CNE Analysis in XKS

TDP SECRETIIEDHIHTIIREL TD LISA, ALIS, CAN, GER, HIL . . . ?m?m 11-52 5: DATED: mamas r; usm Aus, CAM, GER, MEL DH: mazmna . 1.17:1 _2

TDP SECRETIIEDHIHTIIREL TD LISA, ALIS, EAH, GER, HIL .. int. - I'm ill 43' 5? rift: 5.51553: Him: 95:5: [fi? fizzTDP EDMIHTIIHELTD USA, ALIS, CAN, NIL I

l' TOP I REL TD USA, AUS, CAN, ESE-SIR, HEEL ao is a collector - analogous to field site Various formats based on collection ?equipment? - OLYMPUS vs UNITEDRAKE WC ys SRI plus content produces ?sessions? - payload format Significant overlap with passive, especially in terms of collected files I of?ce; pdf, Much unique opportunity - Config files]r registry, network Beginning to feed standard analytic tools TUP SECRETHCCIMINTHHEL To USA, AUS, CAN, GER, MEL

I I TUP EECRETHCD TD USA, @3133, I - l: a .- [Ir?n I 3 - . 5&ng r. - PINWALE (storage/legacy) TUNINGFORK (aggregate data Views and tasking/legacy) - XKEYSCORE (discovery+) I (profiles [machine and user], future tasking) - (networks) I TU (future) TUP SECRETHCCIMINTHREL TD LISA, AUS, CAN, Gee, MEL

TOP SECRETHCD TD USA, fillUS-3101 UNITEDRAKE - TUCKER - OLYMPUS - EXPANDINGPULLY [formatting issues) - UNIX (very little, poorly formatted) - Not PISA, Not ECI - Data retention from 291anuary (many projects not available until 15 May) Toe SECRETHCCIMINTHREL TD LISA, me, Can, See, MEL

TDP SECRETIIEDHIHTIIREL TD LISA, ALIS, EAH, GER, HIL vv? Fir; - DMIHTIIHELTD USA, ALIS, CAN, MEL 1 ?3

TOP SECRETHCD TD USA, AUS, CAN, SEE, - 3 SU It 5 Selecting all tables generated between 2003?9-22 ancl '2009??3?23 00:06:03 Pulling hit data from aks-centralcerp.nsa.ic.geu 30 distinct users feund 13993 results in 60 separate searches RESULTS (ad-haCl: USEFKEH 221?10421 Iran NPS Bic-mains userasx?BUB-?gwm 25362321 8_1 f652356 clecurnent_metatlata HM 1353 1652656}? t652856_l]631 26106125361 1?6_1 tech 232 Iran Tech Search userm_03?32420012536461431 Distribution 01? Searches by type: emaiLaddresses: eatractecljiles: 32 full_leg: 5 ciecument_n1etaciata: 6 phene_nun1ber: 1 tech: 4 registry: 5 TUP SECRETHCCIMINTHHEL TD LISA, AUS, Carl, Gee, MEL

TDP SECRETIIEDHIHTIIREL TD LISA, ALIS, EAH, GERh?F?t - I I a: TDP EDMIHTIIHELTD USA, ALIS, CAN, NIL I

TCIP SECRETHCU TD LISA, RUE, CAN, SEE, I my HI H113: Eh Hahn-5' ?zdcmarl': Ila-uh: Hep 6.- 1' rrc-zta'usII-zazl . .Ema-t?zahw?s 'a'mHaLmImc-n- 3i: ans-cumch Wall: ELI-EVER. I?l?i?cun--? 1g magi-I Ij "pr m3: :lnsJ'Iu II-I.I Il'- . Ewen-HI I 1r. ?ur F- $4413 .llLEars Eighth I'mem-Emtal 351mm 321mm T33er Ehvamm 3E uHeIn-r SE . ?b LI tut]: Iiimtegm w. . JZHE I I LJR: a A I ca tl 5:23am d'ul'J'n'erlI'irwd: I - Cali-annular. m?deIrj-Tl?fmj - I 3??5 mtmamdn'jv?t .j-lthua-llbadfa?? I IlThu?iII; . a I a Jug? d'utvabadn?? 1:11:15: - RIM l: .- Luna-.1- mt WI'md'r?'lmjm I: II humus-.12 - Limit to XKS-CN 5:23:15: if Franz-ml I performan a searcn *5 135-: um I I 'al'sma 7' - Very search 322:??me :Pupulcd "in. 1 Luz-mn- @m I 5 er Him-4 I TGIF SEC

TOP SECRETHCD TD LISA, ALIS, CAN, SEE, HZ - ?le En! Elan Edam-ks 19:15. Hill:- 6 - mammal U?rart?mhnar? Jag-mt: R1 vaehaunMr-Eppw 1'14: him-Carver {in Dar-wage ?u - 35'; ?item? me: #4 31-1 mun-12mm: H: 11: 1. I. avgSear-:cam. mun ?rh 2-41 IEWHL: I?th 4 1'3; shrug It mazr ?Help Navigation Mann IE 1-. In: Ema-H3 553*? rm - vim - FIJEHS: 1 ?3113 13-man HEIUE 3113'? EFF.- Mil" RESIN-3 - FF 12 1 I311 Flaming Lug; IE IE ES- F'ErsEr LE Tau-J1 Suing: Emu-n: User Hail-rt:- . 5mm Ieut In: datehm: mag-1m: dateti're 'mjal-m-? manna]: mu:- {appl'mtun= Hd?'?uadllsi'dl?mu'?? m: I: Hum-uh? AND Fn_- Em?traam'k El twin-mm D?mmnw Hm 'rlzl'ErEf El I11 Hana-Jan -I I Ir QL'mAci-wh' IEI D'Ie'th lil [aw-21232 Iii-rt-H'J E?l?mrh?aw: ELI F'En?hg '??wnnwe :Hy Wur'nfcr-w I E?j??n?lltPIE-gal 1 u?1 r? Page Size: EDI rut-21': :IJ-dit-L: l. 15: :l 'r I. ?in: 1 II..I .-. [3 lg

TOP TD LISA, ALIS, CAN, SEE, HZ - - Ilrr'rm I. :Ir. Er?: lill?l'l'r Innh Cf. HEEJH {If uni-Ila .Emarzeuzdmarks nix-mm: 2.1 ll] rue-aha Llama-:2: Fl: n1 ah} EFMHJEHT. Ha a: Puma Pa: man i13I-1 {char-1. Mar-Em tr mmacatg Him] ..Jmm 3E Hnimrzh F-l - - - -. ..-. -I. 151'! - Lihi- ICIJ: EEng ,a?jAu-r Limes ik?mr ?I'IIJmm-wm-nrgi ,?mm i-anrg 35:145an Hungarian Peru 'ilil . Wuha- -. - Elms-313mm ELF-5 I I EEG: HILL: ul'. l1 . ul Bu 1: Ila-1 IIEFII: '5 glam-mm. an-EE?rr-Erl' JJIZWP A .a 1 I -.- I'n'rlrl'l . . Eli-mm: E. ?31? 12* 41$ . Efren-Wanruzrm 1. mun-Jaw u-urm} .?uum - Mamas mm? - Em?wr?wmww F. 'l I 5 a JIJD TuJ-c IEI . 1- . . 3r?:ij IFI I hh??ll ??i?ldjB?u?ms .. ill. 511Dme Hl?lna?li EAI I FIAI P'l'd'u' nus Frank: Wilt-?554 Illth'Ii-Hl" I 1-1.: Fin-Lil: magnum? JDIZIJJIJEBEI I Il1ll1: a. L??llhni?l I 5m: Hm??ll-ELI-?r-i- 3' 1 a {?an-II Erq I'Iifrrl . - mmadrxm dll'l Ihl ??t-Brim .- ui'. I El PM: mm Elm-H by?: ?El and Epcjiw?cr E'g?m i?lBlni-IJI} 4F) ll E'Wip .1 Fig: . 3 Elm: Fir-'3 H: MFthunnmm? thh'llitld'l - :5 ul1} Han-Hr. 1

E: lid: Hgtm' End-wris- [cc 5 help ?wc: Find. lam 15mm: R1 [:msFe-aa - In: HI 35'. ME EL: hi -l-l Ea: IE leg": ETEEURE Lng' Euic' .. 7-: "ii: #11- .- . H33: lam: H'Atmn iLz-rcrze 3.. Sm? ?wuk?zm'Cmm iEij'Ig if Eff-r mall-I Ell-hr 351B.- 1 ;l NH El El ml??ll'lil't TI :l'rllilp II g?mlw gm gun.- 't?h-?rlhm? awn-am Eng.- Han-rt 4mm Elly FM:an 4mm; Elly Haul: Elly ling-1h; ELM EM Ema-luau: Elli aural-[Health Elli Rum-ls EM ?nk: EM :I'Iutilu?uwia: Fl?itaialhi I: 35'.er 35mm Thanh-a ?'a-chEm-mcd- ?'r'nh Tun:th 1-:1 :l lH-Il'nmnn'r. I: I?m H51 IEliEl; 33] IEI :I'Ti'il J. 1' F!:p:l1:5 ?lil?l?l Elli Elli l'lli Elli Elli Flli I II- Elli Elli . 3' TFER: ll: mm a Query Jana-gem 'u'l?'cmaw Fugue] [Elm-1042 I: lzi?? IEI ?I?I?l'?li 17:45:32 ITa-l-Ei?i' IEI IEI '13? Imm?iil'd IE IEIIJIEHI FIE-I'l-I-hlii' 11' IE IE E3IHIH HIP TEIP Tl'lF' ?-Fl'ltlil" . 3EE2FIETT Till:I 'iili-Ii'lilzliT. I. -

TD LISA, ALIS, CAN, GER, HZL ?it-n - r-1c-2illa Fire-Fm: ?le w. ?aw Hat-w ?auhnalfcs ME Help Wen-La 'l'hir lyrlirn IEI Ir-:l l'nlig'ntr F2: cal?HI?:- Seslmn [from archwe] I Cam "ulclututilzln Frnn'l 1F Fran-I F'arl: Tn [Enid-:51 ??esslun Head-3'13) Mcta?) gulch: [Ill'l?i 31E 5'355i'3'r' 5E 5233 Fc-rmat AHTFJ ncnr?tt H1121 El Find aF-Ellz-aljnn El id: lu J. LI fzing mic-mam I In Ila-It aTlgjehEr: m: pale-land I.L1: n: 133.? land: 51:11: . uavLuwli?J'tz til?11} ?Jpn-.9 Tu; Ian-L711?: 2:3 9-09?2 53 LEIGH: 1T Ell] 35.3.: LEI 33'. quaanadtTiweIn:n} :ype="p1ug11" value="553533593? Plugin Ha: 1011.3 ?pay;nnd:3u11? {pay;03d:1p1 {JuauLnan:Her319nh LE I 1:3: {InagLna?:E:rnr} {Jpaplaad:Paplna?}

TD LISA, ALIS, CAN, GER{ii-Jill: 'm'itwm - Hazilla Fin-an Elna Edi: Elm ?nnhnad-s 19:45 lisp Hips gal.- CHE-E Th 3 I 1'2 2 LIE-E- - IE: 21' 'I'I:rl I- El: TII I 3"Il-l E: F: I- I - EEC [fl-um awhluc] Datutim: Casi.- Frc-n'l Fr-Jrn F'c-rl: Tn:- Lang-h IJ lien-Hun WELT-.21 Exaggmn ?uiEk Elitk! IILITD :pu_id= 'ln'itl'htlr LEAD funn?lur. - 3K Sewn-I DIRECT um ways: 33E '3 dhtjaylcuadfdirwalk Id upuuhllu all all a C'EilncumcntE Skh'Ji: D?rnh tact Ekynaang D?each SHE-e.an EHFF: .prn Euljlilusinns- El?n? Hum-n] Same-pun: Ska-pludrlu - EUDCDIIEQE Elr'lrnep'lg Ek'ypepng in?ll-Banana Skip-3pm: Sh: ?3!.an 5Hy:e.png BIZ-J 5-;va .prg Skip-341m: Eli'pr .prlg L?ilcwennq

TD LISA, ALIS, CAN, GER, HZL fill-l I'm Erna-inn Viewer Firulurl: Elle id: 112w Edmund-=5 Incl-5 ?ab ?if I -. .I ill-I'- I IF: 1m F: :o 'Ill?li'l' I I .F-F-II: [21: 5:55!? [from urchl'u'c] I Datatina ?3553 Mutatinn Fro-m TI: F'Izurt F'crt Pratt-ml Lannth I EEK-IS 35m.? Head-axis} mum I I FuIL?KELHu-dllurl 3 5E 5:55 arigheadermml 1' th-il EH I dlidr an: bud-1:1] 3i:- 51' asiunal we Gian-"1J3" pnliav??ussidla' csiqnall dart-File tinrle'xa- dmsuT'rpe a-II'I'EI-ca'n'nsuTgr'p-an- itadrm?q?zad} innqu-rl'rg; 1'i1' ?tdFEH??t side?'anurd'PIl. durum-Hark ccl1-aracturish: cdataLEn-a?th 33535 dfllab??ilab tfcl'arartcr'istich- 'Ir-n?hi mug-"rum mi: :in aim]. F'ur qpmvidtr: =pddq=l?? SLEIU: cfsiuadn- dig-ruwdarb ?itl'ui?l narnl? 'forwarding'? cpararn BIZBF pararn char name=?5 :El 5 Ef?- ?lial-E 5 El '1 crrp-ar-ameur :r tparnrn n?I'nr I :ter Tim LEI: unmet-tr:- par-arr: rater nama-"E I: IZ-IZIEE an ?amateur Il? .Il .-

'E-jllt? Flu-uln- - Hm:in Fiefur: Ell: ?dt 11:14 Hat-m Emmi-5 19:15 urt- 631 I: 11 IE-ngdg [9:111:51 ugh-:1 . .5111 Ian-sultan RE Jig-mt?i mm mm TE. itii'iiarkral I llanhJE-E-?-?l-T-??it.er I Hue-.113 a - II.-I E-E-II: H4. Iill .a - - . . Illi . 1' :11: Welcume- Lug mt ?l'?ft ?ll-slur; imam Earth E'In'ul'crI-rllaw Central '32:?:15 EET?agg'ng T315th "Mama; 1 an ME 115113 1 i . 353- 4-41 Amnmv I Tun-ch Erna: r. Eu: :1er 1? r3. 1:25.151? 111:1 3am may Tma Mann-Ea nalajma Euw t' Elva? waif-1:11am; 11?1113; tea -3 11:10:33: 11.11: 11511911115 I [Timed gamma-14153 1 111 21:03 1E 13 I'mm'url E wm 1:11:11- - :1 El Elisha-mn- l-ls IN: Elm-1313 23:55:13 PHD 2th 1 PM: (IrJJLazunze PHD Eamlna?un- :In? IHHEFEdat-ati?ne 3335-39-13 1W: cat-Ethan c- ?ling-313235521] MID mt - 11111:: II-amlna?nn- in 3 I3 Fl E: Trauma I WHEF an E11 1:11": Emma-11 1m hm L1 3:331??th 1.1- 11' IEF Eat-it . 'l Luann-:1 =45 3511.13.11 Fig; 1-11: Cnrh-?cl 35': Earth: aha-pailumrm ?l'hn'll r?ll. alh-IC'I i?h'Hn?n alad'vncr THEFIJ all?, brand: Ham-n Renal; Ll 1 EH31 Haw-113 Rants j" ALILIE MUD: - 1m.? 1 Ell-11g.- animr?" . Ell?; Emw' D-?nlL?-?ls a" - rawm awn-{hulk a 11:21.11: .1"ch I-T Enl?mchn Biz-wt:- Ii "lFI-ETr-rll?er :l .3 kqhig?m L1-. Fl: ll?tl?all' I 1=1 13-11 nl?hmm?'r I 5mm: - -1 and . . Imp-I: #1111 mannFm Fthn'tlel'u'FTy?njl I1. [Hi-g- alt-11h: EMF-MEI EHEI-H-E-I 01:23:51: 11144;: It'll: 1111mm.? mil-=11: mt: H.- Jun?manuals 2:19-114: 1111:1315: (?4-13 swan-app: [Int mars-.115.? mun-13 1111-51-15-? 1111:1135: ma: swap?: Jaw?01.21 1.1141513 2:19?11:44 01:23:51 'Imnt Educate-4111: . 1111-5?11?: 1:11-1:33 Hula?11-14 anus: m4? Lam-r 11.1.1 ?111 iota?01.21 mam-1 lt?-H-Ed?hlt?l =15, Lumlm Jun?Ir?: 11.1mm 31-11111?13441112131241 [5141?1-31 1:51 I- i i U: ?it-11H!

SECRETHCD TD LISA, ALIS, CAN, SEE, HZ .- -II . . "'Active/ Passive Converged Analysis Lust-3m:- and Hill HID-3 I-Ir-arc-II .I?l?l El:- E1: Elm-.- Inn-:15 than Ll: I:-a I I ELL-J: r-?uu I.quJ huuluu q? :Isyun: 9.1 1i- - I: ?quHiIIm-Hllm ?In: Ll. Ear-null Hun-I. Email-.1.le Jib: l'urnrl Hull-.- Hu?aum??;r I 7 ?l 2?15" - 4-m- Hen-cm wow ll-Hl-i-E in. - E'IT-a-ch Ear-ml: D: cams? pder Haiti-115 Elm-Him: hm Eur-:1: Eta-:1an Tm: Erin-mm: Col-rum: =in-nn-rc- Lawn-:51:- - a _l - IH.I II-l.l I-uu :lIrJ-ub'll'h'n'JJrILIHl-u mu Hen-:qu I'll-Hun n-F?nm?nnr-rl I11: hill-51". l'l?lC: I'll-l l'll'lil'ull'l amnp?u-r- ll-ll' L .l 1m:- hilt-I'- fur-I "nan-3 Evan-:4an TEL-H.131 ?album-3rd lli'J?l Influx?. hri Ellill'llil 1.1- nun-In u-I'Tluuf'M-ul-II IH.I II-l.l Alu'HIu PLEHIJIHI I :Irh: Fl thtie-? -:l1 EMS-1E1: 13:11:45 af?ne-humid I11: J?l'l'uimlulu-c.- n-u- Ilu I.Iur .Ill'l II C-u-nIlJuII-n ILH t'u I l?a '11- 1U ?ab-I'lde way-Wu Fur-I EEIM n51 I U. 5E- 1n Ha?hunr? nun- Ermnn'. Firm-am Elj ETMII: a - "bulb: f- aunt-+1 mac-morn En-i?lm-il-JE lil?l' .?Ir?i rl'?ll EH.- Mull: Ell-.I.- II'Irun-Iru 1: 'w-z-r-tl no Bn-z-nnml-zn: nr-i?n-zu mall EH.- the. I an] Rem-r: Real? I?lv Illa I'l-Il'ih-I-rn Em a JIJ-I-EI 'll:l I :l II-EI Illur ill-i Eln-I-? .ITI Flu-lull Ihl {Ila?.1? I I ell?l ell-I: lid . 5 5 ran] I3 ill-I'D 'll:l 1.1- run-mm u-I'Tluumu-m-II IH.I II-l.l Ilull 5-1-1er ?mm :m-1o.12 mums m: nri?ni ram-um l'r'IIJrIlnz-iui ETr'l'El'ml'l? 3L- Eh in l-l flu-Hull! ..-I -.-. .I..- -. - -: . . . . -. 1' ham-u il Ir ll? Tm?H-l . I Ila-Ign- 1 LI :1 I'll- Pugh Shh. Fl" 'Jhr I.thland lI

'11:}th Hetnvlewer: r-lt-zll-J ?1533 Eile Edit ILu'iew 11512131"! ace-Prawn: Inc-I5 LL, 1E4 - I Gz-eqle Ill 0105: Smaft?nnkn?r?r'a Elan-jut n1 veal-Ia LIFEN Mapper 1?5: WES-Central 0} Dunspaua- [j 5:1 I. - 11:: Humviuwem" 5451-: {Llld :LuLlu .. IJI 21:: 51:55:05: IHI - .- - ?H-j?a LUEEFE Search ?WCr'l-lil'lt'f': Central HEEL-H13 EETaa-ilng Elf-.15: Hi F0rur11 ?31 Help? Hewigetiun Henu lliitngl'ern: I Esta-grew: 1 l-I?l .- I E-il-il PEI Tecl' C?tl'hgs in D0 01": IEE'I-zmla. Der1-:- Filter? Uttlr 415:: .3. - Emmi?: l-lr: 153 Cl - Hl'lI:l File Tl'ensfel' ITe-tlr .5. I.-.val-=15. i CI Network M5n505-m5nt I at: 1-1: {0'51" (W 1:5! V. :33? 133:5 .L Lu I Eff-.1- $101." El I: 5ch- El I. ?aw-0:511:35: C5n1r5l piynt; . i: Easenutatlnn .I PEI I llel: -- -- - -- aelechcun 3'1 _IT:e:l User r'uleITe L'Ie:1etll1':e @L?I-zumeln 015 El 1 Ed 5 a} 2000-10-10 05:15:10 L095: m0lln0rII150.0n .2540 :30nl0r 00ntn0t:5 In lulli 1'0: an: Her-5 ?1:5 my me: ant qesuh 2111-11- 10 111I LHt't'i'il- I?ll-I i101 .1500 23-10 .I'lliiul d? rm Rwullg 21109 1B 111' 115:1 15:10l I:ml.n15:0f05u5.00n1 .2540 00:1150115 In lull: 1'0: mr1IImmaldmrIne-menakatmetrur IE ME Int-Ehle qaaung 2111-11- 10 111I 23-10 Eldlli'U-l .I'llilul [Lu 3qu i; r5-If 21119 1B 111' ?6:115:11l IrnE: n15: :I50n10n .3541: 50nl0r In lull: 1'0: 2h: El Hy EmvnI-z-nc 201-0 10 :2 05:50:00 5:51. Eluult: 2010 EwiIsH I uluu: 51Iiuli5uu-?autuule ?51.15.5005?: i?inwin-Llil. El .2000 10 1.: 05:50:00 Inwln?." 3010 50.055: mien: amullattammtaale '5 Ewan" 201-0 10 11 05:55:55 101000 Ell Ln. PHI. 3.5.1.0. caumnm: 01551.5: Hutu-5:5- a .J-.ll 'rrH-Ilru? P?ql?q . 5000 10 11 05:55:55 cm: 101000 Ell EMA enLch-n 00.5: 0515:535- [a Result: .Ll" mm Haw-Alt: 11119-1 [1-11 115511353 LHL 11115119 EII CALIFIZIFL 55151131,,33 501-0 10 11 05:55:55 rur'?iu Hennuulmlm 101000 Ell P552. :5an 5::gnm enqummnn 21119-1 [1-11 {15:36:53 LHL'tl'a: 11115119 Ell LA PAI. BAJA. 1 1?3 Lil'l'i 211-1-9- 1l1' 1111:3605-1- EII EIUMD JMHE. El HTwaiHI-i 2055-10-11 05:55:50 LHL 101000 Ell mun-A0 JUAFLE. '5 501-0 10 11 05:55:55 rur'htu 101005- Ell Ln. PHI. 5.5.1.0. i; m? 00.50-15-? 0.5-1 4:5 5-5.1. rI:1:1:r 151500. r" em rem. nah-1 ?5.5555515. El {jTesqing ll ii Tuu?i' '4 -: -: I Ingr: 1 n1" I I 'ngr: peg-:3 I '1 - I n1 Half FFI tin-1:: 'r 1 I I 11111111 155411111151}_1 and Human ht: I :Irnr: 51:5 In". TOP SECRETHCOMINTHREL TO LISA, ALIS, CAN, GER, NZL

TDP SECRETHCD TD LISA, PLUS, CAN, SEE, HZ . FR - . 21-] .1'1 FOGGYBOOM) Herr-1511:? Ell: Edit m2?- Hitm' 1312mm; T515 till: 1? f} [a 213111512221 51312221111112 12-21mm? Max-El? 311: HRS-Eertral 112 lj Janna-.2: F11 111 [1:1um - 1'3: :11: a I: I: 31,: 1:1; sud-1: JJ-Illtt: 1_i 11' .1. LUH Ham-2 ELEM: 5L. 5512:1'. 5L. Heau? 12121121 :1 EE lam-1n EE H2111: 511-, 3E I'l 1.511:- 1* ?2123131152: :1an . HEW P-Ittima Recline: 1* 5.12111- 'jj' it EWGALE: 1.1211211112- I:r-:1 HI H1221 41-1. UHL Arqs EJ212121 harm I Hm: 11:11:11 [111211 - Uri] ?2'121 hi4 i?IHI-ilil-Mi?lhi?hl? 1111! anus?Ind-uaemu 111:1: gamma?? 21:11:11 2009.10-11131111110 meat 1111:? acre :2121 1:11 {1.15 9121: 31:11:11 2003 ll] 1-1- mt i:1:11:11 [11; get 1.133 Emmy 5? 21:11:11 2111-11-112nzmn .35 11:1 1:11122211 Pan? d5 i21:11:11 2212-11-1121221212 .31; 91:1: EDIE-Imrtud?l?? ?ii?tilil- EH: 911! ?lm-1.11. EMer-?qm 91:11:11 2212-11-112m2un get Tumult-51411121111 1:12:1111111 Eel-m? ..1'14 Lg": 1111! EtiiraI-ilaitlbmi?unl FIEF- 311:1 1:11 get in: 21:11:11 2112 11 1121121212 .345 p12: lu-Lildamlmuh.wm ?ab-uh. 33:11:14 W51: intuit-1 114-1 ill 1121221211: [Hg wt l1l-1I3w11wlm-Elq- In}; "El: friends: rel?tn Hawaii: E121 1:441 [113 um FJL-EHLIJGIH 9-21: 11m Er?xmh #12: 21:11:14 2111-11-112122111 1.11:! Elf-1* ?claim :21:11:11 2212.11.1unc2bw get

TOP TD LISA, ALIS, CAN, SEE, MEL RI. FOGGYBOOM) Wm; bt-Hmn - Hc-zllf-a I ii: E_n'l: 11:31 ?nch-11:5 Itch ?irt: Tl'l:: HJrnan Elli-b: :3 TU Jill-'- I'-f-l 5531 BEE 'I'iewaul- - Datetirr: Casi:- TI: Fr-Jm Tn:- Pratt-col Leng'?'l 5.55m hadar [3,1 u'rck Clicks Ragnar HFEI IE r? Tuut: E-n1r1 'lr-Er h'u I1: app_i-J= Hie-war: form-alien Info: 1 4" I . WE Tutu: 3-31: Germ 3m: :3 and w??r The URI. Tri?e-111cm: tn: I215 I111: - net! ncaspupcr. 5:131: 1'1: '11: It'i'i'ii'i?pnlg: 1:1?11 Pua'L H: FIHTI. Ff?: 63:2] TH: 2E3: HJn'Izn 'iT .. 13-"

TDP SECRETIIEDHINTIIREL TD LISA, ALIS, EAH, GER, HIL

TOP TD LISA, ALIS, CAN, SEE, HZL I HE: SuanJ I: - El: Edl: ltd: LH: - u'u ;1 - Dill .n-n'a r-m-u Emu: - . are: l'ri tEI-n-u' rl-cs 1 *?'?r?ertd g. fanning-n a} Ti m??carch:EHE 1112-, 311-5 .3 mm 51' in 11:: I HI: Lug ?l'hrr IilLPr-Ers EL Burch Hm?l: EzTagng-g lard-mg Emmuurl F-zl'u-n Help" Hangar-1n Hnnu {If i I Ham:th 1 SF Miran-? . Marl? FIth: 1' Ama'lcEdF-duluua' Fiddt: Cher 'SidurLrI Edna-dual 5mm 'a?bluw [Qumran Class-l: EEtazhEIEtru Nam?? - ECHE and my: DH Justificatinn: [gamma-1 ECism F?arsu'crds - Ema nal ?l EBa-cunerl: Md? Enmm Miranda Number: I lam-madam n?tgtime; 1 3w 1 Start; ganglia-14 Ei 5 Stan: mug-M15 23:5? 5 . CZEII Technmuc: ELo-jr': a1: Passwuru'. IJsemamecreelm}: Eli?j Ell-uni: r-l-E Erin-hurt? I .135 gum-ESE: FIG Emmi-r.- 15' ITD HunhH Eil'h'??l 11??

TDP SECRETHCD TD LISA, PLUS, CAN, SEE, HZ ch: Ht-z -- mm :31: .1, :n'nItIEI-ccl-Irclk: :Eigr-n-J: 'ruh: L??lt-?cpm H-t-tmrrel :11- .- .3 Hum-5cm: Enttu' Luau}: :lzitmzh tantrum-?rm! IJJI-csuh: EEi-xclra Ii Him-turn Iii-I3? if Ll I Ira? am; Heme: Health Health Tulle-5 miner-L59: Eealch Ail-Les :?E-nc-umri: Lit-twat: Etnlieihrm-a-s HETLDEGER ?Emmp humidon: Eran-mummide :lf?ulzhsaw EH. . Ema-Hr Jug ?ira 1-1.3 HI, Emir Nahum:- Emu? DatIEtIrnE: I Una,r 1* 5:31: IE Ile! II in; 2' ,2th Hind-u: apunw? Hum-5r lam-m1- Emmi Erm- i?FEI-ju- Luz-:5- EFT-I3 ESE- P?'btll E?msln?ctun El hrrh'dww EMU El?n:- .t .I M- I rrl?fr'? El Jamaal:- - 'rl-i-c- 1- II [r'ull'ulel-IL-Li I lTu Tl Cdlectim Techniu-JE: I 5: Hunt: wh?zwr Marne: Qacsinl' flE': IE: I line: I Eur I 3 Fa: Eu:ll: :r

TD LISA, AUE, CAN, GER, HZ . {3:11 - Hurlln I gm. EH55: '1':in .15: 15m 55 reruuRme-e- 3E 5545mm numb-mm: Hg'nr} gin-mam: inn: I .I?lgrx-Jl'53: w. hhtanlimi-?l w. Lag: I nm [:h:ng5 -. mB numb: I I 331:: Harm-I.-. -.H.-. -.--I. . .. -.. "u 1' vaaltaJ'na: ?Hm-s hum: iwnwm-tmlm E:F::p:rl: Hammiza Emazmd Ema-1m Uriah-v I keyinqger I "in Af?rm 'Irm' I ENE 1: mama EH21 Jill-Z HEITEI 352:6: El Elm-?53 'Jua ?n?m ??1in mm-m-?r-w?mm max: Baal: 'l mm-wm r555:- 1-5 mum ??35 El? Enalk?n?m 555' ElJi Will-E 1-51 incl-:5 El' . Emmi-:1thm 355515 1555mm 5mm: mix-.5: mar-ne- our 551:5 151: DENIM EM 5:55.15 15 1:55:31 mgr-:- $15: It: 1: Ell-il? [mk?pr-Eitirl] 1555151555qu 55E??i'i Elm-131$? EIE 355451:- $55.13: hummus-ml. mta.ln1:cr.d5.l5 5 Emma: Jar-:1 luv-51w: Ekmq m" ?HI-lira .- 5-- i'UlI'l-1 CHEW-145315 HEEL EIE IE P5951. HIKE-1315 CPI-151E- 3 IJ 2555-15-15- 5:52:55 [55:1 DIE +5235 5 55: 3153.1 5-1: ?55551 5 [tram-51y;- ?Hat'a-a-k .555 HUM-1 um?wmw nth-5L .I 55-3 a 5555454555351 mama-5315 II 55: 31534515 53.45.55 Hummus;- mm HHI?-qul??; 5r. claw. w-qa-a'd. a Em- mm 1? 2:511513-55551 :?iEm-m?-IE 5:53.555 Hm 551 255545.15 55:45.55 [Hm-55.51151 a: HT Efmr?unw Hart-lam: Hrrn-Icr? 1r .1151). 1 5-nrn-lrm5 r5554; 55 3533.35.? IE Hush-l. 552 HIKE-IEHE Hg - Hr 555545-15 11555-1 53:11:: 55: 555545.12 55.5545 5 . . 1- mum] Hicnsu'? Elli-[El - JCEFH- 552 EMU-1113.3 ?Ell-5:15 1311333] IE P5331. 2 EDIE IFS-15.51 5535? 2555.15.15- 5555-2-1 Emu-54:51: 55:11:15 55: ants?ml: may. 255515 1355mm 5353.555 3:55 rah-A 55: mm1n1:w:-15:53 ETmh ?'lh-t-II 13 KEHFA 552 an.? ?d Mum-L45:th I: F3551. lJnE-c' am n: manna? 5mm: 25:11:: 5:15th ante-151: 55:45:55 [awhmm F'rm'r EDIE-1 HEEL-ACES [Ail DIE I FPS-3.1. 1 EIE IE CPI-HIE 5555.15-15 1:155:31 541mm 55:31: 351:5: 2-: II 55: 55:34:11: 55245 54 [add-:35 Hr: .3155}. .I 55': mus?1m.- z? 'FIBT-Brgrer Err-h W- . I rl'? ?nal-Harman? gal-mama: I -. 5? 1- Pan-nice: I'll:I I (511-: raw-:- 5-5' mun-c": Magi-r51 -

TD LISA, ALIS, CAN, GER, r? - 5h Edt Ham Ham.- ?zml'ma? [:qu Hal:- it? *1 T, 13 Elk: r: Tr (El: Sesslun 'Ill'lauar Datum! E15: I'Ihtatx-n Frn-I 1F Length 16-:13 I13 BITE 31.133 Jar-mm l'n: rv'1ur': L-I'I'Ir'll'l'! Clicks IE i 3E Sc55i-zm Kiwi-u?: cal-mm: 3:3 {Emailed majwrw: 3d - HEW REFLEILJLE :Icatnd Engi?'?r qq-Jm?uw mnemwsa?ma?m 53.1121Wimlnw Titlur WEE H: Access A1: I i 2m 1? 15ml 5' ?5 Etna?1043114 2916.131 I. lam [?xtf] :szj 5] 2m9404311~412315 13];ij l??iimhw T'i'l'li- Changed: I I

TOP TD LISA, ALIS, CAN, SEE, NIL Httuvitwtr: Fir-EllJi-i El: grit admits 1MB: j=h 6 [3 ?th EIEWE Emma-15:31 i_ ErrIartEazuzul-mar-Is 'reeJ-IaanrrIapc-ar i11- Jag-mum I Q: Emma-3H? my. In} I I 1] Tuumunx I ?ll-Ipsdm?mJ-ml I Egan-[mun .J -I.-I .II H..- . . 112-: I'j'j: Lug Cut Iln-rn: Searcn 1 Rum: 3:1: EzTuslu: I . l-?-Ilruun ?ll: El ?El 5' - JE-E-I- 15: -. I-jl'l Havig-ntinrl Hutu fit; :l Hen: - Regan: - HIM- FILIEHE: Etrrg: 'nL'In _.ll glam? 'r'alJE Type I'I'Izldi Elem-la.? I 1 25 El?m "Erma - USERS 1 Emr??r?rl' "it:le '"lnr-iln a 3" ?Ev-?5555 Fl: Edit Etukm-uks Tm: Ha; JJ mural-I12 USERS UmrHII-mu Th nil-?rth: I. 5- 513 E: H- Turn =ir I1: H-fE?r? USERS I I. ll'lil I I I El :Ir?wh Irmmema? EEC 3 SW ?Wm? 1' F?Ilm'i'?l? I rr: CI: T-: From TI: Z'Ewmmw "EV-?5mg slug-1:342 12:33:13 5 ?Wm Harv - - I Haida If: 119:: IT: I USERS Perth 1' 'crh??jwa - -. . Eml_w?hgw?3 ?5'ch 5' I Brig-?u; USERS uulclc than . Em Hm? q?uh 33: Hessian rr-Ecn aj] Mum-Ia: Hunts: USERS I: I.'lr' nt_pn'5' 1: rcgqum'g' HEW-3 HIE-QUEER Ej Hill-Elf, - EM Dawn-313 1-- EH ESL-suit gm Fran-rm; Rants FIE-USERS HER 51mm; - EM Mal-mu Err-4'1: 3- g] - gm UgE

TDP SECRETIIEDHIHTIIREL TD LISA, ALIS, BAH, GER, HIL DMIHTHHELTD LISA, Aus, CAM, GER, ruzL

TOP SECRETHCD TD LISA, AUS, CAN, SEE -. .. . Parsing Tailored Viewing I BrowserInfo yes - Collected Files standard View I Directory Walks yes - Drive Listings I Ipconfig - Keylogger yes In Process Lists In Registry yes I System Survey (partial) Toe SECRETHCCIMINTHHEL To USA, ALIS, Can, Edit, MEL

TOP SECRETHCD TD LISA, AUS, CANarpca Che networkmapping I arpcanfiguratlan I netstat I I netwarkstatistics I capturedcradentialsdata I systima I cannactlanlog (unavailable) I muting I datatransmissi?n I rautingcunfiguratiun I email I sleepysheri? I arrnr I smackcrafty I exchangedata I staradfile I fb I systemsuwey I ?le?lterlist I systamvarsian I Iacaleinfarmatlan I I madulellst I unldentifiedfile I machineinfarmatian I wireIE-Sssuruey I netmap TUIJ SECRETHCCIMINTHHEL TD LISA, AUS, CAN, Gal-1, MEL

TUP MIHTHREL TD LISA, PLUS, CAN, SEE, Fl - Catchall for data types run In dun Fir:an [Elli] I: r: Ijll' Elam Harri-3r ?lth-Imam Linn}: tit-II: 3h 6 l-n, {f 'r IIEITI Sjjge ulna-ed 5mm: EIJDMEPS Elia I?ignnut: 'r'eeh-aLRH 3E {HES-Cenrd EtrdF'cgE- I ll] Rl :1-2r' m: I. Il'. I11 1 i I I.Jl_l- I a? I Lcur-sFagI: 2'15: I #43? I Turin-:3me mam; ?El-lure lug?: E??l'l '??mmruw Eur-5 mm 35mm. EETa-ggng Ews?icurt 3E QEEL Furacr a 'Ellh Emma 'r Em.er Elm'eEFle Tim-51H ?x'k'et?rmc'r' EWresl-mk I?I'cu'nrrm arm-f El El Inter-rm: Luau-Ammu- r-?J Eli?Ll'?mhflaw Eel-hi AI wmcnuws EM Pending Wurk?Lw: gram?. if?H-a Flam-? Fur-min: Ema Frau-sine: RESUME Em: ?r??imc Raaula ?rrgang??L?s d. I an humm- 3 rec-5m?; I Irpn I Hun: ?dhlu' Ewan" ?Ear LH: "It? cu: ma ENE ms U1: Us. Lilli-5m: 1191232] Film-1L1: 11 Ham?1 Emil-1+1! ?5:33:35 Ilfll-1l-1I Still-1L1? ?5:33:33 ?5:33:42! ZHIll-1i-13 11 ?1:33:43 1i 1? ?5:33:51 Jill-1L1? ?19595 ring?11.11 15:31:34 ?3:33:53 mm: II- ll?l -I- Ult?lml: Ln? 2005-13-13 'I?I?'ll?l'l Ill-Elm 30115-1114? El?n-1M 2005-10-12 Mil-'15? Elli]!- 12 Mal-?1?? 1? Mal-?hill Il?'r'llz'l? ?Mil-[I Ilia-1m 09:21:44] ?lial-1:10 'il'li-ilim'lli' snmilJm-th' Itch tech Ila-{N luthJu-Lly both- [Huh lJ-Ll-lh' MthmEr' fear: 1-: chm-in: um nuns-n1 'I'l1l1 chm-II: 11m chaeic tuna-In: 11m uhEEiLi um chggiu 11m ch55": um uhs?iu 11m um ?h??iu nh?ain ?H$$it class?: II'l1l1 nan Icm Tau: I?:h I'Imum turn mm mm In!? turn mm unlit It'll? lul??ll win up? 1.qu1 will uqH'I ?HI-cl? Fuld-HI Pm'mtm -I. I I . rll'l' IJT?-E?ilf?hl Elli El" n_r-I1. ".I?wu?lm ll.? tlli. i'I tll?. ntl-?rlli I'l" i'l tll?. :1 :Ili' a" nil-HM rr' -I1 .r rr' I'l" ?I'll Fi'?'li'l'lilf'ih? FIT.

TOP TD USA, AUS, CAN, SEE, I Expanded data coverage I UK, AUS, (NZL possibly) I Validator/FOX contactfsurtreyir flows?? I ECI data?? I Better TUCKER processing (both in TAO and XKS) I Extended plug in coverage I Network information (neighbor/gateway IPs etc) I Machine Information (host name etc} I Process files not found in passive I Registry files I I Browser history/bookmarks I Apply to Media Explotation TUP SECRETHCCIMINTHHEL TD LISA, ALIS, Carl, Gait, MEL

TDP SECRETIIEDHIHTIIREL TD LISA, ALIS, BAH, GER, HIL I I a. _i l?rHIl I?II. l5DMIHTIIRELTD USA, ALIS, CAN, NIL

TOP TD LISA, ALIS, CAN, SEE, HZ .. .?xlr . - Page TUP SECRETHCCIMINTHREL TD LISA, ALIS, CAN, GER, MEL