bogusBeginningHexDump

bogusBeginningHexDump

Figure 4 - uploadpref.dat header taken from the malicious preference file