ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 10 November 2009, 12:58:04
Processing time: 6 min 42 sec
Submitted sample:

File MD5: 0xF944117D58EE302318B1AF1C42DB1D43
File SHA-1: 0x3D8C11A03E29EAE1EDC85174A9A4EA6B0E206946
Filesize: 3,114,304 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\.#\MBX@3A0@14637C8.###	2,048 bytes	MD5: 0x07946BFB65276977DB5DD6E0A97FAA53 SHA-1: 0x043C718F3C61EA3991D1AE31ADE55442F15B915D
2	%AppData%\.#\MBX@3A0@14637D8.###	2,048 bytes	MD5: 0x00062BCB956254627904B9E5B7D48931 SHA-1: 0x8077DB91DC5B3F880185339544C098C8B717C3A0
3	%AppData%\.#\MBX@3A0@14637E8.###	2,048 bytes	MD5: 0xFBA0E9E6A999201341F255B14860A38F SHA-1: 0xB426A359CCA925FAF615F9EA5128BBDF0A2EA736
4	%AppData%\systemfl.$dk	990 bytes	MD5: 0xE4D3804FDC63C1A31C2DAC730D428036 SHA-1: 0x551E55E36961C19E7F06BD3E611E64963117C48B
5	%DesktopDir%\Folder Lock 6.lnk	742 bytes	MD5: 0xE4BAFF0821E15BD1986EE430EBF0676C SHA-1: 0xD76F67D742DB2F809527A4D4477E39B48C651BF7
6	%Programs%\Folder Lock 6\Folder Lock 6.lnk	1,640 bytes	MD5: 0x31673D3E77F8A1FA2F44E0B675836BA8 SHA-1: 0x6619CF5B73C4B6702BC35A58CD1817C3B46A14AE
7	%Programs%\Folder Lock 6\Uninstall Folder Lock 6.lnk	667 bytes	MD5: 0x99B5E050322EDE91F026B59BA3EF2676 SHA-1: 0xB7DAA43247A6DC0A23C9CA04298C3ED669BD4D9A
8	%Programs%\Folder Lock 6\User Guide.lnk	705 bytes	MD5: 0x56CFAEF8AE1FF3A8C5EA2C117A706E55 SHA-1: 0x5CAEBCFEA2F14C4C7774181ADF6FE53D6EF0A9C0
9	%ProgramFiles%\Folder Lock 6\FLContextMenu.dll	498,240 bytes	MD5: 0xD51EA8EA8C5463138A9C8E4EEFDBAA22 SHA-1: 0xCE16C7D89E40C44FF6A90076EDB9A05E4DF77B98
10	%ProgramFiles%\Folder Lock 6\flk-icon.ico %System%\flk-icon.ico	33,982 bytes	MD5: 0x617D890C9D27FFD0C9B492D221FE786D SHA-1: 0xB2063DD504490CC675983E78181EE9B84AF8CFAF
11	%ProgramFiles%\Folder Lock 6\Folder Lock 6.exe	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709
12	%ProgramFiles%\Folder Lock 6\help.chm	384,959 bytes	MD5: 0x96C1DF4D7D68229F84A6D4A9B9C646BA SHA-1: 0x4BD9431F813A32F1D1B132916E94A97D173A7BCA
13	%ProgramFiles%\Folder Lock 6\unins000.dat	11,496 bytes	MD5: 0x610445BBE9E33E42C7FAAC98463BDF40 SHA-1: 0x80711756800ED775F67D78EC04BCC2D41D1DB96A
14	%ProgramFiles%\Folder Lock 6\unins000.exe	751,898 bytes	MD5: 0x05035AB1E7919BF17628DD62113FCA07 SHA-1: 0x69245A93A1DE876943BC2B20DDC93014ED1C7119
15	c:\Sys_LogWin.log	345 bytes	MD5: 0x101257BEDD80C4F3AE58C9C44BBE9BCF SHA-1: 0x89AE90EE8A8FC416F74C9DD2BC745DFF79A55A6F
16	[file and pathname of the sample #1]	3,114,304 bytes	MD5: 0xF944117D58EE302318B1AF1C42DB1D43 SHA-1: 0x3D8C11A03E29EAE1EDC85174A9A4EA6B0E206946
17	%System%\sys_drv.dat	6,024 bytes	MD5: 0x89EC1AE15DADEB595DC5EF46560910B8 SHA-1: 0x2AEB3EEEA60D2EB367583EDCFA2CBA30A5FE5861
18	%System%\sys_drv_2.dat	5,020 bytes	MD5: 0x86001B2A6B584DA0C11892118638C7C0 SHA-1: 0xDFC6825664BCCBDBA835C9557DA7D53234AAD658
19	%System%\WinFLdrv.sys	10,752 bytes	MD5: 0x7575AB6902C3F321D62A8E5A7E4F55A9 SHA-1: 0x13CF9F6C8A5EB91B7DA7BEFABD36AFB854D259B5
20	%System%\WinFLsrv.exe	7,680 bytes	MD5: 0x0C409514F73F81D849B96BF9D5BB32F0 SHA-1: 0x2FC974EBDE86554FBDCFBAC69AC041B287066762
21	%System%\WinVd32.sys	180,224 bytes	MD5: 0x58997182304759F46902A62128D44D5C SHA-1: 0xA1C78962E0C29C0B4F13CCAEAD00257D0D7E6DC7

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following directories were created:

%AppData%\.#
%Programs%\Folder Lock 6
%ProgramFiles%\Folder Lock 6

Memory Modifications

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
MBX@3A0@14637D8.###	%AppData%\.#\MBX@3A0@14637D8.###	Process name: Folder Lock 6.exe Process filename: %ProgramFiles%\folder lock 6\folder lock 6.exe Address space: 0x10000000 - 0x1007C000
MBX@3A0@14637E8.###	%AppData%\.#\MBX@3A0@14637E8.###	Process name: Folder Lock 6.exe Process filename: %ProgramFiles%\folder lock 6\folder lock 6.exe Address space: 0x1670000 - 0x167F000
MBX@3A0@14637C8.###	%AppData%\.#\MBX@3A0@14637C8.###	Process name: Folder Lock 6.exe Process filename: %ProgramFiles%\folder lock 6\folder lock 6.exe Address space: 0x1890000 - 0x18EE000

There were new kernel-mode drivers installed in the system:

Driver Name	Driver Filename
WinFLdrv.sys	%System%\winfldrv.sys
WinVd32.sys	%System%\winvd32.sys

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.flk
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flkfile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flkfile\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flkfile\Shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flkfile\Shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flkfile\Shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\VersionNumber
HKEY_LOCAL_MACHINE\SOFTWARE\FolderLock6
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINFLDRV
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINFLDRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINFLDRV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINVD32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINVD32\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINVD32\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Instances
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Instances\WinFLdrvFltr
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVd32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVd32\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVd32\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINFLDRV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINFLDRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINFLDRV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINVD32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINVD32\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINVD32\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Instances
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Instances\WinFLdrvFltr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVd32
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVd32\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVd32\Enum
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellBox
HKEY_CURRENT_USER\Software\Classes\Interface\{f3fc950c-7583-4377-bad8-efbeaa33273c}
HKEY_CURRENT_USER\Software\Classes\Interface\{f3fc950c-7583-4377-bad8-efbeaa33273c}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\FolderLock6

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.flk]

(Default) = "flkfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flkfile\Shell\open\command]

(Default) = "%ProgramFiles%\folder lock 6\folder lock 6.exe /OpenInNewWindow "%1""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\flkfile\DefaultIcon]

(Default) = "%ProgramFiles%\folder lock 6\flk-icon.ico"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\VersionNumber]

VersionNumber = "B83A4A96543A540C3EA80C301ACCC482BAC26C8CBAFA6E9E100844007EFEDCBE"

[HKEY_LOCAL_MACHINE\SOFTWARE\FolderLock6]

ExePath = "%ProgramFiles%\Folder Lock 6\Folder Lock 6.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\GroupOrderList]

FSFilter Monitoring = 01 00 00 00 01 00 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINFLDRV\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinFLdrv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINFLDRV\0000]

Service = "WinFLdrv"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "WinFLdrv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINFLDRV]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINVD32\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinVd32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINVD32\0000]

Service = "WinVd32"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "WinVd32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINVD32]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Instances\WinFLdrvFltr]

Altitude = "370000"
Flags = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Enum]

0 = "Root\LEGACY_WINFLDRV\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv\Instances]

DefaultInstance = "WinFLdrvFltr"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinFLdrv]

Type = 0x00000002
Start = 0x00000002
ErrorControl = 0x00000001
Tag = 0x00000001
ImagePath = "system32\WinFLdrv.sys"
DisplayName = "WinFLdrv"
Group = "FSFilter Monitoring"
DependOnService = "FltMgr"
DependOnGroup = 00
Description = "WinFL Filter driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVd32\Enum]

0 = "Root\LEGACY_WINVD32\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVd32\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinVd32]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\WinVd32.sys"
DisplayName = "WinVd32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderList]

FSFilter Monitoring = 01 00 00 00 01 00 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINFLDRV\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinFLdrv"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINFLDRV\0000]

Service = "WinFLdrv"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "WinFLdrv"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINFLDRV]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINVD32\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "WinVd32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINVD32\0000]

Service = "WinVd32"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "WinVd32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINVD32]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Instances\WinFLdrvFltr]

Altitude = "370000"
Flags = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Enum]

0 = "Root\LEGACY_WINFLDRV\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv\Instances]

DefaultInstance = "WinFLdrvFltr"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinFLdrv]

Type = 0x00000002
Start = 0x00000002
ErrorControl = 0x00000001
Tag = 0x00000001
ImagePath = "system32\WinFLdrv.sys"
DisplayName = "WinFLdrv"
Group = "FSFilter Monitoring"
DependOnService = "FltMgr"
DependOnGroup = 00
Description = "WinFL Filter driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVd32\Enum]

0 = "Root\LEGACY_WINVD32\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVd32\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinVd32]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000000
ImagePath = "%System%\WinVd32.sys"
DisplayName = "WinVd32"

[HKEY_CURRENT_USER\Software\Classes\Interface\{f3fc950c-7583-4377-bad8-efbeaa33273c}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_CURRENT_USER\Software\FolderLock6]

SetupSrc = "[file and pathname of the sample #1]"
DriverStatus = "1"
UnInstaller = "%ProgramFiles%\Folder Lock 6\unins000.exe"
VDEStatus = "1"
Language = ""
ShowTaskbar = "1"
ShowSysTray = "1"
PlaySound = "1"
Deleteable = "1"
ContextMenu = "1"
Shred = "0"
Copy = "0"
HCleanAll = "1"
HClipBoard = "1"
HFinds = "1"
HRecentDoc = "1"
HCleanMore = "0"
LockPc = "1"
ShutDownPc = "0"
Monitoring = "1"
Auto_on_off = "0"
Alwaysremember = "0"
Onlynow = "0"
Idletime = "0"
StealthAll = "0"
SContext = "0"
SShortCut = "0"
SUninstall = "0"
HideinPro = "0"
Hotkey = "F"

Other details

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
67.222.47.38	80
72.52.249.53	80
74.125.95.102	80

The data identified by the following URLs was then requested from the remote web server:

http://www.password-protect-folders.net/buyfl.php?linkid=_1
http://www.newsoftwares.net/images/tab_2.png
http://www.newsoftwares.net/images/tab_2_select.png
http://www.newsoftwares.net/images/tab_2_RO.png
http://www.newsoftwares.net/images/tab_3.png
http://www.newsoftwares.net/images/tab_3_select.png
http://www.newsoftwares.net/images/tab_3_RO.png
http://www.newsoftwares.net/images/tab_4.png
http://www.newsoftwares.net/images/tab_4_select.png
http://www.newsoftwares.net/images/tab_4_RO.png
http://www.newsoftwares.net/images/tab_5.png
http://www.newsoftwares.net/folderlock/?linkid=_1
http://www.newsoftwares.net/images/tab_5_select.png
http://www.newsoftwares.net/images/tab_5_RO.png
http://www.newsoftwares.net/images/tab_6.png
http://www.newsoftwares.net/script/tour.js
http://www.newsoftwares.net/images/tab_1.png
http://www.newsoftwares.net/images/tab_1_select.png
http://www.newsoftwares.net/images/tab_1_RO.png
http://www.google-analytics.com/urchin.js

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.