ID: Cookbook: browseurl.jbs Time: 15:40:31 Date: 11/04/2018 Version:
|
|
|
- Felix Hopkins
- 5 years ago
- Views:
Transcription
1 ID: Cookbook: browseurl.jbs Time: 15:40:31 Date: 11/04/2018 Version:
2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview AV Detection: Phishing: Networking: Remote Access Functionality: System Summary: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info No static file info Network Behavior Network Port Distribution TCP Packets UDP Packets DNS Queries DNS Answers HTTP Request Dependency Graph HTTP Packets HTTPS Packets Copyright Joe Security LLC 2018 Page 2 of 44
3 Code Manipulations Statistics Behavior System Behavior Analysis iexplore.exe PID: 3412 Parent PID: 548 General File Activities Registry Activities Analysis iexplore.exe PID: 3480 Parent PID: 3412 General File Activities Registry Activities Analysis ssvagent.exe PID: 3568 Parent PID: 3480 General Registry Activities Disassembly Code Analysis Copyright Joe Security LLC 2018 Page 3 of 44
4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 15:40:31 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Cookbook file name: Sample URL: 0h 11m 51s light browseurl.jbs s/2011/10/zzzzygol.php Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 6 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout MAL mal56.phis.troj.win@5/40@3/3 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Failed Failed Copyright Joe Security LLC 2018 Page 4 of 44
5 Cookbook Comments: Warnings: Adjust boot time Correcting counters for adjusted boot time Browsing link: cmd=login_submit&id=89af8e6f8859ef8579f 68bfcc382e9ba89af8e6f8859ef857 9f68bfcc382e9ba&session=89 af8e6f8859ef8579f68bfcc382e9ba 89af8e6f8859ef8579f68bfcc382e9ba# Real link is: cmd=login_submit&id=89af8e6f8859ef8579f6 8bfcc382e9ba89af8e6f8859ef8579 f68bfcc382e9ba&session=89a f8e6f8859ef8579f68bfcc382e9ba8 9af8e6f8859ef8579f68bfcc382e9ba# Browsing link: cmd=login_submit&id=89af8e6f8859ef8579f 68bfcc382e9ba89af8e6f8859ef857 9f68bfcc382e9ba&session=89 af8e6f8859ef8579f68bfcc382e9ba 89af8e6f8859ef8579f68bfcc382e9ba# Real link is: cmd=login_submit&id=89af8e6f8859ef8579f6 8bfcc382e9ba89af8e6f8859ef8579 f68bfcc382e9ba&session=89a f8e6f8859ef8579f68bfcc382e9ba8 9af8e6f8859ef8579f68bfcc382e9ba# Browsing link: cmd=login_submit&id=89af8e6f8859ef8579f 68bfcc382e9ba89af8e6f8859ef857 9f68bfcc382e9ba&session=89 af8e6f8859ef8579f68bfcc382e9ba 89af8e6f8859ef8579f68bfcc382e9ba# Real link is: cmd=login_submit&id=89af8e6f8859ef8579f6 8bfcc382e9ba89af8e6f8859ef8579 f68bfcc382e9ba&session=89a f8e6f8859ef8579f68bfcc382e9ba8 9af8e6f8859ef8579f68bfcc382e9ba# Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, dllhost.exe Execution Graph export aborted for target iexplore.exe, PID 3480 because there are no executed function Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 2018 Page 5 of 44
6 Strategy Score Range Further Analysis Required? Threshold Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample HTTP request are all non existing, likely the sample is no longer working Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior Copyright Joe Security LLC 2018 Page 6 of 44
7 Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis Signature Overview AV Detection Phishing Networking Remote Access Functionality System Summary Hooking and other Techniques for Hiding and Protection Click to jump to signature section AV Detection: Multi AV Scanner detection for domain / URL Phishing: HTML body contains number of good links HTML title does not match URL Suspicious form URL found META author tag missing META copyright tag missing Networking: Social media urls found in memory data Downloads compressed data via HTTP Downloads files Downloads files from webservers via HTTP Found strings which match to known social media urls Performs DNS lookups Tries to download non-existing http data (HTTP/ Not Found) Urls found in memory or binary data Uses HTTPS Remote Access Functionality: Contains strings related to BOT control commands System Summary: Searches the installation path of Mozilla Firefox Classification label Creates files inside the user directory Creates temporary files Copyright Joe Security LLC 2018 Page 7 of 44
8 Reads ini files Reads software policies Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses new MSVCR Dlls Binary contains paths to debug symbols Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Behavior Graph Behavior Graph ID: URL: Startdate: 11/04/2018 Architecture: WINDOWS Score: 56 Legend: Process Signature Created File DNS/IP Info Is Dropped Hide Legend Multi AV Scanner detection for domain / URL HTML body contains number of good links Contains strings related to BOT control commands started Is Windows Process Number of created Registry Values iexplore.exe Number of created Files Visual Basic Delphi Java bestdfw.org , 49408, 50323, GOOGLE-GoogleIncUS junelavonne.com started.net C# or VB.NET United States C, C++ or other language iexplore.exe Is malicious 2 31 bestdfw.org , 443, 49169, DOE-HQ-USDepartmentofEnergyUS United States junelavonne.com , 49167, 49168, 80 HOSTNET-DE-ASDE Germany dropped started C:\Users\user\AppData\Local\...\login[1].htm, HTML ssvagent.exe 6 Simulations Behavior and APIs Time Type Description 15:40:44 API Interceptor 451x Sleep call for process: iexplore.exe modified 15:40:46 API Interceptor 1x Sleep call for process: ssvagent.exe modified Antivirus Detection Copyright Joe Security LLC 2018 Page 8 of 44
9 Initial Sample Detection Scanner Label Link 9% virustotal Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains Detection Scanner Label Link junelavonne.com 1% virustotal Browse bestdfw.org 0% virustotal Browse Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Copyright Joe Security LLC 2018 Page 9 of 44
10 Screenshots Startup System is w7 cleanup iexplore.exe (PID: 3412 cmdline: '' -Embedding CA1F703CD665867E8132D2946FB55750) iexplore.exe (PID: 3480 cmdline: '' SCODEF:3412 CREDAT: /prefetch:2 CA1F703CD665867E8132D2946FB55750) ssvagent.exe (PID: 3568 cmdline: 'C:\PROGRA~1\Java\JRE18~1.0_1\bin\ssvagent.exe' -new 0953A FD1E655B75B63B9083B7) Created / dropped Files C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log ASCII text, with CRLF line terminators Size (bytes): 89 Entropy (8bit): C3811BA23EE83D7F641DA209564E AF9C38DCBC33A0C23D6384F B7E8D0B2AB2A9D80CD6EB8AA032F33B7C820200DBDC17ACE59413D91032FB7F Copyright Joe Security LLC 2018 Page 10 of 44
11 C:\Users\HERBBL~1\AppData\Local\Temp\JavaDeployReg.log AB1879DFD4CA10E0D82B2B39B5953D9C86B465C3D864A032D9AF762A3FA7D578C29DF5C BB466F 71D3A E5D1D70198A723D7DC38E59BB C:\Users\HERBBL~1\AppData\Local\Temp\~DF248F18C99E TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): B564B15EF76C4B32DDD02B6D9D4795 6D46CCACD54BBADBDD22D138E87FC781C3EA3908 F397357A708E2F36AA7EE180FB4E0335AA31E29478D2ECC912F A3875 9DA37DAE2430DEBFB4F039622B7AED8614C D6022C4070F56DB5211B37A844FCEFF F05CD40CF88EDB2D29419EAE64842FBD525 C:\Users\HERBBL~1\AppData\Local\Temp\~DFC2D B9B.TMP FoxPro FPT, blocks size 258, next free block index Size (bytes): Entropy (8bit): DAD2EF9E A5B B459 0AB4BB3A856C0EFCBD96F9E683564BE5AAD54713 CDFB39AB1608C1B66037BA3F46BA4594C8024CCE35C0A07CD424D CFAE154645B0048C4A76422F2045A6D5AFB B40F8ECBE1E75D91ACD7367D659ADED195BBDDD0318C55 24FFF1BAC0D9BCF2AD0EC168476C5F20DEEB59 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B B5E195ECB0E8F243A4 data Size (bytes): 896 Entropy (8bit): F4DE9D7ED07B90F74B30F8E6F338ED 5F4AF4AA669988DC C3E529D7E1 DE7D8C72B389E18C8B1C835B0DB12A3A3EBABCAD3496EE63D2EC7DF594D62541 BDC1DA76BDB19EA306C1F66CE8FDBD9384D0F65580B04DAB5286C8F5A66D25F5DD9F4B17DDC7DFCB6D9F1D3D 64687A80371AD96B33EA8B85509ABC7D96DA34E3 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E0 4 data Size (bytes): 471 Entropy (8bit): B93B055F18ED02AC BFA E49C843005A144BE3DE9485B1F9BC4E5A9126D A2649B55B45DF55AC2A B428AD312A749BDA88AA21B6C800DCE6AD4CED 1A7E8C92A1516E9B2E224E239C29EA395C615585A429B5FDF66B794DBBE6336C2BCE435ACD4F145563E5ACB4E DDBE001566E1BB345BF9F6F5EAE0341B9AAB2A6 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Microsoft Cabinet archive data, bytes, 1 file Size (bytes): Copyright Joe Security LLC 2018 Page 11 of 44
12 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F Entropy (8bit): true 89BDF8CFF3B90356B6E57BD51F6DDEE8 EE5CE85ABD2594DB8050B76462E7AB602D9E169D EA99A003C32F94FBBEDF5965E2A9DA9C1D7FAD954D37E9596CFAE90C4FE725F0 F31DEC84A3819B12E70324B8E239FCEE0D52C3A451E7AA4744E38D9F870C1D01786D5E8F9A355E440C82A1ECCA A199C379C9F15F2745D8A1C68E178CA187FB37 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 4267 Entropy (8bit): CB0B90F6C6A2563D3C53A8ED7A30C F896BF9EC591F63AD144F89D0FEBE13148EAA491 BFD1A7921FDE6D8D42495F1C9C87845F6C97A7232F7BDA9ECDE183716CE797D4 D9C59B7D2C9678A1BC39077AEB6AA1DCE982D554BDE3EC3E0FE579F45751E728842DDE6460A0EDD6DDA1CB6A 3FBAD78CE117AC77C4DB9918EBDBA1DF50FA4271 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A data Size (bytes): 1786 Entropy (8bit): AEB4E76C6F68EFD7A48092E9F0F A035C0BDCC3DC09C881E788F7FACA53C6B458 FE1B9A0EABF44FDBE4DDE97C3CC1209FAD2FBB2D2D7476FFBF64066BD9919A4F 50D98FB4C9875B1AED0AEC06A9C934DB5010B6C5F54539E323EC14FD487E1D92D01652E4614DDF308AB2F1EDE A9E9CB1E23030C971255CC106016C6E7BBAF48C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B0 8 data Size (bytes): 1398 Entropy (8bit): DA79BFE5361DD1075C4D7B9F42294C8D DA80C39672A8657A632E964374A1BB5DF27DF4C9 3E69F628925E417CA625A3B65F2A6E0ECEA0B7C5DB69A97ACB0D EE1E8 5CB05AF401C063F0E488D79660FC3EA14FC46E823319F2557B77812DFD7EDD333A4F3F1D8BCF2DCC8157EB7EB ADC BE8A2A7AF3067B6E2FE30B93DC2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 data Size (bytes): 340 Entropy (8bit): ED983663C5DACC803FD572115CEF2E8 2BD53993AB850EB7932DE647831C0E46223C9486 E9E8DD59FA821AD9A29C69C3194A799E1761F70D B9858C8AED4D225B 2FE09A EDFF96074A66AED D14F84F1E043F87D95884A5B78CF272ADEE70409F55DC301989EF2 B47B65E4A378D0EB D2EACBC58AD90 Copyright Joe Security LLC 2018 Page 12 of 44
13 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B B5E195ECB0E8F243A4 data Size (bytes): 204 Entropy (8bit): D6609E C0F089A9D29C757CF B181A A329FD60149E9B5F88EB2F2F BA F08A538DE4FE7D210FEF4242F D91F6EC0E92A0 D6467BD760251FF79E25CBBFBA448F59AF0234A5D5027D5CD1C8B366D3F07C7AA4F7CB8D118868F62AE6355C84 423CCA3E23572FB4CC132E8972D67C366BD2C2 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF B E04 data Size (bytes): 868 Entropy (8bit): EAC18C929768A88D5CEB451D5A9621 BC6108D4C2C78591BED56EF14B77C2F9352EC98F 4AEA966DFFD963F71517EE93C8D9324CB79DCF8C7089E7A697BF5E12A53F2CC2 287A FCDD7AF04CA046A28F8F32D935C3F592B3E00E8CDF83F3ED6C E16090CA6167D5559B56561 A5165D3F9E66A28B56B2D16C68B91D C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F data Size (bytes): 330 Entropy (8bit): C1D0A227D2F7ABD2DF21B2D34F1A2CBB 08E54DEADBF3B4496BDF629F8A558F7E959FDF0A E9B3DE5F360C9371E124C AE C03AAB3DC2794D935EC 9E5247FEF70E91A62898DFBB2E44552E6A D9F683AC2693ABB3580B28B31F2780ECC A CD00E5BD01DCBB704DF02AABCCD06B40FF C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F data Size (bytes): 452 Entropy (8bit): A67207F9F7C2A6C FDEF4DF C F06111E9 71B793A76A21CF6B53FDD46ED2B5A2D49988A7A7F39F720B1FF94E84012D5A02 B6A2402A27D45AC1EF587291C69A8413FF9CCE6B606FFFF00BCD2F3355D114A4F348E2C4E2FF3F9049DCD8237A 0610CCB1C0A6945D88D68E CFF5 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A data Size (bytes): 424 Entropy (8bit): F18E0BD34CDF880B6D1FD85F33231F41 9ABE8E57F2B9DE1796FD45E705D18B550D F3F8073F80FDC6C B820949D885291B6D44F1E0BB94634FA35716D6E8 Copyright Joe Security LLC 2018 Page 13 of 44
14 C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A 629FCDE AABA0498AD0CD736BF F07D4EA63DF77F916B08F003DDF414CC7882DB424A93BC17D F07CA8EC2768CA409CC2C2BB6978C C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B 08 data Size (bytes): 1028 Entropy (8bit): E4015D8451CF0DA CF263A7 BF33DDEDF4E77A762BF0C88B01F225D A08AC47B76E4012FF83CA10A9BCDEAEFA9A36CDD FF930B3A6ECAA160 D546941ACEB B6F0BEB5A78A5A13BA7C6F29F646BF3FA81CE71264B41B8B B2D0CB65C8FDF 6122B466CE7AF7A68A9C6CB1E7645A99FE67ED C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 09B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 1CA34CA6009AF B43C9EEAC DAF5B FBEF3177B910BB9AA276C4F D06DDD41309CFC3CF8F0C5ED66F2DBD0EE917190DAE14D6999FAC0637C2B26C2 82AB95028E8CA516A FEBB9061CE45AF67B778BC7B7642F186BA61E9889D CE954C8858FE9F07E2 E10C948A6D4ACB5EF6F3DA5018C39EDE4A848 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EE5E16A1-3D8D-11E8-B7AC-B2C276BF9C88}.dat Microsoft Word Document Size (bytes): Copyright Joe Security LLC 2018 Page 14 of 44
15 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EE5E16A1-3D8D-11E8-B7AC-B2C276BF9C88}.dat Entropy (8bit): B8FCF9399BD05DA3C8F6B4CBAA5F207 8AF9C92D5CA46EF C1B1411E AB48EB25F43C EA3BE870E38248B1F148123E2A77AA5765C59F323 9B6C146AD963A1B27ECF966B75D64AB0BBC6943C990E1920E3CFD5B9AB9536CB04BD24D11E247309DF4B76DF8 1D7EFB9CFC548F61F8985D6CB7E606E77C6674E C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EE5E16A3-3D8D-11E8-B7AC-B2C276BF9C88}.dat Size (bytes): Microsoft Word Document Entropy (8bit): D910ED41C523F96DAD2F63A6D254 CEAA508E05E65D4657BC D247D5D21C5 622DAC F9025E9B6D3C4806BB7C F13100BA40A 526FFC76637F746EB CB93D81507F658AE5873BD7E8B7D87F45B4EF569D5996D D607F7D73E79A55 F335344D8F4A60898BAB658E34512C774E55 C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver126B.tmp Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators 095C72688DE7D90E6526DC0D8878F3F6 A1CAE182FB7E86C74FB5467C0014B2A27472BE DA E9B4B0D245C5B7E1FAC1242A087DED44EAF3B792E4A231E AB7FD229A6F532AE11E4CCEB01F823810B33D5C740BC9F290C79646C422AFFC27DDB8476C931D6E4A9686EED97 0E219B6CEBBF68F9A12B6C629B6816CDE1615C C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\fb4mf11\imagestore.dat data Size (bytes): Entropy (8bit): B2A6759AEE994E7B8B41CFBDD3D60646 A0FEB6EE02A198C3E644F65A489A8141B45A78B4 BA15784A9387BB C304883B123BCE12B1ACDECCEA219F9EC4555FC483A 275E249100A97C523B586380B2ED6DC81A403FAA51B157D323B56C821609B52F34F03293E1D1B B C21A85B616B6B3E9D75A29CE439EEA01D2A C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\iecompatviewlist[1].xml Size (bytes): Entropy (8bit): XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators CB5C06CAECCCCB809C12E3109E7A6508 D082EC34FE89EEC747CEB5B4E ADAD D4C25AEDE32AEAADE78F8423B2E062D2E54C1298AF61906D6F5C25DB1D C1720D948EB387BCD03C467E7CFF96EDB5310FAE397EAAFDF9CDD429EB57662C6C338772BA4D2E ED9A82D24B639B55459B42EA3F416ACC Copyright Joe Security LLC 2018 Page 15 of 44
16 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\login[1].htm Size (bytes): 3640 Entropy (8bit): HTML document, ASCII text, with very long lines, with CRLF line terminators BA17A5671EF90D83FC925AC7D67C7A3A CD63A5EE1987E8D372FEDACCF70023D7 BE447B07EB4AC11F3B49DA2E6DAA7B9AB603823A556B B13B08E45F 14E4D8B8A3119FFE40D066566B0A56DFDBF0D21C795D5BA80B03FD004542BD40B941A174A773F541EE69DF BEBBF7D3A92DE617AEE2FC97C89E0C6D3 true C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0316J1PS\suggestions[1].en-US data Size (bytes): Entropy (8bit): A34CB996293FDE2CB7A4AC A 3C96C D1A77873CD62BC639B3A10653F C6A5377CBC07EECE33790CFC70572E12C7A48AD8296BE25C0CC805A1F384DBAD E1B7D F E70F68B1BE6FD0CA65DCCF4FF D44278D3A77F704AEDFF59D2DBC0D56A6 9B2590C8EC0DD6BC48AB30F1DAD0C07A0A3EE C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\favicon[1].ico Size (bytes): Entropy (8bit): MS Windows icon resource - 6 icons, 16-colors 12E3DAC858061D088023B2BD48E2FA96 E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5 90CDAF E C605D D348116D198F355A98B8C6CD21 C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0 D349B247EB4912EE169D C719CD01 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\m1[1].png Size (bytes): Entropy (8bit): PNG image data, 1365 x 172, 8-bit colormap, non-interlaced B18BDDCF949A40BDD86A46AA80 4DA462567DA67AA4177B0E8D1ECEA502715F9E3B D1EE29B8B B737D E91CB08ABE71D4DE7F52B EBF869BF7E2536B1687A51B0D4BC2F E32295EC24B26738DB18D7DCBFC0FCF0007C61932F19B7E4 B6D F8A7882A70C16AA06F DB4 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\m2[1].png Size (bytes): Entropy (8bit): PNG image data, 1365 x 161, 8-bit colormap, non-interlaced 9BD0B2CB90935A91F839A15352FF04D2 ECEF60AC349256FF7C526CEBED9907FD2A56939B 85BCB E212737E9FAB C3BCE991160E82936A F7A69AE2 70E B7CCEE277AB9F48972FC4436A4421EFA3F8E EBDF50CC1FB274CB8BFA F4611 A A1478CA56DE3AA758AC1C64DE4C2 Copyright Joe Security LLC 2018 Page 16 of 44
17 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\m2[1].png C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0TZNT9WD\urlblockindex[1].bin Size (bytes): 16 Entropy (8bit): data FA518E3DFAE8CA3A0E495460FD60C791 E4F30E D37267C0162FD4A C C4B4E5F883F9FD5A278E61C471B3EE B6D129499AA7 D21667F3FB081D39B579178E74E9BB1B6E9A97F C165729A58F1787DC0ADADD980CD026C7A601D416665A 81AC13A69E49A6A2FE2FDD AA645C07 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\m3[1].png Size (bytes): Entropy (8bit): PNG image data, 1365 x 176, 8-bit colormap, non-interlaced D9C566425EF2385EB0785C5FF856A079 7C061BC679276CEF0EE7B0BE439CDF4669B2B B0BD86269DFB4078AFD96B5AE78CB3AE8D2C9BCBE5EEA33AAFFC809732D8 DD431D9B4A8F568C AD0370A95D382443FA02B61C7BF12BE1BCDF6BA0D9B373CC60FDDDB8D58B A071BDAF70B1F76370E3F4FC5AA329CABE61 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\m4[1].png Size (bytes): Entropy (8bit): PNG image data, 1365 x 164, 8-bit colormap, non-interlaced true FF694312BCC58FC9C20DC9CFBB6C488B 6A539605A9416CD697A EAEFE47DF0F F26462D064118C9B7D78A5B023F74B1F9BB653E0CE0720E428BE19FEA1A3427F 8D813A07892AE8434C1C50EFB5D9F1B9E65CD485DCBC61DD50C8DD68E20FF9ED8D6CD511F76AFD44096ACAC3 E406D0FB10D1F0984AE7025F8F5D02A295419A19 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\m5[1].png Size (bytes): 1921 Entropy (8bit): PNG image data, 205 x 16, 8-bit colormap, non-interlaced CBFA20DF831553C3036A53241BD32BE3 FEBA9D1A96AAB8B6274AC58B97E5FC529F2C8CF7 00CED541E81E E31F510DC530D2BC304292FE0E5BB8AD4EA96D8C7C CD EB50F08D9D6C9FE7A173EE A154A4DDD667A442FFBBCCDA867CCE82AD47D672BDA04E8F0 EF D7456BE5D3DF994EA8F8CFBEC01295 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\zzzzygol[1].htm HTML document, ASCII text, with CRLF line terminators Size (bytes): 138 Entropy (8bit): FF330748EBFFD6E2B0F19B81D01AC231 Copyright Joe Security LLC 2018 Page 17 of 44
18 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77PTX9DT\zzzzygol[1].htm C243511E12F47D15F4570D3A13CF234A3E32A1C5 3B68C03EB434CA2519A78AFB0A10C6FE16AB6C419758D0DE6B97A4DD1435B53D 301E92248EAB566B293419B2463A9FD2B0BB9F26983ECAEF367FB09ED62FFE1F2361DB42C8E04D A6AD 1D27E5C3ACE3E16060A201EA0F5FC91DB2FC82 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\continue[1].png Size (bytes): 401 Entropy (8bit): PNG image data, 340 x 38, 8-bit colormap, non-interlaced 68EE0BF2D67020AFCF0F6C5561FA0361 D5D5A0B60B81C83C8EAC370D5A3AA D772 0A30956D43221ED177BC7C8B0B18A004112DF1E32BB12F4562A5BA6C C 659C3A67E31C146FE5B2AABDF62ABDDFAA3E5EC11CCE3A033F79C97C958E8A90408E57794CF15B1E40C6D55C CC013159B6952BC377533F3BF605AB31E30654F9 C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\favicon[1].ico Size (bytes): 237 Entropy (8bit): PNG image data, 16 x 16, 4-bit colormap, non-interlaced 9FB559A E77D F6541 EA13848D33C2C7F4F4BAA39348AEB1DBFAD3DF31 6D8A01DC7647BC218D003B58FE04049E24A B7E0CEBAE76EDF85B8B914 0E CD123BE8A20B87D9A3AAF5CB05249DE7F8286FF99D3FA35FC7AF7A9D9797DD6EFB6D1E722147DCF B74437DE D0009D452FB96A8ECE236B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\m6[1].png Size (bytes): 465 Entropy (8bit): PNG image data, 82 x 17, 8-bit colormap, non-interlaced B416BAEC444FE07FE788AFE20088CEE9 C169890F37D9DB2F649F4DE3CB4A6D0F0F9A09FD B45AB79E4A9484F17682AFA7BD6CB13D2D19D B70E30B720A7A0DEA 45601D E3F6CA9B92F6A39F7BEFE40143E9FEBEAEE69B3DB7F3E6CC4F F08CFFFCB65F5FE9D D6D6EA8E7A9A1AE8A15B251618F24E55E42852B C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DEWWYACU\m7[1].png Size (bytes): 358 Entropy (8bit): PNG image data, 68 x 14, 8-bit colormap, non-interlaced FAD5A0916FDF910ED6D3353BD6A BF A32A1F1BBDB1A5E7BDB638272AE 09B648B79D47694CAD6A6A94B2B7758F5BDBD09C1B1E7BF81B30C4A135631E2A 25117DF85D5302CF8AB B6FF1ED73D4B9BA74A0F24D51FB78D6AFDA6FCC6A64880A98A45ACDAC589C8A 9096D36C70A77A68EF29B323850F808240A3506 Copyright Joe Security LLC 2018 Page 18 of 44
19 Contacted Domains/Contacted IPs Contacted Domains Name IP Active Malicious Antivirus Detection Reputation junelavonne.com true 1%, virustotal, Browse unknown bestdfw.org true true 0%, virustotal, Browse unknown Contacted IPs No. of IPs < 25% 25% < No. of IPs < 50% 50% < No. of IPs < 75% 75% < No. of IPs IP Country Flag ASN ASN Name Malicious United States GOOGLE-GoogleIncUS Germany HOSTNET-DE-ASDE United States DOE-HQ- USDepartmentofEnergyUS true Static File Info No static file info Network Behavior Network Port Distribution Total Packets: (HTTPS) 80 (HTTP) Copyright Joe Security LLC 2018 Page 19 of 44
20 53 (DNS) TCP Packets Timestamp Port Dest Port IP Dest IP Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Copyright Joe Security LLC 2018 Page 20 of 44
21 Timestamp Port Dest Port IP Dest IP Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Copyright Joe Security LLC 2018 Page 21 of 44
22 Timestamp Port Dest Port IP Dest IP Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Copyright Joe Security LLC 2018 Page 22 of 44
23 Timestamp Port Dest Port IP Dest IP Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Copyright Joe Security LLC 2018 Page 23 of 44
24 Timestamp Port Dest Port IP Dest IP Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Apr 11, :41: CEST Copyright Joe Security LLC 2018 Page 24 of 44
ID: Cookbook: browseurl.jbs Time: 03:38:04 Date: 30/04/2018 Version:
ID: 57282 Cookbook: browseurl.jbs Time: 03:38:04 Date: 30/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 19:33:28 Date: 25/04/2018 Version:
ID: 56640 Cookbook: browseurl.jbs Time: 19:33:28 Date: 25/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 17:57:53 Date: 27/04/2018 Version:
ID: 57046 Cookbook: browseurl.jbs Time: 17:57:53 Date: 27/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 10:30:00 Date: 09/01/2018 Version:
ID: 42036 Cookbook: browseurl.jbs Time: 10:30:00 Date: 09/01/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 21:16:31 Date: 24/04/2018 Version:
ID: 56483 Cookbook: browseurl.jbs Time: 21:16:31 Date: 24/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 01:14:26 Date: 03/05/2018 Version:
ID: 57739 Cookbook: browseurl.jbs Time: 01:14:26 Date: 03/05/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 01:54:38 Date: 10/05/2018 Version:
ID: 58820 Cookbook: browseurl.jbs Time: 01:54:38 Date: 10/05/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 18:33:33 Date: 06/04/2018 Version:
ID: 53568 Cookbook: browseurl.jbs Time: 18:33:33 Date: 06/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 20:25:07 Date: 07/05/2018 Version:
ID: 58298 Cookbook: browseurl.jbs Time: 20:25:07 Date: 07/05/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Cookbook: browseurl.jbs Time: 22:08:00 Date: 05/07/2018 Version:
ID: 66955 Cookbook: browseurl.jbs Time: 22:08:00 Date: 05/07/2018 Version: 23.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Cookbook: browseurl.jbs Time: 21:49:21 Date: 20/04/2018 Version:
ID: 55777 Cookbook: browseurl.jbs Time: 21:49:21 Date: 20/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: html Cookbook: defaultwindowshtmlcookbook.jbs Time: 15:11:10 Date: 11/04/2018 Version: 22.0.
ID: 54166 Sample Name: 14527716735276.html Cookbook: defaultwindowshtmlcookbook.jbs Time: 15:11:10 Date: 11/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection
ID: Cookbook: browseurl.jbs Time: 16:38:13 Date: 14/04/2018 Version:
ID: 54814 Cookbook: browseurl.jbs Time: 16:38:13 Date: 14/04/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis
ID: Sample Name: sentenza berwind.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 21:41:19 Date: 11/04/2018 Version: 22.0.
ID: 54234 Sample Name: sentenza berwind.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 21:41:19 Date: 11/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection
ID: Cookbook: urldownload.jbs Time: 15:58:06 Date: 04/06/2018 Version:
ID: 62516 Cookbook: urldownload.jbs Time: 15:58:06 Date: 04/06/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Sample Name: Harry Potter and the Sorcerer's Stone.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 06:34:30 Date: 24/04/2018 Version:
ID: 56310 Sample Name: Harry Potter and the Sorcerer's Stone.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 06:34:30 Date: 24/04/2018 Version: 22.0.0 Table of Contents Analysis Report Overview General
ID: Cookbook: browseurl.jbs Time: 09:15:48 Date: 09/01/2018 Version:
ID: 42027 Cookbook: browseurl.jbs Time: 0:15:48 Date: 0/01/2018 Version: 20.0.0 Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature
ID: Sample Name: message_zdm.html Cookbook: default.jbs Time: 17:40:56 Date: 04/05/2018 Version:
ID: 58003 Sample Name: message_zdm.html Cookbook: default.jbs Time: 17:40:56 Date: 04/05/2018 Version: 22.0.0 Table of Contents Table of Contents Analysis Report Overview General Information Detection
ID: Sample Name: Zipongo Value for Investment_ Theresa & Year 1 ROI vs. treatment costs.pdf Cookbook: defaultwindowspdfcookbook.
ID: 56479 Sample Name: Zipongo Value for Investment_ Theresa & Year 1 ROI vs. treatment costs.pdf Cookbook: defaultwindowspdfcookbook.jbs Time: 20:35:00 Date: 24/04/2018 Version: 22.0.0 Table of Contents
XC2 Client/Server Installation & Configuration
XC2 Client/Server Installation & Configuration File downloads Server Installation Backup Configuration Services Client Installation Backup Recovery Troubleshooting Aug 12 2014 XC2 Software, LLC Page 1
FAQs GOLF CANADA KIOSK
FAQs GOLF CANADA KIOSK WHY THE GOLF CANADA KIOSK? The kiosk web address is generally used at the course because of its basic features and user-friendly interface. There is no password required for entry,
The MQ Console and REST API
The MQ Console and REST API Matt Leming lemingma@uk.ibm.com Agenda Existing capabilities What s new? The mqweb server The MQ REST API The MQ Console 1 Existing capabilities Administering software MQ Queue
PRODUCT MANUAL. Diver-Mobile for Android
PRODUCT MANUAL Diver-Mobile for Android Contact details: Van Essen Instruments B.V. Van Essen Instruments - Canada Delftechpark 20 630 Riverbend Drive, Suite 100 2628 XH Delft Kitchener, ON, The Netherlands
Cisco SIP Proxy Server (CSPS) Compliance Information
APPENDIX A Cisco SIP Proxy Server (CSPS) Compliance Information This appendix describes how the CSPS complies with the IETF definition of SIP (Internet Draft draft-ietf-sip-rfc2543bis-04.txt, based on
THE STATCREW SYSTEM For Basketball - What's New Page 1
THE STATCREW SYSTEM For Basketball - What's New 2000-2011 - Page 1 What's New For 2011: Version 4.13.0 (available June 2011) Access to all updates from June 2011 through May 2012 (i.e., versions 4.13.1-4.13.xx)
Integrate Riverbed SteelHead. EventTracker v8.x and above
EventTracker v8.x and above Publication Date: March 27, 2018 Abstract This guide provides instructions to configure a Riverbed SteelHead to send its syslog to EventTracker Enterprise Scope The configurations
Oxygen Meter User Manual
Oxygen Meter User Manual Monday, July 23, 2007 1. Outline...2 2. Program...3 2.1. Environment for program execution...3 2.2. Installation...3 2.3. Un installation...3 2.4. USB driver installation...3 2.5.
We release Mascot Server 2.6 at the end of last year. There have been a number of changes and improvements in the search engine and reports.
1 We release Mascot Server 2.6 at the end of last year. There have been a number of changes and improvements in the search engine and reports. I ll also be covering some enhancements and changes in Mascot
ACI_Release_Notes.txt VERSION Fixed Tank info for ELITE in Dive section 2. Fixed USB port initializing for old DC VERSION
VERSION 2.4.0 1. Fixed Tank info for ELITE in Dive section 2. Fixed USB port initializing for old DC VERSION 2.3.9 1. Fixed Dive Computer configuration section error 2. Fixed message for download/upload
DESKTOP SKILLS COURSEWARE
Introducing Mac OS X Yosemite Course... ds_maco_a01_dt_enus Working with Mac OS X Yosemite Course... ds_maco_a02_dt_enus Installing Mac OS X Yosemite Course... ds_macp_a01_dt_enus Managing and Configuring
Diver Training Options
MAIN INTERNET ON-SITE TAILORED PACKAGES INTER-COMPANY Diver Training Options DBI offers a menu of tailored courses Designed for users as well as IT Professionals to learn how to master the functionality
REMOTE CLIENT MANAGER HELP VERSION 1.0.2
VERSION 1.0.2 MERCHANT SALES: 800-637-8268 New Merchant Accounts PARTNER PROGRAMS: 800-637-8268 New and existing partnerships CUSTOMER CARE: 800-338-6614 Existing merchant account support Statements and
AGW SYSTEMS. Blue Clock W38X
AGW SYSTEMS Blue Clock W38X Contents table BLUECLOCKS...3 THE EVOLUTION...4 WHAT S NEW!...5 HARDWARE...6 SOFTWARE...7 MULTI COMPANY...8 INSTANTLY...9 EVEN MORE!...10 WHAT S INSIDE HOW DOES IT WORK...11...12
Using the Lego NXT with Labview.
Using the Lego NXT with Labview http://www.legoengineering.com/component/content/article/105 The Lego NXT 32-bit ARM microcontroller - an Atmel AT91SAM7S256. Flash memory/file system (256 kb), RAM (64
Version 3.1.0: New Features/Improvements: Improved Bluetooth connection on Windows 10
Version 3.1.0: Improved Bluetooth connection on Windows 10 ***Important notice for Mac Users: Upgrading from Shearwater Desktop 3.0.8 to 3.1.0 will not cause issues. Upgrading from any 2.X.X to any 3.X.X
Tennis...32 Stay above...34 Decimal...36 Bundesliga simulator...38 Shooter management...41 Installation...43 Registration...45 Where do I get the
Content ShotAnalyzer with Scatt and the Häring target system... 3 ShotAnalyzer with Scatt and the Meyton target system... 5 ShotAnalyzer with Scatt and the Disag target system... 7 ShotAnalyzer with Scatt
86 5A 62 DF 67 3A 7B A F A 65 F6 95 F4. win7-sp1-x64-app02-1 win7-sp1-x64-app02-1 KVM :32: :51:37
9B 76 FE 5B 89 51 68 06 67 62 A5 4A 06 67 7C 7B 57 5F 00 59 CB F6 95 F4 7E D3 67 5F F6 95 F4 63 01 7E ED F6 95 F4 06 67 5F 15 64 CE 72 48 67 2C FILE 2017-01-31 15:32:29 2017-01-31 15:51:38 1149 79 D2 1.4-Maldun
Microsoft Windows Software Manual for FITstep Stream Version 4
Thank you for purchasing this product from Gopher. If you are not satisfied with any Gopher purchase for any reason at any time, contact us and we will replace the product, credit your account, or refund
Inspection User Manual This application allows you to easily inspect equipment located in Onix Work.
2016 TABLE OF CONTENTS Inspection User Manual This application allows you to easily inspect equipment located in Onix Work. Onix AS Version 1.0.15.0 03.06.2016 0 P a g e TABLE OF CONTENTS TABLE OF CONTENTS
Previous Release Notes
Release Notes Shearwater Desktop 3.1.5 Support for NERD 2. Previous Release Notes Version 3.1.4 Improved Bluetooth Reliability with the initial connection. Bug Notes: dded software workaround to allow
Inspection User Manual
2016 TABLE OF CONTENTS Inspection User Manual This application allows you to easily inspect equipment located in Onix Work. Onix AS Version 1.0.15.0 03.06.2016 0 P a g e TABLE OF CONTENTS TABLE OF CONTENTS
Software Manual for FITstep Pro Version 2
Thank you for purchasing this product from Gopher. If you are not satisfied with any Gopher purchase for any reason at any time, contact us and we will replace the product, credit your account, or refund
Flow Vision I MX Gas Blending Station
Flow Vision I MX Gas Blending Station Alicat Scientific, Inc. 7641 N Business Park Drive Tucson, Arizona 85743 USA alicat.com 1 Notice: Alicat Scientific, Inc. reserves the right to make any changes and
SQL LiteSpeed 3.0 Installation Guide
SQL LiteSpeed 3.0 Installation Guide Revised January 27, 2004 Written by: Jeremy Kadlec Edgewood Solutions www.edgewoodsolutions.com 888.788.2444 2 Introduction This guide outlines the SQL LiteSpeed 3.0
Quintic Automatic Putting Report
Quintic Automatic Putting Report Tutorial www.quintic.com Introduction The Quintic Automatic Putting Report is designed to work as an add on to our premier Quintic Biomechanics analysis software. Auto
Table of Content IMPORTANT NOTE: Before using this guide, please make sure you have already set up your settings in
Quick Start Guide Table of Content Introduction... 3 Prerequisites... 3 How to Open QQEvolution 2... 4 How to do Carrier Downloads... 5 Locating a Client in QQEvolution 2... 7 Adding a New Client... 8
Instrument pucks. Copyright MBARI Michael Risi SIAM design review November 17, 2003
Instrument pucks Michael Risi SIAM design review November 17, 2003 Instrument pucks Pucks and Plug-and-Work The MBARI puck prototype Puck software interface Pucks in practice (A Puck s Tale) Embedding
NETDIVER TUTORIAL. Revision Doc-NDT Dimensional Insight
NETDIVER TUTORIAL Revision Doc-NDT-121411-02 2011 Dimensional Insight NetDiver 6.3 Tutorial, Manual Revision Doc-NDT-021411-02. Dimensional Insight, Inc. disclaims the implied warranties of merchantability
[CROSS COUNTRY SCORING]
![[CROSS COUNTRY SCORING]](/thumbs/89/99405973.jpg "[CROSS COUNTRY SCORING]")
2018 The Race Director Guide [CROSS COUNTRY SCORING] This document describes the setup and scoring processes employed when scoring a cross country race with Race Director. Contents Intro... 3 Division
Totalflow Web Interface (TWI) software Help notes v1.0 Oct. 3, 2014
Technical reference Totalflow products Totalflow Web Interface (TWI) software Help notes v1.0 Oct. 3, 2014 File name: Totalflow products 2105166MNAA.docx Document name: Document status: Totalflow products
Using MATLAB with CANoe
Version 2.0 2017-03-09 Application Note AN-IND-1-007 Author Restrictions Abstract Vector Informatik GmbH Public Document This application note describes the usage of MATLAB /Simulink combined with CANoe.
BVIS Beach Volleyball Information System
BVIS Beach Volleyball Information System Developments in computer science over the past few years, together with technological innovation, has in turn stimulated the development of tailored software solutions
Excel 2013 Pivot Table Calculated Field Greyed Out
Excel 2013 Pivot Table Calculated Field Greyed Out Use Excel pivot table calculated item to create unique items in a pivot table field. (00:47 minute mark) Group By Date: Excel PivotTable: 1) Drag Date
KEM Scientific, Inc. Instruments for Science from Scientists
KEM Scientific, Inc. Instruments for Science from Scientists J-KEM Scientific, Inc. 6970 Olive Blvd. St. Louis, MO 63130 (314) 863-5536 Fax (314) 863-6070 E-Mail: jkem911@jkem.com Precision Vacuum Controller,
Skillsoft Course Catalog. Desktop Collection
Skillsoft Course Catalog Desktop Collection Adobe Reader X Course... at_adre_a01_dt_enus Adobe Air 3 for Flash CS5.5 Developers Course... at_airr_a01_it_enus Adobe InDesign CS5: Fundamentals Course...
Section 8: Model-View-Controller. Slides adapted from Alex Mariakakis, with material from Krysta Yousoufian and Kellen Donohue
Section 8: Model-View-Controller Slides adapted from Alex Mariakakis, with material from Krysta Yousoufian and Kellen Donohue Agenda MVC MVC example 1: traffic light MVC example 2: registration HW8 info
- 2 - Companion Web Site. Back Cover. Synopsis
Companion Web Site A Programmer's Introduction to C# by Eric Gunnerson ISBN: 1893115860 Apress 2000, 358 pages This book takes the C programmer through the all the details from basic to advanced-- of the
Steltronic StelPad User Guide
StelPad User Guide Steltronic StelPad User Guide Contents Contents... 1 About StelPad and its Features... 3 StelPad System Elements... 3 StelPad Computer Integration with Focus... 4 Enable Custom Graphic
Section 8: Model-View-Controller
Section 8: Model-View-Controller Slides by Alex Mariakakis with material from Krysta Yousoufian and Kellen Donohue Agenda MVC MVC example 1: traffic light MVC example 2: registration HW8 info MVC The classic
FireHawk M7 Interface Module Software Instructions OPERATION AND INSTRUCTIONS
FireHawk M7 Interface Module Software Instructions OPERATION AND INSTRUCTIONS WARNING THE WARRANTIES MADE BY MSA WITH RESPECT TO THE PRODUCT ARE VOIDED IF THE PRODUCT IS NOT USED AND MAINTAINED IN ACCORDANCE
World Leading Traffic Analysis
World Leading Traffic Analysis Over the past 25 years, has worked closely with road authorities and traffic managers around the world to deliver leading traffic monitoring equipment. With products now
Ranging and Communications Module Reconfiguration and Evaluation Tool (RCM RET) User Guide
Ranging and Communications Module Reconfiguration and Evaluation Tool (RCM RET) User Guide PulsON 400 RCM TIME DOMAIN Cummings Research Park 4955 Corporate Drive Suite 101 Huntsville, AL 35805 USA http://www.timedomain.com
The Race Director. IPICO Integration Direct Connect [IPICO INTEGRATION]
![The Race Director. IPICO Integration Direct Connect [IPICO INTEGRATION]](/thumbs/72/67145921.jpg "The Race Director. IPICO Integration Direct Connect [IPICO INTEGRATION]")
2017 The Race Director IPICO Integration Direct Connect [IPICO INTEGRATION] This document explains how to manage the results data between your IPCIO readers and Race Director using a direct connection
Database of Winds and Waves. -internet version-
2009.1.6 Database of Winds and Waves -internet version- http://www.nmri.go.jp/wavedb/wave2.html National Maritime Research Institute CONTENTS 1. Outline of the Database... 1 2. Use of the Database on the
Rules of Soccer Simulation League 2D
Rules of Soccer Simulation League 2D (RoboCup2016 Leipzig, Germany) This document contains the rules for the RoboCup2016 Soccer Simulation League 2D competition in Leipzig, Germany. 1. Soccer Simulator
APP NOTES Onsight Connect Cisco Integration. July 2016
APP NOTES Onsight Connect Cisco Integration July 2016 Table of Contents 1. Direct Onsight Device to Cisco Endpoint Calling... 4 2. Onsight Device to Onsight Device (including Cisco Endpoint) Calling...
Multi Class Event Results Calculator User Guide Updated Nov Resource
Multi Class Event Results Calculator User Guide Updated Nov 2011 The Multi Class Point Score has been developed as part of Swimming Australia Ltd. s commitment to creating opportunities for people with
Blackwave Dive Table Creator User Guide
Blackwave Dive Table Creator User Guide Copyright 2002-2009 Blackwave. All rights reserved. These materials (including without limitation all articles, text, images, logos, compilation, and design) are
Meter Data Distribution User Manual
0.1 Meter Data Distribution User Manual February 2016 Public Copyright 2015 Independent Electricity System Operator. All rights reserved. Public Page 2 of 24 Table of Contents Contents 1. Overview... 4
ICD-10-CM IN VERSION 10
ICD-10-CM IN VERSION 10 June 2014 eclinicalworks, 2014. All rights reserved Introduction Effective Date CONTENTS INTRODUCTION 3 Effective Date 3 Global Effective Date 3 Individual Insurance Effective Date
Armfield Distillation Column Operation Guidelines
Armfield Distillation Column Operation Guidelines 11-2016 R.Cox Safety SAFETY GLASSES ARE REQUIRED WHEN OPERATING THE DISTILLATION COLUMN Wear gloves when mixing alcohol feedstock The column will become
USA Jump Rope Tournament Software User Guide 2014 Edition
USA Jump Rope Tournament Software User Guide www.usajumprope.org Table of Contents Contents System Requirements... 3 System Conventions... 4 Phase 1 Tournament Pre registration Preparation... 5 Name Your
Online League Management lta.tournamentsoftware.com. User Manual. Further support is available online at
Online League Management lta.tournamentsoftware.com User Manual Further support is available online at www.lta.org.uk/leagueplanner Contents Welcome... 3 Using this guide... 3 Further support?... 3 Publishing
by Robert Gifford and Jorge Aranda University of Victoria, British Columbia, Canada
Manual for FISH 4.0 by Robert Gifford and Jorge Aranda University of Victoria, British Columbia, Canada Brief Introduction FISH 4.0 is a microworld exercise designed by University of Victoria professor
LiteSpeed for SQL Server 6.5. Integration with TSM
LiteSpeed for SQL Server 6.5 Integration with TSM 2011 Quest Software, Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide
Quick Start Guide. For Gold and Silver Editions
Quick Start Guide For Gold and Silver Editions Table of Content Introduction... 3 Prerequisites... 3 Installation and Setup... 4 Download and Install QQEvolution 2... 4 Create Users... 8 Create Agent/CSR/Producer...
Digi Connect ME 9210 Linux: serial port 2 for JTAG modules
Digi Connect ME 9210 Linux: serial port 2 for JTAG modules Document History Date Version Change Description 08/05/2009 Initial entry/outline Table of Contents Document History... 2 Table of Contents...
2 November WSI Hubcast VERSION 3.5 RELEASE NOTES
2 November 2016 WSI Hubcast VERSION 3.5 RELEASE NOTES THE WEATHER COMPANY WSI Hubcast 2 2 WSI HUBCAST 3.5 RELEASE NOTES This document describes the major changes introduced with version 3.5 of the WSI
Steltronic Focus. User Manual Manage Focus Tournaments
Steltronic Focus User Manual Manage Focus Tournaments Steltronic S.p.A. Via Artigianale 34, 25082 Botticino Sera Brescia - Italy Tel: +39 030 2190811 Fax: +39 030 2190798 Service: + 39 030 2190830 http:
WildCat RF unit (0.5W), full 32-byte transmissions with built-in checksum
Overview of SMRU series 9000 SRDL satellite tags Basic tag construction and function Housing: Standard sensors: Optional sensor: normal solid epoxy body rated to 500m, reinforced 2000m pressure (resolution
Software for electronic scorekeeping of volleyball matches, developed and distributed by:
Software for electronic scorekeeping of volleyball matches, developed and distributed by: Developed for the rules of USports 2017-18 As adopted by Ontario University Athletics for Men s & Women s Volleyball
Configuring Bidirectional Forwarding Detection for BGP
CHAPTER 7 Configuring Bidirectional Forwarding Detection for BGP This chapter describes how to configure Bidirectional Forwarding Detection (BFD) for BGP. This chapter includes the following sections:
Burner Management System DEMO Operating instructions
Burner Management System DEMO Operating instructions Burner Management System DEMO Operating Instructions Startup Summary - Normal startup is accomplished in four basic steps: 1. Leak Test a. Safety Valve
Sales Create Outbound Delivery from Sales Order S01- Lean Baseline Package
SAP Lean Baseline Package Version: V1.500 Country: UK Language: EN Date: February 2006 Sales Create Outbound Delivery from Sales Order S01- Lean Baseline Package SAP AG Neurottstr. 16 69190 Walldorf Germany
Heart Foundation Walking Website user guide for Walk Organisers
Heart Foundation Walking Website user guide for Walk Organisers Proudly supported by Website User Guide for Walk Organisers Contents 1. Introduction... 2 1.1 Finding the HFW website... 2 1.2 Log in on
iregatta User Manual
iregatta User Manual iregatta User Manual This manual may not always be up to date with the latest version of iregatta available in Apples App Store, as minor additions or bug fixes may be published without
Instruction Manual. BZ7002 Calibration Software BE
Instruction Manual BZ7002 Calibration Software BE6034-12 Index _ Index Index... 2 Chapter 1 BZ7002 Calibration Software... 4 1. Introduction... 5 Chapter 2 Installation of the BZ7002... 6 2. Installation
DakStats Football Quick Start Guide 1 of 7
DakStats Football Quick Start Guide 1 of 7 This quick start guide for DakStats Football is designed to familiarize new users with the main features and entry modes of the program. For more complete instructions,
[CROSS COUNTRY SCORING]
![[CROSS COUNTRY SCORING]](/thumbs/84/89721527.jpg "[CROSS COUNTRY SCORING]")
2015 The Race Director Guide [CROSS COUNTRY SCORING] This document describes the setup and scoring processes employed when scoring a cross country race with Race Director. Contents Intro... 3 Division
PLA 2.1. Release Notes PLA 2.1 (build 604) December 21, 2015
PLA 2.1 Release Notes PLA 2.1 (build 604) December 21, 2015 PLA 2.1 - Release Notes PLA 2.1 (build 604) COPYRIGHT 2015 by Stegmann Systems GmbH, Rodgau, Germany. All rights reserved. CONTACT Stegmann Systems
An STPA Tool. Dajiang Suo, John Thomas
An STPA Tool Dajiang Suo, John Thomas Structure of an Unsafe Control Action Example: Operator provides open train door command when train is moving Control Actions Operator Train Door 2 Structure of an
Tournament Manager: Running a VEX IQ Event - Beginner
Tournament Manager: Running a VEX IQ Event - Beginner Indiana IQ Event Partner Workshop Agenda 1. Main Window a. Once i. The Main Window has a standard menu bar. ii. A series of tabbed pages filling the
Integrated Sports Systems (ISS) Inc. Meet Management Suite
November 2010 Integrated Sports Systems (ISS) Inc. Meet Management Suite User Guide and Technical Document Version 2.0 Table of Contents Table of Contents... 2 General Concepts... 3 Installation Meet Management
ArcLink Additional API support for Wayback Machines
ArcLink Additional API support for Wayback Machines Ahmed AlSum PhD Candidate Old Dominion University What is ArcLink? Introduction ArcLink is a complete system to Extract, Preserve, and Access to Temporal
Mac Software Manual for FITstep Pro Version 2
Thank you for purchasing this product from Gopher. If you are not satisfied with any Gopher purchase for any reason at any time, contact us and we will replace the product, credit your account, or refund
A physicist, an engineer and a programmer were in a car driving over a steep alpine pass when the brakes failed. The car was getting faster and
A physicist, an engineer and a programmer were in a car driving over a steep alpine pass when the brakes failed. The car was getting faster and faster, they were struggling to get round the corners and
Fencing Fox SmartApp Documentation. 25 avril 2018
Fencing Fox Fencing Competition Software SmartApp User Guide Copyright AFC Europe 2014-2018 1 1 TABLE OF CONTENTS 2 General overview... 3 2.1 Installation... 3 2.2 Local network setting... 3 2.3 Starting
SWIM MEET MANAGER 5.0 NEW FEATURES
SWIM MEET MANAGER 5.0 NEW FEATURES Updated January 24, 2014 1 ABOUT SWIMMING MEET MANAGER 5.0 MEET MANAGER 5.0 for ming (SWMM) is HY-TEK's 6th generation of Meet Management software. Provides the very
Getting Started with the LabVIEW Toolkit for LEGO MINDSTORMS NXT
Getting Started with the LabVIEW Toolkit for LEGO MINDSTORMS NXT Contents Overview...2 Mass Compiling...2 Building a LabVIEW VI that Runs on the NXT...3 Running a LabVIEW VI on the NXT...4 Building a LabVIEW
Microsoft System Center Data
U ft i V F_R S! TA TSBIB L! OTHEK MAMMOVER J Microsoft System Center Data Protection Manager 2012 SP1 Learn how to deploy, monitor, and administer System Center Data Protection Manager 2012 SP1 Steve Buchanan