`Case 3:17-cv-05659-WHA Document 98-21 Filed 06/07/18 Page 1 of 2
`
`
`
`
`
`
`EXHIBIT 18
`EXHIBIT 18
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case 3:17-cv-05659-WHA Document 98-21 Filed 06/07/18 Page 2 of 2
`Case 3:17-cv-05659-WHA Document 98-21 Filed 06/07/18 Page 2 of 2
`
`SKY ae i
`
`cf
`
`VENTION
`
`ele
`ferep ay
`bt reeas
`
`PS]
`Manual Upioad
`Paesa)
`
`
`
`Persistence: 2%.
`Ransomurare: 2%
`
`y
`
`Fine-grained behavior: 26%
`—
`e
`
`Networking: 9%
`
`Persistence: 4%.
`Targeting: 7%
`
`Fine-grained behavior: 17%
`
`Obfuscation 2%
`
`Evasion: 15%
`
`Ransomware: 2%
`Persistence: 4%.
`Networking: 2%
`a Targeting: 2%
`Evasion: 7%.
`
`Behaviors Seen
`
`impact
`@Oes
`@
`ie
`fs
`fie
`foe
`he
`6
`6
`(ie
`
`
`
`Category
`Parsistence
`Ransomware
`Evasion
`Fine-grained behavior
`Parsistence
`Fine-grained behavior
`Evasion
`Obfuscation
`Evasion
`Pornistence
`
`Behvior
`Exeoutable file created in Windows! and launched
`FE proxy settings modified
`Executable fle crated but nod launched
`Checks hosts fie and opens for reading
`Executable fie created
`Executable contains reiounses that cin be executed i.e. code type or archive type
`Contains evasive sleap loops to bypass analysis
`Executable fails checksum teat
`Performa checks for kernel debuggers
`Executable file created in Windows!
`
`rd
`
`FINJAN-JN 317942
`
`