ID: Cookbook: browseurl.jbs Time: 19:59:33 Date: 23/03/2018 Version:

Size: px

Start display at page:

Download "ID: Cookbook: browseurl.jbs Time: 19:59:33 Date: 23/03/2018 Version:"

Daniella Briggs
5 years ago
Views:

1 ID: Cookbook: browseurl.jbs Time: 19:59:33 Date: 23/03/2018 Version:

2 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview Networking: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets ICMP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Code Manipulations Statistics Table of Contents Copyright Joe Security LLC 2018 Page 2 of

3 Behavior System Behavior Analysis iexplore.exe PID: 3332 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3420 Parent PID: 3332 General File Activities Registry Activities Analysis ssvagent.exe PID: 3484 Parent PID: 3420 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 34

Analysis Report Overview General Information Joe Sandbox Version: 22.0.0 Analysis ID: 51608 Start time: 19:59:33 Joe Sandbox Product: CloudBasic Start date: 23.03.

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 19:59:33 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 8m 41s light browseurl.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 4 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean1.win@5/20@10/3 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Show All Exclude process from analysis (whitelisted): dllhost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Copyright Joe Security LLC 2018 Page 4 of 34

5 Confidence Strategy Score Range Further Analysis Required? Threshold true Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Copyright Joe Security LLC 2018 Page 5 of 34

6 Analysis Advice Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview Networking System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section Networking: Social media urls found in memory data Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Urls found in memory or binary data Uses HTTPS System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Copyright Joe Security LLC 2018 Page 6 of 34

7 Behavior Graph ID: URL: Startdate: 23/03/2018 Architecture: WINDOWS Score: 1 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Hide Legend started Number of created Registry Values iexplore.exe started iexplore.exe Number of created Files Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious , 49408, 50323, GOOGLE-GoogleIncUS United States unilil.bid , 443, 49171, CLOUDFLARENET-CloudFlareIncUS United States 2 other IPs or domains started ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 20:00:00 API Interceptor 3671x Sleep call for process: iexplore.exe modified 20:00:01 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Initial Sample Detection Scanner Label Link 1% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link ocsp.comodoca4.com 0% virustotal Browse Copyright Joe Security LLC 2018 Page 7 of 34

8 Detection Scanner Label Link x.co 0% virustotal Browse unilil.bid 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 2018 Page 8 of 34

$exe (PID: 3420 cmdline: '' SCODEF:3332 CREDAT:275457 /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3484 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.$

9 Startup System is w7 cleanup iexplore.exe (PID: 3332 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3420 cmdline: '' SCODEF:3332 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3484 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log Size (bytes): 89 ASCII text, with CRLF line terminators Entropy (8bit): F613B7E50E BB0A2AF294E5E5 D45B8CFC FD8C70D7FE FA6AE4 0F5679A3D C8E2B92E8B73B1459EA8F50FB441410A8AF8F72708BD0A1 86F B2BB3C6B5E19C5D7FF2F2A11BE91F106FFE0BB1B3900E1F9D C3E110636EBEC5B975D35E32 7DD1DCCAA94C DACB2C853AFE3756E96 Copyright Joe Security LLC 2018 Page 9 of 34

10 C:\Users\HERBBL~1\AppData\Local\Temp\~DF19A446DF34CDFFD2.TMP data Size (bytes): Entropy (8bit): DA6790B066B58715CFB4C A0 0087FA1D69EACECB7C0E7CFE1D7E46E7F2D2C909 D47A956A01094BC29F0803B5CFC76EB07D08E84F0BB6E25556E63D8FDAB62F0F 90BA88AAF6298B2E428A6AF7818D5D1A508645FD810DFB810494CDD2E63A34802FB846F4D5B2BFB84A6DA4578D 3AE164B3FF27EB1A62FE4C29DC63768A7522CE C:\Users\HERBBL~1\AppData\Local\Temp\~DF2C3E2BFDF23C3DE9.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): F5066AD29EF5422EFC055A11528CFAF 6E73CDDFF3BB69AEB3751B7DEE449F E4 E3F30C E478FBE33EA10EBC0ADBD835940E8488A67C848A272BBB97 FA95A24449CCB7396FC4C432C3F4AE22A EBCF1581AB52EC7E337A9601C749EE06A485A2CE042DC20 9FD04AB57CDA EFDA296A0C5BB18DA C:\Users\HERBBL~1\AppData\Local\Temp\~DF523AB0337BE8D73D.TMP data Size (bytes): Entropy (8bit): EC72F777E1383B78B44D87FE520F63C5 A79148EC578421DFE35D746828B3D E393 6D502A36777CF5B0DFEDD20DD02E D907B950456C4E896BB97FFC57E23 8A7D708CA7088EFE3AC6E511483E2FF35144D31F B8EE61AAE8541C955479FD0CD24814B1C33C809FDF9E D10DDBF0D57D2FF13CA3FC184D446431C501C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Size (bytes): Entropy (8bit): Microsoft Cabinet archive data, bytes, 1 file true 06ED9A39AC55EB00DD78E416E1A804F D D86FF89184BA5ED45708D38BD9 298BBA62CAA0B61A402F715BB5B8D1D28ECD0B58D9A9B6B8AE7947B39DA8B1EB 6A3A747BB754D9BFB78D18E37CD E00EEE85C59E16E3FCB B422BE94A83D4FD447912CC516A77B 2D17A A40B75C2831A6548D63287 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 340 Entropy (8bit): C047974C96697F8B46E5D837B0C50B2 D6FA4F73870EE82FA431ECC7547F52A618DC90C E845BD6E8E0F80D1E606939C23B32DF69C3548A98AD040AEF7143C4EBF6 60F61B585EE7BB0C1042C1B7EA59B71BA89576F57EBFCC E28D08EC9B9CAB1F2079AE E60E7B 38BA67D B98DAA6AA6A5AEDE77FB2AAA Copyright Joe Security LLC 2018 Page 10 of 34

11 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 330 Entropy (8bit): E6977D06F EA20C6B1A4 ABD48F206126A7E2F F5AA13A6D97 DD9DE1D4E3832B E50B4B8C569A4FBD66948E295A5AC39BA1F5A B2FC036E716CB BEB8C808CD06377B56BC4017FD8EF8CE10BAB D3AD99F33C42A3AA6E B526E6E7C5F6B2B4429F605FB07DF5FB1A49B9 C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators CD92626B9D868BA5417FF14EB9EF62E4 4FCD235DD7E53CB77B6A2A75D7ECA328F4C59640 F9B944E6B F3FB14890F2E53DF240D46EEDB7FA06A3A4E9AF78A1 485C66EA2AD29B0A4DDC8FEF912F5C67895C1EAC0DDDC71930B180205B629CAAF841738E33231FCD72E802994E 088FEB729127E67E568CE7DA3959D45AC714BA C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{623319D1-2ECC-11E8-B7AC-B2C276BF9C88}.dat Microsoft Word Document Size (bytes): Entropy (8bit): B176EF39BB1ABBA4C9389BED606CE Copyright Joe Security LLC 2018 Page 11 of 34

12 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{623319D1-2ECC-11E8-B7AC-B2C276BF9C88}.dat E3B4D43A026D7ECCFC175E7483AE46A2CB A6C0AB4C901F5634B2D42B23E10E6C62FFC2960AC8118A AFB6 B58CC9C30F2F4D2976D813193D58938F396F8DEB7077BED43E6CD1D4CC774E68770E7A195D5BFE E3 BA31965A981B FD1131FACE85AF45 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{623319D3-2ECC-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): AE43019F33D1E555A16CB40860BB 770BB006AAD852B9A690542A29A06C21D2918E E80DF82D0B87B8B3B5D9438C365C430BEE28347B2BCE2486AF5A91E9877 9D6049EEA4B3BED4D84244C87BA44DED3862F0317E10A8F42144A4FD926EAE646FDCE4E40A6D92BE726DF0A56 AB5400BA8C D24E1BA7AF4218A6651DC1 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6BF0EBD0-2ECC-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): D9B22A230D BBDD7A9B0F0 54FDF7581C900CA761CCF08F99C ED20CE 3ADDD0ADF947429E4BCD C2FB606028D481912F86776D4EB0B6A1D0 872F006BBFDB02EB7C655F42E5051FEF428B234BEB EB9B69F65106F2A52E69D8880E4636F6B7 A93834FAF7F9478E9E0577D2FB90A807398F C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver87D0.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED97 0E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\favicon[1].ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\iecompatviewlist[1].xml XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators Copyright Joe Security LLC 2018 Page 12 of 34

13 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\iecompatviewlist[1].xml Size (bytes): Entropy (8bit): E5C53C B F1D541D440B 81EC E699A0BFA191B2AE1B74320D316CE 7DA1E84B3EE4D8FAD40B8A2B775F2CE1D8C38931D6B403294AE4EE8426FAFB7F 8094EA2119B2D321EB62916CD5584A8DF20A BCDBF2E9F20D5EEB5306D1F30A8607B EFF3F2E31 6F3634DAF3EEADFDC CB1C961644A92 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\suggestions[1].en-US data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\A0HY48A1.txt Size (bytes): 111 ASCII text Entropy (8bit): DA1F34763F ECC966ED E1D65F9CEFAB3F FE75929CB07F1C740 A487DEC03A68F5FB419D7CDAFA0E03B809BE EB00ABBE699C473 D85AB2CE993D11DE4CE032EF43AAB316C19D871B0E7FA67BEB7D4978DB52F5D8A574FF2F548E1F12E4B47455B 697B332EBCA363AA449CFC2F95D88681A70EF98 C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GCNQ98VWFEFN0WC4104M.temp data Size (bytes): 3358 Entropy (8bit): FAC9D9DF81098D4CFC3A00E844AE4D 1572B17D9786B266A60E E9891EE9875 9D076565D2A2A9C64AC58EF30EDF19A64E6A22C EA76CABC35 08F02591A17D9256F8B5C394AC081024C40B459A1B3CECC33EAB71811AA432C796213F0FD62C43021A2132B9AB3 D336473A41C419F46882AE E6738FDC \samr Size (bytes): 116 Entropy (8bit): Hitachi SH big-endian COFF object, not stripped 080E701E8B8E2E9C68203C150AC7C6B7 4EF B805758AE1D3B122F9D FE129AE2A7C F6F51091E6E512C9FEACA1042A1E9DB914C651FEB344D C11D88B8E355B7B922B B693F75BA4C2A62F9137A15842CA82F9B6B3ED13059EDC0DF1C04E7DE43719 D892B4C0D22BB67BE0D57EAB368BA1BC057E79 Copyright Joe Security LLC 2018 Page 13 of 34

14 Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation ocsp.comodoca4.com true 0%, virustotal, Browse unknown x.co true 0%, virustotal, Browse unilil.bid true 0%, virustotal, Browse unknown Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States GOOGLE-GoogleIncUS United States AS GO-DADDY-COM-LLC- GoDaddycomLLCUS United States CLOUDFLARENET- CloudFlareIncUS Static File Info No static file info Network Behavior Network Port Distribution Copyright Joe Security LLC 2018 Page 14 of 34

15 Total Packets: (HTTPS) 80 (HTTP) 53 (DNS) TCP Packets Timestamp Port Dest Port IP Dest IP Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Copyright Joe Security LLC 2018 Page 15 of 34

16 Timestamp Port Dest Port IP Dest IP Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Copyright Joe Security LLC 2018 Page 16 of 34

17 Timestamp Port Dest Port IP Dest IP Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Copyright Joe Security LLC 2018 Page 17 of 34

18 Timestamp Port Dest Port IP Dest IP Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :01: Mar 23, :01: Copyright Joe Security LLC 2018 Page 18 of 34

19 Timestamp Port Dest Port IP Dest IP Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Copyright Joe Security LLC 2018 Page 19 of 34

20 Timestamp Port Dest Port IP Dest IP Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :02: Mar 23, :02: Mar 23, :02: Mar 23, :02: Mar 23, :02: UDP Packets Timestamp Port Dest Port IP Dest IP Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Copyright Joe Security LLC 2018 Page 20 of 34

21 Timestamp Port Dest Port IP Dest IP Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Copyright Joe Security LLC 2018 Page 21 of 34

22 Timestamp Port Dest Port IP Dest IP Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :00: Mar 23, :01: Mar 23, :01: Copyright Joe Security LLC 2018 Page 22 of 34

23 Timestamp Port Dest Port IP Dest IP Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Mar 23, :01: Copyright Joe Security LLC 2018 Page 23 of 34

Release Letter. Trufa

Release Letter. Trufa Release Letter Trufa 4.1.16 2016-04-22 Content 1 Summary... 3 2 What s New?... 3 2.1 Business Drivers Dependency Wheel... 3 2.2 Raw Data Synchronization Facility... 4 3 Prerequisites... 6 3.1 Trufa Access