ThreatExpert Report: Trojan.Neprodoor!inf, Troj/Pushu-Gen, Mal/Fakedis-A, Virus:Win32/Cutwail.F..

Submission Summary:

Submission details:

Submission received: 11 November 2009, 23:18:39
Processing time: 7 min 2 sec
Submitted sample:

File MD5: 0x08BA612F05B0433A4A5CA2DF4DA38DEB
File SHA-1: 0xBCDAFAABC91615255532111D4672FCEF7AEB9593
Filesize: 56,320 bytes

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Communication with a remote SMTP server and sending out email.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan.Agent	Trojan.Agent will spy on the browsing habits of users, modify Internet Explorer settings and download malicious files.

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%UserProfile%\reader_s.exe %System%\reader_s.exe [file and pathname of the sample #1]	56,320 bytes	MD5: 0x08BA612F05B0433A4A5CA2DF4DA38DEB SHA-1: 0xBCDAFAABC91615255532111D4672FCEF7AEB9593	(not available)
2	%System%\dllcache\ndis.sys	212,480 bytes	MD5: 0xA329EADC3E525324566E8B70A7068B04 SHA-1: 0x689374F942835C06F472D9BCA1E5D5C6CF784FA0	Trojan.Neprodoor!inf [Symantec] Troj/Pushu-Gen, Mal/Fakedis-A [Sophos] Virus:Win32/Cutwail.F [Microsoft] Virus.Win32.Protector [Ikarus] Win32/Dnis.C [AhnLab]

Notes:

%UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following file was modified:

%System%\drivers\ndis.sys

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
reader_s.exe	%System%\reader_s.exe	49,152 bytes
reader_s.exe	%UserProfile%\reader_s.exe	49,152 bytes

There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	5,124,096 bytes

Registry Modifications

The following Registry Key was created:

HKEY_LOCAL_MACHINE\SOFTWARE\AGProtect

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

reader_s = "%System%\reader_s.exe"

so that reader_s.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\AGProtect]

Cfg = 09 00 00 00 A6 4A 00 00 26 66 47 19 BF A0 A0 A0 A9 A0 BD A0 A0 A0 A0 A0 70 A0 5E 5F 58 52 5A 5F 52 59 52 67 A0 BA A0 A0 A0 A0 A0 70 A0 5A 5F 52 5F 5B 58 52 5F 5A 59 52 5B 67 A0 B8 A0 A0 A0 A0 A0 70 A0 5F 59 5C 52 5F 5D 5D 52 5F 50 5C 52 5E 5F 50 A0 B

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

reader_s = "%UserProfile%\reader_s.exe"

so that reader_s.exe runs every time Windows starts

Other details

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
159.226.251.12	25
187.141.85.226	25
205.178.132.80	25
206.114.155.9	25
206.132.63.29	25
207.45.161.80	25
209.181.247.105	25
58.59.85ae.static.theplanet.com	25
211.18.214.189	25
38.187.14.226	25
78.159.121.41	38811

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 25:

There was an outbound traffic produced on port 38811:

00000000 | 4742 0000 0100 0000 7400 0000 C600 0000 | GB......t.......
00000010 | 0000 0000 0501 280A 0200 0000 0000 0000 | ......(.........
00000020 | 4742 0000 0100 0000 7400 0000 C600 0000 | GB......t.......
00000030 | 0000 0000 0501 280A 0200 0000 0000 0000 | ......(.........
00000040 | 4742 0000 0100 0000 7400 0000 C600 0000 | GB......t.......
00000050 | 0200 0000 0501 280A 0200 0500 1C2C 0000 | ......(......,..
00000060 | 7365 7661 2167 7572 6420 6975 6820 616B | seva!gurd iuh ak
00000070 | A169 7420 A76B 2D6C E168 7368 198D 9B89 | .it .k-l.hsh....
00000080 | 9EDF 9C8A 8D9B DE96 8A97 DC9E 91DF 978B | ................
00000090 | DF9E 96D2 939A 968C 90AF 7265 7E61 2067 | ..........re~a g
000000A0 | 7472 6420 6E75 6820 606E 2069 7220 616B | trd nuh `n ir ak
000000B0 | 2C6C 6568 766F 508D 9A89 9FDF 988A 869B | ,lehvoP.........
000000C0 | DF96 8B97 DF9E 9BDF 968B DE9E 94D2 9A9A | ................
000000D0 | 978C 91AF 7365 7661 2F67 7572 6520 6975 | ....seva/gure iu
000000E0 | 6620 616E 2169 7420 6C6B 2D6C 6468 736F | f an!it lk-ldhso
000000F0 | 5C8D 8989 9EDF 998A 8D9B CD96 8A97 DE9E | \...............
00000100 | 91DF 878B DF9E 95D2 939A 878C 90AF 7265 | ..............re
00000110 | 7761 2067 6372 6420 6875 6820 746E 2069 | wa gcrd huh tn i
00000120 | 7520 616B 396C 6568 726F 508D 9A89 84DF | u ak9lehroP.....
00000130 | 988A 8C9B DF96 9397 DF9E 90DF 968B C79E | ................
00000140 | 94D2 929A 978C 87AF 6C65 7661 2167 7572 | ........leva!gur
00000150 | 7920 6975 6920 616E 3C69 7420 606B 2D6C | y iui an<it `k-l
00000160 | 7E68 736F 518D 9B89 9EDF B98A 8D9B DE96 | ~hsoQ...........
00000170 | 8A97 FF9E 91DF 978B DF9E 8BD2 939A 968C | ................
00000180 | 90AF 7265 5361 2067 7472 6420 4D75 6820 | ..reSa gtrd Muh
00000190 | 606E 2069 5720 616B 2C6C 6568 516F 508D | `n iW ak,lehQoP.
000001A0 | 9A89 9FDF 988A A59B DF96 8B97 DF9E B6DF | ................
000001B0 | 968B DE9E 94D2 B59A 978C 91AF 7365 7661 | ............seva
000001C0 | 0C67 7572 6520 6975 4320 616E 2169 7420 | .gure iuC an!it
000001D0 | 4B6B 2D6C 6468 736F 798D AA89 9EDF 998A | Kk-ldhsoy.......
000001E0 | 8D9B F096 8A97 DE9E 91DF B88B DF9E 95D2 | ................
000001F0 | 939A BA8C 90AF 7265 7761 2067 4672 6420 | ......rewa gFrd
00000200 | 6875 6820 536E 2069 7520 616B 1C6C 6568 | huh Sn iu ak.leh
00000210 | 726F 508D 9A89 A9DF 988A 8C9B DF96 BC97 | roP.............
00000220 | DF9E 90DF 968B EA9E 94D2 929A 978C A4AF | ................
00000230 | 4965 7661 2167 7572 5E20 6975 6920 616E | Ieva!gur^ iui an
00000240 | 1969 7420 606B 2D6C 5D68 736F 518D 9C89 | .it `k-l]hsoQ...
00000250 | 9EDF A68A 8D9B D996 8A97 E29E 91DF 978B | ................
00000260 | DF9E A8D2 939A 968C 90AF 7265 3461 2067 | ..........re4a g
00000270 | 7472 6420 2875 6820 606E 2069 3420 616B | trd (uh `n i4 ak
00000280 | 2B6C 6568 4C6F 508D 9A89 9FDF 988A C89B | +lehLoP.........
00000290 | DF96 8B97 DF9E D5DF 968B DE9E 94D2 D09A | ................
000002A0 | 978C 91AF 7365 7661 6967 7572 6520 6975 | ....sevaigure iu
000002B0 | 2020 616E 2169 7420 266B 2D6C 6468 736F |   an!it &k-ldhso
000002C0 | 168D D789 9EDF 998A 8D9B 9396 8A97 DE9E | ................
000002D0 | 91DF DD8B DF9E 96D2 939A DD8C 90AF 7265 | ..............re
000002E0 | 7761 2067 2572 6420 6875 6820 2E6E 2069 | wa g%rd huh .n i
000002F0 | 7520 616B 636C 6568 726F 508D 9A89 CADF | u akclehroP.....
00000300 | 988A 8C9B DF96 D997 DF9E 90DF 968B 8D9E | ................
00000310 | 94D2 929A 978C C1AF 2A65 7661 2167 7572 | ........*eva!gur
00000320 | 3320 6975 6920 616E 7669 7420 606B 2D6C | 3 iui anvit `k-l
00000330 | 3068 736F 518D 9B89 9EDF C48A 8D9B DE96 | 0hsoQ...........
00000340 | 8A97 849E 91DF 978B DF9E CDD2 939A 968C | ................
00000350 | 90AF 7265 2C61 2067 7472 6420 3675 6820 | ..re,a gtrd 6uh
00000360 | 606E 2069 2A20 616B 2C6C 6568 2E6F 508D | `n i* ak,leh.oP.
00000370 | 9A89 9FDF 988A EF9B DF96 8B97 DF9E F0DF | ................
00000380 | 968B DE9E 94D2 F39A 978C 92AF 7365 7661 | ............seva
00000390 | 4667 7572 6520 6975 0D20 616E 2169 7420 | Fgure iu. an!it
000003A0 | 056B 2D6C 6468 736F 338D F089 9EDF 9B8A | .k-ldhso3.......
000003B0 | 8D9B B696 8A97 DC9E 91DF FE8B DF9E 95D2 | ................
000003C0 | 939A F08C 90AF 7265 7761 2067 1872 6420 | ......rewa g.rd
000003D0 | 6875 6820 0D6E 2069 7520 616B 466C 6568 | huh .n iu akFleh
000003E0 | 726F 508D 9A89 EFDF 988A 8C9B DF96 FA97 | roP.............
000003F0 | DF9E 90DF 968B B09E 94D2 929A 978C FEAF | ................
00000400 | FD65 7661 2167 7572 EA20 6975 6920 616E | .eva!gur. iui an
00000410 | A369 7420 606B 2D6C 1768 736F 518D 9B89 | .it `k-l.hsoQ...
00000420 | 9EDF 0A8A 8D9B DE96 8A97 4E9E 91DF 978B | ..........N.....
00000430 | DF9E 04D2 939A 968C 90AF 7265 F361 2067 | ..........re.a g
00000440 | 7472 6420 ED75 6820 606E 2069 E020 616B | trd .uh `n i. ak
00000450 | 2C6C 6568 E06F 508D 9A89 9FDF 988A 059B | ,leh.oP.........
00000460 | DF96 8B97 DF9E 16DF 968B DE9E 94D2 159A | ................
00000470 | 978C 91AF 7365 7661 AC67 7572 6520 6975 | ....seva.gure iu
00000480 | E320 616E 2169 7420 EB6B 2D6C 6468 736F | . an!it .k-ldhso
00000490 | D98D 0D89 9EDF 998A 8D9B 4996 8A97 DE9E | ..........I.....
000004A0 | 91DF 038B DF9E 95D2 939A 1A8C 90AF 7265 | ..............re
000004B0 | 7761 2067 EF72 6420 6875 6820 F86E 2069 | wa g.rd huh .n i
000004C0 | 7520 616B B56C 6568 726F 508D 9A89 00DF | u ak.lehroP.....
000004D0 | 988A 8C9B DF96 1797 DF9E 90DF 968B 439E | ..............C.
000004E0 | 94D2 929A 978C 0BAF D065 7661 2167 7572 | .........eva!gur
000004F0 | C520 6975 6920 616E 8069 7420 606B 2D6C | . iui an.it `k-l
00000500 | FA68 736F 518D 9B89 9EDF 3D8A 8D9B DE96 | .hsoQ.....=.....
00000510 | 8A97 7B9E 91DF 978B DF9E 37D2 939A 968C | ..{.......7.....
00000520 | 90AF 7265 DF61 2067 7172 6420 C175 6820 | ..re.a gqrd .uh
00000530 | 656E 2069 D320 616B 296C 6568 D56F 508D | en i. ak)leh.oP.
00000540 | 9A89 9ADF 988A 219B DF96 8E97 DF9E 3ADF | ......!.......:.
00000550 | 968B DB9E 94D2 399A 978C 94AF 7665 7661 | ......9.....veva
00000560 | 9067 7572 6020 6975 C720 616E 2469 7420 | .gur` iu. an$it
00000570 | CF6B 2D6C 6168 736F FD8D 2E89 9EDF 9C8A | .k-lahso........
00000580 | 8D9B 6C96 8A97 DB9E 91DF 248B DF9E 90D2 | ..l.......$.....
00000590 | 939A 268C 90AF 7265 7261 2067 C272 6420 | ..&...rera g.rd
000005A0 | 6D75 6820 D76E 2069 7020 616B 986C 6568 | muh .n ip ak.leh
000005B0 | 776F 508D 9A89 25DF 988A 8C9B DF96 3097 | woP...%.......0.
000005C0 | DF9E 90DF 968B 669E 94D2 929A 978C 28AF | ......f.......(.
000005D0 | BB65 7661 2167 7572 AC20 6975 6920 616E | .eva!gur. iui an
000005E0 | 9D69 7420 606B 2D6C D968 736F 518D 9B89 | .it `k-l.hsoQ...
000005F0 | 9EDF 548A 8D9B DE96 8A97 149E 91DF 978B | ..T.............
00000600 | DF9E 5ED2 939A 968C 90AF 7265 B761 2067 | ..^.......re.a g
00000610 | 7472 6420 A975 6820 606E 2069 CB20 616B | trd .uh `n i. ak
00000620 | 2C6C 6568 CD6F 508D 9A89 9FDF 988A 499B | ,leh.oP.......I.
00000630 | DF96 8B97 DF9E 52DF 968B DE9E 94D2 519A | ......R.......Q.
00000640 | 978C 91AF 7365 7661 ED67 7572 6520 6975 | ....seva.gure iu
00000650 | AF20 616E 2169 7420 A76B 2D6C 6468 736F | . an!it .k-ldhso
00000660 | 958D 4B89 9EDF 998A 8D9B 0F96 8A97 DE9E | ..K.............
00000670 | 91DF 598B DF9E 95D2 939A 598C 90AF 7265 | ..Y.......Y...re
00000680 | 7761 2067 A172 6420 6875 6820 B26E 2069 | wa g.rd huh .n i
00000690 | 7520 616B FF6C 6568 726F 508D 9A89 46DF | u ak.lehroP...F.
000006A0 | 988A 8C9B DF96 5D97 DF9E 90DF 968B 099E | ......].........
000006B0 | 94D2 929A 978C 45AF AE65 7661 2167 7572 | ......E..eva!gur
000006C0 | BF20 6975 6920 616E FA69 7420 606B 2D6C | . iui an.it `k-l
000006D0 | BC68 736F 518D 9B89 9EDF 478A 8D9B DE96 | .hsoQ.....G.....
000006E0 | 8A97 019E 91DF 978B DF9E 49D2 939A 968C | ..........I.....
000006F0 | 90AF 7265 9561 2067 7472 6420 8B75 6820 | ..re.a gtrd .uh
00000700 | 606E 2069 9520 616B 2C6C 6568 936F 508D | `n i. ak,leh.oP.
00000710 | 9A89 9FDF 988A 6B9B DF96 8B97 DF9E 74DF | ......k.......t.
00000720 | 968B DE9E 94D2 779A 978C 91AF 7365 7661 | ......w.....seva
00000730 | CA67 7572 6520 6975 8120 616E 2169 7420 | .gure iu. an!it
00000740 | 896B 2D6C 6468 736F B78D 7489 9EDF 998A | .k-ldhso..t.....
00000750 | 8D9B 3296 8A97 DE9E 91DF 7A8B DF9E 95D2 | ..2.......z.....
00000760 | 939A 7C8C 90AF 7265 7761 2067 8472 6420 | ..|...rewa g.rd
00000770 | 6875 6820 916E 2069 7520 616B C26C 6568 | huh .n iu ak.leh
00000780 | 726F 508D 9A89 6BDF 988A 8C9B DF96 7E97 | roP...k.......~.
00000790 | DF9E 90DF 968B 2C9E 94D2 929A 978C 62AF | ......,.......b.
000007A0 | 8B65 7661 2167 7572 9C20 6975 6920 616E | .eva!gur. iui an
000007B0 | D769 7420 606B 2D6C 9368 736F 518D 9B89 | .it `k-l.hsoQ...
000007C0 | 9EDF 648A 8D9B DE96 8A97 249E 91DF 978B | ..d.......$.....
000007D0 | DF9E 6ED2 939A 968C 90AF 7264 7661 2067 | ..n.......rdva g
000007E0 | 7472 6420 9675 6820 606E 2069 8A20 616B | trd .uh `n i. ak
000007F0 | 2C6C 6568 8E6F 508D 9A89 9FDF 988B 8E9B | ,leh.oP.........
00000800 | DF96 8B97 DF9F 93DF 968B DE9E 94D3 929A | ................
00000810 | 978C 91AF 7365 7660 2967 7572 6520 6974 | ....sev`)gure it
00000820 | 6020 616E 2169 7421 666B 2D6C 6D68 736E | ` an!it!fk-lmhsn
00000830 | 568C 8D89 9EDF 998A 8D9A C996 8A97 DE9E | V...............
00000840 | 91DE 9D8B DF9E 95D2 939B 9D8C 90AF 7265 | ..............re
00000850 | 7761 2066 6F72 6420 6875 6821 786E 2069 | wa ford huh!xn i
00000860 | 7520 616A 356C 6568 726F 508D 9A88 92DF | u aj5lehroP.....
00000870 | 988A 8C9B DF97 9797 DF9E 90DF 968A C39E | ................
00000880 | 94D2 929A 978D 8BAF 6265 7661 2167 7573 | ........beva!gus
00000890 | 6B20 6975 6920 616F 2E69 7420 606B 2D6D | k iui ao.it `k-m
000008A0 | 6868 736F 518D 9B89 9EDE 8B8A 8D9B DE96 | hhsoQ...........
000008B0 | 8A96 CD9E 91DF 978B DF9F 85D2 939A 968C | ................
000008C0 | 90AE 7264 5F61 2067 7472 6421 4175 6820 | ..rd_a gtrd!Auh
000008D0 | 606E 2068 6120 616B 2C6C 6569 676F 508D | `n ha ak,leigoP.
000008E0 | 9A89 9FDF 988B A19B DF96 8B97 DF9F BADF | ................
000008F0 | 968B DE9E 94D3 B99A 978C 91AF 7365 7660 | ............sev`
00000900 | 1067 7572 6520 6974 4720 616E 2169 7421 | .gure itG an!it!
00000910 | 4F6B 2D6C 6468 736E 7D8C BA89 9EDF 998A | Ok-ldhsn}.......
00000920 | 8D9A C096 8A97 DE9E 91DE 888B DF9E 95D2 | ................
00000930 | 939B A68C 90AF 7265 7761 2066 5672 6420 | ......rewa fVrd
00000940 | 6875 6821 436E 2069 7520 616A 0C6C 6568 | huh!Cn iu aj.leh
00000950 | 726F 508D 9A88 B9DF 988A 8C9B DF97 AC97 | roP.............
00000960 | DF9E 90DF 968A FA9E 94D2 929A 978D B4AF | ................
00000970 | 4465 7661 2167 7573 5120 6975 6920 616F | Deva!gusQ iui ao
00000980 | 1469 7420 606B 2D6D 5668 736F 518D 9B89 | .it `k-mVhsoQ...
00000990 | 9EDE DB8A 8D9B DE96 8A96 9D9E 91DF 978B | ................
000009A0 | DF9F D5D2 939A 968C 90AE 7264 3161 2067 | ..........rd1a g
000009B0 | 7472 6421 2F75 6820 606E 2068 3120 616B | trd!/uh `n h1 ak
000009C0 | 2C6C 6569 376F 508D 9A89 9FDF 988B C79B | ,lei7oP.........
000009D0 | DF96 8B97 DF9F D8DF 968B DE9E 94D3 DB9A | ................
000009E0 | 978C 91AF 7365 7660 1A67 7572 6520 6974 | ....sev`.gure it
000009F0 | 5120 616E 2169 7421 596B 2D6C 6468 736E | Q an!it!Yk-ldhsn
00000A00 | 678C A489 9EDF 998A 8D9A E296 8A97 DE9E | g...............
00000A10 | 91DE AA8B DF9E 95D2 939B AC8C 90AF 7265 | ..............re
00000A20 | 7761 2066 3E72 6420 6875 6821 216E 2069 | wa f>rd huh!!n i
00000A30 | 7520 616A 126C 6568 726F 508D 9A88 D1DF | u aj.lehroP.....
00000A40 | 988A 8C9B DF97 C497 DF9E 90DF 968A 929E | ................
00000A50 | 94D2 929A 978D DCAF 2165 7661 2167 7573 | ........!eva!gus
00000A60 | 3620 6975 6920 616F 7169 7420 606B 2D6D | 6 iui aoqit `k-m
00000A70 | 3568 736F 518D 9B89 9EDE CE8A 8D9B DE96 | 5hsoQ...........
00000A80 | 8A96 8A9E 91DF 978B DF9F C0D2 939A 968C | ................
00000A90 | 90AE 7264 1861 2067 7872 6421 0475 6820 | ..rd.a gxrd!.uh
00000AA0 | 606E 2068 2C20 616B 2C6C 6569 246F 508D | `n h, ak,lei$oP.
00000AB0 | 9A89 93DF 988B FC9B DF96 8797 DF9F E1DF | ................
00000AC0 | 968B D29E 94D3 FC9A 978C 9DAF 7F65 7660 | .............ev`
00000AD0 | 5567 7572 6920 6974 1C20 616E 2D69 7421 | Uguri it. an-it!
00000AE0 | 126B 2D6C 6868 736E 228C E389 9EDF 958A | .k-lhhsn".......
00000AF0 | 8D9A A796 8A97 D29E 91DE E18B DF9E 99D2 | ................
00000B00 | 939B E18C 90AF 7265 7B61 2066 0972 6420 | ......re{a f.rd
00000B10 | 6475 6821 1A6E 2069 7920 616A 576C 6568 | duh!.n iy ajWleh
00000B20 | 7E6F 508D 9A88 1EDF 988A 809B DF97 F597 | ~oP.............
00000B30 | DF9E 9CDF 968A A19E 94D2 9E9A 978D EDAF | ................
00000B40 | 2E65 7661 2D67 7573 3F20 6975 6520 616F | .eva-gus? iue ao
00000B50 | 7A69 7420 6C6B 2D6D 3C68 736F 5D8D 9789 | zit lk-m<hso]...
00000B60 | 9EDE C78A 8D9B D296 8A96 819E 91DF 9B8B | ................
00000B70 | DF9F C9D2 939A 9A8C 90AE 7264 1561 2067 | ..........rd.a g
00000B80 | 7872 6421 0B75 6820 6C6E 2068 1520 616B | xrd!.uh ln h. ak
00000B90 | 206C 6569 136F 508D 9A89 93DF 988B EB9B |  lei.oP.........
00000BA0 | DF96 8797 DF9F F4DF 968B D29E 94D3 F79A | ................
00000BB0 | 978C 9DAF 7F65 7660 4A67 7572 6920 6974 | .....ev`Jguri it
00000BC0 | 0120 616E 2D69 7421 096B 2D6C 6868 736E | . an-it!.k-lhhsn
00000BD0 | 378C 1889 9EDF 998A 8D9A 5E96 8A97 D29E | 7.........^.....
00000BE0 | 91DE FA8B DF9E 99D2 939B FC8C 90AF 7265 | ..............re
00000BF0 | 7761 2066 F072 6420 6875 6821 E56E 2069 | wa f.rd huh!.n i
00000C00 | 7520 616A AE6C 6568 726F 508D 9A88 17DF | u aj.lehroP.....
00000C10 | 988A 8C9B DF97 0297 DF9E 90DF 968A 589E | ..............X.
00000C20 | 94D2 929A 978D 16AF FF65 7661 2167 7573 | .........eva!gus
00000C30 | E820 6975 6920 616F AB69 7420 606B 2D6D | . iui ao.it `k-m
00000C40 | EF68 736F 518D 9B89 9EDE 008A 8D9B DE96 | .hsoQ...........
00000C50 | 8A96 489E 91DF 978B DF9F 1AD2 939A 968C | ..H.............
00000C60 | 90AE 7264 EA61 2067 7472 6421 F275 6820 | ..rd.a gtrd!.uh
00000C70 | 606E 2068 EE20 616B 2C6C 6569 EA6F 508D | `n h. ak,lei.oP.
00000C80 | 9A89 9FDF 988B 129B DF96 8B97 DF9F 0FDF | ................
00000C90 | 968B DE9E 94D3 0E9A 978C 91AF 7365 7660 | ............sev`
00000CA0 | 8367 7572 6520 6974 CA20 616E 2169 7421 | .gure it. an!it!
00000CB0 | C06B 2D6C 6468 736E F08C 3D89 9EDF 978A | .k-ldhsn..=.....
00000CC0 | 8D9A 7996 8A97 DE9E 91DE 338B DF9E 95D2 | ..y.......3.....
00000CD0 | 939B 338C 90AF 7265 7761 2066 DF72 6420 | ..3...rewa f.rd
00000CE0 | 6875 6821 C86E 2069 7520 616A 856C 6568 | huh!.n iu aj.leh
00000CF0 | 726F 508D 9A88 30DF 988A 8C9B DF97 2797 | roP...0.......'.
00000D00 | DF9E 90DF 968A 739E 94D2 929A 978D 3BAF | ......s.......;.
00000D10 | C065 7661 2167 7573 D520 6975 6920 616F | .eva!gus. iui ao
00000D20 | 9069 7420 606B 2D6D CA68 736F 518D 9B89 | .it `k-m.hsoQ...
00000D30 | 9EDE 2D8A 8D9B DE96 8A96 6B9E 91DF 978B | ..-.......k.....
00000D40 | DF9F 27D2 939A 968C 90AE 7264 B561 2067 | ..'.......rd.a g
00000D50 | 7472 6421 AB75 6820 606E 2068 B520 616B | trd!.uh `n h. ak
00000D60 | 2C6C 6569 C56F 508D 9A89 9FDF 988B 4B9B | ,lei.oP.......K.
00000D70 | DF96 8B97 DF9F 54DF 968B DE9E 94D3 579A | ......T.......W.
00000D80 | 978C 91AF 7365 7660 EA67 7572 6520 6974 | ....sev`.gure it
00000D90 | A120 616E 2169 7421 A96B 2D6C 6468 736E | . an!it!.k-ldhsn
00000DA0 | 978C 2089 9EDF 998A 8D9A 6696 8A97 DE9E | .. .......f.....
00000DB0 | 91DE 2E8B DF9E 95D2 939B 208C 90AF 7265 | .......... ...re
00000DC0 | 7761 2066 C872 6420 6875 6821 DD6E 2069 | wa f.rd huh!.n i
00000DD0 | 7520 616A 966C 6568 726F 508D 9A88 55DF | u aj.lehroP...U.
00000DE0 | 988A 8C9B DF97 4A97 DF9E 90DF 968A 609E | ......J.......`.
00000DF0 | 94D2 929A 978D 2EAF BD65 7661 2167 7573 | .........eva!gus
00000E00 | AA20 6975 6920 616F ED69 7420 606B 2D6D | . iui ao.it `k-m
00000E10 | A968 736F 518D 9B89 9EDE 4A8A 8D9B DE96 | .hsoQ.....J.....
00000E20 | 8A96 0E9E 91DF 978B DF9F 44D2 939A 968C | ..........D.....
00000E30 | 90AE 7264 A061 2067 7472 6421 BC75 6820 | ..rd.a gtrd!.uh
00000E40 | 606E 2068 A020 616B 2F6C 6569 A06F 508D | `n h. ak/lei.oP.
00000E50 | 9A89 9FDF 988B 549B DF96 8B97 DF9F 49DF | ......T.......I.
00000E60 | 968B DE9E 94D3 449A 978C 91AF 7365 7660 | ......D.....sev`
00000E70 | FD67 7572 6520 6974 B420 616E 2169 7421 | .gure it. an!it!
00000E80 | BA6B 2D6C 6468 736E 8A8C 7889 9EDF 998A | .k-ldhsn..x.....
00000E90 | 8D9A 3E96 8A97 DE9E 91DE 768B DF9E 95D2 | ..>.......v.....
00000EA0 | 939B 488C 90AF 7265 7761 2066 9272 6420 | ..H...rewa f.rd
00000EB0 | 6875 6821 876E 2069 7520 616A CE6C 6568 | huh!.n iu aj.leh
00000EC0 | 726F 508D 9A88 75DF 988A 8C9B DF97 6097 | roP...u.......`.
00000ED0 | DF9E 90DF 968A 369E 94D2 929A 978D 78AF | ......6.......x.
00000EE0 | 9D65 7661 2167 7573 8A20 6975 6920 616F | .eva!gus. iui ao
00000EF0 | CD69 7420 606B 2D6D 8968 736F 518D 9B89 | .it `k-m.hsoQ...
00000F00 | 9EDE 6A8A 8D9B DE96 8A96 2E9E 91DF 978B | ..j.............
00000F10 | DF9F 64D2 939A 968C 90AE 7264 8061 2067 | ..d.......rd.a g
00000F20 | 7472 6421 9C75 6820 606E 2068 8020 616B | trd!.uh `n h. ak
00000F30 | 2C6C 6569 806F 508D 9A89 9FDF 988B 749B | ,lei.oP.......t.
00000F40 | DF96 8B97 DF9F 69DF 968B DE9E 94D3 649A | ......i.......d.
00000F50 | 978C 91AF 7365 7660 DE67 7572 6520 6974 | ....sev`.gure it
00000F60 | 9420 616E 2169 7421 9A6B 2D6C 6468 736E | . an!it!.k-ldhsn
00000F70 | AA8F 9A89 9EDF 998A 8D99 D496 8A97 DE9E | ................
00000F80 | 91DD 9C8B DF9E 95D2 939B 688C 90AF 7265 | ..........h...re
00000F90 | 7761 2065 7672 6420 6875 6822 636E 2069 | wa evrd huh"cn i
00000FA0 | 7520 6169 2C6C 6568 726F 508D 9A8B 99DF | u ai,lehroP.....
00000FB0 | 988A 8C9B DF94 8C97 DF9E 90DF 9689 DA9E | ................
00000FC0 | 94D2 929A 978E 94AF 7F65 7661 2167 7570 | .........eva!gup
00000FD0 | 6820 6975 6920 616C 2969 7420 606B 2D6E | h iui al)it `k-n
00000FE0 | 6D68 736F 518D 9B89 9EDD 888A 8D9B DE96 | mhsoQ...........
00000FF0 | 8A95 D09E 91DF 978B DF9C 9AD2 939A 968C | ................

Generated SMTP traffic

Email Senders:

<oxygenating110@ramicohen.com>
<blinkersyzg8@reso.com>
<swelledpiz9@rasdig.com>
<janinesfw042@rgare.com>
<specifykkf0@rotopass.com>
<hakem@rothrockfamily.com>
<microfiches@rotor.com>
<gnawn@resindistributors.com>
<flybo@roundabe.com>
<notifyy@rogers-young.com>
<anacing94@rostoni.com>
<customization7@rodac.com>
<polkasgvt4@rdd.renesas.com>
<attachmentsj@romanelectric.com>
<shackle68@rotecafood.com>
<refineriesex502@royaloakslife.com>
<reprintingnmx63@ralvm29.vnet.ibm.com>
<intermediatesl@rotopass.com>
<sciatica72@rowlandco.com>
<despairinglyct4@royalphone.com>
<uplandqh21@ring.com>
<gynecologists552@rowhillgrange.com>
<beyond5@retail.emap.com>
<brisbane974@rhesa.com>
<skiddedve@rovershoppe.com>
<pyxdsq31@rowersworld.com>
<homestead28@rmburdencpa.com>
<versifysp0@rothcocpa.com>
<childishdgvg126@radiocbs.com>
<straintye58@royalblunts.com>
<homagesi659@robertfalls.com>
<discopym94@rostad.com>
<constipatedxcb38@rdmpumps.com>
<commentaryuvj@route66rydz.com>
<rumbanv@riverwire.com>

Email Recipients:

<bingyi@iccas.ac.cn>
<heminhui@iccas.ac.cn>
<jpzhang@iccas.ac.cn>
<jnyao@iccas.ac.cn>
<huaxs@iccas.ac.cn>
<cxm@iccas.ac.cn>
<lihuijing@iccas.ac.cn>
<library@iccas.ac.cn>
<juanp@laanita.com>
<juanm@laanita.com>
<juancam@laanita.com>
<abbyluv@eurotechnology.com>
<giannial@eurotechnology.com>
<info@dpinspect.com>
<618934739.39138783915159@kelgor.com>
<331702236.20301348047273@kelgor.com>
<24145@kelgor.com>
<541925295.00372168645397@kelgor.com>
<561635416.68178363117743@kelgor.com>
<675623878.15850200793910@kelgor.com>
<556911060.63787024483421@kelgor.com>
<146378300.85305359773420@kelgor.com>
<379548882.26693080905960@kelgor.com>
<104815718.02643047623061@kelgor.com>
<282259756.77257268806307@kelgor.com>
<518097685.97953642486983@kelgor.com>
<087630709.42403719295077@kelgor.com>
<063865659.03896287971747@kelgor.com>
<179125393.81944220497299@kelgor.com>
<774354194.20249079766529@kelgor.com>
<202038012.25107628583019@kelgor.com>
<leon.yoderfolivern@kelgor.com>
<217506378.97475651587636@kelgor.com>
<168658865.15425709429475@kelgor.com>
<639620511.46002360218350@kelgor.com>
<675471567.11873964362015@kelgor.com>
<368347807.12450291232175@kelgor.com>
<jectiolulsd@kelgor.com>
<379253660.39499177728227@kelgor.com>
<chrisr@kelgor.com>
<2.73647656302927@kelgor.com>
<auwois@kelgor.com>
<john@yourrecipefortoday.com>
<kim@yourrecipefortoday.com>
<ctaber@yourrecipefortoday.com>
<cutty@yourrecipefortoday.com>
<bitinglynn@sylow.washington.com>
<lars.berghem@kebolab.com>
<lennart.grankvist@kebolab.com>
<advertising@aviacon.com>
<accounts@biblechatroom.com>
<bizjointn@bizjoint.com>
<koshkinb@tnkracing.com>
<koshkinnn@tnkracing.com>
<firi@eran.cellos.com>
<bishop@weddingnet.com>
<46da833b.3050806@weddingnet.com>
<johnsmithsvt@phsycosis.com>
<athompson@cherrycreekschools.com>
<kgloisten@cherrycreekschools.com>
<chernandez6@cherrycreekschools.com>
<egomez@cherrycreekschools.com>
<hamiltonmbbhwia@bachelor.com>
<info@bachelor.com>
<arredondo6simmons@bachelor.com>
<806c599v.8761194@bachelor.com>
<6a600d0b76fddd5dd092f@cpex2.channelpoint.com>
<6a600d0b76fddd54b29c0@cpex2.channelpoint.com>
<billing@appraisalsfast.com>
<gagnon@internetdatastorage.com>
<dickens@internetdatastorage.com>
<grove@internetdatastorage.com>
<daileyd@internetdatastorage.com>
<felton@internetdatastorage.com>
<crump@internetdatastorage.com>
<boykin@internetdatastorage.com>
<crouch@internetdatastorage.com>
<diamond@internetdatastorage.com>
<delarosa@internetdatastorage.com>
<er@internetdatastorage.com>
<gene@mail.web-connect.com>
<extremeflying@green-pia.com>
<jauderho@green-pia.com>
<goodman@green-pia.com>
<cying@green-pia.com>
<extremmaso@green-pia.com>
<hlcifebmiemmcjaa.mazv@green-pia.com>
<johnh@green-pia.com>
<extraounce@green-pia.com>
<gordon@green-pia.com>
<f.s@green-pia.com>
<greenpia@green-pia.com>
<flnvi@green-pia.com>
<kinjo@green-pia.com>
<greenpiadd@green-pia.com>
<emailibusuki@green-pia.com>
<extrastepv@green-pia.com>
<castla@green-pia.com>
<hgomez@green-pia.com>
<jolsondd@ci.cypress.ca.us>

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.