Title: CNE Analysis in XKeyScore

Release Date: 2015-07-01

Document Date: 2009-10-15

Description: This NSA presentation from 15 October 2009 explains how analysts can exploit the products of the agency’s CNE hacking operations within XKeyScore and provides examples with screenshots: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

Document: CNE Analysis in
XKEYSCORE

15 October 2009

xkeyscore@nsa.ic.gov

l@nsa.ic.gov)

y

>M 1-5

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

DERIVED F ROM: Ñ WCSSM 1-52
DATED: 20070108
DECLASSIFY ON: 20320108

These slides are classified
TS//SI//REL FVEY in their entirety

data indicated as more highly controlled has been filtered out.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL





• Tao is a collector

• analogous to field site

• Various formats based on collection
"equipment"

• OLYMPUS vs UNITEDRAKE :: WC vs TU...

• SRI plus content produces "sessions"

• dnt payload format

• Significant overlap with passive, especially in
terms of collected files

• office, pdf, ...

• Much unique opportunity

• Config files, registry, network information,...

• Beginning to feed standard analytic tools

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

• PINWALE (storage/legacy)

• TUNINGFORK (aggregate data views
and tasking/legacy)

• XKEYSCORE (discovery*)

• TURBOCHASER/MARINA (profiles
[machine and user], future tasking)

• JOLLYROGER/TREASUREMAP (networks)

• TURBINE/PRESSUREWAVE/MAD
(future)

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

IMMhC'm

1
HETT
vj roar ifda r.' ■Eg
i ['] io k*

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

-CNE D

• US-3101 Bf C, D, E, F, L, M

• UNITEDRAKE
•TUCKER

•OLYMPUS

• EXPANDINGPULLY (formatting issues)

• UNIX (very little, poorly formatted)

• Not FISA, Not ECI

• Data retention from 29 January (many
projects not available until 15 May)

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

CNE Related Searches

TOP SECRET//COMIMT//REL TO USA, AUS, CAN, GBR, NZ

"typical" day's CNE results

Selecting all tables generated between ’2009-9-22 00:00:00’ and ’2009-9-23 00:00:00’

Pulling hit data from xks-central.corp.nsa.ic.gov

30 distinct users found 13998 results in 60 separate searches

QUERY RESULTS (ad-hoc):

userxxx email_addresses 22/10421 Iran NPS Domains userxxx_0808493001253628218_1
f652856 documentjmetadata 11 /10S3 f6S2856_0 f652856_0631781001253611176_1
useryyy tech 2/2 Iran Tech Search useryyy_0303242001253646149_1

Distribution of Searches by type:
email_addresses: 7
extractedjiles: 32
fulljog: 5

document_metadata: 6
phone_number: 1
tech: 4
registry: 5

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

XKEYSCORE Searches

(live demo)





TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL



b r* *i i < ' *!■ it* • j 1

T*11*< i ; ! • i C u



TOP SECRET//COMIMT//REL TO USA, AUS, CAN, GBR, NZ

1L*

P>«t^siicd im5 tEc.5K-.yi-5 .J rscnotfiM O voohSÎWÏM5K»f 4:5 certiol ¿* Kniaoe X-KEV5C.

J 3çwl:C: £ aEAROIlIQfr *> DonsPeqs -X^, | « Sea-... Q | KK.cjh f i> *tti4(
WÉSH

Often Used FiOdfi

m a : Hi
XKFYSCOREWelcome crvemi! I nr. Out

â_H)|w ¿â^jrrin ¿»Usars :-v Se^fi liWcr Kitov C*Y.»l 0 Sttt&fce : I TWnj : I Tastfr y SfryArccuY ÏK «K room tfrtsfc**

,3 Jttrinttfi*
-0 Clos-i-^A^«*

Input Source (Project Name)
Application

■'■{jf'O ^Cpavbid/ayditnfo
■prints) fr.ill.ovrtl cht_p*)bad/:rc
3 CNE
3C®IL3 :*becrvDNI
Q£*ftj« r.ti
I I yr- I SCtacPMMMrt*

dnt_payload/file#£i_

¿P^ieiiTwjyiii?

dnt_payload/dir

Limit to XKS-CNË

-rCXVac&ohEtë
3rUI-C*j DMI

3HTT3 Actl/ty

gHKEProet

3-
Efefc N|
^^LésER’*

-~I Sthvok Leas

ctot_pcr/badAapU*e±r€d$
cftt_parjtoad/:onnlog
s:gad chtjMr^bid/iatatrarrsiiri:

rht jvr;

Casenotabon cht_por;lc>)d/^rt_par>'tod
c*rt_pavtoad/:tYkt
Session 30 dhtjvplrvrl/'filf»
chtjjavlcadrtieTirelut

c*itj>»b)ci/pccnlo
ctit par/load/D&a -ength dntj^tod/istcKues

:ropMk:o with ~ o d 2
**• ipoDtilgcs v
Assocctsd Sosy jn .iH-»_y,i.)

Rlnrk Number

if

session Longtfl
Frorocol

-

performing a CNE specific search'

11 ** ^_:=Rr VcPMetA** Task ma ID I



Very similar to "CNE" search

Tasking ID [
arsonalD [

TOP SECal

Éj’ECrS-RV

aw

■J^Cd^rs-LCflS

DS»'

¿JSSLPsf«:

31 ecn &w&3 n locmîi

Externa Vetad3ta
Field«; r ill »>:M

P jyMlc-c viUiZf JS

iwrms audited '¿"Jï-ml iî ar J iu'nin r.icfïti ka qïiî' ¿nu

TOP SECRET//COMIMT//REL TO USA, AUS, CAN, GBR, NZL

Results - Mozilla Firefox

Etc =dr. '¿on Hfctoty Boci'ira-te iccte bteP

* C X L&J PIT hU0&:/£&&-Ci6nU«J .corp.f6d.ic. wv:8443/. XE/5CCR
[> Most -liityd __, S cit ejOfjfiiKS jscrciut: Ri J vechoURN 5(£ XKS-Certrat Jj* DonsPag»-x-keysc...

& • |[Q-
PI

•jj» DonsPage - X... !;< XK Resu... £§ *X Lcgh «43H (dvn... d rumr^ropK ]> KK8: P.esufcs »<5esr:h: Fu.

Thic cyrtam ic airlit«-| fcrLSSil) Id and H irri*i 1«: rjhtr a-t rr-npliAn"»

TOP 5CCRET7/COMIM 77RLL~ IQU5A. AUS. CAWTGDK. ond IMZL//ZO32UT00~

uum i ifl ______

XKFYSCORF WBlramR^^^H 1 n riiil~

j^Ktome /¿Adnn ¿Iseis Search if Wcifclbuv Cental ».Resets £3 Sfcststbs i=racoh:| *=7asfehg 21 Wv Account *&XKFoiun Wltefp^

fXaviqation *ienu

1«

«

. f

i-^ rnui; u ».ci l. xi f-i1. |

I- (g RBGAN
E REGISTRV
S RTP

Q ROClJS leg-

@SP

[3 SS. Psfset
¡3 Tech Strings n Docu n
(3 DSC» ACSIvty
g\ALAM

E VvebHe iron:i«

[3 Web Phx*y
Ew%«shsrk

lit l2~ Cawrcn
UJ C3CKtcnc»v Hits
G) OFift "tensrer
0 OlMtiSsirch

Id Qjliletvzoik Menegon -rt
0 £jU3erACWty
0 DVcIP
0 CjW'dei!
a^vwotttiow Ccit'd

IWbrkffav/s

gAI Psncng‘/'»'knows
H" My WorVf cws
0QR*--Uts

W • *-» A.

I





All Previous Results

hefr Actor«- Vfew - FILTERS: '

Query tteme

tao wraes? survey fp cct09 (WORKFLOW

Actfcns

Stents

Kidd misted

Query Type
ruljcg

M;mFtesuts Numces 03l«=f1

12 1011 2CCSL

Query Text (xj

■.WERE datetme >= 12 0:00:00 A'Dd^re «£= *2003-10-33 0:00:93 AND { app»:atcr — drt_pa’ftoad,l/.i'ele55i»Jvey ) AfO:. ( frn_co«.nby |='U5* AND Fmj.1

<



jJ

Pay | 1 [or 1 I Ml© Page Size:____________________20

D&pisyrgi -1 on

This system is audited fcrL&SZC* 13 ond Fijntan P qhte Act compliance

TOP SFC RFT//COMIKT//RFI TO I liA, Alii. CAW, GAR. and N7I y/S>03?ninfi

ccnbrt.corp nv».r rpv:84^3fXKE7SC CHF/re*itoftlfrr*it5;fic^5iihrftt.rtV
Siks ccntrol errp nro.tr. 9w:8*43 j ^

es

i

U

3

H

V)

«M

c‘ s
§ . >- Ê “ t §
c» S > (O 2 u. ft » ? S 2 TS «JO X Ci I
rl< t> ■3p 3% 3 0

ft!

> i > *> t > S & > > 5H V “J 1 > ** g *
V • M • - M li b M ■ II ■
r • ? ? «% « i < « 5 w t V r ( ? r . « * « * i - J
•77' • • T. * » i il fl V > • «c c v> Í V «J r V ** * r. V U w « a «* •»
* : Z T T V i 5 Z U V ” _ . • i_ U
a *« 5 1 £ 1 i I i I * î
S» - t * T 1 * c 11 *• c 1 t
IC î i i i 1 ï î i i I 1
¿ ! -= « ■3 « 3 * 3 Ü * 3 3 ï 3 < -5 3 3 * 3 * 3

= S w

ElEiaEalEHBHDBHHBBia^ 0E).?BDEl2

r0 • ■ • ■ •-! ! ! - -•/D^ a a

* tv -........... . m. it.m

O

c

Í ,.

* b

«- 5

c ••

> <

ED £
ü
....a

Bo^jnsrb

rcitrcl.cop.nMJC.^vîW^^EYSCCRE,

JXKMctavwwer. I • tul log (tao-wirele**) - Mo?iltal itrio*

JL. Musl^btoJ __ siidtl&uk ‘»-H> itP .'5y jU: ft I Q YiitJid -r£ WS O.i l-j iy py i>l'cya ■ X KEVSC.

Btncu:; PJ 1 0 íe^oílkhv | ¿ DoiJc» • >-... &>KNeu...B JtC ■:< icci

& *4314 (¿lárt... □ TlMkGFCRK V MS: =».ä>jlli | ^Utps;/. LO.Htf îfQXSMrlt =J

hl _________

XKEY5CORC Welcnne^H^H Log Cut
ÔH:« X'Aímn ¿usn \ Scofo'i tfv^kfloNvCeiti'a Resute 0 swsiks T«ar»j :- rosicno fv, Accart î&XKFoMn »Hsp-

3Vv^Prw/
Svsireshafc
3 3Ccnmcn
♦J _ji;c!ontfyPllv
♦I Uh» ir»n¿r-r
(8QMulS«fcr
3 ZDktiworc
ÇOU^CîMIy

Gpavop

GO

sâwikflw conta

¿jAIXatí'CWJ
SjAircft^öWöMtow5
S) Uy Wtorrtto/v$

ü£jVft3il5

:£]Uy Recfrt HcäjIä
5]Uy fVe\nu2 ifesiite
E]Uy ¿rctvwd Reut;
3lly Cng:h: Restfcs
3Uy tovcrbads
5 AI jov/ooaos
El^l ae«rt fajsifls

El Äl :fevEl^l AfCOked Rculte
3*M OftOOirgReeut*
S
3 OSigrrf /:rr*i*¿1hr.
gilnà'Si»tiiwl734fcnr
9¿5Tfi(nim

^1“Ocr»E*frC*lCt

gSjToo'ftj

=JV*C* TfloHrg
O 23 VV A^COUrt

_U_______ I

IK^Uynm Irpul Scurcc
í I mrr SftfcsUrr

Hsi:oramo*. iroui Sem* (Click 8ai :o ai:*0

1 - full kiq (ttio-vHrdess)

li-p *idcn: v Reports - yfciv - 31 TFfcS: il. -
□ £WC u - Hgniyics U&ffiflfto
i □ I cm:
2 d ß I 4 CM:
3 d F7! 7 CM:
i n ED s r~» • 11
i n LJ * CM:
« □ feil 12 □ feil 11 IM:
» n ED !Z CUE
» n L±l n CUE
., □ ei u cm:
11 tj [Hl li cm:

Finqerprint Malcl»

Query JOLLYRCGCR
Oifcry TLNIXGFQRK

Canes

ween: Ktdineenii COSSflte-tlDn
!009-1•00V10 1211:12:50 2009 10 1210.S0.00 TOP SECRET C
'Û01-1Û-1? 1137:16 2000-10-1211:17:00 TOP SECRET c
'IHH-10-1211117:16 2100-10-1211:17:00 lop sum i :c
ÎOW-10-1217^5:52 2000*10*1217:02:00 TOP SECRET C
J001-10-12 17^5:32 2009-1f-1217i02i00 TOP SECRET VC
17*05;*? ?009-1*-l? 17;f?;00 TOP SECRET O
2001-10-1? 158134 2009-10-1 ?15:0?:00 TOP SECRET' C
2001 10121*1*11 2009 10 1210:00:00 TOP SECRET C
2001 10-12 2W5fc23 2009 10 1223:01:00 TOP SECRET "C
2000-10-122*5438 2009-10-1223:01:00 TOP SCCR1Í VC^J

û11

-»ogîSstae: /u ixtofc:9iititnws}vr pogei

I.Kflcying 1 .IVcd iy
saved J1«47«0MCö*)4101

Default)

Fit I'Ji. ÿtw H*Ur/ &vhf»af
httpi:J/xte-cne rorp.n« j:.gcv:8443j:
<3xk Session Viewer - Mozilla FirefoK

îhiï vyiiamis aucHadfor U S S10 ^ 0 ard human Rights Ad corprfianca
ClASSU nj^HUN lUv* Sbl MLP/U jMIHTiTPLl lUU^frUS.CMS.OL*« NZ.

X-K.LVSLUKL 121 Session Viewer ffrom archive]



:-hiw

lilsli

Datebme

Case Notation

From IP

To IF

2GÛ9-C9-30 02:04:01

A r .SPOAECA AADT C

From Port Tc Port Protocol -çnqth

793

Session

Header (3) I Meta (1)

AJTC



OWnTOdU SWSSIOI

ai

Quirk fllrk«

«

One-CliCi< StidfChöS

Session

àHC

CD find application

dnt_payload/error
d find muuate ¿lüä ul stf&si
:Ü ->

: 0

il

J 2J

PAYI HAD XMI

ïi< ses3 format ATJTO center.: xrr.l FORMATTER |auTO *•]

Using XML formatter

Error payload: £at«Type>

< p a y load : Hams» pace> ui n : pay 1 oad : d:it pay 1 i*ad : farces paire >

< p ay load : Ver » ioa> 1.0.7 p a y lo ad : Ve 12: iu cj>

< pay load : Tims Iu£o>

2 OC 9- 09 -2 6T10:52: 37
4.5G payload: Tat gecTirae 2^ns0££3ec>
20C9-09-2 6TC5:35:32+00: 0O
pay load : T Itce I nr o>










payload : Ver sion>





payload: Payload>

z]

Tldi ¿'.¿Ivin « àvcilûdf j- U£ 5ID *3 irO hj man Rio'iti A:-4, cc r cf rf'i:-«

Æ

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZ

Session Viewing

i R I • ] • i I ■ ^[ <

FfSpecialized peF payload)

ÜXK Session Viewer - Mozilla Flrefon

0c z.dt jtfw H Story ^cokrna'ks led? Hop

-JDj^

J» __ M kl jv :;V .-'ki-urr.wp.i i^a .i.. ;ju v :34 43fXKEV SCOPE,'; ip? jaueTiU?=Sc^sm i '•le jwU:'.=%2FkKEYSCOPE% 2F%2Ft.c ta v« werV42Fn»?:
TW r system 15 >jdiccfcf US& C IS Human Fid-« Aotoompllancc
CLASSIFICATION: TOP SECRETXVCOMIMTiVREL TD USA AUS , CAN,GSR,K-*

X KFYSCORF C2C Sneslnn Viewer [from ftPfhivr]

c4 4 j^c^cnpT"

Datetime

y
• •I

Case Notation
20D9-09-30 02:06:32 JR .SPDCTLAAAD TC

From IP To IF From Port To Port

2bt36

Sr**«inn Hr.vkt <3) Meta ( 1 )

ALTO

-jUman:-,

E-f.s- text :o s
Quick Clicks

JfcSesi

Qfc

ion

Or.5-Click search*5

0 Find application

drtLPoyloôd/diwolk

ö Find JPULS t* ^idr uf

:0

:0

AUTO FORMATTER: cap ld = dnl p__________________________________________________DIRECTORY WALK_______________________________________

open all | close all

>2 C:\Doaiments aid Settincs\aYio at_ed\tiy Documcnts\My 3kv:»c PicsjrssS
j— JjAncel SIcype.Dnc
; □*rch tcct Skypc.ang
!--QBeach Skype png
j-QBehind Skype .png
j— ^business Skype.ang
¡•‘LJCollMc Swccthcort.pnq
j- He .png

j-QCornivdl S^ype.prig
QChie Skvoe.onq
¡-□Christmas Skypc.png
j— JCollego Skype.png
;-•□oes€rt Skype.png

{-□Oesioner Skype.pnc

j— ~^|OeviI Skype .png
j-| "IPIY Sky pe.png
; Skypc.prg

j-QEor&jd Skype .png
j— □)Ervipire* Skype .png
S-QF« Skype.pna

T

£ •**
o i'»
C «O

3<0

s

♦

♦

tí

o

Cl

tí

o

a

Cl

o

II

*

X»

«/»

u.

Z

X

O

Ci

■U

c

c

5

c

c¿



00

i-

X«

"3

T>

X*



.U

Ä

ji

!•

*

n

o

t*

"□

o

V

jz

»%

i*

v*



p

V

X

2

IÑ

D

*

2

V.

h i i i ; u u

U. a¿ W — — — — — 1—



■-.v V .y ,«■ V .y
■ 5 V« -» 3 S £ w V 2 *5
•— V v v ^ V •-/ V-
^ M M M ** tt
« 4i & u ** 2 2 2 *+ 2 2 u
■r •5 t «f T t •* t
¿ i ¿ i Í ¿ ¿ ¿
* i i i i | § 1 *
ÍS| * Ci *4 í. A4 O TO « w « «e O o
$ i 51 i 5 3 3 5
* *> «• ■* «t *•
s 8 £ £ £ £ á £ ¿
¿ t i i i i ♦ ¿ i
f*$ n n tn n CN
¡8 * SI $ $1 £ si Sí £
1 f7 ! a a a a a 0 a E
IU caca CE U L
*- íi «TV. o »— O* c-

g ilffilMEWMTO
2

S •■ M!

~¿Í2:

ÍSOOGOÍ

ti) tí til Ü 4 :

3 * o

! i i«!

i ? 11 *

S é | I* Í | s

«: í 3 í ü § ¿

n «

II

I 1
I |

a <
3 <

¡ A

GOOOGOG
<0 "•

■a..

aran

TOP SECRET//COMIMT//REL TO USA, AUS, CAN, GBR, NZ

«Document Metadata -

Í Active/Passive Converged Analysis

XK mccovicwch iron U* customs ond nod tuctacted L»ocs Mozilla Hrcfoic



I £to £dc SJow H&ory feseftrote Iccrfs dop
1 ^'1 1 a|‘l'Uy>U,'«l>-«.ci It al.vuiy >va «..guv ' ' IlLi • | ‘T- /
1-Q| UklwJ ( (SiMltjjli. mL c-,5 35y«jjl: P.l Qv —Iimcrn V xi31 1»ftjuiii:R? VARCMI1GH1 > lni-Px |h - X-I.-V^b 3CK ... £j | *4.114 nlioIH ¡li» 'I 11 NiN*;;t-OM: !? il.l 1« 1 I :*>: KM-iJls oTT •

tSHBBr

-

LQJ.L'lIt

¿¿¿AJiin ’■-Vu'-.h tT Cti4/v4 Kv-tlv El -IW.^.Olv * _ I v*.tj i m i_lw/>Juv) Swy'AiiVuui *K Furir i Hu*/ •

■i>jl*-íüh u tmriMfi.
xki YSicoui wcteomc

VTIM //

EG

soviaot»on Menu

—J i «roo r
Slices Stnogo n C*3
1 Use» AclDty
| gV4A:*l
^}w»i, r. w. -r m i*rw»»

j ¡3Wh|iPzii>y

ixl LU^Mpm‘'r
£3 QflHimry I
R CD He Tran-slci
BCDM,fc3e*Ch
m CDHcfrAOrf« Mof»;j:*ricrt

j UlClU$0'.*Ct)Vt7

UlClVcl*

3 I

JÍpJWbfUlov/ tirirrf

£~) AI WCfKlttWC
FH Ai rcr»d ng Wsrcflowo
Q M/ I'WVfWi
3Qft?wly

• [c| M/ It»-« >•*•! Rko 4 -c
£]M/ PrK«aiai< P»30il>:
gzl M/ ArrtMri
cl M/ Orfjnro first to*
trIM/ nov*nr»yli
fcH AI Dowi Jjci1&
riAl Rccov. Rcstáo
£DAI rrcvlDuoRo^to
sDai Kcc-jto

eEJai UHDCrO Keouto
3<

3 CD Sljr jW Ac JwUll* >

is^LI I. 5UfTrT4rl26!0n

jfigiwinq

3lo:ci icoirFlTcwliEvtio^lv*

3 'CD To>f • ij

(c|V. V'Txsfclij
3 ! |Vty

«I I

Iran CP CuvUimih Mini R4ll Pxlrm

—

-43»> /VOlWOC ~ HCI»-tv * VÍDW* HLItHS: lit »

►I

H&iVJ'A: DütciífT«: ZCKtCK DcOJTXnV. T'rt-»- E'l.fytll-i CctrtiXc-^ =lcnc»ro Extender» LorouCi>;- M.'nr V wv iu •>* LVIkUKAIilKUl o4tic«*iViOi«l IK* no rt: J:ip lo|> illVJObfVA'Pi turto ümIoxí uac: 414 P.IV JOI M.K«I>|I uao/u
cWV 2M9-10-*» 00:0:50 LUTCU5ASTR01 o^fir.r.'word no no II: JrtP ton ilriioC’liiA Triurtlc IbmIox . OOC nr« 90470
ax V 2*m iu •>» I2imui LUIbU&Afc IMU1 cttioo word no no Hi Jnp top a£*V 2049-1CM)* 12:41:01 LUrCUSASTROI c/fice.'«ord no no II; Jnp top V JOOP 10 12 IT:IO: IS uTTIcmíVjoi «1 no no 3S07.UOC V 2049-10-12 17.10.43 ofílce^oril no no 3047.doc V 704P 10 4 1 08:44:55 aricwi'/jui «1 ■10 no -4> -•- xw^ltlutf •lor Ml V* Mirim ConipuiMi
V .’WV IV n U3:f4:t>4 ctTioo.vjora no no A> . L»>^»'V 7A*ft 1M3 IW:XI:r.? f*tU.A>+jc,rii rw> no nr« fa« Rrman> Rr mam
V U'i; 20!1«4i ctrico.vgora no no »aoan.«nn>na nv»ii
V 2')40 10 12 20l14l*l2 cniooVvord no no Boonn.nli
V IIH7 14:71:111 iif(ii:MnM«ii«l • Nl ■ in ÍiiIiIm.iIiii: • Inc him K-V 20^P 10 4J I IM IrlO omcwi'/joi u ■ IO no TtDIé.aOÚ V 94««.IA.47 Irt 1^ 04 l/Hl «1 • Ml • Ml n,is,ui «Imi • InC Ml Jt "a*< (■m44,«iimiI • ••all 1
V 20^P 10 47 10:15:01 ofTlcwtVJOi «1 no no BaKaii.iloc V 2040-10-12 12:44:35 o/noCiVword no no «r«fCIO MOltAZOtl Moitnziui . -
±1 l -ÍC > i—i_ .1... OD““ 0 tmmaa—■" ->r
14 PVAJ. 1 ui .1 k k| »“2? si*». (Mm/. *j»i |.m?'»; Cl.g-y» il; 1 SOUIId
(fli.mul Ü*j/!ÍK?ÜUU17S5+K;if^ 1



TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL





If

Numbers/Loqin etc

XK Mctavlcwcr: dostccn_200Ol013_sS Mozrilo Flrcfox

-Iff I *1

file Edit Wew I lisfcor/ Dcotavaiv^ Tools I elo

- e X

uJU

F^T

hfctps://xlss-c«n(rd. coi p .nsa .¡c qov: 0440/XKCVSZOPCj

☆ -

Í&1

Gocqlo

-P

QU Most Vlïlted __, Sma-t Bookmarks ^ JSOnout PI [_3 Yeeha UPN Mapper ?f< WS-Central -ÿ> DonsPage - M-KE/3C...

|2j JSiuiuu.: RÍ

ft SEARCHLCQ-r Qunr...

•?> ^oiii-Pai** - X->:EWSS

XK '■ItfldYievrer:... (j¿>l -j£» ¿4314 fUia il© U ©

■■ ^1 I Ü

TLNINSfiORK

lt-ál

iüiiI

:-K pgt.uH.1.

¡je

SS3M2S

XKEY5CORE Wukunu

OMINT / /NOFORN

árTHone i^Acmn

-líll-QüL

, Users Search ÎÎ Wcrkficw Central □ Resulls EU S:alls:lcs :E Taöölng :E Tasking *21 My Accouru XK Forum W

Navigation Menu

fell SKI l'nrnrtr
|tz| Tec I* Gtrngs in Do
3 AuUyIy
Qvvl/xim

ED Wnh h In I hin^-nr
F5|Web Proxy
H vvSrw» wrk
R CD Cctntncn
LU Qj Dirtmnory Hitr<

0 CD filo Transfer
0 í I MüliStftirul
R CD Network Maniement

LU i~’ 11 iftrtrActiyity

0 CD VcIP

01 IWi-wkww
R ffDVVorktlo'-v Cemrsi

ED Wrrçi .r.rFSlAIIWoïkflows
[3 Ail Pvi i Jii iq V\\jrk flu'-v'v
[3 My Wo'klo/zs

|tz] My Roc orit Re s mHs
□ MV Pwv'iuuv R trulls
My Archived Resulto
ED My < ingnng Hr.^i Jtr%

¡Til My Downlo-ic s
S3 All Duv/i iu^Us
i^D All Recent Resulto
ED All I 'rr.virun Vr.xiitrc
¡Til All A c *»¡vc
All O luui iq Rwwuly
R t3S1StlSllC0

LU CJ > Aftguir-itiftn
f^jLirk Sunnoriroticn
SP^Taqjinq
; ; LOOOi Tagging

ED onh 1-xlrqntnK

0 CD Ta 5 'cing

[3 Vup Tavcii q
R CDM/ Account

<1_________________________I

I listogram: Cfur SfltulpJii

jd

I istogr&m of:*® Do man (Click Dar lo Piker)

4 00
3 00
200
I OO
Ü

158





-



•yv







c>

Pivot:

Casenctatlon

u

H.i*rrr*n IIP 11 II IX
Cear Detection

He|> /tictions'- Kepcrti - Vew - ML It Kb': lb - N 1-

»

OvIX.RF* IT6-I0)

03 ::cch«(is;
PEI viMLAur (.j;

_inal Us or Maire

Dal et me 1 ighligl-rfs ^•Domain '^.il^ect Chain

20t0-10-10 05:15:13 (-Ht'V mellJiorlnoo.cn 2340 acnlor contacto In kulUYor zn< OKLicOOgO imnmamnl.iiof lnco.cn^l<8tc.otrtir
20#0 10 10 05;f 5:10 LHt'V lmt:iii«t;t;iiivialvi .cvi 2340 seiiioi vuiatiivlv in hnli^ ivi di< Ok'jeOOuO'lim ilit^:in.ii.nvi iiiw^uSkjU.uliul
■ 2000 10 10 05:15:10 LUL'V »ml.msorociie.com 2340 senior contacte In kiillafor zn< OkqeOOgOimnm^m^l-iiorlncoxn^kJto.etrur
2000 10 10 05:15:1) (-Ht’V jli^iilmviuil.cuiii 2340 ytnioi contact* in Imliu ici du Ok'.i^OOifO Inn iliijû'nuii.nvi iiiw^iiSkjU.uliul
2000 10 10 05:15:10 UlL'V Ims mo (henion 2340 senior contacte In tulla for zln Ok>:ieOOuOimr4ll»3mal.iiorlnco.cii£kate.ctrur
2000 10 12 08:20:00 V tlvvlü iwl.cu 2010 «wise i ul»* 3iliuli*U^ij2>etv*lu iivl.vuîl.'vkHi ijûjiiv-wiikIit
2000 10 12 08:20:00 V lnwlntl.ti 2010 swlse rolex 3vkiarh.3 lnvAj|iulJt
2000 10 11 08:36:58 (-Ht'V veii.^ivb.iiix 101009 Ell LA PAZ, BAJA CALIFOPII» tlM¡*1.:*ir.fllit;¡t;£¡>i;í|;Jui;;il£mliuii
2000 10 11 08:36:53 CMC |T|i.bv«il 101009 Ell MEXICALI, BAJA CALIFOR ilgit^l. umIí*í*(Q>i>Í|/Jv;.ilSmliiai ik>..n vivb(5>t'
2089.10-11 08:36:53 LML wp.Mcb.uix 101009 Ell MEXICALI, BAJA CALIFOR ikli^l .:«■ Mliviv^i>i|>JoiMl2eiliuii Mvte^v
2080 10 11 08:36:53 rurV 101009 Ell LA PAZ, BAJA CALIFORII» ik|i^1.11 ►.ili*>i*>*u-|/i|/Jvu;ilSt*ikuii
2089.10-11 08:36:53 lhl'V wp.Mcb.uix 101009 Ell LA PAZ, BAJA CALIFORII» clMiel.aiMliviv^pfnJucvil^eilirai clo.aiMote^v
I 2089 10 11 08:36:50 rur Wlf.Mcli.nix 101009 Ell CIUDAD JUÁREZ, CHIHUAH iKiittl. umIí*í*»^í>i>Í|/Jot;;il&minai ik>..n
2089-10-11 08:36:50 LML WM.qob.mx 101009 Ell CIUDAD JUAREZ, CHIHUAH ilMiel .:u Mliviv^|>i|>JuiMl^eiliun
2089 10 11 08:36:53 rurV |T|i.bv«il 101009 Ell LA PAZ, BAJA CALIFORII» tlni*1.:«iMlit;i%;€i>i>fMJut;;il£mliufli tknaiMvt*^*'
(i.4 -i .-nr n»v ■i»viaa
is^rtn 1 nt!i HI \lftcjr.-\\7r. 70 ;fi/cv *TiPiP rnwr? fr.r pngr.)

I loying 1 - :iln1hV*

clareen 07301400012«43C0>C 1

Tt-il7 torn Is au d I tod ~or U^SCC IS and Human R.lqhtr Act
ION SfcCKfc I //CUMIN I //ISJUf-UKN

)rnri

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

vi« rrínfml.rnrp.n^.r.gnuíKIIX ]

TOP SECRET//COMIMT//REL TO USA, AUS, CAN, GBR, NZL

HTTP Activity

(FOGGYBOTTOM)

Oxk Meto viewer: drverml □ Mozilla Flrefo«

-lOlxl

Efe Edit Vjtw n«iory gwhnaite icos Hob

# • C X JL j- - I'CtCSlI.'X'S -ce*it
& ' |[ÇT"|Ccod9

P

b¿J MKt VKited ____5nwrt EnAna-te J; asowuti Rl LÜ vccte'jRH nappe' ! DonsPaje • X-KEV5C...

iJj JScim-t: fti________5EARChUGHTOw...

-» Duis-Paqr-X-KEVE . i |

Sfc XK Metaviewer:... ~^2H3f=ORK y I ^ liUy&:,7r->-..f713.h:ml |_ l¡¿ XK Secrtli: hTTP\A. .

rr* X^örrn £ Users tf Wtofcnow Certra jKesuts

drvermi_0

a-iditgd for USOIO 13 and Humai Right; Act compliance

tCKblV/CUMirv, I //NÜFÖKN________________

XKEYSCORE Wulo.-mc^^^g Log Out
IH|Sl*«*cs irlswnq triase fiMy.Aeeaul -VC XK Forum

Ö H=
Navigation Menu

I V ViV»/

80>W.Srcr:h
0IP Addresses

gMGCAÖÖfC35
:-QUsemame
8G|Qo»fc A.M

SaecfcBerry

hEJCN:

EJCallLogs
gjCOtegory DM
SCelUor DM
i?|Oscc Pas swells
HOVE

SC^JWrtMdedste
3c^-wjr*-ii Taaqiiq
^JEítíii Addresses
¡SjFtfracteö FlfS
SFUI-Ofi [»>1
3 HTTP Activiy
^IKE Parser
[SJlOijrisand Password
3 Vícsrof^w«*i Met
t)^2j^a55itz H-Z
gjKEYLOGCS*
S^^twork Loss
3 PDF VMwiria

<<

H9I.0 Act tons * Reports v view v FI TFRS: » iii

Daceiire brd Hariqms HÏ TP Ivpe H02I URL Parti URL Args Sea'c^i lepns Lerc^ecie
21:1*44 2U49-1 U-14 2*2*41' CXE post logmiaccbeok .com i iogin_attcm|rt-i
21:1*44 2009-1014 2*24.-40 CXE 0*1 www/;i«îbwk.71:1*44 7049-10-147*7*40 CXE r* www.14octohcf.com f nmvsKUSfl>Sc038-f75
21H*14 2009 10 112*2*40 CKE post vwm.1471:1*44 7049-10-14 7*2*40 CXE nr-21:1*11 2099 10 142*2*40 CXE OOt foffum.kooora.com i f-133
71:1*44 7049.10.14 7*79^0 CXE tofimi.koaorA.com < f-133
21:1*44 2099-10-142*2*40 CXE net fofuntikoooni.com i t=l9827244
21:1*44 2099-10.142*2*40 CXE .lllOllt
21:1*44 2099-10-142*2*40 CXE 9*t about
21:1*44 2099-10-14 20:29:40 CKE f0rum.k666n.C6m ( t=19800445
21:1*44 2099-10-14 2*29.-40 CXE o*t ook.com fcOHIflKMl.1 indexée
21:1*44 2099-10-1429:29.-40 CKE oot ww w.qoogle.c ovn.sa ( hl:arlsourc*li|)4q:
21:1*14 2099 10 14 2*29.-40 CXE post 1'XjiiiJacobook.com f login_attemoi-l
21:1*44 2099-10-142*2*40 CKE post logmJoccbook .com t login attcmpt-l
21:1*14 2099 10 14 2*2*40 CKE not www.goojlo.coii i.ea \ hl-ai Seonrco-lip-Sq-
71:1*44 2049.10.14 2*79:40 CKE V* MMivi.Kchook.coni (friends.1 ref-tn
21:1*44 20991014 2*2*40 CKE oot www.gooolo.coin.ea / hl-ai Suoiif co-l»|).Sq-
71:1*44 2049-10-142*29:40 CKE static ..ikJ.Kehook.com ('common. index-4
21:1*44 2099-10-142*2*40 CKE 21:1*44 2099-10-14 2*29:40 CKE 9** loiiiiiJ.Kebook .com / login .ittemjjt-1

J

/

t

/

/

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

CNE

Specific Searches



Tse • ■

TOP SECRET//COMIMT//REL TO USA, AUS, CAN, GBR, NZL

NE Search

^)XK Search: ChE - Mailla Firelox

ffe Edt Vecx Itetory Dcd-roarvs Teds »Jcb

• C X ÜL, ISÏ

ht^£:/fxl^evircJ.ccf9.n$4.¡c.
X3

> *

IËF



O

i ¿1 Kost 0«ted Sruft Bookmarks ¿-j JSçroj:: P.l T] YeehaUPTd flipper :
lJ JSijiout: R1

& SEARQ-ttaiTCu;... I -;*? CcfiîPaqg - »i-gEVS... XK Search: CNC Q jJjLMNGFûRK


TOP SFC.RFT

'ifí&f^TWJííRW&nFfm
xkfy 5>corf Welcome

Log Out

í^Hor-c J*4¿chin ¿Users Sswch if MWiilov/Certral Resuis 13 Sfaftistiís i= Twqqnq J - lessfcnq S Vty Accourt -\£XK Fcrun W Hdp •

Navigation Mrnu

«

QfcDKVjtiSea'C'i

ElP AdcPcsscs
□ Mac Âdcress
¡guseirarp

QQCbBSC A-V1
0 Aterí
0Btos*B«ry
0CNE
gJCd legs
0 Category DNI
gjeri utorow

[3Cisco favsswerds

@DNS

EJCccurert Vfctwdal«
0CCCtfl‘tfi T*9£|-|ß
[=]tltlOl AddfSC-CCS
0 Extradée* fifes
gjFiíllogDNI

OhFPAdivty —
gJhE Parsci

Lours anc Passwcrc:
[gMCf Cf^^l Kfetäö$ia

t|Q^te'S2,c W*«Z
0KEVLOGGSR
E| uct//ctv tegs
i£]FCF rxttadàia
g)niB=W/

[gPPF VdP Metadata
gJPö^OCll

0Phons Nunhef Extract!
0 REGAN
0 REGISTRY

Help

Fiédv* AitancedFeaiieev • Shew/ KiJden Starch Fwfcte Cfea* Sesrc'i Vafe?s RduwiiLav! Swrch Yduev

Search: CNE

Query Norm?:

Justificdtiuri:

Ri : :r it ~ KtVicatiQfK

Acrdirricnal Justification:

Miranda Number: [

Datetime: 11 Day 3 Start: 12DQ» 10-14 □[ C0:00 |y[ Stop: 2009-10-15 ß ¡23:59 $■ 0

Collection Technique: r

Username :

P Address: |~ I From jJ f?P Address Finiri Piiilrierl

]P Address: | |To z] •*- rilL6ddr.e.ss.Fjg lEuildacl

Port: 1 |From j*J

Port: f~ J lTo d

U U

!= b

Bca

!ï

î t

Z S

O fc)

U U

C JJ
f *

f? ?

a •
* *

y

EJ là

:< 5

.................................................. v...j.r $ .............................

rsiC5taQl[iiliSl2aiI21&iLiliai£JiiiüilÍJÍ3íZJ S lütüïïjÎLitiLSBJüLlliSIÎJïiJL1 s

5 «

* 5

5

Ü

f »

«2

*>

r

¡s s

3 ï

7J

“0


*

3

■P *0 *P .=

G ” 3

% 2 I î

ï *i

f

n «
8 3

S 5
ï «


si

5iS??S2í?!?í

ïrïtï ! WS Ei

_3

g

K+j>«,cg2on rtynfmmap«»f,«Q

£

'l'

V

ogger (result

Mrtavicwn-krylo^qri - Mo7Ün I irfoK

JÜ*.

Fie Fit dry. Hdrorj; floctow« Tod* Ht'p
É9K * C X ^ Mhttoss/^c cnc.citp.rca c gcviBU-yttEYSCCftE/ ú - IGI-I^w
Jl Voted | jSns t fc>:F.na b r£ J5y>xit Rl (_) fcsfo URKJ tapper .V XfcS CbnsFaje-X-íEVSC..
LJ) JS^rojI PL $ SEAPO-UCHT .. $ jCdSzc* - K-K. % WMaUtfftk«'!... *;< HC loqír >> **214 (:*. J iuoixfxx >.KIB RPídt; .•;*..7 lO.htr» ^CxrM«tayl...Q -

Í^Hcrrs Alfeeis $-?ich

N#4VÍijhIÍihi V1*»IUI

XHEYSCORE '-velwr.0 LQQ Pit

?T '.Vijk:fcr.v Cvilifí yftesuts Rer^irli [^ISJtriBli:? SMy ¿sc0.ri J¡£XH Fyum IM:b-

¡gcscoPoM'wds

j j EJd^c

ílD:0/TCft Melada
£¡] Dx-yfncrí Toxír»íi
igEreilAc*:re&»s
SjExtttdseFIcc
^3 Fiil L09 CM
r *3 HfTP Acfivty
gMI tosa

^5 Lojng *rd ^gy/orc*

3 Kfcryp i«n Meto*?«
Ú£|ClftC4*N¿
3KrrLCGGK
£]M*A'D'k .03c
jgFCFKtetídda
SCLEE^W
3hW VolKMcMel«

r-3P*«
3 Ptonc Nunfcei kxsrac«
f-^RBOA«

Hr'

3Rrp

gK*IU3L02¿

1-3 sp

;-3ssLPíf€8r
3 Tfc-tfi Sfrfftrjc ira lYiriK.
;•-j3 User «K'lv
:-gvu ¿rj

rfc rvan&to'
f-^VNel: Fto>y

♦iQCoiwror

HCjDv.unuym*

?lC3Fle Transfer
SfiiWJÜ5«fv;li

3P

«

3

keyloqqer -*
Fri-. Adíen; ~ V«w,p FLIERS: '7* -w
:$ fa«tm?6d a A SCifCé 3 ICC N*f8 Wd# tijfiw Sd&sD Pro. D ~ITI* Key SJrcie^ Qn
20£M 043'60300 Cfl£B*>ttCOl5 QQcxc 3 w\c MOO-IOd3CP:42 45 WM);c* IdrJ|dHIdrl|^.IIdr|IdHIc*rlId.lj;dTl *-_
2003 10 13 ‘ 50303 0fi£B’KH'\CS15 CO¿:2C03-10-13'60303 ttCSl5 CGtexe «» 3 03- 2008-10*12 Q7:42 tó (tbclOJcl 1)' :2C03 1O-1D'G03OO otcingi i-VvGic GSÍ;©xc W.'ü 3 03' 200 101: 0^:13 00 CCe-»OPCOx»C]ICCeC|Z \\0/.t0\ *
2003.10.13*60303 vír“ 3 m< 20CO 10.1207 .13 22 (/Pírík«|»C6);cün
2003-10-13'603 03 CREBUOIACS15 QQ0X6 3 w 2008-10-13 eP:4¿ 02 COX«SK0»5UOXC5IO:oS:[0xe5PFCOKC6] '.OXCSF *
2003 10*13 30303 A 3 052 20C8IO 12 Or.*15.l 3 3
2003*10-13'C03 en WEG40MACS15 EXC3.DÍ «owcUEycel-XÍ KSA 3 ÍS2 2000-10*13 0?:45*0 («irPsd.'JPl
2003-10-13*603 en CflEBOCHACSIS e::= Mcrcscil Exosl- XE KVA 3 $52 2300-10-13 07:45*16 3
2G0B1Ú-I3GO3O3 tiREd'KMAC&IS e:2003-10-13'603 en 0RE04OWCD16 EKC3L0CE Mowclt Exosl - X L fyPA 3 $52 2300-1013 CP:4S: 33 2
2003 10-13'503 03 <36EB*>ttCS15 =:VLIfd-1 U-13 ' btl J llJ ÜWrtílJCHACiflS» fcXC=Lh>.t f.lno-.cítbxcel- JC t P5*A J iS,‘ 2JUU-1U-lJlV:4b24 tí
2003 10*13-5>33 03 CflEB4&UiCS1S =:oniw.irt.iS'fwnm (iflfRviTHArsi* F200310-13*60303 CflEBICHKS15 EXCr.Br MO03C(t EX09l - X t K'P'A 3 $52 2009-10-1307:45 35 [McrF3(5 OJ3C5
200310-15 00303 «vircmcsis cxcs-b:: Muuatrt Cxvcl- X E H»A 3 552 5flC8*l 0-12 07.45 *3 3
2000-10-12 IfcOO.OO GREÉHCHAOS15 EC= MicrD5oflExcd-3CiMí 0 $52 2000-10-' 3 07:45:*: [M»inPi>d-3)28
2003 10 13-50303 <3fiEB'KHA»CS15 s:2003.10-15-60303 «VO'KttACSIS ::2003 10 13*603 03 vREB*>f\CS16 e::e Mocccrt Excol XEK>A 3 $52 2200 1012 O7: «5:53 7
2003 10 13*60300 $flEB*HACS15 e:3 ClcrPacT)]
2UlW-10-13'bUJW c¡.c fiicrooeit txoei - x 155» A J S6¿! ^UMu-iaiVxbin 1
2003 10 15*00303 CTCCNGI I4C31S ::2003.10-13 *603 en OfiEQtolACSlS £:2003-10-13'603 03 CRE&KHACS15 e::= Mcroscit E:2003-10-15'003 03 0RCD43 ttC315 -:2003.10-13'603 OO C*EB>l>ttCSlS E:.£ Maocclt Excel - XEKSA 3 $52 2000-10*1307:45 39 C«irPa0.3)a2 'T
•l "T ■" ' ' ±r
**p:tP 1 o- 1 If H «5 r*iqc5íz«: 30 (\1x< fOOrw» co- cc*>p- C4:t>
5b E'Jt 3*s Hstcry &yAn*Vs Dok tbj

003)57330125552

hytps^fxli-mr.corp.roa.»: gc\,:8‘1W6!iEi‘5CCirl.£|Vi>'cctsi'iq3Cl-V^ifiK£V£CORE'JA2f%2Friel

X KEYSCORE C2C Session Viewer [from archive]

AUTO

t)XKSes>ii>n Viewer - Mozilla Firefox

•iz z'fi\cmlsa.d

for U5SI0 13 arrf H.rft^n Mg*rt?Atfcorrpi ar*o

CLASSIFICATION: TOF SECRrWC 3 MINTAiREL TC USA AUS CAN ößR IL

-r--lT.fi

>3- ■> /I ffeffl

D stimme

200^-lG-13 16:15 43

Case fOototon

Fron IP

To IF

From Pori

To Pert Ffotozol Length

CC.RMSXXXAHZDTC

31133

Quick Click« I«

Session

a!«

find *ppl»«-A* rn

dn: pavload/l
Find vppvi te sit

:0 •->

:0

v.



r.-irr CVnt

ETteM»ric®c«eh

KEYLOGGER

Oicput columns are designated by process >wne*prcce& idteestion >d

ICcyatiokc legend

Window Titl»:

2C0?-10-13T7;4 2.-5/ 06

"ctrij( c>r'J[ctrl] [ctrl)[ etri](nri] ictrl)[ctrl][ctri]

’clilir ctrllf ctill f clrlir ctillf rtrlH05s3ir ctrllV

2C09-10-1377:42:46.781 ?

2C0 9- ] 0-1307:42:* $.79$ !Cx J$] [ctrilOs]

2CÜ9-1Ö-13T7436 921

2C09-10-13T7;43.22. ]5 »W

Window Tide Changed:

QQ.e.xr-804-0

»IS

;Oxi5J&;Oxe5}I(Dxe5](tee$]AO[Oxe5]
Oxe5]ZH[Oic5^T[Ozc5]W[Cfcic5]
;0xe5JHE(0ic5] [0xe5]
CKf5]r",[0>:e5]l[Dxe$]B[0se5]I[iixe5]
;Cxc5]AO[0«c5; [Oa;5][.][C>:c5j;0:ic5i

:0xe5]Z7O[0re5][C:{e5Tn[0xe5i
;Oxe51AN[Ose5; [O»5][Oxe5JDE(0»i5]
;0xe5]0[O>se5]2[0Ke5][Oxe5JY7EC3xe5]
;0x:3JBU[Q«5][Cfcc3 ][ Q*e5JZIII[Cte3 ]
Cxc5p[OxeS]AO[Of:CSi f0nc5]

,G’/Cf 5 )1 IfOse 5] N[ Om $] (Oxe i ]QU [0x25]
Cxe5M0^5T[Oxe5][0»;5]N3[0»5]
■fd]’0xe5][saH



EXCEL E XE '552 'O

MSACCESS.EXErt5B(M0 MSACCESSJJXl

Micros ufl Excel - 3CuF t5-ir A2C(i'
W $09: 8-1X11*1*

Microsoft Access

Microsoft Ac

Session Leads (3) Veta (l)

;Oxe5]B;Oj«5MOxe5][Oxe5]

>

F

JS *T>

c
: -W



u b

2 û! a

Ml

umm rara



3

cS

r*

I

r

E

V

5

li

i*

«/•

O

CM

U

LU

a:

o

«-»

>

■

X

?

Cl

a

o

tí

o

LL

E

p

ù.

.o

Cl

E

C*

5*

S

c

d

C

E

g 2

WWW W W (A (A W M W W W W W W (A W W W WWW

uli£(£ m uc ci uc ictcmucccucucu: ucucucx ucmuc

OO 10 .0 V) CO .0 V» bOC/lC/SCOC/lCOlObOCOlOUlCfl www

=•, =. 3.

3, =, 3. 3

=• 3, =>, =,

3. 3 =■ 3, 3 3, 3, 3, 3, 3. 3



T r

T r

X T T T. T

«

5

v;

J § ¡§ 1 i

S- a. > aBttHvaJlJi

- - N - N.VNNÍ.-----

*C “ï 2 322222't^C^'t

nnnñ n n fi n § itt vn r¡n tti ¿ vi m ïïi rvi rïi rn in wi fa *771

® -3-® -s - © -s • ® ■ « fl] fl]

—a-.....©

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Parsing

Tailored Viewing

• Browser Info

• Collected Files

• Directory Walks

• Drive Listings

• Ipconfig

• Keylogger

• Process Lists

• Registry

• System Survey (partial)

yes

standard XKS view

yes

xml

xml

yes

xml

yes

xml

TOP SECRET//COMINT//REL TO USA, AUS, CAN. GBR. NZL

• arpcache

• arpconfiguration

• auditinformation

• capturedcredentialsdata

• connectionlog (unavailable)

• datatransmission

• email

• error

• exchangedata

• fb

• filefllterlist

• localelnformation

• modulelist

• machineinformation

• netmap

networkmapping

netstat

networkstatistics

systime

routing

routingconfiguration

sleepysheriff

smackcrafty

storedfile

systemsurvey

systemversion

transportlist

unidentifiedfile

wirelesssurvey

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

»

ÖL

ï

3

»

t:

3

«J
• ■

11*

■Cf«

II

?

?

w

LU

r

?

*

«


>

«

?

n

£

5 ,

Ul

Cf

=3 I
*1
JC

c

5



<3

it

*




i>

5?

i>

ftj

.&

T3

’J.

£

fs cl

O

2 *

.w

% s

I a

* % *

r- £)

a

2 2

£ %

I S

<9 «

a

3* *

Ps\

a

»

?

4

-

■5

S *

I 1

1

a

* « * -s s

— — — — ^

.-* .*-* .- .-

*

* II

ff «

a *

* ■* *

* 4!

3 g

r c

I I

S «
a '

%

c c
a £
4S *
r 2 JS .*-
5 c >
•i 1
« fl •r
«■ a c
* ?
*» N.

c"

a

«

*

a

*

U

g

n

£

g r

U

2 5

=: i»

?

s s s s s = r s 3 r s 3 3 3 Z
5T 5" > ? 5“ X > î ? î ? î î S’ S’ S ? S S’ S
c c c c c c c = c a = C c c c
? > ? Si * Si Si ? Si ? ? ? ? ? t Sr ? Sr Si
o « O Ci « O O y o o o « y C." •-> « « ü c t»
« « «• * « «> « O O c 0> o » » i» «Í ï» «n v> X c O
« 2 5 5 5 12 2 -2 2 5 J 5 2 J2 ^ 2 i 21
V V V w V V w J V V V V V V V V V L»

i

■- -i

E c

* I

UJ

ft

=' -,

I €

8 £

>, ><
w ^

5 2

¿r

S

ä

c.

SSSSSS5 S*

A A A *> A A AAA
"“I ““ I I I I I I I

C JZ C C X

S= *=£

5

£ £

€ « S

¿

2 2 ¡5 2 5

_A I A ^ A.

JZ S jc' £ £

f • ^

V c o o y o •-> u « y z i v 2 v c v

o c o* o X» o» i» V t V a 2 c r c
Î/ n. f. n 5 f. 5 ?. r r t T ti T n ?. i!

V <5 >f ■/* -Ö -ff ro c: ^ C ca ^ ^ *-i-

^ T- C ■=•

cor; nj {M



Ci

i=S5 32SS$3S3S3333333SS

fî O» «*•

«SggggggSgggggSSSgigg

-J OJ fS rj ÎH r\ 7N FM Cl FN Cl n
^ » r*>

«

Cl

3 5 2 2 2

r* ç-.

5>

fii ä »»»»»«»»»¿ ¿ÂNÏÔi^NN

CM r* fC .-A r. ,-A W « M « r» « « ÍN « f, ,-l w ?■*

£?S8888888288S3S¿:8¿8



«V ff.

ff» 0i ffl 0. 0- A J. A 0. A J.
S 1 ï % $ 5 t $ s ï S %
A4 A»i AN Al rs M Ay M <

ff. at

¿ a 3i il * il i 21 9 21 21 § il 2 51 El El El El El S

V *• >>>>>>> * > V > .&> V t* »

V -Vs *9 *9 +ÿ 'f t 'S *9 •* y V V Y v V

rr J* JJ '-J JJ LJ îii JJ LL’ JJ Ï4

oooooacoco£55

U» UJ UJ UJ UJ

C O O O O

o

LJ

.C

»

.?

? ë

ri 8

W I-

£

C

•= £■ «*
¿ 2 te

? u Cl i,

Il SI

%

-•

«

*-

X

c X

c

tr>

C

lÆ7|F7IPlf71VIÏVlfI|

S

o

SÂ

- m Ja

o S f

C fc £ fl

g 111
ils

t:

I

w o

0

1
r

»

->

® £
® r.

O ¿
£ î

c

LL

J& i

S 5

fi ¿

■c

t

• g'

'D

Ol

C

CL

i ?

2 C

< O

1 ^ 2

2 2 i 2

O'DOOOGQO s 000 na ¿ ® ®rara

03003)311100 0

•-CD ...3 -

IIUHL* ’• • [I [vil



MiSl
iron ioimkob

TOP SECRET//COMIMT//REL TO USA, AUS, CAN, GBR, NZL

aHv!

Future Plans

lL’lr
*

Lj

• Expanded data coverage

• UK, AUS, (NZL possibly)

• Validator/FOX contact/survey flows??

• ECI data??

• Better TUCKER processing (both in TAO and XKS)

• Extended plug in coverage

• Network information (neighbor/gateway IPs etc)

• Machine Information (host name etc)

• Process files not found in passive

• Registry files

• Thumbs.db

• Browser history/bookmarks

• Apply to Media Explotation

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Questions?

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Page

TOP SECRET//COMINT//REL TO USA, AUS, CAN. GBR. NZL