ThreatExpert Report: Mal/Dropper-P, Trojan:Win32/Wisp.gen!A

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 28 October 2010, 19:13:22
Processing time: 7 min 5 sec
Submitted sample:

File MD5: 0x9F0CEFE847174185030A1F027B3813EC
File SHA-1: 0xD1DD77D870AADE5B29BA2791163F6D873B76253F
Filesize: 153,600 bytes
Alias:

Mal/Dropper-P [Sophos]
Trojan:Win32/Wisp.gen!A [Microsoft]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\nsunday.dll	27,649 bytes	MD5: 0x31E0D52EDCF2BBE8A05849D357A03302 SHA-1: 0xA33A26666866342A02613BD96E961F45ECB1A12E	Trojan:Win32/Wisp.gen!A [Microsoft]
2	%Temp%\nsunday.exe [file and pathname of the sample #1]	153,600 bytes	MD5: 0x9F0CEFE847174185030A1F027B3813EC SHA-1: 0xD1DD77D870AADE5B29BA2791163F6D873B76253F	Mal/Dropper-P [Sophos] Trojan:Win32/Wisp.gen!A [Microsoft]

Note:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
nsunday.exe	%Temp%\nsunday.exe	49,152 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\ipconfig\DEBUG]

Trace Level = ""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

nsunday = "%Temp%\nsunday.exe -installkys"

so that nsunday.exe runs every time Windows starts

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47AFB915CDA26D82467B97FA42914468726138DD]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C]

Blob =

Other details

Analysis of the file resources indicate the following possible country of origin:

China

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
64.208.241.73	80
65.202.221.207	443

The data identified by the following URLs was then requested from the remote web server:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 443:

00000000 | 804C 0103 0000 3300 0000 1000 0004 0000 | .L....3.........
00000010 | 0500 000A 0100 8007 00C0 0300 8000 0009 | ................
00000020 | 0600 4000 0064 0000 6200 0003 0000 0602 | ..@..d..b.......
00000030 | 0080 0400 8000 0013 0000 1200 0063 78E6 | .............cx.
00000040 | A68B BBA1 4DD7 C041 9D9C 9A13 35C8 1403 | ....M..A....5...
00000050 | 0000 0101 1603 0000 3869 B279 A4C5 BD7D | ........8i.y...}
00000060 | A11C 05F6 A56C 5705 1AB9 BD69 5FF5 58CD | .....lW....i_.X.
00000070 | 7EA5 21F3 5681 213E FB63 C457 93C3 8B13 | ~.!.V.!>.c.W....
00000080 | B48E B426 D9F8 5247 1285 C79A 1E8B 9342 | ...&..RG.......B
00000090 | 9F16 0300 0061 0100 005D 0300 4CCA 2E27 | .....a...]..L..'
000000A0 | 0649 455C E5DD AFFC F4D4 C632 AAC6 4F5F | .IE\.......2..O_
000000B0 | 9206 F4E2 CB63 FEEC 6996 606D 204F 147D | .....c..i.`m O.}
000000C0 | CC62 81BC 9571 A637 AB7B 1B33 0B7B 6CA6 | .b...q.7.{.3.{l.
000000D0 | 82F8 0C6C A72C 749D FE1D 939E B300 1600 | ...l.,t.........
000000E0 | 0400 0500 0A00 0900 6400 6200 0300 0600 | ........d.b.....
000000F0 | 1300 1200 6301 0016 0300 0084 1000 0080 | ....c...........
00000100 | 6AB1 3144 CB43 28C0 46E1 DAEE BE34 7B00 | j.1D.C(.F....4{.
00000110 | E0D1 0D0D 33BF 7870 C586 C536 94FB E351 | ....3.xp...6...Q
00000120 | 25FF FF5F DC69 7AD5 15F4 3B95 E022 C7B3 | %.._.iz...;.."..
00000130 | 306F 5BCA 0A5E C0D2 75AF FA5C A552 F358 | 0o[..^..u..\.R.X
00000140 | CE95 D069 C26E C082 C1C3 EA40 9312 8049 | ...i.n.....@...I
00000150 | FA6B A13A 0880 310B 03F8 0D97 51CA A4AC | .k.:..1.....Q...
00000160 | 8B4B B4F5 13D7 9BE3 FD89 C49C DA00 B0E9 | .K..............
00000170 | E5E4 5570 461E 2CE7 71CB 757C 0FF0 FD4E | ..UpF.,.q.u|...N
00000180 | 1403 0000 0101 1603 0000 3893 7A89 1013 | ..........8.z...
00000190 | 274C BA10 3769 F17D 103D 1592 B07E 0AEE | 'L..7i.}.=...~..
000001A0 | 9DE2 64E4 8AB4 DD6D 1BB7 7AC8 E40A 0DA4 | ..d....m..z.....
000001B0 | 4E58 32CB 7659 A8EB C52D 218B 1FAC C10E | NX2.vY...-!.....
000001C0 | F300 A417 0300 0222 7EA2 F841 2224 291C | ......."~..A"$).
000001D0 | DD62 526D 5304 1CB6 F0A8 4557 5291 8947 | .bRmS.....EWR..G
000001E0 | 8CC2 E91A 9B06 33DE 4091 26B4 02EB F319 | ......3.@.&.....
000001F0 | E2C6 24B4 DA1D 325F 8D61 A7FB 4ACF 2E12 | ..$...2_.a..J...
00000200 | 5A27 AB1E 2571 A1BD EA25 8320 C4AD B97D | Z'..%q...%. ...}
00000210 | 33A2 0B68 85FE 48A9 D0EC A428 261F 63CE | 3..h..H....(&.c.
00000220 | 8995 E19E EAE0 43EB 9C5F 754F D846 22F6 | ......C.._uO.F".
00000230 | 037F 0CD0 D5B1 C427 5AFC E7EC 43B7 A6A4 | .......'Z...C...
00000240 | E835 9CC2 8903 D232 3C83 BAED 79A9 1611 | .5.....2<...y...
00000250 | 169B 0DE9 01A1 72F3 B7FA 6C47 EBF7 5082 | ......r...lG..P.
00000260 | EE53 03E4 68C7 7254 9253 D85D 6126 A8A9 | .S..h.rT.S.]a&..
00000270 | 62A4 883E D2A3 2276 E453 8B12 6A2C DA2F | b..>.."v.S..j,./
00000280 | F0B2 FD29 D831 2B70 CF2E 8458 2A52 4740 | ...).1+p...X*RG@
00000290 | C19B F6E6 121D 9DD7 2C28 953A 3770 E9D3 | ........,(.:7p..
000002A0 | A00C 733C 915B 04B7 BCF9 85E9 E9CF AC3F | ..s<.[.........?
000002B0 | 76EC 8D8A 3696 FD7B C662 CC9C 997C 1791 | v...6..{.b...|..
000002C0 | 01F2 FD99 C42B BA97 ECE4 5B13 DD44 D083 | .....+....[..D..
000002D0 | 2C16 0B5C 69EC 39BD 71BC 3F28 F38A 7E00 | ,..\i.9.q.?(..~.
000002E0 | 3357 2D4B 445D 5D29 61D0 411D E242 9A72 | 3W-KD]])a.A..B.r
000002F0 | 1FF1 FE7E 2D96 621E 4869 7F9D D06D 1827 | ...~-.b.Hi...m.'
00000300 | CFFF 8726 EA88 925E CC60 0BF6 22F5 60BD | ...&...^.`..".`.
00000310 | 51DD 9E98 4D35 B917 52C5 F66D D483 07FA | Q...M5..R..m....
00000320 | 106D F5E6 79B0 8C32 EBC1 92F9 4DE7 A25F | .m..y..2....M.._
00000330 | 7059 E6CD 8065 1C13 19D7 5268 DFD5 9A12 | pY...e....Rh....
00000340 | 5109 021E AE44 8D17 036D 0392 301C 1897 | Q....D...m..0...
00000350 | 5B07 22B1 571A 0F70 468E 0AF1 6761 266D | [.".W..pF...ga&m
00000360 | D1CE E5BC 4A82 1287 29F0 438D FBDB 3084 | ....J...).C...0.
00000370 | 9DB9 A7CA 86C8 EEB8 94AF 5877 9543 B104 | ..........Xw.C..
00000380 | C12D 8D33 A761 56E0 2959 D40F 7CD7 65E7 | .-.3.aV.)Y..|.e.
00000390 | C5CD 5D59 5546 69C6 3DEF 6224 0842 763B | ..]YUFi.=.b$.Bv;
000003A0 | 4DF8 DAEE B27D 1672 47E3 7FF0 BE80 A191 | M....}.rG.......
000003B0 | 9166 8958 2A79 38DA 4E66 B012 5B0C 7433 | .f.X*y8.Nf..[.t3
000003C0 | 8CE8 01D1 81FE 0200 F778 4433 CA4A A7A6 | .........xD3.J..
000003D0 | 6FEC 1554 5BEF 0F89 18E4 DB99 2C54 4ACD | o..T[.......,TJ.
000003E0 | 7536 C8C6 9DBC 3FB8 1F81 1603 0000 6101 | u6....?.......a.
000003F0 | 0000 5D03 004C CA2E 28E2 0BA5 0098 3322 | ..]..L..(.....3"
00000400 | 22FD 8C60 15F7 D7B8 71D4 C355 8852 F40D | "..`....q..U.R..
00000410 | FAC2 6343 9520 76B9 6C9A DF12 24A7 2D8C | ..cC. v.l...$.-.
00000420 | 0248 5E54 1DDA 416D 4009 1B97 4EBC 23E3 | .H^T..Am@...N.#.
00000430 | E423 E75B 814E 0016 0004 0005 000A 0009 | .#.[.N..........
00000440 | 0064 0062 0003 0006 0013 0012 0063 0100 | .d.b.........c..
00000450 | 1403 0000 0101 1603 0000 388F 771A D3BD | ..........8.w...
00000460 | 4455 2C8A F55A 5ECF 5595 7D7B F91A 436C | DU,..Z^.U.}{..Cl
00000470 | BD34 EAE7 EE4D 9A52 5EEB F89E 579F 5EEB | .4...M.R^...W.^.
00000480 | 5BEF 3F43 5A52 41D0 F07B 76A9 0150 877E | [.?CZRA..{v..P.~
00000490 | B751 6F16 0300 0061 0100 005D 0300 4CCA | .Qo....a...]..L.
000004A0 | 2E29 73C5 E0C4 993D 24D5 566C 3D6C 3F02 | .)s....=$.Vl=l?.
000004B0 | 0DAF 15AE 0706 0388 FC23 ED0C 36A6 2076 | .........#..6. v
000004C0 | B96C 9ADF 1224 A72D 8C02 485E 541D DA41 | .l...$.-..H^T..A
000004D0 | 6D40 091B 974E BC23 E3E4 23E7 5B81 4E00 | m@...N.#..#.[.N.
000004E0 | 1600 0400 0500 0A00 0900 6400 6200 0300 | ..........d.b...
000004F0 | 0600 1300 1200 6301 0016 0300 0084 1000 | ......c.........
00000500 | 0080 89A4 20EE D16E E73F 0136 E5B3 FE35 | .... ..n.?.6...5
00000510 | 44D8 7B63 80F1 6FC2 9EC7 B84C 2828 C902 | D.{c..o....L((..
00000520 | 835D C18C 6420 9F9E 273B 30B3 9204 B021 | .]..d ..';0....!
00000530 | C16F 9815 B23E 1D5D 48A6 C26B 83A3 ECBC | .o...>.]H..k....
00000540 | 415D A132 4C08 5B77 8EEA 5ACF E70B F21C | A].2L.[w..Z.....
00000550 | 8C3D 7836 BC1A E721 131D 3D02 742F 4867 | .=x6...!..=.t/Hg
00000560 | 5101 2D46 A0BF 43AE 3C82 1142 0204 3D05 | Q.-F..C.<..B..=.
00000570 | CD0E 4221 68EA B1E2 7A8F 44A0 CE52 3A08 | ..B!h...z.D..R:.
00000580 | 9000 1403 0000 0101 1603 0000 3885 643C | ............8.d<
00000590 | 5C27 DC2B 3047 AAD5 BD2F 38D2 B26C 0D23 | \'.+0G.../8..l.#
000005A0 | 4B8A 6231 561E DC73 EF85 98B1 75BA 4350 | K.b1V..s....u.CP
000005B0 | AA29 7A5B 4287 CA53 D36D 49AB 58E1 EB31 | .)z[B..S.mI.X..1
000005C0 | AD4C FB7A EC17 0300 018C 4602 F9E2 BCC7 | .L.z......F.....
000005D0 | A9B4 73C9 DAB9 6E3A FA14 96ED DF86 4875 | ..s...n:......Hu
000005E0 | 0F03 46C4 5C1C FCBC 3B6C 627D 433D D18A | ..F.\...;lb}C=..
000005F0 | 135D E9E5 B27B B5EA A915 6B45 6209 37B0 | .]...{....kEb.7.
00000600 | 4E47 7F62 0346 D37F 3F9B F952 1BE6 0565 | NG.b.F..?..R...e
00000610 | 8D9A 288F 4E96 44C7 3D81 46E8 689E BE72 | ..(.N.D.=.F.h..r
00000620 | EE1A DAB3 A380 2618 D465 2174 22E3 E5FA | ......&..e!t"...
00000630 | 2131 FEEF 0EE3 EA55 3525 0D6A 1598 0A35 | !1.....U5%.j...5
00000640 | 8883 7191 DDFD 41F0 3D08 7A21 2450 5F54 | ..q...A.=.z!$P_T
00000650 | A698 A466 F6EB 4B02 90BB B3A9 A6F3 9C35 | ...f..K........5
00000660 | 06AE ED7A 8D80 9A8E E5EE 92B2 E093 9E79 | ...z...........y
00000670 | 91DB 34CA 1E9E FD84 C68A A22E 51F7 BF1E | ..4.........Q...
00000680 | CFAD 1D82 5AD2 944B 387A 082F 2196 B518 | ....Z..K8z./!...
00000690 | 2354 C725 A6F0 5962 4D66 2C89 D263 841A | #T.%..YbMf,..c..
000006A0 | 1E94 6467 CAAD E242 E815 C030 B211 96E6 | ..dg...B...0....
000006B0 | 3535 8457 9158 AE8D 0136 4EB8 6619 75C6 | 55.W.X...6N.f.u.
000006C0 | 4C6E 8D70 E485 E515 FCEF 8F46 A653 660A | Ln.p.......F.Sf.
000006D0 | 353A 7B88 9C19 041B FFF3 AC75 7C03 2053 | 5:{........u|. S
000006E0 | 1C92 A4A3 463C AB22 ED63 82E9 506B F291 | ....F<.".c..Pk..
000006F0 | AE91 24CF ED3E 7A7D B37E 3B90 9F2D 1408 | ..$..>z}.~;..-..
00000700 | B716 AF75 F06D 8DFE 8DA1 58B5 63E2 3BA2 | ...u.m....X.c.;.
00000710 | 07FC 70C0 3C71 8E56 E693 7135 D782 DAD7 | ..p.<q.V..q5....
00000720 | FF4A 5F9C 20B5 8C23 3739 3525 5BA0 9529 | .J_. ..#795%[..)
00000730 | 0DCB 50EE 4B6F 1CEC D15B 80F4 3E8D 9075 | ..P.Ko...[..>..u
00000740 | 283B 42FF 5575 271C 90EB 3518 F4F5 2E15 | (;B.Uu'...5.....
00000750 | 0348 5F74 96CA 1703 003F FB4E 39A5 C0FD | .H_t.....?.N9...
00000760 | 2DE8 67E9 D1FB 976A 742F 5679 1230 6AEF | -.g....jt/Vy.0j.
00000770 | 2428 0BFA 59B7 10DB D81E 53BF F427 DE48 | $(..Y.....S..'.H
00000780 | E5BD C7E0 8FB4 2133 F717 E6B1 A9A8 FAE1 | ......!3........
00000790 | E1E3 E41B 632B 18C7 04C0 4D77 4098 8D91 | ....c+....Mw@...
000007A0 | 529D 53C4 A86E 0ABA F5FB C280 7321 E29B | R.S..n......s!..
000007B0 | 990D 97ED E1EA B4E1 878F D23E 4E74 8FA7 | ...........>Nt..
000007C0 | 7CBF 73D3 C2FE 4106 F99D 3B2D 1B0A 605F | |.s...A...;-..`_
000007D0 | AAEF 7F24 D6C5 611F 6A5C CE04 8141 5093 | ...$..a.j\...AP.
000007E0 | 35FC D55D 3EAE 26FA E4F0 7D93 515C B5C3 | 5..]>.&...}.Q\..
000007F0 | 08A4 C659 8CFC 33E4 9AA1 F728 5E65 FE4E | ...Y..3....(^e.N
00000800 | A5DF 710D 1C67 0E49 C0C4 8493 C615 66B0 | ..q..g.I......f.
00000810 | C34D 1088 1708 24DC F1E7 0861 D40C 2599 | .M....$....a..%.
00000820 | 239E 11EB 21BA 4B7B 4547 B224 C1F9 5CD3 | #...!.K{EG.$..\.
00000830 | 9220 B23F 97E2 3A3F 0B3C 04B9 8527 3CF8 | . .?..:?.<...'<.
00000840 | 9B30 E405 4130 52A3 59A0 0180 1B01 3620 | .0..A0R.Y.....6
00000850 | A8F8 393C E5AA 626E 4B23 E422 58C3 1A26 | ..9<..bnK#."X..&
00000860 | 5C60 C24E 2B31 139B 88DD CEFF 2251 CD71 | \`.N+1......"Q.q
00000870 | 3DDF D84A 06BF BD4A 0887 F2DD DCD4 A527 | =..J...J.......'
00000880 | EDCF E045 7E33 BD0C CC13 636F 36AF CE66 | ...E~3....co6..f
00000890 | 683D 25DC 3176 C32C 1210 705B DC97 4D12 | h=%.1v.,..p[..M.
000008A0 | 254D 4105 6D7A FFD7 5684 ECED E060 BE1E | %MA.mz..V....`..
000008B0 | 2A75 987D 9049 9379 BA60 C32C E8B2 9212 | *u.}.I.y.`.,....
000008C0 | 9355 BD0F 289D 0E36 9D92 9201 4317 D2C0 | .U..(..6....C...
000008D0 | BA29 83AA F26F A517 4F99 48FE 74FC 18DC | .)...o..O.H.t...
000008E0 | 29CA 7ECA D7B7 2A92 1FCB E0D9 456F 5B16 | ).~...*.....Eo[.
000008F0 | C0B3 0C9E 8367 931A D686 F58A 67A1 BBE8 | .....g......g...
00000900 | 5DD0 CD07 FA01 85A4 B66A 0B99 6D43 97E3 | ]........j..mC..
00000910 | 75D7 D575 B8A8 D6E4 CE43 2CD6 2B89 53D9 | u..u.....C,.+.S.
00000920 | 3EF4 BF46 590D 4B4F 2A0D 29B2 2D85 52B4 | >..FY.KO*.).-.R.
00000930 | 0F03 1B5C 8501 DE59 5E8C 68D3 ADCC D58D | ...\...Y^.h.....
00000940 | 95A0 3ED5 3B82 A739 FC84 1F43 026A 17A6 | ..>.;..9...C.j..
00000950 | 86D8 A71C 4C61 8BEF 85E8 FB71 3ABA 106B | ....La.....q:..k
00000960 | 2D43 FA7C AA84 BB1C B878 71C7 5108 9C59 | -C.|.....xq.Q..Y
00000970 | 6CCB 1EA8 A77D 4350 E300 8AD3 4B22 1119 | l....}CP....K"..
00000980 | 6E96 33C1 961E 5A84 9329 365A 2F55 BF16 | n.3...Z..)6Z/U..
00000990 | A866 640C 3E8D 3364 629F DB75 31A9 07C6 | .fd.>.3db..u1...
000009A0 | BD3B 8C4B 6710 E2A4 5B5E B802 8572 C5F7 | .;.Kg...[^...r..
000009B0 | D7A7 B10D 2914 46F1 3E10 3CFD D033 3CA4 | ....).F.>.<..3<.
000009C0 | D688 A73B EBE0 A1E5 B52E 6E73 B2A5 3375 | ...;......ns..3u
000009D0 | A699 5914 E879 3448 A3BE 51FD 1E0C F34E | ..Y..y4H..Q....N
000009E0 | 9635 DF6E 22E8 7EF2 D2DB F6CA 3A41 8CE4 | .5.n".~.....:A..
000009F0 | 9631 35F2 28BB 0308 3D3D AF50 4091 6529 | .15.(...==.P@.e)
00000A00 | CB0D A278 5C7F 4B57 1054 AB94 8326 7BE7 | ...x\.KW.T...&{.
00000A10 | 7B56 B20B C0E6 1B18 19B5 81F8 1F28 59CA | {V...........(Y.
00000A20 | AD09 0F60 5514 128A 33EC 9246 DEED 3703 | ...`U...3..F..7.
00000A30 | B628 433F EAA2 2F75 C4CB AAE2 B5D0 DF20 | .(C?../u.......
00000A40 | 32B1 12AE 7FD2 2A84 83F9 3660 0899 6376 | 2.....*...6`..cv
00000A50 | CAA2 A679 8B71 DC14 C266 383A 6676 98CE | ...y.q...f8:fv..
00000A60 | 34E5 F150 6EA7 8F32 1090 FC54 F284 17C4 | 4..Pn..2...T....
00000A70 | 9899 CFA3 EF98 6764 01AC 848D 9D07 28F0 | ......gd......(.
00000A80 | 9C5A ED1D BDC0 8516 4B6A E573 FDDF FAFB | .Z......Kj.s....
00000A90 | 78B4 210D 7919 3EDB 32A7 27A4 43F1 F246 | x.!.y.>.2.'.C..F
00000AA0 | 0085 230C 309B 80A4 D01F B726 3662 9167 | ..#.0......&6b.g
00000AB0 | 575F 6927 3C5E D059 9FB7 B593 6C25 3FBA | W_i'<^.Y....l%?.
00000AC0 | C0B5 1552 0D08 4D0F 0979 725D 302A F42B | ...R..M..yr]0*.+
00000AD0 | 0892 CE32 BD62 6537 1AE9 0231 59A0 AD5B | ...2.be7...1Y..[
00000AE0 | 2BA6 4708 649F 221A 53A0 60B5 E35F 61A7 | +.G.d.".S.`.._a.
00000AF0 | 3055 0900 5220 B4E3 4741 629F E943 19C2 | 0U..R ..GAb..C..
00000B00 | B8B3 4B82 8354 8409 A916 3134 137A 7CF2 | ..K..T....14.z|.
00000B10 | 5E24 6787 C3DA 164C C8D8 F8EC 1C8A CC62 | ^$g....L.......b
00000B20 | 486A 3F18 799A 537F CE24 021C 2D54 AC2E | Hj?.y.S..$..-T..
00000B30 | C241 7537 8DA7 CEDF 6460 FE8A 7CBD 88EE | .Au7....d`..|...
00000B40 | 45BA F3FC C7C8 F8D4 E9AF 201B 4DE1 9167 | E......... .M..g
00000B50 | D67A 7A3C AD3F 8DD6 F7B7 A954 48F8 5181 | .zz<.?.....TH.Q.
00000B60 | 72D6 4B86 0CA5 364F C4F3 9242 EA76 FD66 | r.K...6O...B.v.f
00000B70 | B2E3 B1CF 4659 AC73 AFC3 5265 0A18 095F | ....FY.s..Re..._
00000B80 | 338D 9D50 FBFC 183E BFB8 7340 E6F3 DB32 | 3..P...>..s@...2
00000B90 | BFE1 8B33 97FE 6E1F A0AB 708E 6BF4 F1B4 | ...3..n...p.k...
00000BA0 | 7023 956B DB71 B357 039C E538 C73F 0E74 | p#.k.q.W...8.?.t
00000BB0 | F316 5180 ECCB BC03 1D58 B848 B9C3 059A | ..Q......X.H....
00000BC0 | 5FD7 A404 5078 BA7A 32F4 4A15 C6D1 5A7F | _...Px.z2.J...Z.
00000BD0 | E227 5C83 5DF1 D234 6726 6AE7 BB0B 3294 | .'\.]..4g&j...2.
00000BE0 | B085 6C74 E452 0C79 EA9A DE94 CEC4 DD24 | ..lt.R.y.......$
00000BF0 | E7D7 54E5 B7D7 FE5B 23A4 1A59 CE8A 6B6C | ..T....[#..Y..kl
00000C00 | BB83 3ADD EBA7 E994 425D 0774 9BC3 6FF6 | ..:.....B].t..o.
00000C10 | 8142 BA51 5492 8F50 0015 D16D BBBA F2CB | .B.QT..P...m....
00000C20 | E1FE 2C9E 21E1 4965 97E4 67D0 5694 3A61 | ..,.!.Ie..g.V.:a
00000C30 | 5B8D E293 7B9A B000 EE2C 55BC 284A 2396 | [...{....,U.(J#.
00000C40 | 9DD0 CB17 DA41 9F17 016E E4DA 73A3 E71D | .....A...n..s...
00000C50 | DEF1 FD7B 0C16 19B6 9384 B9AD 0406 768D | ...{..........v.
00000C60 | 9CDF C72A D15E B865 C98A A8D9 7E17 99DD | ...*.^.e....~...
00000C70 | 5340 07BE 13D0 93B8 7015 687B 11D4 A53E | S@......p.h{...>
00000C80 | 2C9D E7E8 E287 1916 6AAB 0EF4 3FC6 D1BC | ,.......j...?...
00000C90 | BC51 EA9A 75E1 3689 B556 80FD 9461 26EC | .Q..u.6..V...a&.
00000CA0 | 3560 C84B 92BD 0D17 9F38 7421 1B87 8C24 | 5`.K.....8t!...$
00000CB0 | FCBF 92B9 241D 3316 A8E8 0355 2EB6 BFBD | ....$.3....U....
00000CC0 | 2799 00E8 F1E4 8CA6 1CA7 93A6 E2E5 E6FA | '...............
00000CD0 | D1A9 E787 45C8 28C1 09B0 BC29 7A32 613B | ....E.(....)z2a;
00000CE0 | 144E AAD3 0D23 1480 AFDA E195 C336 04D0 | .N...#.......6..
00000CF0 | 279E 7AC7 0A49 D519 C939 8FA0 1A93 3DC2 | '.z..I...9....=.
00000D00 | 1E3A E8A9 D9FC 0026 ABBD 1603 0000 8410 | .:.....&........
00000D10 | 0000 8092 A362 20EB 656B 7C5E 580F 41D5 | .....b .ek|^X.A.
00000D20 | 94BE 68C1 D3C2 3582 01C1 25B5 CF47 2F5D | ..h...5...%..G/]
00000D30 | F5AC DD50 4F7B D07B 5252 B694 88D4 D944 | ...PO{.{RR.....D
00000D40 | 7CA0 88A4 42D5 A6EC B527 4F23 7500 33D8 | |...B....'O#u.3.
00000D50 | 737C 342F 41D6 0982 9CD5 1DDA BBCF C734 | s|4/A..........4
00000D60 | 00AC 4505 19A0 D1B0 0F61 4E86 13AC 0F82 | ..E......aN.....
00000D70 | 46A0 2B25 75DA C8A9 AFFE 3DC4 D871 EAC6 | F.+%u.....=..q..
00000D80 | 9400 4D64 A797 97B1 0560 FAB0 DD09 E6F0 | ..Md.....`......
00000D90 | 4498 7F14 0300 0001 0116 0300 0038 FD25 | D............8.%
00000DA0 | FB0F 4BB1 EA31 3C17 12F1 0F04 F626 DEE6 | ..K..1<......&..
00000DB0 | 1F3B 27AB B5C4 83B6 71BB 994A C95E 4B89 | .;'.....q..J.^K.
00000DC0 | 4DAF 71DC CAE6 7F92 2602 0799 0D27 4EF3 | M.q.....&....'N.
00000DD0 | C12E AE06 67E2 0D9B BE3A C382 D7EE 1FF1 | ....g....:......
00000DE0 | 379C 5523 20C2 B140 0B30 DC72 E2FF 0113 | 7.U# ..@.0.r....
00000DF0 | 558F D90F 09B4 DCEB E599 F2E5 48A9 7AD5 | U...........H.z.
00000E00 | 4395 834B B754 6EA4 5FB6 3E14 E7E0 478B | C..K.Tn._.>...G.
00000E10 | 0E2C E01F B0F6 00BC 4C90 DBA0 6983 A603 | .,......L...i...
00000E20 | 8BB9 00FD E0A6 24EF F36D 40A0 D03D 1F36 | ......$..m@..=.6
00000E30 | 8B8D 494A 2054 AB61 B748 A8BE 88E2 0298 | ..IJ T.a.H......
00000E40 | 093B 1544 9EC1 9DFC 26F0 6C86 9F5F 259F | .;.D....&.l.._%.
00000E50 | 24C4 685A 14E8 7314 AA79 7173 ABE8 AF69 | $.hZ..s..yqs...i
00000E60 | B5E2 5832 E2B7 3491 6FBC 8B66 1B94 9CFE | ..X2..4.o..f....
00000E70 | 2555 E726 8144 077C 1DB2 B822 AE43 40AB | %U.&.D.|...".C@.
00000E80 | 3F1F 6ECF 87EA 46A4 BE19 5155 AF98 B04B | ?.n...F...QU...K
00000E90 | 14F5 6908 4BB5 F535 94ED 4BFE C82C ED2D | ..i.K..5..K..,.-
00000EA0 | 3D3D 14E1 2833 1105 88D3 1AC9 E958 4A69 | ==..(3.......XJi
00000EB0 | 581C CD0F 2D15 F933 5F60 2584 D959 05BD | X...-..3_`%..Y..
00000EC0 | 2A4E 7B83 0E5D D18A 6E87 9BFA 4D0B 4D59 | *N{..]..n...M.MY
00000ED0 | 824B 2F00 07C2 1853 F808 9303 2E13 076D | .K/....S.......m
00000EE0 | 27EC 2077 6DB7 23AD 79B5 6846 D500 002A | '. wm.#.y.hF...*
00000EF0 | D332 57D2 836B 1994 76C1 9347 35B6 BEB1 | .2W..k..v..G5...
00000F00 | F520 5338 950F E030 2D4B 4E94 9085 CF03 | . S8...0-KN.....
00000F10 | 775B 15D7 1359 C1FF FA21 52E8 5910 B620 | w[...Y...!R.Y..
00000F20 | DBDB EC6A F225 33C0 F52F 79F9 DCA0 0E0F | ...j.%3../y.....
00000F30 | 3466 4920 3D95 1E4A 3802 3EFC 40A4 F249 | 4fI =..J8.>.@..I
00000F40 | FA53 170E 444D ED18 051C 982A C17B 6D76 | .S..DM.....*.{mv
00000F50 | 6288 247E 6BF3 27A0 CCB5 AEBA 6747 FDAE | b.$~k.'.....gG..
00000F60 | AD52 F300 9C6D 69BC B3C9 5B6A 929A 5215 | .R...mi...[j..R.
00000F70 | 0FBC B362 AE3B 1BC2 9DF9 D4CC 8C74 7863 | ...b.;.......txc
00000F80 | 62E4 AB3B 9701 4B15 22B6 F39A 5531 C873 | b..;..K."...U1.s
00000F90 | 4EBA 2E9C 86E7 44E8 C11D B37F 757A 48B1 | N.....D.....uzH.
00000FA0 | 0724 EA0F 5984 FF7A C791 2796 5439 5521 | .$..Y..z..'.T9U!
00000FB0 | 7CC1 A70F 880F E7EE 9514 16E6 BBF9 5A4A | |.............ZJ
00000FC0 | C4B8 78C4 5FFB 976A 2A07 4990 986E B4E3 | ..x._..j*.I..n..
00000FD0 | 45A2 5EE7 A054 9DC7 1A3B B695 50EE E47D | E.^..T...;..P..}
00000FE0 | 8A9A CF31 E4FE 6366 E90C 1816 D3AF C8F0 | ...1..cf........
00000FF0 | 3A33 4780 46F9 F670 6EB5 DEF4 D68B 4F3D | :3G.F..pn.....O=

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.