Powered-By: PHP/ Cache-Control: no-cache, private Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 2364 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b ed 5c fb 6f db fe 7d ff 0a ae f 0 2d 3f 2 b4 5 1d 03 bd 6c b3 bb b8 ed 3e a 5c b bc 50 a2 4a 51 4e 5c 23 ff fb 0d f5 6 6d 3 76 aa e0 d2 d cb 14 e7 c1 f 66 3e 0e 15 d7 a3 1f 7f fe f3 f4 e2 f bf de c fc c f c 65 fc d6 a3 0a 23 db c5 32 a4 ea a4 f5 f 8b b3 f6 eb f8 d8 a3 27 2d d 64 0b 5f 51 1f a6 fb 82 f 84 de 1a be e7 e2 a6 2a 1 aa 3 a7 c5 7b fd 63 be 44 a b a 6e bf 40 fd 6e af 6b a0 7f b0 2b c4 8f e8 37 df ee a0 b7 c a3 f8 7e d a c 51 d f5 43 4a e 45 ff 3a ff 1 fd e 0c 5b b a6 4 e8 8c d 6b b5 1d 5b 78 e6 3c a de d1 b1 40 2f cd 8a 5f 7a 6c 61 0b 2e a4 75 d0 ed c 5f 4f a d6 c1 d d d f0 6e 22 c8 dc 20 6c e dc 10 dc e0 cc 70 7b 86 db 37 dc 81 e1 1e 1a ee 1 e1 1e 1b 81 a4 86 0d 1e 1b 8e 0 e e1 30 ca 0 44 d7 e0 74 4a 7d f 88 4 a1 e8 ad c c d8 d7 f 22 a1 a8 a1 5c e5 4 f f 85 ab 3b c 2e c2 d2 db e0 2 c7 01 ac 3 bb 18 a6 37 c2 00 db a 40 6e 6 7 d3 54 4e 0f b 68 d c f8 86 cd 54 ea 2c 71 7c 83 7a 46 a8 a4 f0 a7 da b 07 a0 6e c7 40 5a 3e 2c 06 f3 61 3c d d0 1d 67 0b ce c2 62 a2 4f e5 2e f4 5a db 8 b3 a 6f 71 ea a8 e1 dd 4a c8 52 3b ec 33 b5 7a dd ee 4f 6b 8d 7c b a 8d 4f b 34 0d ad 67 cf b0 0d ae cf bd 62 b5 b1 1a c3 7e a1 27 8c 82 c5 8c 4a c5 6c cc 53 af f4 cd c da b 0 f8 4a 78 c3 bb 25 f0 42 ca a ad 12 ef 1d ec 31 3e b7 8 ef 52 c d4 b d a3 f0 e5 52 3c ee 2 dc 2 a7 e8 dd 0f 2b 1 8c 16 a8 4 b8 e a e a1 5e 37 b d 2d b b b7 0f 42 a7 ad 6b 50 a b 37 8c 28 d7 7a f3 0a 74 0d 51 6 a a 2c 0b 7 7f 3a 22 d0 a ce f4 c0 8f ec bd b ec 87 6d 28 7 e6 0c 51 b c ca 3a 36 a ce f8 d5 02 8c dc c3 62 8a 18 c2 1b ce 7c da 2e ee 6d 56 7 e5 b0 db 24 c c0 f1 dc 8a cb b4 ac bf 6c 75 c c a b e a8 bf 8d e6 c7 0e a6 36 ea 44 5f a4 fe f4 7e da d1 e c e 0a a2 2 de 31 dc b5 c e6 4 5 d6 0d e0 0d b8 06 f6 8e b3 17 d 1 0c 35 c0 2e e5 41 bd e7 41 a c ea ac 2b 23 d 8f f3 30 ad 8a d7 c7 fa 37 cf f8 cc 76 7f 35 ef 0b 03 0 db d2 e2 c 08 4e ea 7d c2 3a e1 12 8b c7 f6 71 ef e8 4d b d 1c 71 b5 4 b d6 4f b6 5c 31 8b a d 21 b1 e6 54 2b de c ea 85 a e a6 80 cd ec fa f 40 c e5 77 fd bc 52 e3 f0 fd f 5 da ba 60 1e 0d d1 1f f4 06 7d 10 1e f6 5b 06 8a 47 a dd d6 a7 20 bd b5 6 bc 21 5c d c0 4e d5 ce ca dd 71 aa b5 5f e2 af 63 0d b5 c a7 e2 6d 24 cd c7 76 dc 2d 24 fc b cb f 5d 5 bc 53 4c 71 a e7 7a 5b eb b1 d0 80 7a b b5 2c a3 bb d 57 7a f c 21 e ae 37 b2 b5 3a 25 b1 0d ad 0 be 8e 41 1e d2 a c 76 e7 b6 a 07 d4 82 5c 62 7a 33 ac ad c5 8c d3 1d 2 6e 2 72 bb f1 4e d3 7f 5d 6c 11 e5 52 1c ae ec b a6 f7 d a8 b c 0a 01 dc e3 ed 25 f5 62 ee 13 f4 c4 e7 4c 2a 0a 67 b b4 b Data Ascii: \o8}e-?l>\hypjqn\#mvpf>!wy (ya3r)&e#22''-)&b-d_qp*{cd"k6uzn@nk+7~$q!bg6cjpf%r.e:[vxirp k[x<bf*@/_zla.uvl_ocn" lfnebdp{70dtj}b0?b#0&\"\cvw`b?;'.&b)7@nytnfkh8plt,q zfn@z>,a<rc5bgbow.zoqjr; 3zOk Bm!T+u.&e@wRB@`}[Gxu i!\niedq_cm$v- $4!utO]SLqz[z,Wz& \!7:%@pVA2xv\bz3xSVPnrN]lRPvke$%&,%bL*gT HTTPS Packets Timestamp Port Dest Port IP Dest IP Subject Issuer Not Before Not After Raw Copyright Joe Security LLC 2018 Page 23 of 2

24 Timestamp Jan, :16: CET Port Dest Port IP Dest IP Subject Issuer CN=linkprotect.cudasvc.c om, O="Barracuda Networks, Inc.", L=Campbell, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU= O=DigiCert Inc, C=US Mon May 08 02:00:00 CEST 2017 Wed [[ Version: V3 Subject: Feb 20 CN=linkprotect.cudasvc.com, O="Barracuda 13:00:00 CET 201 Networks, Inc.", L=Campbell, ST=California, C=US Signature Algorithm: SHA256withRSA, OID = Key: Sun RSA public key, 2048 bits modulus: public exponent: Validity: [From: Mon May 08 02:00:00 CEST 2017, To: Wed Feb 20 13:00:00 CET 201] Issuer: CN=DigiCert SHA2 High Assurance Server CA, OU= O=DigiCert Inc, C=US SerialNumber: [ 04debb3f 136e da5ba2 53ccc0f4]Certificate Extensions: [1]: ObjectId: Criticality=AuthorityInfoAccess [ [ accessmethod: ocsp accesslocation: URIName: accessmethod: caissuers accesslocation: URIName: anceserverca.crt]][2]: ObjectId: Criticality=AuthorityKeyIdentifier [KeyIdentifier [0000: FF 0 AF C CC D A2 12 Qh...u<..edb..0010: B B.Yr;]][3]: ObjectId: Criticality=trueBasicConstraints:[ CA: PathLen: undefined][4]: ObjectId: Criticality=CRLDistributionPoints [ [DistributionPoint: [URIName: DistributionPoint: [URIName: ObjectId: Criticality=CertificatePolicies [ [CertificatePolicyId: [ ] [PolicyQualifierInfo: [ qualifierid: qualifier: 0000: 16 1C A 2F 2F E E 63 6F 6D 2F gicert.com/cps]] ] [CertificatePolicyId: [ ][] ]][6]: ObjectId: Criticality=ExtendedKeyUsages [ serverauth clientauth][7]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: Criticality=SubjectAlternativeName [ DNSName: linkprotect.cudasvc.com][]: ObjectId: Criticality=SubjectKeyIdentifier [KeyIdentifier [0000: 2D F C3 A5 5A DE 5C 36 F4 1 7B -.5OYr...Z.\ : D A4.x..]]] Algorithm: [SHA256withRSA] Signature:0000: 37 EE 5 68 B8 FD 43 A7 1B D E F 7..h..C...T6..vo0010: 4 E6 FD A D1 3E C 2 22 F EC CC E1 I..50@..>.." : 10 5B FB 0 AE 35 FB 8F 6E 77 2E 6C 36 CE C6 53.[...5..nw.l6..S0030: 3F 0C E8 BF A2 AF 4B D 3A?...Gs..Kat1%t.:0040: 77 FA F4 70 CC 0F 58 CD 72 8E 2A 84 E8 5 D 82 w..p..x.r.* : C7 DB 51 CE F5 2A D0 DE 3E CB 02 BB FF 85..Q.uF.*..> : D4 3D 1C 6B D D7 B1 10 D0 A C2 D8 E2.=.k : 77 A 04 DF 1C B4 AA 1E 24 5F B0 F F2 A4 w...$_..h&..0080: CC FC D5 4B BC 3 FB B8 10 5C E7 D C0 07 g...k...\...000: BE 4C 28 C2 D F 3D D4 AF DF C7 1F.L(...4.=...F..00A0: C0 0F 53 F F CE BB F F0 B4 3u..S..uh..'c?..00B0: EF B B6 A5 5B 46 EB 1D 1C C4 1C C5 AF 1 8F CE...[F...00C0: 3A B3 D A FE 18 :..i...&.b.j..00d0: 3D DB A E 80 EC 00 D6 C D =.e"c...u.00e0: 0A F4 06 E2 EF 5 74 BE 78 E2 B1 64 EA CF D3 D7...t.x..d...00F0: 78 0 C7 34 D A BE 6D Copyright Joe Security LLC 2018 D 5E F4 x..4...:.m.^vv@.] Page 24 of 2 Not Before Not After Raw

25 Dest Jan Timestamp, :16: CET 443 Port 4167 Port IP Dest IP CN=DigiCert Subject SHA2 High Assurance Server CA, OU= O=DigiCert Inc, C=US CN=DigiCert Issuer High Assurance EV Root CA, OU= O=DigiCert Inc, C=US Not Tue Before Oct 22 14:00:00 CEST 2013 D 5E F4 x..4...:.m.^vv@.] Not Sun AfterOct [[ Raw Version: V3 Subject: CN=DigiCert SHA2 High 22 14:00:00 CEST 2028 Assurance Server CA, OU= O=DigiCert Inc, C=US Signature Algorithm: SHA256withRSA, OID = Key: Sun RSA public key, 2048 bits modulus: public exponent: Validity: [From: Tue Oct 22 14:00:00 CEST 2013, To: Sun Oct 22 14:00:00 CEST 2028] Issuer: CN=DigiCert High Assurance EV Root CA, OU= O=DigiCert Inc, C=US SerialNumber: [ 04e1e7a4 dc5cf2f3 6dc02b42 b85d15f]certificate Extensions: 8[1]: ObjectId: Criticality=AuthorityInfoAccess [ [ accessmethod: ocsp accesslocation: URIName: ObjectId: Criticality=AuthorityKeyIdentifier [KeyIdentifier [0000: B1 3E C F8 BF D A EF.>.i...G...& : B C3 cd+.]][3]: ObjectId: Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: Criticality=CRLDistributionPoints [ [DistributionPoint: [URIName: ootca.crl]]][5]: ObjectId: Criticality=CertificatePolicies [ [CertificatePolicyId: [ ] [PolicyQualifierInfo: [ qualifierid: qualifier: 0000: 16 1C A 2F 2F E E 63 6F 6D 2F gicert.com/cps]] ]][6]: ObjectId: Criticality=ExtendedKeyUsages [ serverauth clientauth][7]: ObjectId: Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: Criticality=SubjectKeyIdentifier [KeyIdentifier [0000: FF 0 AF C CC D A2 12 Qh...u<..edb..0010: B B.Yr;]]] Algorithm: [SHA256withRSA] Signature:0000: 18 8A E6 6D DF 5C FC 1D 68 EA 4A 8F 83...m.\..h.J..0010: D6 51 2F 8D 6B E AC 63 F5 D2 6E 6C 84.Q/.kD...c..nl..0020: 8B AA B ED 34 4E B0 B CC 2D...q.[.4N..y.).-0030: 80 6A F0 8E 20 E1 7 A4 FE EA F5 86 CA.j...y...G : D F B D D FE D C Yq...k.YX=..1%\0050: A3 E6 F 82 FD 8C 5B E CD 78 E.8...[.1N.x.0060: 1A FD 85 CB 4 AA F2 27 8B 72 FC 3E AA D I..'..r.>..A0070: 0B DA D5 36 A1 BF 1C 6E F 5E D 48 7C nGI.^.H..0080: D FD 8B 4 A EB D A4 64 0A...I..&B@...d.000: C4 F5 1D D6 02 5E 6B AC EE C4 80 A WT...^k...r00A0: FA 56 3 D7 FF BF BF 0B 7F 4E FF 57.V N.W00B0: 05 D 24 ED 85 C3 2B FB A6 75 A8 AC 2D 16 EF 7D..$...+..u C0: 7 27 B2 EB C2 D 0B 07 EA AA 85 D3 01 A y'... (00D0: D2 81 E3 AA F6 EC 7B 3B 77 B AYC(...;w.@b00E0: EF E DE C0 33 B 67 D3 61..AE...>..3.g.a00F0: 2E E4 6 FC E 70 F5 1E C B4.r..i...W@.p...] Copyright Joe Security LLC 2018 Page 25 of 2