Microsoft Word - cover.doc

Transcription

1 効率的な解析を目的とした 自動マルウェア分類に関する研究 Automatic malware classification for efficient analysis 2012 年 2 月 岩村誠

2

3 効率的な解析を目的とした 自動マルウェア分類に関する研究 Automatic malware classification for efficient analysis 2012 年 2 月 早稲田大学大学院基幹理工学研究科 情報理工学専攻情報構造研究 岩村誠

4

5 i

6 ii LCS( ) LCS A B C

7 iii xFF, 0x15/0x

8

9 v VirtualProtect Forward Backward E n x,y PTE XDbit I/O getversion vmware-vmx.exe VMXh IDTR LDTR

10 vi 2.21 Intel VT notepad.exe E n Viterbi DP M A CD Conficker.B C C 95% C 90% C 50% C 20% IMAGE DOS HEADER IMAGE NT HEADERS IMAGE OPTIONAL HEADER IMAGE DATA DIRECTORY IMAGE OPTIONAL HEADER IMAGE IMPORT DESCRIPTOR IMAGE RELOCATION IMAGE RELOCATION Type

11 vii

12

13 ix MCC (%) of dataset (A) MCC (%) of dataset (B) MCC (%) of dataset (C) Ratios (%) of true and false positives/negatives to all obfuscated bytes Disassembly accuracy (%) Disassembly accuracy (%) for one-program training Disassembly accuracy (%) for one-program training Disassembly times (%), Od (%), Ox sdbot diff (%) sdbot05b (%)

14 x x x15FF x25FF

15 Malicious Software DDoS Distributed Denial of Service [1] [2 4] [5] C C++

16 2 1 [6] 90% [7] 1.3 [8 14] [15 28]

17 1.3 3 N-gram [16] N N-gram [17] [18] N-gram C++

18 4 1 [29] N-gram/N-perm N-gram/N-perm N-gram/N-perm N-gram/N-perm IA-32 Windows

19 ,53687:93;=<?> ')(*,+.-0/132 S=T07:93;=<?> H0IAU:V=W -! X0YAZ0[ H0I FAG J KALNM,O:P0Q3R 1.1 LCS Longest Common Subsequence LCS IAT Import Address Table IAT 1.1

20 IAT 7

21 & [7] 2.1./ '(87 /:9; (57 '()+*-, "!#%$ <=3> '(57 /:9; (57 2.1

22 # # * + - *,+ % & ')( * +! " # $! " # IAT(Import Address Table) [30] 3. OEP Original Entry Point OS 2.3 PEiD [31]

23 2.3 9 [32] [33 39] OS OllyBonE [33] Universal PE Unpacker [34] Renovo [35] Pandora s Bochs [36] Saffron [37] Renovo TEMU [40] Pandora s Bochs Renovo Saffron OS PTE (Page Table Entry) User accessible PTE TLB (Translation Lookaside Buffer) IA-32 [41] TLB PTE Saffron PTE User accessible TLB User accessible

24 10 2 OEP OEP 2.4 PE PE IA-32 [41] Windows [42]

25 VirtualAlloc [43] 1 1 state, protect, type CPU IA-32 4KB 2MB 1 Allocation range OEP Memory region VirtualProtect [44] Memory page [45] PAGE EXECUTE READ PAGE EXECUTE READWRITE 2.3 OEP Memory region (PAGE_EXECUTE_READ) VirtualProtect Memory region (PAGE_EXECUTE_READ) Memory region (PAGE_EXECUTE_READWRITE) 2.3 VirtualProtect VirtualAlloc OEP

26 12 2 Windows OEP IA-32 [46] 2.4 OEP

27 IA-32 IA-32 Windows *1 OS HMM: Hidden Markov Model [47] HMM HMM *1 /

28 14 2 Visual C++ Delphi 2.5 Start Data 2.5 Instruction 1 1 Data Instruction Data Instruction IA-32 6 Prefix 0 4 Prefix Prefix Prefix Opcode 1 3

29 Opcode ModR/M 0 1 ModR/M Opcode SIB 0 1 SIB Scale Index BaseOpcode Mod R/M Displacement 0 4 Displacement Opcode Immediate 0 4 Immediate Opcode Prefix 11 Opcode Visual C++ Delphi Visual C++ Delphi Visual C++

30 16 2 Start of instruction Prefix Opcode1 Opcode2 ModR/M SIB Displacement End of instruction Immediate 2.6 Forward/Backword [47] *2 0xEB, 0x01, 0xFF, 0xC3 * 3 0xEB 0xEB,0x01 2 ADD EDI,EDI 2 0x01 0xEB 2 0x *2 [48] *3 16 0x

31 Input byte sequence 0xEB 0x01 0xFF 0xC3 JMP SHORT xEB,0x01 Instruction state ADD EDI,EDI 0x01,0xFF Initial state INC EBX 0xFF,0xC3 Last state RETN 0xC3 <DATA> 0xEB <DATA> 0x01 <DATA> 0xFF <DATA> 0xC3 Data state Forward/Backward Forward N: X = x 1 x N : x 1 x n x n 1 S = {S B, S I, S D, S F, S M }: HMM S B S I S D S F S M 2 L = l 1 l N : x i (1 i N) l 0 = S B, l N+1 = S F

32 18 2 const InsnState = 0; const DataState = 1; var matrix : array[number of states,number of symbols]; var laststate; {special state for last instructions or last data} var startaddr; {first symbol address} var endaddr; {last symbol address} var insn; {decoded instruction} var addr; {counter} procedure generatematrix(); begin for addr := startaddr to endaddr do begin insn := decodeinstruction(addr); {decode instruction at addr} if isvalid(insn) = true then {insn is a valid instruction.} if addr + length(insn) <= endaddr then begin matrix[insnstate, addr + length(insn)].previous.push( InsnState,addr); matrix[datastate, addr + length(insn)].previous.push( InsnState,addr); end else laststate.previous.push(insnstate,addr); end; end; if addr + 1 <= endaddr then begin matrix[insnstate, addr + 1].previous.push(DataState,addr); matrix[datastate, addr + 1].previous.push(DataState,addr); end else laststate.previous.push(datastate,addr); end; end; end. 2.8 w s,n : s x n w s,n w s,n w s,n x n+ w s,n 1 n a s,s : s s b s,n : s w s,n a s,s b s,n

33 a s,s b s,n θ Forward θ X P (X θ) P (X θ) P (X θ) X P (X θ) = P (X, L θ) (2.1) alll = alll P (L θ)p (X L, θ) (2.2) P (L θ) P (X L, θ) P (L θ) P (l n l n 1, θ) (2.3) 1 n N,l n S M P (X L, θ) P (w ln,n l n, θ) (2.4) 1 n N,l n S M P (X θ) P (X θ) alll 1 n N,l n C P (l n l n 1, θ)p (w ln,n l n, θ) (2.5) L O(N2 N ) O(N) Forward x n 1 1 l n s F (n, s) F (1, S I ) = a SB,S I

34 20 2 Input byte sequence 0xEB 0x01 0xFF 0xC3 JMP SHORT xEB,0x01 Instruction state ADD EDI,EDI 0x01,0xFF Initial state INC EBX 0xFF,0xC3 Last state RETN 0xC3 <DATA> 0xEB <DATA> 0x01 <DATA> 0xFF <DATA> 0xC3 Data state 2.9 Forward F (1, S D ) = a SB,S D F (n, s) F (n, s) = P (x n 1 1, l n = s θ) = = s,n :n + w s,n =n 1 s,n :n + w s,n =n 1 s,n :n + w s,n =n 1 s,n :n + w s,n =n 1 s,n :n + w s,n =n 1 P (x n 1 1, w s,n, l n = s, l n = s θ) P (x n 1 1, l n = s θ)p (l n = s, w s,n xn 1 1, l n = s, θ) P (x n 1 1, l n = s θ)p (l n = s l n = s, θ)p (w s,n l n = s, θ) F (n, s )P (l n = s l n = s, θ)p (w s,n l n = s, θ) F (n, s )a s,sb s,n F (1, S I ), F (1, S D ), F (2, S I ),... F (N + 1, S F ) P (X θ) X = (0xEB, 0x01, 0xF F, 0xC3) 2.9 F (1, S I ), F (1, S D ), F (2, S I ),...

35 F (5, S F ) P (X θ) l n = s x N n B(n, s) B(n, s) B(n, s) = P (x N n l n = s, θ) = s,n :s S,n =n+ w s,n s,n :s S,n =n+ w s,n s,n :s S,n =n+ w s,n s,n :s S,n =n+ w s,n s,n :s S,n =n+ w s,n s,n :s S,n =n+ w s,n P (w s,n, x N n, l n = s l n = s, θ) P (w s,n l n = s, θ)p (x N n, l n = s l n = s, θ) P (w s,n l n = s, θ)p (l n = s l n = s, θ)p (x N n l n = s, l n = s, θ) P (w s,n l n = s, θ)p (l n = s l n = s, θ)p (x N n l n = s, θ) P (w s,n l n = s, θ)p (l n = s l n = s, θ)b(n, s ) b s,n a s,s B(n, s ) B(N, S I ), B(N, S D ), B(N 1, S I ),... P (X θ) = B(0, S B ) 2.10 Backward X θ l n = s P (l n = s X, θ) P (l n = s X, θ) = P (X, l n = s θ) P (X θ) P (X θ) Forward/Backward P (X, l n = s θ) = P (x n 1 1, x N n, l n = s θ) = P (x n 1 1, l n = s θ)p (x N n x n 1 1, l n = s, θ) P (x n 1 1, l n = s θ)p (x N n l n = s, θ) P (x n 1 1, l n = s θ) P (x N n l n = s, θ) F (n, s) B(n, s) P (l n = s X, θ) P (l n = s X, θ) F (n, s)b(n, s) F (N + 1, S F )

36 22 2 Input byte sequence 0xEB 0x01 0xFF 0xC3 JMP SHORT xEB,0x01 Instruction state ADD EDI,EDI 0x01,0xFF Initial state INC EBX 0xFF,0xC3 Last state RETN 0xC3 <DATA> 0xEB <DATA> 0x01 <DATA> 0xFF <DATA> 0xC3 Data state 2.10 Backward X x i x j X (i, j) J X X (i, j) J X P (l i = S I, l j = S I X, θ) x i x j P (l i = S I, l j = S I X, θ) P (l i = S I, l j = S I X, θ) P (l i = S I X, θ)p (l j = S I X, θ)

37 x n E n E n = P (l i = S I X, θ)p (l j = S I X, θ) (i,j) J X :i n j+ w SI,j 1 j n i+ w SI,i 1 OEP E n x y k OEP ɛ { p 0 if {p p < k, E p < ɛ} = φ, = max{p p < k, E p < ɛ} otherwise. { q 0 if {q q < k, E q < ɛ E q 1 } = φ, = max{q q < k, E q < ɛ E q 1 } otherwise. x = p + q { 2 r N 1 if {r k < r, E r < ɛ} = φ, = min{r k < r, E r < ɛ} otherwise. { s N 1 if {s k < s, E s < ɛ E s+1 } = φ, = min{s k < s, E s < ɛ E s+1 } otherwise. y = r + s p, r OEP E n < ɛ q, s ɛ E n OEP x y p, q r, s OEP 2.5

38 24 2 E n ε 0 q* x p* k r* y s* 2.11 E n x,y Offset 2.5 Forward P (X θ) θ X θ P (X θ) P (X) *4 P (X M θ) P (X) 1 1 *4 P (X) = N

39 x i x j X (i, j) J X (i, j) l i S I l j = S I F i,j X P (X, F i,j θ) (i,j) J X = P (X θ)p ( F i,j X, θ) (i,j) J X P (X θ)p ( F i,j X, θ) (i,j) J X P (X θ) P (l i S I or l j = S I X, θ) (i,j) J X P (X θ) 1 P (l i = S I X, θ)p (l j S I X, θ) (i,j) J X P (l i X, θ) Forward/Backward

40 26 2 P (X θ) (i,j) J X 1 P (l i = S I X, θ)p (l j S I X, θ) P (X) PC PC Saffron 2.12 Saffron Saffron PTE User accessible TLB User accessible

41 TLB VMware [49] TLB [50] TLB Saffron PTE User accessible TLB PTE writable-bit 0 PTE XDbit [51] PAE(Physical Address Extensions) MSR Model-Specific Registers 11 [52] PTE PTE writable-bit 0 writable-bit 0 XDbit 1

42 PTE XDbit TLB TLB VMware Saffron OEP 3

43 OEP 2.6.3

44 30 2 VMware [49] VMware I/O VMware OS OS I/O VMware 2.18 Elias Bachaalany *5 VMware VMware I/O EAX VMXh ECX EBX DX VX IN in eax, dx 2.18 VMWare 10 ECX VMware IN EBX VMXh EAX ECX 2.18 EBX VMXh VMware PC IN IsInsideVMWare false vmx 2.16 IN EBX EAX ECX IN 2.17 *5 Detect if your program is running inside a Virtual Machine, system/vmdetect.aspx

45 bool IsInsideVMWare() { bool rc = true; try { asm { push edx push ecx push ebx mov eax, VMXh mov ebx, 0 // any value but not the MAGIC VALUE mov ecx, 10 // get VMWare version mov edx, VX // port number in eax, dx // read port // on return EAX returns the VERSION cmp ebx, VMXh // is it a reply from VMWare? setz [rc] // set return value pop ebx pop ecx pop edx } } except(exception_execute_handler) { rc = false; } return rc; } 2.15 I/O isolation.tools.getversion.disable = "TRUE" 2.16 getversion IN VMware VMware PC vmware-vmx.exe OS IN I/O EAX VMXh jz NOP 0x90 IN

46 32 2 bool IsInsideVMWareEx() { try { asm { push edx push ecx push ebx mov eax, VMXh mov ebx, 0 // any value but not the MAGIC VALUE mov ecx, 10 // get VMWare version mov edx, VX // port number in eax, dx // read port // on return EAX returns the VERSION pop ebx pop ecx pop edx } } except(exception_execute_handler) { rc = false; } return true; } 2.17 cmp large dword ptr ds:0d018h, VMXh jz loc_7cf2ff 2.18 vmware-vmx.exe VMXh ITDR LDTR IA-32 IDT Interrupt Descriptor Table IDT CPU IDTR IDT Register IDTR SIDT 2.19 IDT IDTR 6 4 IDT IDT

47 DWORD getidtaddr() { UCHAR idtr[6]; asm sidt idtr; return *(DWORD*)&idtr[2]; } 2.19 IDTR declspec(naked) USHORT getldtselector() { asm{ sldt ax ret } } 2.20 LDTR monitor_control.vt32 = "TRUE" 2.21 Intel VT PC VMware LDT Local Descriptor Table VMware LDT PC LDT 2.20 getldtselector PC 0x0000 VMware 0 IDTR LDTR PC PC VMware Intel VT vmx 2.21

48 OEP OEP OEP Windows notepad.exe k kernel32.dll ,088 notepad.exe ,712 user32.dll , k notepad.exe HMM Firefox [53] Microsoft C++ Compiler(Ver ) xul.dll E n ɛ n 16 E n kernel32.dll, notepad.exe, user32.dll k OEP notepad.exe 0x000D7689 x y 2.22 x y notepad.exe

49 kernel32.dll code [0x00001DE8 0x000B4BFD] 6000 notepad.exe code [0x000D5400 0x000DDFE3] k(oep)=0x000d7689 x=0x000c4ffe y=0x000f1a12 user32.dll code [ A593] E n x x x x x x x x x x x000A0000 0x000B0000 0x000C0000 0x000D0000 0x000E0000 0x000F0000 0x x x x x x x x x x x001A0000 0x001B0000 0x001C Offset n dll p q E n x = p +q 2 notepad.exe E n 2.23 notepad.exe 0x000D5400 E n > ɛ p 0x00D5404 0x x x x x x nop nop nop nop nop 0x mov edi, edi 0x push ebp 0x000D5405 WinMain [54] WinMainCRTStartup [55]

50 36 2 notepad.exe code [0x000D5400 0x000DDFE3] p*=0x000d ε= E n x000D53FE 0x000D53FF 0x000D5400 0x000D5401 0x000D5402 0x000D5403 0x000D5404 0x000D5405 0x000D5406 0x000D5407 Offset n 2.23 notepad.exe E n C 0x000D5405 E n 1 0x00D5400 0x00D WinMain [56] NOP 0x00D5400 0x00D E n 0 p kernel32.dll E n 2.24 kernel32.dll 0x000B4BFD E n > ɛ q 0x00B4BF9 0x000B4BF8 0x000B4BF8 pop edi 0x000B4BF9 pop esi 0x000B4BFA leave

51 E n x000B4BF6 ε=0.5 0x000B4BF x000B4BF8 q*=0x000b4bf9 0x000B4BF9 0x000B4BFA 0x000B4BFB Offset n 0x000B4BFC kernel32.dll code [0x00001DE8 0x000B4BFD] 0x000B4BFD 0x000B4BFE 0x000B4BFF 0x000B4C00 0x000B4BFB retn 8 kernel32.dll 0x000B4BF8 retn E n 0 q kernel32.dll x = p +q 2 1. OEP k E k ɛ 2. PE

52 E n ɛ OEP E k ɛ OEP E k < ɛ OEP E n ɛ OEP OEP E n ɛ 2.22 E k < ɛ PE E n ɛ ɛ CCC DATAset 2008 Firefox Microsoft C++ Compiler Ver

53 HMM 2.2 xul.dll * OS OS Windows XP SP3 CPU Intel Xeon 2.66GHz 3GB VMware Server OS Windows XP SP1 CPU 1 512MB (*1) 0 (*1) 0 *6 Firefox ( 8.5MB)

54 PID=364H 1.00E E+04 (*1) Logarithm of Likelihood Ratio 0.00E E E E E E E E E+05 Time (sec) PID=364h PID=5C0h PID=4F0h PID=400h

55 OEP OEP OEP OEP TLB

56

57 [57 59] [60 62] [63] IA-32 Windows (IA-32) Windows 3.2

58 44 3 [64] [65, 66] [67] Linear sweep GNU objdump [68] Recursive traversal [66] Linear sweep jmp ret Recursive traversal Recursive traversal Speculative disassembly [69] Recursive traversal Linear sweep Linear sweep BIRD [67] Recursive traversal Exhaustive disassembly [65] Recursive traversal

59 Linear sweep Speculative disassembly Recursive traversal BIRD Recursive traversal N: X = x 1 x N : x 1 x n x n 1 S = {S B, S I, S D, S F, S M }: HMM S B S I S D S F S M 2 L = l 1 l N : x i (1 i N) l 0 = S B, l N+1 = S F w s,n : s x n w s,n w s,n

60 46 3 w s,n x n+ w s,n 1 n a s,s : s s b s,n : s w s,n Forward θ a s,s b s,n X P (X θ) Viterbi [70] θ argmax P (X, L θ) L l n 1 1 x n 1 1 x n s l n = s V (n, s) V (n, s) V (n, s) = max P (x n 1 1, l n 1 1, l n = s θ) 1 = max P s,n :n + w s,n =n 1 (xn 1, l n 1 1, w s,n, l n = s, l n = s θ) 1 = max P s,n :n + w s,n =n 1 (xn 1, l n 1 1, l n = s θ)p (w s,n, l n = s x n 1 1, l n 1 1, l n = s, θ) max V s,n :n + w s,n =n 1 (n, s )P (w s,n l n = s, θ)p (l n = s l n = s, θ) max s,n :n + w s,n =n 1 V (n, s )b s,n a s,s Forward V (1, S I ), V (1, S D ), V (2, S I ),... V (N + 1, S F ) max P (X, L θ) s, n argmax P (X, L θ) L argmax P (X, L θ) L θ X = (0xEB, 0x01, 0xF F, 0xC3) 3.1 V (1, S I ), V (1, S D ), V (2, S I ),... V (5, S F ) max P (X, L θ) 3.1 V (5, S F ) V (4, S I ), V (3, S D ), V (1, S I ) argmax L P (X, L θ)

61 Input byte sequence 0xEB 0x01 0xFF 0xC3 JMP SHORT xEB,0x01 Instruction state ADD EDI,EDI 0x01,0xFF Initial state INC EBX 0xFF,0xC3 Last state RETN 0xC3 <DATA> 0xEB <DATA> 0x01 <DATA> 0xFF <DATA> 0xC3 Data state 3.1 Viterbi (A)(B)(C) (A) (B) Visual C Express Edition [71] 8 [72 79] (A) (B) (A) (B) /Ox (C) Popov [80] SPECint-2000 [81] 10 (A)(B) 7 (C) 9 (PD) LS

62 48 3 IDA Pro4.9(IP) [82] MCC Matthews correlation coefficient [83] MCC = T p T n F p F n (Tp + F p )(T p + F n )(T n + F p )(T n + F n ). T p T n True positive True negative F p F n False positive False negative MCC 0% 100% True positive True negative 2 False positive False negative (A) 3.1 IDA Pro Program LS IP PD SpeakFreely analog lame make ncftp xpdf 3.00 (pdftops.exe) putty for Win TightVNC (vncviewer.exe) Mean MCC (%) of dataset (A).

63 % 95% Program LS IP PD SpeakFreely analog lame make ncftp xpdf 3.00 (pdftops.exe) putty for Win TightVNC (vncviewer.exe) Mean MCC (%) of dataset (B). 3.2 B IDA Pro IDA Pro (A) (C) Popov 3.3 IDA Pro (A)(B)

64 50 3 Program LS IP PD bzip crafty gap gcc gzip mcf parser perlbmk twolf vortex vpr Mean MCC (%) of dataset (C). Popov 90% 3.4 (C) True/False negative/positive False Program Linear sweep IDA Pro Our tool T p T n F p F n Ratios (%) of true and false positives/negatives to all obfuscated bytes. positive/negative (C) Linn

65 Dabray Confusion factor(cf) [48] V O CF CF = V O. V Kruegel [65] DA DA = 1 CF DA (C) 3.5 Program Linear sweep IDA Pro Our tool bzip crafty gap gcc gzip mcf parser perlbmk twolf vortex vpr Geom.mean Disassembly accuracy (%). IDA Pro 55% 45% 86% Popov [80] Kruegel Exhaustive disassembler [65] (C) DA 50%

66 52 3 Program bzip2 crafty gap gcc gzip mcf bzip crafty gap gcc gzip mcf parser perlbmk twolf vortex vpr Geom.mean Disassembly accuracy (%) for one-program training. Program parser perlbmk twolf vortex vpr bzip crafty gap gcc gzip mcf parser perlbmk twolf vortex vpr Geom.mean Disassembly accuracy (%) for one-program training.

67 crafty 85.38% vortex 76.04% CPU 3.2-GHz Pentium IV 2GB 3.8 Viterbi Program Size (bytes) Time (s) Throughput (KB/s) mcf 624, bzip2 694, gzip 704, vpr 805, parser 838, crafty 908, twolf 936, gap 1,356, vortex 1,518, perlbmk 1,612, gcc 3,051, Mean 1,186, Disassembly times. N O(N) KB/s

68 PE Windows Linear sweep Exhaustive disassembly

69 N-gram [16] N N-gram N-gram N N-gram N-perm N-gram/N-perm

70 56 4 [17] [18] IAT(Import Address Table) N-gram/N-perm C++ N-gram/N-perm N-gram/N-perm

71 4.3 LCS( ) 57 N-gram/N-perm N-gram/N-perm 2 IAT 2 2 LCS Longest Common Subsequence 4.3 LCS( ) 1 2 LCS [84] LCS 2 dbca bdca LCS dca bca LCS 2 M, N O(MN) LCS [84] 2 S = s m 1, T = t n 1 S T LCS L(sm 1, t n 1 ) LCS i = 0 or j = 0 0 L(s i 1, t j 1 ) = s i = t j L(s i 1 1, t j 1 1 ) + 1 (4.1) s i t j max(l(s i 1, t j 1 1 ), L(s i 1 1, t j 1 )) O(MN) LCS S, T LCS DP S = dbca, T = bdca

72 58 4 DP 4.1 b d c a d b c a DP 100,000 LCS 4.4 LCS Crochemore [85] LCS DP 1 and, or, not add S = dbca, T = bdca 2 T S M 4.2 a b c d d b c a M LCS { j = V j = 1 j n (V j 1 + (V j 1 &M yj )) (V j 1 &M y j ) (4.2)

73 DP 4 IA-32 [41] SSE2 [86] andnot/or 128 add 64 1 M IA IA-32 6 Prefix 0 4 Prefix Prefix Prefix Opcode 1 3 Opcode ModR/M 0 1 ModR/M Opcode SIB 0 1

74 60 4 SIB Scale Index BaseOpcode Mod R/M Displacement 0 4 Displacement Opcode Immediate 0 4 Immediate Opcode Prefix1 Prefix Prefix1 Prefix2 Prefix3 Prefix4 O p c o d e L en. O p c o d e M o d R / M SIB 4.3 Opcode Len Opcode 2 ModR/M SIB

75 ,000 8, MB *1 CPU A, B LCS L L S D L S = (4.3) A + B L D = 1 S (4.4) S A,B LCS Jaccard N-gram/N-perm N-gram/N-perm LCS LCS 100,000 LCS LCS SSE2 LCS 100 *1 100,000

76 LCS

77 VMware Windows XP Windows XP

78 ' ! "!$# % & (!$)$ % & * +,.-0/ % & * +, Windows XP

79 A,B,C A,B,C A CCC DATAset 2009 [87] 10 B SHA1 Windows XP SP0 C 2 3,233 SHA1 5.4 A CCC DATAset HASH F,84E9,1D ,CD91

80 66 5 D (1 S) HASH_DF75 HASH_68AC HASH_84E9.02 HASH_F8C1 HASH_D493 HASH_84E9.01 HASH_FDF3 HASH_1D23 HASH_393F HASH_84E9.00 HASH_7190 HASH_CD A F 84E9 S = CD91 S = 0.29 TCP 139/445

81 5.4 A IRC EnterCriticalSection API [88] LeaveCriticalSection API [89] IRC CD IRC EnterCriticalSection API LeaveCriticalSection API CD IRC CD91 API CD91 autorun.inf 7190 CD91

82 B 702 S Conficker.B Conficker.B++ [90] S 0.91 Conficker.B 446 Conficker.B Conficker.B Conficker.B++ LCS Conficker.B++ CreateNamedPipeA [91] 5.4 SRI International Conficker B C C % 50%(1593 ) % 5.5 Conficker [92] 50% Rahack [93] 25% Conficker 91% 3

83 5.6 C 69 seg000:009577f6 lea eax, [esp+1a8h+var_198] seg000:009577fa push eax seg000:009577fb push esi seg000:009577fc push esi seg000:009577fd push offset sub_ seg000: push esi seg000: push esi seg000: call ds:createthread seg000: a push eax seg000: b call ds:closehandle.. seg000: push ebp seg000: mov ebp, esp seg000: sub esp, 510h seg000: b push ebx seg000: c push esi seg000: d push edi seg000: e lea eax, [ebp+var_110] seg000: push 104h seg000: push eax seg000: a call sub_958d4e seg000: f mov edi, ds:createnamedpipea seg000: pop ecx seg000: pop ecx seg000: mov ebx, 3E8h seg000: c mov esi, 400h seg000: jmp short loc_ seg000: loc_959133: seg000: push 0 seg000: push [ebp+var_4] seg000: call ds:connectnamedpipe seg000: e mov [ebp+var_c], eax seg000: call ds:rtlgetlastwin32error seg000: cmp [ebp+var_c], 0 seg000: b jnz short loc_ seg000: d cmp eax, 217h 5.4 Conficker.B++

84 70 5 W32.Spybot.Worm_7661A Suspicious.MH690_FA215 Suspicious.MH690_E5F5D W32.IRCBot_D7584 Suspicious.MH690_D19BD Suspicious.MH690_D0B3D Suspicious.MH690_BA302 Suspicious.MH690_B7EC7 Suspicious.MH690_9D088 Suspicious.MH690_63F89 Suspicious.MH690_3E00C Suspicious.MH690_0C8ED Suspicious.MH690_2ED2F W32.Spybot.Worm_EDD2E W32.Spybot.Worm_B71EC W32.Spybot.Worm_B202C W32.Spybot.Worm_A8D2D W32.Spybot.Worm_6B04C W32.Spybot.Worm_50F47 W32.Spybot.Worm_5EFB9 W32.SillyFDC_CCCBA W32.Virut.W_1A707 W32.Virut.W_E645B W32.Virut.W_E6AD3 W32.Virut.W_8A643 W32.Virut.W_79FDF W32.Virut.W_79EB6 W32.Virut.W_0BF40 W32.Virut.W_171E9 W32.Virut.W_7ADEB W32.Virut.W_231B1 W32.Virut.W_9FB4E W32.Virut.W_07711 W32.Virut.W_B76C8 W32.Virut.W_76100 W32.Virut.W_CF15D W32.Virut.W_D8D8C W32.Virut.W_9A8BF Trojan.Horse_27360 W32.Virut.W_87BE3 W32.Virut.W_9042C W32.Virut.W_47650 W32.Virut.W_8E040 W32.Virut.W_FFD71 W32.Virut.W_DED6F W32.Virut.W_D41A6 W32.Virut.W_732D4 W32.Virut.W_1CD78 W32.Virut.W_005B5 W32.Spybot.Worm_0A157 W32.Virut.W_B86B1 W32.Virut.W_A3578 W32.Virut.W_15B81 W32.Virut.W_F2C32 W32.Spybot.Worm_E639F W32.Virut.W_E5111 W32.Virut.W_D9D08 W32.Virut.W_D4988 W32.Virut.W_C9470 W32.Virut.W_B44CB W32.Virut.W_A2BF4 W32.Virut.W_6BBE1 W32.Virut.W_6921B W32.Virut.W_555C0 W32.Virut.W_52F7B W32.Virut.W_2EEAA W32.Virut.W_2DEB8 W32.Virut.W_2312A W32.Virut.W_17F68 W32.Virut.W_0266E W32.Virut.W_14EA9 W32.Virut.W_2330E W32.Virut.W_7C34E W32.Virut.W_C490E W32.Virut.W_A77BC W32.Virut.W_5FEBD W32.Spybot.Worm_54B37 W32.Virut.W_47B84 W32.Virut.W_1268E W32.Virut.W_44419 W32.Virut.W_27B00 W32.Spybot.Worm_0DE18 W32.Virut.W_12B75 W32.Virut.W_CF2BA W32.Virut.W_42D6B W32.Virut.W_0F562 W32.Virut.W_E9CB0 W32.IRCBot_4E702 W32.IRCBot_77688 W32.SillyFDC_05C60 W32.Spybot.Worm_D5009 W32.IRCBot_F8F51 W32.IRCBot_6AC21 Backdoor.Trojan_7F023 W32.Spybot.Worm_FD119 Downloader_4F2AA W32.Spybot.Worm_5A4B4 W32.Spybot.Worm_15E02 W32.IRCBot_9AC70 W32.IRCBot_F7734 W32.IRCBot_BD466 W32.Spybot.Worm_C9897 W32.Spybot.Worm_666E6 W32.IRCBot_94852 W32.Spybot.Worm_E95F7 W32.Virut.W_2CF14 W32.Virut.W_D1668 Backdoor.Paproxy_93A28 W32.Spybot.Worm_DD45D Trojan.Horse_5409A W32.IRCBot_6189A W32.IRCBot_4FBAC W32.IRCBot_CFBBA Trojan.Horse_60E80 Backdoor.IRC.Bot_A0CD4 W32.Spybot.Worm_377C8 W32.Spybot.Worm_D32E3 W32.Spybot.Worm_B67DC Trojan.Horse_FB606 Trojan.Horse_F767C W32.IRCBot_86C06 Trojan.Horse_92BB2 W32.IRCBot_856A5 W32.Spybot.Worm_5291C Trojan.Horse_5FAB0 W32.IRCBot_26D12 Trojan.Horse_C4ECF W32.IRCBot_8DF6E W32.IRCBot_818BD W32.IRCBot_105CB Trojan.Horse_76463 W32.IRCBot_6E3B9 W32.IRCBot_F7796 W32.IRCBot_ECFC8 Backdoor.IRC.Bot_EB97C W32.IRCBot_EA8AB Trojan.Horse_DE154 W32.IRCBot_B3553 UNKNOWN_73B27 W32.IRCBot_5BC23 W32.IRCBot_3AF8F W32.IRCBot_245CB W32.IRCBot_32B94 W32.Spybot.Worm_B2281 W32.IRCBot_D7358 Trojan.Horse_C0A4D Trojan.Horse_BAF7C W32.IRCBot_B2A82 Backdoor.IRC.Bot_25170 Trojan.Horse_7CB0E W32.IRCBot_FEED9 Trojan.Horse_58AFD Trojan.Horse_96E36 Backdoor.IRC.Bot_53866 W32.IRCBot_FE955 W32.IRCBot_DE9CE W32.IRCBot_BEE3B W32.IRCBot_BD377 Trojan.Horse_8EF19 Trojan.Horse_80651 Backdoor.IRC.Bot_3DE45 W32.IRCBot_6C88B Trojan.Startpage_2B15E W32.IRCBot.Gen_DAA38 Trojan.Horse_A07C1 Trojan.Startpage_7971A W32.IRCBot_6DD56 Backdoor.Trojan_31BAB Trojan.Horse_2EF2C Trojan.Horse_02084 Trojan.Startpage_2B0C0 W32.Blaster.F.Worm_C0541 W32.Blaster.C.Worm_3590A W32.Blaster.E.Worm_86B30 W32.Blaster.Worm_BED8E Trojan.Horse_6CDAB W32.Poxdar_25942 W32.IRCBot_7CFB8 W32.Virut.W_DB7DF W32.Korgo.Q_E59FC W32.Virut.W_F5D8D W32.Virut.W_B8EA2 W32.Virut.W_C1565 W32.Wargbot_352A2 W32.Esbot.A_A9657 W32.Virut.R_07D04 W32.Virut.U_5737D Backdoor.Trojan_420B4 W32.Wallz_60EDF W32.Linkbot_8ABD2 IRC.Trojan_5D7CF W32.IRCBot_D5D22 W32.IRCBot_A6106 W32.IRCBot_EFB88 W32.Virut.W_03385 Trojan.Horse_A0E7B Trojan.Horse_59799 Downloader_D5E9C W32.IRCBot_EF780 W32.IRCBot_A425D W32.IRCBot_B2730 W32.Virut.W_31CA4 W32.Virut.B_844CE W32.Virut.W_AE431 W32.Virut.W_A8BA6 W32.IRCBot_16551 W32.Virut.W_A8902 W32.Virut.W_A24EB W32.Virut.W_D6D9F W32.Virut.W_4DBBF W32.Virut.W_10597 W32.Virut.W_3E7A7 W32.IRCBot_EA377 W32.Virut.H_C7608 W32.IRCBot_7CE8B W32.IRCBot_728AD W32.IRCBot_61C62 W32.IRCBot_15C65 W32.IRCBot_57074 W32.IRCBot_1AD2B W32.IRCBot_EBADE Packed.Generic.205_2FE97 W32.IRCBot_EE9E7 W32.Virut.A_CA52D W32.Bobax.dr_0C378 W32.Bobax.dr_6B2CC W32.Virut.U_CAECC W32.Rahack.W_A918C W32.Rahack.W_FFC85 W32.Rahack.W_FD47F W32.Rahack.W_FCEF4 W32.Rahack.W_FCEC2 W32.Rahack.W_FCDB4 W32.Rahack.W_FCC70 W32.Rahack.W_FAE5C W32.Rahack.W_FA954 W32.Rahack.W_FA8FF W32.Rahack.W_FA8A0 W32.Rahack.W_F8F6D W32.Rahack.W_F8F51 W32.Rahack.W_F8185 W32.Rahack.W_F7C32 W32.Rahack.W_F78F3 W32.Rahack.W_F7713 W32.Rahack.W_F62C7 W32.Rahack.W_F4876 W32.Rahack.W_F476A W32.Rahack.W_F3726 W32.Rahack.W_F369A W32.Rahack.W_F2C13 W32.Rahack.W_F26C3 W32.Rahack.W_F112C W32.Rahack.W_F047F W32.Rahack.W_EFED2 W32.Rahack.W_EFB96 W32.Rahack.W_EF119 W32.Rahack.W_EEFB5 W32.Rahack.W_EEB88 W32.Rahack.W_ED2CE W32.Rahack.W_ECFA9 W32.Rahack.W_EBC8C W32.Rahack.W_EA72B W32.Rahack.W_EA4C2 W32.Rahack.W_E8A9D W32.Rahack.W_E838A W32.Rahack.W_E7F2A W32.Rahack.W_E7363 W32.Rahack.W_E711F W32.Rahack.W_E6FA3 W32.Rahack.W_E6E58 W32.Rahack.W_E586E W32.Rahack.W_E57E7 W32.Rahack.W_E57D4 W32.Rahack.W_E4ECB W32.Rahack.W_E3ADA W32.Rahack.W_E3A94 W32.Rahack.W_E39CF W32.Rahack.W_E30CB W32.Rahack.W_E2CAC W32.Rahack.W_E2AB7 W32.Rahack.W_E261F W32.Rahack.W_E2519 W32.Rahack.W_E1F49 W32.Rahack.W_E1614 W32.Rahack.W_E1574 W32.Rahack.W_E112E W32.Rahack.W_E0987 W32.Rahack.W_E0841 W32.Rahack.W_DDA0C W32.Rahack.W_DD1FF W32.Rahack.W_D8803 W32.Rahack.W_D564E W32.Rahack.W_D3EFE W32.Rahack.W_D146E W32.Rahack.W_D0AD8 W32.Rahack.W_D0925 W32.Rahack.W_D075C W32.Rahack.W_D061F W32.Rahack.W_D00B2 W32.Rahack.W_CCF9E W32.Rahack.W_CCA26 W32.Rahack.W_CC996 W32.Rahack.W_CC051 W32.Rahack.W_C96CD W32.Rahack.W_C8E63 W32.Rahack.W_C8DEC W32.Rahack.W_C8B0E W32.Rahack.W_C7E27 W32.Rahack.W_C72D1 W32.Rahack.W_C6F9A W32.Rahack.W_C649B W32.Rahack.W_C44C9 W32.Rahack.W_C4438 W32.Rahack.W_C2EA8 W32.Rahack.W_C28F0 W32.Rahack.W_C1661 W32.Rahack.W_C15D2 W32.Rahack.W_C1541 W32.Rahack.W_C1460 W32.Rahack.W_C12AC W32.Rahack.W_C1173 W32.Rahack.W_C0F68 W32.Rahack.W_BDD20 W32.Rahack.W_BCBFC W32.Rahack.W_BC85A W32.Rahack.W_BC7CE W32.Rahack.W_BBDFC W32.Rahack.W_BB3AD W32.Rahack.W_BB180 W32.Rahack.W_BAF03 W32.Rahack.W_BA42D W32.Rahack.W_B9DE7 W32.Rahack.W_B9A55 W32.Rahack.W_B90E3 W32.Rahack.W_B7D80 W32.Rahack.W_B75DA W32.Rahack.W_B668F W32.Rahack.W_B4BDE W32.Rahack.W_B43DA W32.Rahack.W_B3D8E W32.Rahack.W_B3B78 W32.Rahack.W_B112A W32.Rahack.W_B0D5F W32.Rahack.W_AFFD0 W32.Rahack.W_AF610 W32.Rahack.W_AF5D6 W32.Rahack.W_AD2F8 W32.Rahack.W_AD1F1 W32.Rahack.W_ACB10 W32.Rahack.W_AC6B1 W32.Rahack.W_ABF74 W32.Rahack.W_ABF48 W32.Rahack.W_AB9D9 W32.Rahack.W_AAD78 W32.Rahack.W_A9788 W32.Rahack.W_A882A W32.Rahack.W_A8427 W32.Rahack.W_A7F8E W32.Rahack.W_A7E41 W32.Rahack.W_A75DB W32.Rahack.W_A7213 W32.Rahack.W_A69FA W32.Rahack.W_A512C W32.Rahack.W_A453B W32.Rahack.W_A3E7D W32.Rahack.W_A2282 W32.Rahack.W_A2096 W32.Rahack.W_A1DD1 W32.Rahack.W_A16F8 W32.Rahack.W_A1699 W32.Rahack.W_A04B5 W32.Rahack.W_9F5FD W32.Rahack.W_9EFFC W32.Rahack.W_9D65F W32.Rahack.W_9D5CD W32.Rahack.W_9BE22 W32.Rahack.W_9B76E W32.Rahack.W_9B549 W32.Rahack.W_9B42F W32.Rahack.W_99B12 W32.Rahack.W_99966 W32.Rahack.W_99597 W32.Rahack.W_97FE8 W32.Rahack.W_973F4 W32.Rahack.W_96BC2 W32.Rahack.W_964E8 W32.Rahack.W_94F1D W32.Rahack.W_93153 W32.Rahack.W_9302F W32.Rahack.W_91DE3 W32.Rahack.W_91A52 W32.Rahack.W_915F1 W32.Rahack.W_90EC4 W32.Rahack.W_90D4D W32.Rahack.W_8F286 W32.Rahack.W_8BE2F W32.Rahack.W_8AB68 W32.Rahack.W_894A2 W32.Rahack.W_89199 W32.Rahack.W_87F1E W32.Rahack.W_85E4B W32.Rahack.W_85153 W32.Rahack.W_83CB0 W32.Rahack.W_822A7 W32.Rahack.W_82098 W32.Rahack.W_81F82 W32.Rahack.W_806CC W32.Rahack.W_806B8 W32.Rahack.W_7F84F W32.Rahack.W_7F1EF W32.Rahack.W_7DF81 W32.Rahack.W_7D71D W32.Rahack.W_7C812 W32.Rahack.W_7C0BF W32.Rahack.W_7BE59 W32.Rahack.W_7BBC4 W32.Rahack.W_7B6F6 W32.Rahack.W_7AF4A W32.Rahack.W_7ACD2 W32.Rahack.W_79BF9 W32.Rahack.W_79BD3 W32.Rahack.W_78B3D W32.Rahack.W_78AE0 W32.Rahack.W_77B4C W32.Rahack.W_775C0 W32.Rahack.W_76229 W32.Rahack.W_75F46 W32.Rahack.W_753B4 W32.Rahack.W_7463D W32.Rahack.W_73F5C W32.Rahack.W_72834 W32.Rahack.W_70A28 W32.Rahack.W_70582 W32.Rahack.W_7057C W32.Rahack.W_7055E W32.Rahack.W_6FC3A W32.Rahack.W_6F17C W32.Rahack.W_6B810 W32.Rahack.W_6B135 W32.Rahack.W_6B092 W32.Rahack.W_6AEFF W32.Rahack.W_6AE52 W32.Rahack.W_6ABA6 W32.Rahack.W_69E4F W32.Rahack.W_69D1F W32.Rahack.W_692D9 W32.Rahack.W_68EA1 W32.Rahack.W_68AF8 W32.Rahack.W_67168 W32.Rahack.W_6609D W32.Rahack.W_65E03 W32.Rahack.W_64E4A W32.Rahack.W_64E39 W32.Rahack.W_64975 W32.Rahack.W_641EF W32.Rahack.W_6343C W32.Rahack.W_61C07 W32.Rahack.W_60F07 W32.Rahack.W_6055C W32.Rahack.W_5EAFC W32.Rahack.W_5D798 W32.Rahack.W_5D341 W32.Rahack.W_5CF4E W32.Rahack.W_5CF39 W32.Rahack.W_5C6AF W32.Rahack.W_5B455 W32.Rahack.W_5ABD3 W32.Rahack.W_5A5EA W32.Rahack.W_59354 W32.Rahack.W_5918E W32.Rahack.W_589C2 W32.Rahack.W_58868 W32.Rahack.W_58283 W32.Rahack.W_57387 W32.Rahack.W_55F56 W32.Rahack.W_54E8C W32.Rahack.W_549A9 W32.Rahack.W_54819 W32.Rahack.W_53FF5 W32.Rahack.W_50ED7 W32.Rahack.W_504A0 W32.Rahack.W_50441 W32.Rahack.W_5028A W32.Rahack.W_4E452 W32.Rahack.W_4DFA1 W32.Rahack.W_4DE1D W32.Rahack.W_4B93A W32.Rahack.W_4B23B W32.Rahack.W_4AA7A W32.Rahack.W_4A43C W32.Rahack.W_4A087 W32.Rahack.W_487B8 W32.Rahack.W_4812C W32.Rahack.W_469E2 W32.Rahack.W_45AA8 W32.Rahack.W_456C9 W32.Rahack.W_43A26 W32.Rahack.W_43632 W32.Rahack.W_41555 W32.Rahack.W_41533 W32.Rahack.W_4120A W32.Rahack.W_40DD9 W32.Rahack.W_3F373 W32.Rahack.W_3EF6A W32.Rahack.W_3EE0F W32.Rahack.W_3EB4B W32.Rahack.W_3E93C W32.Rahack.W_3E934 W32.Rahack.W_3BDC7 W32.Rahack.W_3B636 W32.Rahack.W_3B499 W32.Rahack.W_3AD8F W32.Rahack.W_3A76D W32.Rahack.W_3A35C W32.Rahack.W_39D31 W32.Rahack.W_393BD W32.Rahack.W_38C99 W32.Rahack.W_3878C W32.Rahack.W_386D2 W32.Rahack.W_3860D W32.Rahack.W_385EC W32.Rahack.W_38375 W32.Rahack.W_37C0C W32.Rahack.W_36951 W32.Rahack.W_36417 W32.Rahack.W_337E9 W32.Rahack.W_32D19 W32.Rahack.W_31F05 W32.Rahack.W_31E15 W32.Rahack.W_3105B W32.Rahack.W_304E6 W32.Rahack.W_2F40B W32.Rahack.W_2EE91 W32.Rahack.W_2DC5A W32.Rahack.W_2D120 W32.Rahack.W_2CEB6 W32.Rahack.W_2ACBC W32.Rahack.W_2A981 W32.Rahack.W_2A858 W32.Rahack.W_2A5AA W32.Rahack.W_2A462 W32.Rahack.W_298CA W32.Rahack.W_297EA W32.Rahack.W_2947D W32.Rahack.W_2856D W32.Rahack.W_27141 W32.Rahack.W_26816 W32.Rahack.W_2452C W32.Rahack.W_2394B W32.Rahack.W_23660 W32.Rahack.W_230EF W32.Rahack.W_226D9 W32.Rahack.W_2232D W32.Rahack.W_20D09 W32.Rahack.W_1FD4E W32.Rahack.W_1E02A W32.Rahack.W_1CC4A W32.Rahack.W_1CA2E W32.Rahack.W_1C2DB W32.Rahack.W_1B337 W32.Rahack.W_1A4FD W32.Rahack.W_1A195 W32.Rahack.W_19AAE W32.Rahack.W_18B28 W32.Rahack.W_17B88 W32.Rahack.W_164CA W32.Rahack.W_16220 W32.Rahack.W_15BA6 W32.Rahack.W_14731 W32.Rahack.W_13698 W32.Rahack.W_13609 W32.Rahack.W_1271D W32.Rahack.W_1234A W32.Rahack.W_12186 W32.Rahack.W_11709 W32.Rahack.W_1141E W32.Rahack.W_1129C W32.Rahack.W_10BD9 W32.Rahack.W_10930 W32.Rahack.W_0FAB4 W32.Rahack.W_0DD4A W32.Rahack.W_0DCCF W32.Rahack.W_0DCA8 W32.Rahack.W_0ACD7 W32.Rahack.W_097FB W32.Rahack.W_091DA W32.Rahack.W_083DE W32.Rahack.W_0795D W32.Rahack.W_075CC W32.Rahack.W_05CC7 W32.Rahack.W_0414E W32.Rahack.W_03E06 W32.Rahack.W_03DF7 W32.Rahack.W_021A5 W32.Rahack.W_01C4B W32.Rahack.W_020D4 W32.Rahack.W_F6F58 W32.Rahack.W_A93A9 W32.Rahack.W_6B470 W32.Rahack.W_69E97 W32.Rahack.W_48477 W32.Rahack.W_0F3AF W32.Rahack.W_043F5 W32.Rahack.W_0D6FE W32.Rahack.H_9F456 Backdoor.Trojan_F4BB0 Backdoor.Trojan_D3AA8 Backdoor.Trojan_BE7E2 Backdoor.Trojan_9CF30 Backdoor.Trojan_952B3 Backdoor.Trojan_7D8FE Backdoor.Trojan_3B3A5 Backdoor.Trojan_3BCB4 W32.Rahack.H_79ACC W32.Rahack.H_E79B6 W32.Rahack.H_C137F W32.Rahack.H_81018 W32.Rahack.H_711F7 W32.Rahack.H_2A9FA W32.Rahack.H_1B160 W32.Rahack.H_03EA6 W32.Rahack.H_0F478 Backdoor.Trojan_DB81F Backdoor.Trojan_EFC66 W32.Rahack.H_63916 W32.Rahack.H_57EBB Backdoor.Trojan_F996A Backdoor.Trojan_EFDF4 Backdoor.Trojan_EC708 Backdoor.Trojan_E2A2D Backdoor.Trojan_C05E4 Backdoor.Trojan_B1066 Backdoor.Trojan_ABC7B Backdoor.Trojan_A04DB Backdoor.Trojan_9F241 Backdoor.Trojan_98250 Backdoor.Trojan_91877 W32.Rahack.H_8036E Backdoor.Trojan_7DAAC Backdoor.Trojan_670F8 Backdoor.Trojan_4EB11 Backdoor.Trojan_4E396 Backdoor.Trojan_4733C Backdoor.Trojan_42615 Backdoor.Trojan_33E37 Backdoor.Trojan_2DB2B Backdoor.Trojan_164CC Backdoor.Trojan_0F34D Backdoor.Trojan_0DA78 Backdoor.Trojan_00887 Backdoor.Trojan_0213B Backdoor.Trojan_F5637 Backdoor.Trojan_C16F4 Backdoor.Trojan_510CC Backdoor.Trojan_9FC2C Backdoor.Trojan_38E8E W32.Rahack.H_DC7DE W32.Rahack.H_D1757 W32.Rahack.H_C93DA W32.Rahack.H_C8978 W32.Rahack.H_A6B66 W32.Rahack.H_7A576 W32.Rahack.H_74EC3 W32.Rahack.H_729E8 W32.Rahack.H_66512 W32.Rahack.H_0BBC1 W32.Rahack.H_459F0 W32.Rahack.H_7BC81 Backdoor.Trojan_C9C6E W32.Rahack.H_596D7 Backdoor.Trojan_86B54 Backdoor.Trojan_2507D Backdoor.Trojan_2A862 Backdoor.Trojan_FFFC7 W32.Rahack.H_FDAED Backdoor.Trojan_F94B2 Backdoor.Trojan_F61AA W32.Virut.W_F4819 W32.Virut.W_F4005 Backdoor.Trojan_EF2B6 Backdoor.Trojan_E8BE9 W32.Rahack.H_E192C W32.Rahack.H_DF3DB Backdoor.Trojan_DB8ED W32.Rahack.H_D5CF7 W32.Rahack.H_D43C4 Backdoor.Trojan_D0531 Backdoor.Trojan_CC1BF Backdoor.Trojan_C698F W32.Rahack.H_C44B5 W32.Rahack.H_BF2F1 Backdoor.Trojan_B8386 Backdoor.Trojan_B7565 Backdoor.Trojan_B4B30 W32.Rahack.H_B3B67 W32.Rahack.H_B0349 Backdoor.Trojan_A83E6 W32.Rahack.H_A7577 W32.Rahack.H_A708B Backdoor.Trojan_A2465 Backdoor.Trojan_A0F2C W32.Rahack.H_9FB61 Backdoor.Trojan_9F740 Backdoor.Trojan_9E842 W32.Rahack.H_9DEF1 W32.Rahack.H_9BA08 W32.Rahack.H_99AD2 W32.Rahack.H_91886 W32.Rahack.H_9132C Backdoor.Trojan_91241 W32.Rahack.H_8FE48 Backdoor.Trojan_88062 Backdoor.Trojan_871D0 Backdoor.Trojan_81197 W32.Rahack.H_7F388 W32.Rahack.H_79F4D Backdoor.Trojan_79636 Backdoor.Trojan_78CCA W32.Rahack.H_78877 Backdoor.Trojan_75B29 Backdoor.Trojan_70BCB Backdoor.Trojan_6A766 Backdoor.Trojan_66D25 W32.Rahack.H_60D08 Backdoor.Trojan_60C6D Backdoor.Trojan_59996 W32.Rahack.H_59944 Backdoor.Trojan_54F34 Backdoor.Trojan_51B28 W32.Virut.W_5071C Backdoor.Trojan_4B26C Backdoor.Trojan_48928 Backdoor.Trojan_486BE Backdoor.Trojan_468A0 W32.Rahack.H_45FF6 Backdoor.Trojan_4507B Backdoor.Trojan_415DA Backdoor.Trojan_4136D Backdoor.Trojan_4026A Backdoor.Trojan_39F91 W32.Rahack.H_38BC0 W32.Rahack.H_36E47 W32.Rahack.H_3151F Backdoor.Trojan_30AE0 Backdoor.Trojan_2DB91 Backdoor.Trojan_2A7C7 W32.Rahack.H_26DA5 W32.Rahack.H_2614A Backdoor.Trojan_20276 W32.Rahack.H_1B74E Backdoor.Trojan_1B737 W32.Rahack.H_1AAB4 W32.Rahack.H_1AA37 Backdoor.Trojan_19545 Backdoor.Trojan_16535 Backdoor.Trojan_16213 W32.Virut.W_0F378 W32.Rahack.H_0C5A6 Backdoor.Trojan_071D7 Backdoor.Trojan_0633E Backdoor.Trojan_015C4 Backdoor.Trojan_04003 W32.Rahack.H_B9382 Backdoor.Trojan_945AB Backdoor.Trojan_7276A W32.Rahack.H_4FB6E Backdoor.Trojan_48EC5 Backdoor.Trojan_22B2C Backdoor.Trojan_40BC8 W32.Rahack.H_FE43E W32.Rahack.H_F851C W32.Rahack.H_F7017 W32.Rahack.H_F29B7 W32.Rahack.H_F0163 W32.Rahack.H_E75A3 W32.Rahack.H_E65C8 W32.Rahack.H_DF075 W32.Rahack.H_DEC3D W32.Rahack.H_DE5B5 W32.Rahack.H_DCDD3 W32.Rahack.H_DAF28 W32.Rahack.H_D8B61 W32.Rahack.H_D6573 W32.Rahack.H_D1E5E W32.Rahack.H_D0D7F W32.Rahack.H_CEEFC W32.Rahack.H_CE3B0 W32.Rahack.H_CC4F3 W32.Rahack.H_C6AF5 W32.Rahack.H_C0DBE W32.Rahack.H_BD081 W32.Rahack.H_B7E9E W32.Rahack.H_B67E9 W32.Rahack.H_B2D31 W32.Rahack.H_B0905 W32.Rahack.H_AE72E W32.Rahack.H_AC7D3 W32.Rahack.H_A6047 W32.Rahack.H_A5125 W32.Rahack.H_A4F0E W32.Rahack.H_A0E59 W32.Rahack.H_A04B0 W32.Rahack.H_9F1D9 W32.Rahack.H_98D18 W32.Rahack.H_92D9E W32.Rahack.H_8F7AE W32.Rahack.H_8CC2B W32.Rahack.H_872A6 W32.Rahack.H_851AE W32.Rahack.H_814A2 W32.Rahack.H_78CC9 W32.Rahack.H_776C4 W32.Rahack.H_75F7F W32.Rahack.H_75C76 W32.Rahack.H_701D7 W32.Rahack.H_7017D W32.Rahack.H_6AAD6 W32.Rahack.H_65BB2 W32.Rahack.H_6096E W32.Rahack.H_5D320 W32.Rahack.H_54B5B W32.Rahack.H_47579 W32.Rahack.H_3DE1B W32.Rahack.H_3D950 W32.Rahack.H_39C78 W32.Rahack.H_34DF0 W32.Rahack.H_2D5AD W32.Rahack.H_2BD76 W32.Rahack.H_29441 W32.Rahack.H_24992 W32.Rahack.H_2481D W32.Rahack.H_20722 W32.Rahack.H_1FCDC W32.Rahack.H_1E014 W32.Rahack.H_1D01E W32.Rahack.H_1AAA4 W32.Rahack.H_00771 W32.Rahack.H_19C4C W32.Rahack.H_9A9DB W32.Rahack.H_E9F23 W32.Rahack.H_BE4D7 W32.Rahack.H_94E4A W32.Rahack.H_6425D W32.Rahack.H_37FCA W32.Rahack.H_39B95 W32.Rahack.H_B7AF6 W32.Rahack.H_DE5D2 W32.Rahack.H_26F22 W32.Rahack.H_80D52 W32.Rahack.H_8EAB5 W32.Rahack.H_6DA05 W32.Rahack.H_96584 W32.Rahack.H_E2790 W32.Rahack.H_DB102 W32.Rahack.H_D7CA3 W32.Rahack.H_AB69E W32.Rahack.H_FFEDE W32.Rahack.H_9BBB6 W32.Rahack.H_E11A4 W32.Rahack.H_DA841 W32.Rahack.H_D9780 W32.Rahack.H_D6016 W32.Rahack.H_D530A W32.Rahack.H_CA655 W32.Rahack.H_C08C2 W32.Rahack.H_B36EC W32.Rahack.H_B3244 W32.Rahack.H_AF56B W32.Rahack.H_A958C W32.Rahack.H_60C12 W32.Rahack.H_48286 W32.Rahack.H_452C4 W32.Rahack.H_44AAC W32.Rahack.H_14AA7 W32.Rahack.H_00D89 W32.Rahack.H_0B964 W32.Rahack.H_F6AD4 W32.Rahack.H_C629C W32.Rahack.H_BC88D W32.Rahack.H_B8F55 W32.Rahack.H_AF93C W32.Rahack.H_9C4CD W32.Rahack.H_962DE W32.Rahack.H_66627 W32.Rahack.H_64B56 W32.Rahack.H_6003A W32.Rahack.H_5DB71 W32.Rahack.H_5178C W32.Rahack.H_465E9 W32.Rahack.H_44ECE W32.Rahack.H_1A1D9 W32.Rahack.H_133C0 W32.Rahack.H_0AC89 W32.Rahack.H_09E0C W32.Rahack.H_016DB W32.Rahack.H_047F2 W32.Rahack.H_DA726 W32.Rahack.H_B6E50 W32.Rahack.H_17FB1 W32.Rahack.H_2D10B W32.Rahack.H_C8958 W32.Rahack.H_CDEF1 W32.Rinbot.V_C536E W32.IRCBot_3EF5C W32.Rinbot.V_AE319 W32.Rinbot.V_BC3A7 W32.Spybot.Worm_5EA76 W32.IRCBot_7973B W32.Spybot.Worm_09851 W32.Spybot.Worm_316AF Trojan.Donbot_8E41E Trojan.Donbot_E76E1 Backdoor.Trojan_35BAA W32.Spybot.Worm_C13C5 W32.Spybot.Worm_785B2 W32.Spybot.Worm_D0EDC Hacktool_7F0F1 Trojan.Dropper_44BF8 W32.Neeris.C_AE5B2 Backdoor.Trojan_5F216 W32.Spybot.Worm_2AF86 W32.Spybot.Worm_F6B34 Trojan.Horse_C7E6D Trojan.Horse_264C2 Trojan.Horse_2A434 W32.Spybot.Worm_74C6E Backdoor.Sdbot_ED1DA Backdoor.Ranky.X_AFE6A W32.SillyFDC_D6226 Backdoor.Sdbot_EB5ED Backdoor.Sdbot_F3B37 Backdoor.Sdbot_E60A8 Backdoor.Sdbot_E34C0 Backdoor.Sdbot_9E366 Backdoor.Sdbot_82FD3 Backdoor.Sdbot_1BDAC Backdoor.Sdbot_32CC3 W32.Spybot.Worm_0D2D4 W32.IRCBot_A8115 W32.Spybot.Worm_79A1E W32.IRCBot_48217 W32.IRCBot_5A4F3 W32.IRCBot_28B82 W32.Spybot.Worm_5FAF9 Trojan.Horse_25948 W32.SillyFDC_AE262 W32.Downadup_FFAD8 W32.Downadup_08DB8 W32.Downadup_5B971 W32.Downadup_A9DCF W32.Downadup_E48B2 W32.Downadup_9DD06 W32.Downadup_ECAE9 W32.Downadup_AB163 W32.Downadup_81D83 W32.Downadup_FF1C8 W32.Downadup_5815B W32.Downadup_2DB76 W32.Downadup_6EDE5 W32.Downadup_0228C W32.Downadup_4F4CA W32.Downadup_0D0BA W32.Downadup_BBC16 W32.Downadup.B_D6BC8 W32.Downadup.B_C353A W32.Downadup.B_3FB86 W32.Downadup.B_4391B W32.Downadup.B_567D4 W32.Downadup.B_EC2B0 W32.Downadup.B_3E36D W32.Downadup.B_EA42E W32.Downadup.B_FA082 W32.Downadup.B_EE8B1 W32.Downadup.B_EC148 W32.Downadup.B_DAEF3 W32.Downadup.B_CF11B W32.Downadup.B_CBE37 W32.Downadup.B_C9769 W32.Downadup.B_C6571 W32.Downadup.B_BCCA7 W32.Downadup.B_B6411 W32.Downadup.B_B1A89 W32.Downadup.B_9B621 W32.Downadup.B_86C49 W32.Downadup.B_8532A W32.Downadup.B_6204C W32.Downadup.B_5CA71 W32.Downadup.B_5A7F7 W32.Downadup.B_404C7 W32.Downadup.B_53B0B W32.Downadup.B_D92E6 W32.Downadup.B_7B921 W32.Downadup.B_82F17 W32.Downadup.B_F8E14 W32.Downadup.B_D50BC W32.Downadup.B_DFB98 W32.Downadup.B_D52E8 W32.Downadup.B_C79F1 W32.Downadup.B_336FD W32.Downadup.B_89FE7 W32.Downadup.B_F2EE7 W32.Downadup.B_4A457 W32.Downadup.B_C2834 W32.Downadup.B_FBFD6 W32.Downadup.B_F975A W32.Downadup.B_F5C5D W32.Downadup.B_F4A5E W32.Downadup.B_EF5C4 W32.Downadup.B_EE7D0 W32.Downadup.B_ED888 W32.Downadup.B_ED1EE W32.Downadup.B_EA6D4 W32.Downadup.B_E7B81 W32.Downadup.B_E78B7 W32.Downadup.B_D838D W32.Downadup.B_D769A W32.Downadup.B_D6A26 W32.Downadup.B_D4B34 W32.Downadup.B_D45EC W32.Downadup.B_D25A0 W32.Downadup.B_D0491 W32.Downadup.B_CF168 W32.Downadup.B_CE250 W32.Downadup.B_CCD18 W32.Downadup.B_C9CCD W32.Downadup.B_C2C29 W32.Downadup.B_B0012 W32.Downadup.B_AC266 W32.Downadup.B_AACCA W32.Downadup.B_A675F W32.Downadup.B_9FEAE W32.Downadup.B_9F50A W32.Downadup.B_94C1B W32.Downadup.B_93F2F W32.Downadup.B_92CBC W32.Downadup.B_8A8E2 W32.Downadup.B_8A2C9 W32.Downadup.B_87745 W32.Downadup.B_80414 W32.Downadup.B_7BA4F W32.Downadup.B_78670 W32.Downadup.B_76A8A W32.Downadup.B_6E8B7 W32.Downadup.B_65C00 W32.Downadup.B_65875 W32.Downadup.B_61FD3 W32.Downadup.B_6033C W32.Downadup.B_59B1B W32.Downadup.B_5946E W32.Downadup.B_568FB W32.Downadup.B_5606D W32.Downadup.B_54E12 W32.Downadup.B_51E4B W32.Downadup.B_4FCCC W32.Downadup.B_4A472 W32.Downadup.B_4699F W32.Downadup.B_41EB1 W32.Downadup.B_40DF7 W32.Downadup.B_3FB1C W32.Downadup.B_39EB5 W32.Downadup.B_381AC W32.Downadup.B_36AEA W32.Downadup.B_357C3 W32.Downadup.B_3334C W32.Downadup.B_32993 W32.Downadup.B_31EB3 W32.Downadup.B_2DC4A W32.Downadup.B_2AF9C W32.Downadup.B_27BD6 W32.Downadup.B_1F671 W32.Downadup.B_19AB4 W32.Downadup.B_197E3 W32.Downadup.B_15F76 W32.Downadup.B_0BB5A W32.Downadup.B_093B0 W32.Downadup.B_04739 W32.Downadup.B_05ABB W32.Downadup.B_ECC96 W32.Downadup.B_A3421 W32.Downadup.B_9335B W32.Downadup.B_82D80 W32.Downadup.B_4F7D1 W32.Downadup.B_055BB W32.Downadup.B_10706 W32.Downadup.B_18635 W32.Downadup.B_4F1F2 W32.Downadup.B_8F77D W32.Downadup.B_8B782 W32.Downadup_9E18C W32.Downadup.B_37DDE W32.Downadup.B_DAF56 W32.Downadup.B_0B10D W32.Downadup.B_A500B W32.Downadup.B_D205A W32.Downadup.B_FE780 W32.Downadup.B_F8FB1 W32.Downadup.B_F7666 W32.Downadup.B_F25C7 W32.Downadup.B_F1E62 W32.Downadup.B_EF3E5 W32.Downadup.B_EE601 W32.Downadup.B_E8436 W32.Downadup.B_E7116 W32.Downadup.B_E6C48 W32.Downadup.B_E6258 W32.Downadup.B_E5D06 W32.Downadup.B_E0851 W32.Downadup.B_E0347 W32.Downadup.B_DF79C W32.Downadup.B_D63E5 W32.Downadup.B_D24B2 W32.Downadup.B_D1909 W32.Downadup.B_D1615 W32.Downadup.B_CFB0F W32.Downadup.B_CCEF9 W32.Downadup.B_CCD5A W32.Downadup.B_CC96D W32.Downadup.B_CAC58 W32.Downadup.B_C8986 W32.Downadup.B_C4908 W32.Downadup.B_C28F4 W32.Downadup.B_C1D5C W32.Downadup.B_BF44C W32.Downadup.B_B9D36 W32.Downadup.B_B7EF8 W32.Downadup.B_B4BC1 W32.Downadup.B_B16B9 W32.Downadup.B_B0B0D W32.Downadup.B_AEA4A W32.Downadup.B_AE2C1 W32.Downadup.B_AAB7C W32.Downadup.B_AA7FC W32.Downadup.B_AA491 W32.Downadup.B_A874E W32.Downadup.B_A837D W32.Downadup.B_A7C83 W32.Downadup.B_A71B4 W32.Downadup.B_A63E8 W32.Downadup.B_A3A35 W32.Downadup.B_A1E3E W32.Downadup.B_A0191 W32.Downadup.B_9FCB3 W32.Downadup.B_9A56F W32.Downadup.B_9947C W32.Downadup.B_966E3 W32.Downadup.B_90A11 W32.Downadup.B_902FB W32.Downadup.B_8E0DA W32.Downadup.B_88702 W32.Downadup.B_86A17 W32.Downadup.B_86524 W32.Downadup.B_8499C W32.Downadup.B_83ABB W32.Downadup.B_7EAAF W32.Downadup.B_7B3AF W32.Downadup.B_7A85C W32.Downadup.B_79A80 W32.Downadup.B_78EBD W32.Downadup.B_78971 W32.Downadup.B_775BB W32.Downadup.B_75F82 W32.Downadup.B_70751 W32.Downadup.B_6DE93 W32.Downadup.B_6CB17 W32.Downadup.B_6ADC0 W32.Downadup.B_66B82 W32.Downadup.B_65E59 W32.Downadup.B_650EF W32.Downadup.B_6391B W32.Downadup.B_62388 W32.Downadup.B_604B1 W32.Downadup.B_60002 W32.Downadup.B_5F8B9 W32.Downadup.B_5E9BA W32.Downadup.B_5DB89 W32.Downadup.B_5BF68 W32.Downadup.B_59C26 W32.Downadup.B_58FA3 W32.Downadup.B_58BC5 W32.Downadup.B_56230 W32.Downadup.B_555FE W32.Downadup.B_549D4 W32.Downadup.B_53BDA W32.Downadup.B_53341 W32.Downadup.B_527C8 W32.Downadup.B_51429 W32.Downadup.B_513CE W32.Downadup.B_5015B W32.Downadup.B_4AF70 W32.Downadup.B_49814 W32.Downadup.B_475E3 W32.Downadup.B_44B9E W32.Downadup.B_42134 W32.Downadup.B_4196F W32.Downadup.B_4125B W32.Downadup.B_3FE48 W32.Downadup.B_3F4AA W32.Downadup.B_3D464 W32.Downadup.B_3D1B7 W32.Downadup.B_39486 W32.Downadup.B_36687 W32.Downadup.B_3600D W32.Downadup.B_345AD W32.Downadup.B_33E12 W32.Downadup.B_32D54 W32.Downadup.B_32BAA W32.Downadup.B_2FB65 W32.Downadup.B_2CE54 W32.Downadup.B_2AC4A W32.Downadup.B_24986 W32.Downadup.B_23CFC W32.Downadup.B_23B2B W32.Downadup.B_1FF29 W32.Downadup.B_1CFCD W32.Downadup.B_1C704 W32.Downadup.B_1BA50 W32.Downadup.B_1AA6D W32.Downadup.B_19545 W32.Downadup.B_17E57 W32.Downadup.B_16563 W32.Downadup.B_16124 W32.Downadup.B_15DE7 W32.Downadup.B_14B74 W32.Downadup.B_148E8 W32.Downadup.B_126D4 W32.Downadup.B_0DFAE W32.Downadup.B_0DF21 W32.Downadup.B_0D534 W32.Downadup.B_0C3B1 W32.Downadup.B_0B7A1 W32.Downadup.B_0B373 W32.Downadup.B_05429 W32.Downadup.B_08046 W32.Downadup.B_F75A6 W32.Downadup.B_B772B W32.Downadup.B_A4A0A W32.Downadup.B_7B989 W32.Downadup.B_7A5C6 W32.Downadup.B_01FEF W32.Downadup.B_4E7D2 W32.Downadup.B_42324 W32.Downadup.B_58BB5 W32.Downadup.B_B2141 W32.Downadup.B_8EA7F W32.Downadup.B_787FD W32.Downadup.B_5C752 W32.Downadup.B_5ABAE W32.Downadup.B_59EF5 W32.Downadup.B_4AA6A W32.Downadup.B_0209A W32.Downadup.B_39E0A W32.Downadup.B_A033D W32.Downadup.B_03BE6 W32.Downadup.B_6D18E W32.Downadup.B_CCAAF W32.Downadup.B_A6B43 W32.Downadup.B_872AC W32.Downadup.B_7E2D4 W32.Downadup.B_72C09 W32.Downadup.B_23EEB W32.Downadup.B_59FE2 W32.Downadup.B_F186C W32.Downadup.B_C7657 W32.Downadup.B_9C3CC W32.Downadup.B_B2531 W32.Downadup.B_0F7D2 W32.Downadup.B_34119 W32.Downadup.B_9D6E6 W32.Downadup.B_7F6F3 W32.Downadup.B_543EF W32.Downadup.B_26E04 W32.Downadup.B_51278 W32.Downadup.B_A45CB W32.Downadup.B_0FBF6 W32.Downadup.B_89CC8 W32.Downadup.B_36B58 W32.Downadup.B_6BCAF W32.Downadup.B_D6B3E W32.Downadup.B_D50E4 W32.Downadup.B_D3E1C W32.Downadup.B_C1672 W32.Downadup.B_B9AA2 W32.Downadup.B_A9E44 W32.Downadup.B_A7013 W32.Downadup.B_9128A W32.Downadup.B_626B3 W32.Downadup.B_61771 W32.Downadup.B_5FD0A W32.Downadup.B_50743 W32.Downadup.B_49A2E W32.Downadup.B_411A7 W32.Downadup.B_3C9C0 W32.Downadup.B_2EF09 W32.Downadup.B_2DD4B W32.Downadup.B_1DED0 W32.Downadup.B_19547 W32.Downadup.B_0F1B9 W32.Downadup.B_04574 W32.Downadup.B_06509 W32.Downadup.B_05819 W32.Downadup_8F026 W32.Downadup.B_AA161 W32.Downadup.B_C2181 W32.Downadup_ECC16 W32.Downadup_E7F65 W32.Downadup_DB71D W32.Downadup_9D7CE W32.Downadup_66F0A W32.Downadup_72649 W32.Downadup.B_33FB8 W32.Downadup.B_41793 W32.Downadup.B_DDEC6 W32.Downadup.B_5A997 W32.Downadup.B_8758D W32.Downadup.B_DDE94 W32.Downadup.B_984ED W32.Downadup.B_53F3C W32.Downadup.B_86749 W32.Downadup.B_63ABA W32.Downadup.B_F9A1B W32.Downadup.B_FC98E W32.Downadup.B_F317E W32.Downadup.B_F1B0A W32.Downadup.B_ECCDF W32.Downadup.B_EB63E W32.Downadup.B_E7522 W32.Downadup.B_E0116 W32.Downadup.B_DBBB8 W32.Downadup.B_D279C W32.Downadup.B_CF471 W32.Downadup.B_C7DBC W32.Downadup.B_C7296 W32.Downadup.B_C5C35 W32.Downadup.B_C2A89 W32.Downadup.B_BCB57 W32.Downadup.B_A4461 W32.Downadup.B_9F10F W32.Downadup.B_9D383 W32.Downadup.B_8E827 W32.Downadup.B_8C8E7 W32.Downadup.B_8A97E W32.Downadup.B_7AF1B W32.Downadup.B_79C5E W32.Downadup.B_797A7 W32.Downadup.B_7884F W32.Downadup.B_75F7D W32.Downadup.B_7585D W32.Downadup.B_72AEC W32.Downadup.B_729DF W32.Downadup.B_6C68D W32.Downadup.B_6A535 W32.Downadup.B_625E9 W32.Downadup.B_5F705 W32.Downadup.B_5B78F W32.Downadup.B_5ABF4 W32.Downadup.B_506B9 W32.Downadup.B_4D10C W32.Downadup.B_48A4A W32.Downadup.B_3F193 W32.Downadup.B_3C73A W32.Downadup.B_38A7A W32.Downadup.B_364B5 W32.Downadup.B_34766 W32.Downadup.B_26800 W32.Downadup.B_23F1C W32.Downadup.B_1E7E7 W32.Downadup.B_13A2D W32.Downadup.B_0988C W32.Downadup.B_11109 W32.Downadup.B_D74CA W32.Downadup.B_7CD40 W32.Downadup.B_0F285 W32.Downadup.B_3439E W32.Downadup.B_2B2E8 W32.Downadup.B_D0983 W32.Downadup.B_BA841 W32.Downadup.B_03DD2 W32.Downadup.B_56B11 W32.Downadup.B_06990 W32.Downadup.B_253D9 W32.Downadup.B_3A302 W32.Downadup.B_B563F W32.Downadup.B_F1EEF W32.Downadup.B_95409 W32.Downadup.B_92585 W32.Downadup.B_87A5C W32.Downadup.B_87817 W32.Downadup.B_57EFB W32.Downadup.B_41379 W32.Downadup.B_40900 W32.Downadup.B_3AF41 W32.Downadup.B_23EA4 W32.Downadup.B_0DD2A W32.Downadup.B_027CB W32.Downadup.B_0B6B5 W32.Downadup.B_DFAE5 W32.Downadup.B_43C80 W32.Downadup.B_C9FF3 W32.Downadup.B_40D81 W32.Downadup.B_389B6 W32.Downadup.B_B26A0 W32.Downadup.B_9FA72 W32.Downadup.B_80FFB W32.Downadup.B_2459D W32.Downadup.B_6F2D4 W32.Downadup_E5995 W32.Downadup_E17D6 W32.Downadup_D0101 W32.Downadup_CBFD7 W32.Downadup_C9CAB W32.Downadup_BD188 W32.Downadup_99688 W32.Downadup_4F3B3 W32.Downadup_327EB W32.Downadup_05CBD W32.Downadup_32740 W32.Downadup.B_F1579 W32.Downadup.B_92B08 W32.Downadup.B_03A32 W32.Downadup.B_51DC3 W32.Downadup.B_B2A55 W32.Downadup.B_A9A0B W32.Downadup.B_38091 W32.Downadup.B_2A5A2 W32.Downadup.B_1B06F W32.Downadup.B_11311 W32.Downadup.B_1192E W32.Downadup.B_E5852 W32.Downadup.B_C4596 W32.Downadup.B_8E3A0 W32.Downadup.B_57F2C W32.Downadup.B_8C6DF W32.Downadup.B_FF10A W32.Downadup.B_02F69 W32.Downadup.B_FA67A W32.Downadup.B_EA8F5 W32.Downadup.B_63E9D W32.Downadup.B_3CFB7 W32.Downadup.B_45406 W32.Downadup.B_A0596 W32.Downadup.B_F2FFD W32.Downadup.B_83891 W32.Downadup.B_8CB28 W32.Downadup.B_D9E1C W32.Downadup.B_D72C5 W32.Downadup.B_B61C4 W32.Downadup.B_2D488 W32.Downadup.B_398DA W32.Downadup.B_C87CD W32.Downadup.B_C6213 W32.Downadup.B_84418 W32.Downadup.B_83C24 W32.Downadup.B_82F7B W32.Downadup.B_66E65 W32.Downadup.B_15919 W32.Downadup.B_62B6D W32.Downadup.B_6C795 W32.Downadup.B_D4E0F W32.Downadup.B_ECB46 W32.Downadup.B_74EF0 W32.Downadup.B_7E7A2 W32.Downadup.B_18585 W32.Downadup.B_72B23 W32.Downadup.B_D0B4F W32.Downadup.B_C2FCA W32.Downadup.B_BA59C W32.Downadup.B_79100 W32.Downadup.B_76DA3 W32.Downadup.B_64D89 W32.Downadup.B_58D90 W32.Downadup.B_4626C W32.Downadup.B_40A4A W32.Downadup.B_3F1A7 W32.Downadup.B_3B73C W32.Downadup.B_3747E W32.Downadup.B_2DD75 W32.Downadup.B_2982E W32.Downadup.B_28EE1 W32.Downadup.B_25781 W32.Downadup.B_0B89E W32.Downadup.B_2559D W32.Downadup.B_FC154 W32.Downadup.B_91DD6 W32.Downadup.B_A0C8D W32.Downadup.B_F68C7 W32.Downadup.B_D1F1F W32.Downadup.B_C5448 W32.Downadup.B_BCBC5 W32.Downadup.B_BC003 W32.Downadup.B_B7857 W32.Downadup.B_A767B W32.Downadup.B_A6610 W32.Downadup.B_502AE W32.Downadup.B_46362 W32.Downadup.B_2293B W32.Downadup.B_065C8 W32.Downadup.B_13AD7 W32.Downadup.B_60602 W32.Downadup.B_D1D7B W32.Downadup_FC394 W32.Downadup_FA4AD W32.Downadup_F75C0 W32.Downadup_EF37C W32.Downadup_ED1CA W32.Downadup_E32A5 W32.Downadup_D9EB3 W32.Downadup_D6D31 W32.Downadup_D5B56 W32.Downadup_D021C W32.Downadup_BB9B1 W32.Downadup_B8BE9 W32.Downadup_A9796 W32.Downadup_9B84E W32.Downadup_94FF2 W32.Downadup_9278A W32.Downadup_8E734 W32.Downadup_8A742 W32.Downadup_77226 W32.Downadup_6C204 W32.Downadup_65DE6 W32.Downadup_64B71 W32.Downadup_5B262 W32.Downadup_57799 W32.Downadup_5531F W32.Downadup_4D851 W32.Downadup_48F69 W32.Downadup_46905 W32.Downadup_4148A W32.Downadup_3DE19 W32.Downadup_3A155 W32.Downadup_39124 W32.Downadup_249A8 W32.Downadup_1ACEE W32.Downadup_09C6A W32.Downadup_137BD W32.Downadup.B_91D8A W32.Downadup.B_9BD34 W32.Downadup_FD3E2 W32.Downadup_F4704 W32.Downadup_F2B33 W32.Downadup_F25D3 W32.Downadup_ED723 W32.Downadup.B_EC1F0 W32.Downadup_E77F5 W32.Downadup_DCBFA W32.Downadup_DC3AC W32.Downadup_DBE5C W32.Downadup.B_D15E3 W32.Downadup_D04BE W32.Downadup_CF094 W32.Downadup_CBB42 W32.Downadup_CB14F W32.Downadup_BCC9C W32.Downadup.B_ACDDC W32.Downadup_AA553 W32.Downadup_997BE W32.Downadup_8F4E2 W32.Downadup_8CFED W32.Downadup_8BBED W32.Downadup_884BF W32.Downadup_7A285 W32.Downadup_7916A W32.Downadup_786B9 W32.Downadup_72427 W32.Downadup_717AD W32.Downadup_69CE4 W32.Downadup_56443 W32.Downadup_55DBE W32.Downadup.B_5586C W32.Downadup_550E5 W32.Downadup_54DE6 W32.Downadup_5347D W32.Downadup_47775 W32.Downadup_45DCD W32.Downadup_43334 W32.Downadup.B_3C8A5 W32.Downadup_3ABA2 W32.Downadup_1E9FC W32.Downadup_1E306 W32.Downadup_1AAFA W32.Downadup_1B8BA W32.Downadup.B_5FA72 W32.Downadup.B_D57DA W32.Downadup.B_F3D33 W32.Downadup.B_F3B0E W32.Downadup.B_E59DE W32.Downadup.B_DE64A W32.Downadup.B_DD5A3 W32.Downadup.B_D9AA4 W32.Downadup.B_C83F6 W32.Downadup.B_B85E3 W32.Downadup.B_B7017 W32.Downadup.B_B49E3 W32.Downadup.B_B2AC3 W32.Downadup.B_A8F27 W32.Downadup.B_A79B0 W32.Downadup.B_98EDF W32.Downadup.B_983BA W32.Downadup.B_93950 W32.Downadup.B_8D7BE W32.Downadup.B_8C547 W32.Downadup.B_8B8A1 W32.Downadup.B_886CC W32.Downadup.B_84E48 W32.Downadup.B_7C806 W32.Downadup.B_7167A W32.Downadup.B_60D99 W32.Downadup.B_5AFD2 W32.Downadup.B_59E9C W32.Downadup.B_5577A W32.Downadup.B_55375 W32.Downadup.B_4D293 W32.Downadup.B_490D4 W32.Downadup.B_38DBF W32.Downadup.B_26713 W32.Downadup.B_1D41D W32.Downadup.B_1B984 W32.Downadup.B_1B759 W32.Downadup.B_188A7 W32.Downadup.B_0A0FC W32.Downadup.B_15405 W32.Downadup.B_EDA4C W32.Downadup.B_E6ABF W32.Downadup.B_BB3F1 W32.Downadup.B_0A8B9 W32.Downadup.B_B817D W32.Downadup.B_8C591 W32.Downadup.B_4A2E8 W32.Downadup.B_5C904 W32.Downadup.B_53E24 W32.Downadup.B_6A5AD W32.Downadup.B_5ACE0 W32.Downadup.B_900B7 W32.Downadup.B_7A804 W32.Downadup.B_0CE6F W32.Downadup.B_4809E W32.Downadup.B_E433A W32.Downadup.B_E19D5 W32.Downadup.B_D7EF5 W32.Downadup.B_C4788 W32.Downadup.B_C2E71 W32.Downadup.B_B6191 W32.Downadup.B_AD0C1 W32.Downadup.B_A7A79 W32.Downadup.B_910AE W32.Downadup.B_8B677 W32.Downadup.B_80E63 W32.Downadup.B_7C05D W32.Downadup.B_6E0EC W32.Downadup.B_62FA1 W32.Downadup.B_60DB0 W32.Downadup.B_5F374 W32.Downadup.B_5D6E1 W32.Downadup.B_4CF2D W32.Downadup.B_4BD0F W32.Downadup.B_44309 W32.Downadup.B_400CC W32.Downadup.B_2DEF6 W32.Downadup.B_18FB0 W32.Downadup.B_20020 W32.Downadup.B_F48D0 W32.Downadup.B_EB02C W32.Downadup.B_5BEC7 W32.Downadup.B_331B1 W32.Downadup.B_394C2 W32.Downadup.B_F366C W32.Downadup.B_DFD6E W32.Downadup.B_DB4F6 W32.Downadup.B_CB0D9 W32.Downadup.B_C5851 W32.Downadup.B_C192A W32.Downadup.B_B0526 W32.Downadup.B_95332 W32.Downadup.B_60CB6 W32.Downadup.B_102B2 W32.Downadup.B_3AE65 W32.Downadup.B_63501 W32.Downadup.B_F9699 W32.Downadup.B_DE525 W32.Downadup.B_C8D7A W32.Downadup.B_C71A6 W32.Downadup.B_BC3FE W32.Downadup.B_A0D4A W32.Downadup.B_90E91 W32.Downadup.B_8F2AC W32.Downadup.B_82577 W32.Downadup.B_81133 W32.Downadup.B_6CC9A W32.Downadup.B_6489E W32.Downadup.B_627BE W32.Downadup.B_5E5A1 W32.Downadup.B_5D63A W32.Downadup.B_24E5D W32.Downadup.B_488D2 W32.Downadup.B_BF488 W32.Downadup.B_14954 W32.Downadup.B_C5B0D W32.Downadup.B_CA790 W32.Downadup.B_856BD W32.Downadup.B_018A2 W32.Downadup.B_6E10A W32.Downadup.B_EA1E1 W32.Downadup.B_20F0B W32.Downadup.B_C56A6 W32.Downadup.B_9B797 W32.Downadup.B_43AE3 W32.Downadup.B_491CA W32.Downadup.B_F5F71 W32.Downadup.B_2AABC W32.Downadup.B_C9067 W32.Downadup.B_D7243 W32.Downadup.B_CACC9 W32.Downadup.B_A3BA4 W32.Downadup.B_50BF5 W32.Downadup.B_5150F W32.Downadup.B_DDAAC W32.Downadup.B_FE891 W32.Downadup.B_D4FAD W32.Downadup.B_9A155 W32.Downadup.B_A1A22 W32.Downadup.B_71A5D W32.Downadup.B_AB13B W32.Downadup.B_89DFA W32.Downadup.B_1E2E5 W32.Downadup.B_3351A W32.Downadup.B_F9C0E W32.Downadup.B_FCCDE W32.Downadup.B_282A9 W32.Downadup.B_5ADF1 W32.Downadup.B_FA79E W32.Downadup.B_F7D09 W32.Downadup.B_F76F9 W32.Downadup.B_E0748 W32.Downadup.B_BBF1F W32.Downadup.B_7F912 W32.Downadup.B_8FC34 W32.Downadup.B_54F9D W32.Downadup_9B7C4 W32.Downadup_CD073 W32.Downadup.B_724AD W32.Downadup.B_575F9 W32.Downadup.B_28DE8 W32.Downadup.B_46CDA W32.Downadup.B_231E0 W32.Downadup.B_47AA9 W32.Downadup.B_AA915 W32.Downadup.B_3898E W32.Downadup.B_848E0 W32.Downadup.B_06850 W32.Downadup.B_2ECD9 W32.Downadup.B_48626 W32.Downadup.B_2D624 W32.Downadup.B_46C31 W32.Downadup.B_916BB W32.Downadup.B_3C156 W32.Downadup.B_5EA15 W32.Downadup.B_C9E89 W32.Downadup.B_FDF40 W32.Downadup.B_FDB4E W32.Downadup.B_F7FFE W32.Downadup.B_F7F7A W32.Downadup.B_F5E1B W32.Downadup.B_E8C95 W32.Downadup.B_E772D W32.Downadup.B_E0003 W32.Downadup.B_DF800 W32.Downadup.B_DE0F0 W32.Downadup.B_DDB57 W32.Downadup.B_D6EAE W32.Downadup.B_D1C50 W32.Downadup.B_C8D28 W32.Downadup.B_C3D4B W32.Downadup.B_BA0CA W32.Downadup.B_B68EA W32.Downadup.B_B6817 W32.Downadup.B_B5740 W32.Downadup.B_B0FE4 W32.Downadup.B_B0F7C W32.Downadup.B_AD349 W32.Downadup.B_AC6EA W32.Downadup.B_A92E6 W32.Downadup.B_A557C W32.Downadup.B_9FC71 W32.Downadup.B_99544 W32.Downadup.B_990A9 W32.Downadup.B_9328D W32.Downadup.B_8F88E W32.Downadup.B_8E0C3 W32.Downadup.B_8D0D0 W32.Downadup.B_8BC9F W32.Downadup.B_882EB W32.Downadup.B_873CC W32.Downadup.B_85E0B W32.Downadup.B_84FAB W32.Downadup.B_83B2E W32.Downadup.B_7AA3F W32.Downadup.B_7A369 W32.Downadup.B_6CF83 W32.Downadup.B_6358B W32.Downadup.B_62DBA W32.Downadup.B_5822F W32.Downadup.B_4A4E4 W32.Downadup.B_427DC W32.Downadup.B_408F8 W32.Downadup.B_35689 W32.Downadup.B_33686 W32.Downadup.B_3162F W32.Downadup.B_242E3 W32.Downadup.B_22C0F W32.Downadup.B_1B280 W32.Downadup.B_1896C W32.Downadup.B_16183 W32.Downadup.B_0968B W32.Downadup.B_11A79 W32.Downadup.B_EC18A W32.Downadup.B_B0C8D W32.Downadup.B_AD8C8 W32.Downadup.B_7C999 W32.Downadup.B_72993 W32.Downadup.B_2E0CC W32.Downadup.B_43C20 W32.Downadup.B_4F608 W32.Downadup.B_44882 W32.Downadup.B_3AA4F W32.Downadup.B_0D96F W32.Downadup.B_1DC92 W32.Downadup.B_7B09F W32.Downadup.B_A59ED W32.Downadup_AE9E0 W32.Downadup.B_C7F8E W32.Downadup.B_B21A9 W32.Downadup.B_F1006 W32.Downadup.B_2B896 W32.Downadup.B_A6695 W32.Downadup.B_FF325 W32.Downadup.B_FA7ED W32.Downadup.B_EDB08 W32.Downadup.B_EB93F W32.Downadup.B_E3BBB W32.Downadup.B_E29F3 W32.Downadup.B_DD1C2 W32.Downadup.B_D9EDA W32.Downadup.B_CB69D W32.Downadup.B_BBC7E W32.Downadup.B_BB44C W32.Downadup.B_AF125 W32.Downadup.B_8E434 W32.Downadup.B_8DD4F W32.Downadup.B_77D57 W32.Downadup.B_72D4C W32.Downadup.B_5C63B W32.Downadup.B_5922A W32.Downadup.B_2C7C1 W32.Downadup.B_110AB W32.Downadup.B_0C5F8 W32.Downadup.B_0DAC4 W32.Downadup.B_A7849 W32.Downadup.B_20C8E W32.Downadup.B_A3EF7 W32.Downadup.B_8755A W32.Downadup.B_EBE70 W32.Downadup.B_E6C12 W32.Downadup.B_CC860 W32.Downadup.B_AA0A1 W32.Downadup.B_A8BB0 W32.Downadup.B_94B68 W32.Downadup.B_8BABC W32.Downadup.B_5EDC8 W32.Downadup.B_55054 W32.Downadup.B_46316 W32.Downadup.B_1569C W32.Downadup.B_43A4E W32.Downadup.B_EF967 W32.Downadup.B_895E6 W32.Downadup.B_4715F W32.Downadup.B_6F5C9 W32.Downadup.B_5740F W32.Downadup.B_6DB9B W32.Downadup.B_FFB81 W32.Downadup.B_F5480 W32.Downadup.B_6B596 W32.Downadup.B_CF34A W32.Downadup.B_A7165 W32.Downadup.B_DEFF6 W32.Downadup.B_D2DD7 W32.Downadup.B_CE01A W32.Downadup.B_759F6 W32.Downadup.B_4D14D W32.Downadup.B_0574F W32.Downadup.B_16302 W32.Downadup.B_F9DAE W32.Downadup.B_D7908 W32.Downadup.B_8504B W32.Downadup.B_97F46 W32.Downadup.B_FDE21 W32.Downadup.B_AE7F3 W32.Downadup.B_946AA W32.Downadup.B_9C235 W32.Downadup.B_B9E91 W32.Downadup.B_372E5 W32.Downadup.B_0274C W32.Downadup_D673C W32.Downadup_B6D2D W32.Downadup_610A5 W32.Downadup_6757F W32.Downadup.E_D2FA8 W32.Downadup.E_B5666 W32.Downadup.E_9B3CD W32.Downadup.E_78E4A W32.Downadup.B_075C8 W32.Downadup.E_4DA26 W32.Downadup.B_35F2F W32.Downadup.B_4B0C8 W32.Downadup.B_64C7C W32.Downadup.B_A0152 W32.Downadup.B_F4900 W32.Downadup.B_0B15E W32.Downadup.B_54DB8 W32.Downadup.B_25BF1 W32.Downadup.B_14325 W32.Downadup.B_FF3EB W32.Downadup.B_7B065 W32.Downadup.B_3E5A9 W32.Downadup.B_086DD W32.Downadup.B_29677 W32.Downadup_E2CA1 W32.Downadup_D4943 W32.Downadup_D3193 W32.Downadup_CD1EF W32.Downadup_B0328 W32.Downadup_9E62A W32.Downadup_9A517 W32.Downadup_8964F W32.Downadup_60FE7 W32.Downadup_0D903 W32.Downadup_362F8 W32.Downadup.B_E9C5C W32.Downadup.B_D3232 W32.Downadup.B_A7F6D W32.Downadup.B_82859 W32.Downadup.B_76C1B W32.Downadup.B_686BB W32.Downadup.B_02F68 W32.Downadup.B_0DC76 W32.Downadup.B_26140 W32.Downadup.B_E80C4 W32.Downadup.B_BF4E1 W32.Downadup.B_AC784 W32.Downadup.B_A444E W32.Downadup.B_9F981 W32.Downadup.B_4117E W32.Downadup.B_1AD08 W32.Downadup.B_0D076 W32.Downadup.B_155F9 W32.Downadup.B_42C77 W32.Downadup.B_DA394 W32.Downadup.B_B544C W32.Downadup.B_B7D9D W32.Downadup.B_BE950 W32.Downadup.B_76A81 W32.Downadup.B_6D064 W32.Downadup.B_68246 W32.Downadup.B_069F8 W32.Downadup.B_559D4 W32.Downadup_7B597 W32.Downadup_E9418 W32.Downadup.B_F9132 W32.Downadup.B_F240A W32.Downadup.B_D664A W32.Downadup.B_D61B6 W32.Downadup.B_B2DCA W32.Downadup.B_AB4AE W32.Downadup.B_8E47F W32.Downadup.B_7EE38 W32.Downadup.B_73CF2 W32.Downadup.B_62AB1 W32.Downadup.B_61911 W32.Downadup.B_4D7CE W32.Downadup.B_4D588 W32.Downadup.B_4B071 W32.Downadup.B_39D9F W32.Downadup.B_325A6 W32.Downadup.B_2DDE6 W32.Downadup.B_2D6A5 W32.Downadup.B_10311 W32.Downadup.B_17444 W32.Downadup.B_B1B22 W32.Downadup.B_D4057 W32.Downadup.B_6EF58 W32.Downadup.B_47370 W32.Downadup.B_4631A W32.Downadup.B_1AF23 W32.Downadup.B_42B5D W32.Downadup.B_5B7BF W32.Downadup.B_BD15E W32.Downadup.B_2F6B6 W32.Downadup.B_459DE W32.Downadup.B_4F0EC W32.Downadup.B_F96D0 W32.Downadup.B_D7711 W32.Downadup.B_B6F81 W32.Downadup.B_ABB82 W32.Downadup.B_0E644 W32.Downadup.B_1AFDC W32.Downadup.B_B38DF W32.Downadup.B_99D89 W32.Downadup.B_1CBB5 W32.Downadup.B_8223A W32.Downadup.B_A812B W32.Downadup.B_76D48 W32.Downadup.B_6B491 W32.Downadup.B_4F605 W32.Downadup.B_5315C W32.Downadup.B_CEDF1 W32.Downadup.B_A5BD5 W32.Downadup.B_92EBB W32.Downadup.B_6AF2E W32.Downadup.B_57F9B W32.Downadup.B_2E313 W32.Downadup.B_1ED54 W32.Downadup.B_06E59 W32.Downadup.B_1907D W32.Downadup.B_E08A3 W32.Downadup.B_A943A W32.Downadup.B_B7CBE W32.Downadup.B_DBD64 W32.Downadup.B_A440C W32.Downadup.B_8CADF W32.Downadup.B_2EC4A W32.Downadup.B_4E57E W32.Downadup.B_EAED8 W32.Downadup.B_87202 W32.Downadup.B_61BB4 W32.Downadup.B_022F4 W32.Downadup.B_0FF1D W32.Downadup.B_85AE9 W32.Downadup.B_9FD00 W32.Downadup.B_5FC23 W32.Downadup.B_E9DDA W32.Downadup.B_FEE3C W32.Downadup.B_F8805 W32.Downadup.B_EECD0 W32.Downadup.B_EA1A8 W32.Downadup.B_E7FC3 W32.Downadup.B_E7950 W32.Downadup.B_E6CF7 W32.Downadup.B_E5CF9 W32.Downadup.B_E3BE6 W32.Downadup.B_E008A W32.Downadup.B_DFA5C W32.Downadup.B_DECF8 W32.Downadup.B_DDF53 W32.Downadup.B_DDBF6 W32.Downadup.B_D9305 W32.Downadup.B_CFCAF W32.Downadup.B_CA827 W32.Downadup.B_C4AA2 W32.Downadup.B_C3E43 W32.Downadup.B_C3E24 W32.Downadup.B_BF32D W32.Downadup.B_BE33C W32.Downadup.B_BD6A9 W32.Downadup.B_BBDE4 W32.Downadup.B_BB3FF W32.Downadup.B_BB08A W32.Downadup.B_B86D9 W32.Downadup.B_B8550 W32.Downadup.B_B3B7C W32.Downadup.B_B24DB W32.Downadup.B_AF46E W32.Downadup.B_AEFB3 W32.Downadup.B_AE69E W32.Downadup.B_AABF8 W32.Downadup.B_A87EA W32.Downadup.B_A6E26 W32.Downadup.B_A68F9 W32.Downadup.B_A4166 W32.Downadup.B_9E84D W32.Downadup.B_9D3CB W32.Downadup.B_981AF W32.Downadup.B_8BD22 W32.Downadup.B_8AECD W32.Downadup.B_8A231 W32.Downadup.B_89667 W32.Downadup.B_86956 W32.Downadup.B_863E3 W32.Downadup.B_8182E W32.Downadup.B_816F4 W32.Downadup.B_815A9 W32.Downadup.B_7EF23 W32.Downadup.B_7E1A3 W32.Downadup.B_7C5C2 W32.Downadup.B_73F8D W32.Downadup.B_7337D W32.Downadup.B_7053D W32.Downadup.B_6EE81 W32.Downadup.B_6B8D9 W32.Downadup.B_6A4F7 W32.Downadup.B_67F09 W32.Downadup.B_5E657 W32.Downadup.B_59043 W32.Downadup.B_58D78 W32.Downadup.B_52215 W32.Downadup.B_51DC2 W32.Downadup.B_4CEF9 W32.Downadup.B_43E25 W32.Downadup.B_413EF W32.Downadup.B_3CB79 W32.Downadup.B_3AB39 W32.Downadup.B_3A2DC W32.Downadup.B_376C2 W32.Downadup.B_361B6 W32.Downadup.B_2F6C4 W32.Downadup.B_264C1 W32.Downadup.B_20AC3 W32.Downadup.B_19ED3 W32.Downadup.B_183A7 W32.Downadup.B_134CA W32.Downadup.B_124A0 W32.Downadup.B_0F6EB W32.Downadup.B_0F2E8 W32.Downadup.B_0DF50 W32.Downadup.B_0AB2C W32.Downadup.B_05FB0 W32.Downadup.B_005A8 W32.Downadup.B_052EC W32.Downadup.B_DD018 W32.Downadup.B_BE855 W32.Downadup.B_A7844 W32.Downadup.B_993A6 W32.Downadup.B_748DA W32.Downadup.B_735D5 W32.Downadup.B_67529 W32.Downadup.B_5A912 W32.Downadup.B_4D398 W32.Downadup.B_0560D W32.Downadup.B_31844 W32.Downadup.B_C52DC W32.Downadup.B_AF58F W32.Downadup.B_8058B W32.Downadup.B_7FC94 W32.Downadup.B_73138 W32.Downadup.B_0E164 W32.Downadup.B_5882B W32.Downadup.B_AE140 W32.Downadup.B_21225 W32.Downadup.B_81816 W32.Downadup.B_C93C0 W32.Downadup.B_EFC8D W32.Downadup.B_DAD02 W32.Downadup.B_D24ED W32.Downadup.B_CB4A0 W32.Downadup.B_B699C W32.Downadup.B_B3E5E W32.Downadup.B_A29D5 W32.Downadup.B_9558E W32.Downadup.B_9443A W32.Downadup.B_67D83 W32.Downadup.B_63070 W32.Downadup.B_5E33A W32.Downadup.B_5E04C W32.Downadup.B_5261D W32.Downadup.B_509A3 W32.Downadup.B_0A65E W32.Downadup.B_0AAC5 W32.Downadup.B_3C0A5 W32.Downadup.B_B13EE W32.Downadup.B_4C774 W32.Downadup.B_79A37 W32.Downadup.B_F4AA3 W32.Downadup.B_C9DB8 W32.Downadup.B_B7DD4 W32.Downadup.B_909D2 W32.Downadup.B_72C05 W32.Downadup.B_82468 W32.Downadup.B_EEA31 W32.Downadup.B_E1295 W32.Downadup.B_D22C5 W32.Downadup.B_8BA5F W32.Downadup.B_833A6 W32.Downadup.B_431BB W32.Downadup.B_7DC10 W32.Downadup.B_DDB9E W32.Downadup.B_580D0 W32.Downadup.B_A75EF W32.Downadup.B_D7AF0 W32.Downadup.B_F2D6B W32.Downadup.B_D2518 W32.Downadup.B_B94E3 W32.Downadup.B_9559F W32.Downadup.B_2CDB6 W32.Downadup.B_56B52 W32.Downadup.B_67F55 W32.Downadup.B_E092E W32.Downadup.B_CB40C W32.Downadup.B_B25B2 W32.Downadup.B_A5516 W32.Downadup.B_53687 W32.Downadup.B_49098 W32.Downadup.B_3AF98 W32.Downadup.B_018AB W32.Downadup.B_33442 W32.Downadup.B_F76C8 W32.Downadup.B_DAAFF W32.Downadup.B_D45D3 W32.Downadup.B_C6681 W32.Downadup.B_9D639 W32.Downadup.B_888BE W32.Downadup.B_88701 W32.Downadup.B_6FA5D W32.Downadup.B_69E10 W32.Downadup.B_0E028 W32.Downadup.B_0F586 W32.Downadup.B_FB7AA W32.Downadup.B_85C1D W32.Downadup.B_CCE3B W32.Downadup.B_FAEBC W32.Downadup.B_F1B6A W32.Downadup.B_EC2F8 W32.Downadup.B_D386C W32.Downadup.B_C5367 W32.Downadup.B_BE094 W32.Downadup.B_AF54E W32.Downadup.B_A4C51 W32.Downadup.B_93693 W32.Downadup.B_91A46 W32.Downadup.B_76274 W32.Downadup.B_450DF W32.Downadup.B_33282 W32.Downadup.B_0C3E4 W32.Downadup.B_2580C W32.Downadup.B_29C54 W32.Downadup.B_4B551 W32.Downadup.B_72267 W32.Downadup.B_D02DE W32.Downadup.B_D17B2 W32.Downadup.B_EF9A7 W32.Downadup.B_EA18E W32.Downadup.B_C6991 W32.Downadup.B_6FA23 W32.Downadup.B_5AD9E W32.Downadup.B_3BC30 W32.Downadup.B_17872 W32.Downadup.B_08A10 W32.Downadup.B_0F82B W32.Downadup.B_532CC W32.Downadup.B_DC8CA W32.Downadup.B_AE8F4 W32.Downadup.B_8A328 W32.Downadup.B_7C0F1 W32.Downadup.B_78F16 W32.Downadup.B_699AA W32.Downadup.B_4D68A W32.Downadup.B_60796 W32.Downadup.B_3165B W32.Downadup.B_AE7BD W32.Downadup.B_0EC12 W32.Downadup.B_A72AC W32.Downadup.B_0E687 W32.Downadup.B_D3110 W32.Downadup.B_2C550 W32.Downadup.B_37AC2 W32.Downadup.B_DEF47 W32.Downadup.B_C1A2C W32.Downadup.B_B86D6 W32.Downadup.B_A988F W32.Downadup.B_9E2CB W32.Downadup.B_83D32 W32.Downadup.B_2B496 W32.Downadup.B_224F1 W32.Downadup.B_1A94A W32.Downadup.B_00523 W32.Downadup.B_01B01 W32.Downadup.B_FB3B5 W32.Downadup.B_EEE7A W32.Downadup.B_BB5CD W32.Downadup.B_6896D W32.Downadup.B_4A7C3 W32.Downadup.B_61D2D W32.Downadup.B_AD87F W32.Downadup.B_F5529 W32.Downadup.B_E5552 W32.Downadup.B_67969 W32.Downadup.B_39DC4 W32.Downadup.B_273E4 W32.Downadup.B_23246 W32.Downadup.B_06091 W32.Downadup.B_21786 W32.Downadup.B_3E458 W32.Downadup.B_22870 W32.Downadup.B_25ECC W32.Downadup.B_1F433 W32.Downadup.B_23276 W32.Downadup.B_951FA W32.Downadup.B_E8684 W32.Downadup.B_1BF8D W32.Downadup.B_88DF1 W32.Downadup.B_603F5 W32.Downadup.B_C5E27 W32.Downadup.B_60743 W32.Downadup.B_6FFD7 W32.Downadup.B_F64F0 W32.Downadup.B_C36EB W32.Downadup.B_5A5CB W32.Downadup.B_6B809 W32.Downadup.B_B0E7B W32.Downadup.B_E9296 W32.Downadup.B_35813 W32.Downadup.B_E14B5 W32.Downadup.B_A4C12 W32.Downadup.B_8E80B W32.Downadup.B_86386 W32.Downadup.B_14F78 W32.Downadup.B_54135 W32.Downadup.B_D33FD W32.Downadup.B_FE42E W32.Downadup.B_559CC W32.Downadup.B_5EA90 W32.Downadup.B_E55A6 W32.Downadup.B_BBCC2 W32.Downadup.B_ACB4C W32.Downadup.B_9EC56 W32.Downadup.B_46897 W32.Downadup.B_38E54 W32.Downadup.B_158F3 W32.Downadup.B_289DF W32.Downadup.B_6604B W32.Downadup.B_0A466 W32.Downadup.B_C0A05 W32.Downadup.B_00D86 W32.Downadup.B_8BE0C W32.Downadup.B_B2C85 W32.Downadup.B_EE727 W32.Downadup.B_84DD9 W32.Downadup.B_4BE6F W32.Downadup.B_81642 W32.Downadup.B_149DB W32.Downadup.B_4E3AE W32.Downadup.B_9A521 W32.Downadup.B_7092B W32.Downadup.B_AA58B W32.Downadup.B_7BBF2 W32.Downadup.B_F368F W32.Downadup.B_40A07 W32.Downadup.B_D20DB W32.Downadup.B_B2BE7 W32.Downadup.B_D65B3 W32.Downadup.B_BA443 W32.Downadup.B_B3EDD W32.Downadup.B_5F9C7 W32.Downadup.B_238BE W32.Downadup.B_51891 W32.Downadup.B_FE7DB W32.Downadup.B_6EC6A W32.Downadup.B_48653 W32.Downadup.B_4D35F W32.Downadup.B_884FD W32.Downadup.B_08C19 W32.Downadup.B_FD707 W32.Downadup.B_24B8B W32.Downadup.B_7E61B W32.Downadup.B_29203 W32.Downadup.B_CC077 W32.Downadup.B_BF531 W32.Downadup.B_C1514 W32.Downadup.B_AFED1 W32.Downadup.B_DFB7E W32.Downadup.B_B0027 W32.Downadup.B_04F31 W32.Downadup.B_0E2E5 W32.Downadup.B_02973 W32.Downadup.B_AC614 W32.Downadup.B_0C64C W32.Downadup.B_F25D6 W32.Downadup.B_C8AB4 W32.Downadup.B_F1142 W32.Downadup.B_DBD3A W32.Downadup.B_98974 W32.Downadup.B_5266E W32.Downadup.B_02374 W32.Downadup.B_510CE W32.Downadup.B_2EBAC W32.Downadup.B_F7556 W32.Downadup.B_F06D7 W32.Downadup.B_E971C W32.Downadup.B_E06A6 W32.Downadup.B_E05E6 W32.Downadup.B_DEE9A W32.Downadup.B_DC083 W32.Downadup.B_D4742 W32.Downadup.B_D2499 W32.Downadup.B_CF6BD W32.Downadup.B_CB4AF W32.Downadup.B_C8CEA W32.Downadup.B_C13A5 W32.Downadup.B_BDB20 W32.Downadup.B_AB7C4 W32.Downadup.B_A73A7 W32.Downadup.B_9A70F W32.Downadup.B_99286 W32.Downadup.B_93CB1 W32.Downadup.B_91143 W32.Downadup.B_8CBC0 W32.Downadup.B_89B3F W32.Downadup.B_85DC4 W32.Downadup.B_8181E W32.Downadup.B_8093C W32.Downadup.B_7C117 W32.Downadup.B_7BC4F W32.Downadup.B_7BA07 W32.Downadup.B_79774 W32.Downadup.B_7514E W32.Downadup.B_6F7D5 W32.Downadup.B_6D06A W32.Downadup.B_6C861 W32.Downadup.B_69CC4 W32.Downadup.B_64D60 W32.Downadup.B_63BE2 W32.Downadup.B_5DEBB W32.Downadup.B_5CE18 W32.Downadup.B_54E6F W32.Downadup.B_518E3 W32.Downadup.B_501B1 W32.Downadup.B_4A590 W32.Downadup.B_48589 W32.Downadup.B_41234 W32.Downadup.B_37A76 W32.Downadup.B_36141 W32.Downadup.B_2A9EF W32.Downadup.B_26317 W32.Downadup.B_21F37 W32.Downadup.B_167A2 W32.Downadup.B_16281 W32.Downadup.B_108B3 W32.Downadup.B_0C74A W32.Downadup.B_0C2E6 W32.Downadup.B_0A9E8 W32.Downadup.B_0A787 W32.Downadup.B_041F9 W32.Downadup.B_025CF W32.Downadup.B_03026 W32.Downadup.B_B0DFA W32.Downadup.B_95B8A W32.Downadup.B_9505E W32.Downadup.B_42C33 W32.Downadup.B_83F31 W32.Downadup.B_F5517 W32.Downadup.B_CC82E W32.Downadup.B_B4453 W32.Downadup.B_9DF02 W32.Downadup.B_6219C W32.Downadup.B_4CDE5 W32.Downadup.B_2356E W32.Downadup.B_18BF8 W32.Downadup.B_09AAF W32.Downadup.B_0A3D8 W32.Downadup.B_FF825 W32.Downadup.B_F098A W32.Downadup.B_BA6DE W32.Downadup.B_AC16C W32.Downadup.B_7FC0E W32.Downadup.B_2F008 W32.Downadup.B_56AD4 W32.Downadup.B_E9801 W32.Downadup.B_B9124 W32.Downadup.B_85A8F W32.Downadup.B_9DE95 W32.Downadup.B_99B9A W32.Downadup.B_992E3 W32.Downadup.B_AF8AC W32.Downadup.B_7B5BD W32.Downadup.B_9D1DE W32.Downadup.B_07226 W32.Downadup_0A175 W32.Downadup_45BDB W32.Downadup.B_A8BF4 W32.Downadup.B_6EC1D W32.Downadup.B_94ED0 W32.Downadup.B_DAE4D W32.Downadup.B_C619A W32.Downadup.B_907B3 W32.Downadup.B_2525F W32.Downadup.B_4FBD0 W32.Downadup.B_3939E W32.Downadup.B_74116 W32.Downadup.B_E6D66 W32.Downadup.B_AFD22 W32.Downadup.B_A0C23 W32.Downadup.B_70FFD W32.Downadup.B_1CEE5 W32.Downadup.B_5D811 W32.Downadup.B_13C62 W32.Downadup.B_D899A W32.Downadup.B_5E8C6 W32.Downadup.B_E2FF6 W32.Downadup.B_B574F W32.Downadup.B_08BE4 W32.Downadup.B_6EAE2 W32.Downadup.B_B3F08 W32.Downadup.B_E593C W32.Downadup.B_D5C35 W32.Downadup.B_CDCDD W32.Downadup.B_C1E81 W32.Downadup.B_902A9 W32.Downadup.B_804EC W32.Downadup.B_307CD W32.Downadup.B_2352E W32.Downadup.B_28A0A W32.Downadup_92BAF W32.Downadup_C1990 W32.Downadup.B_76ED2 W32.Downadup.B_002EE W32.Downadup.B_7F850 W32.Downadup.B_E5C75 W32.Downadup.B_C3321 W32.Downadup.B_79360 W32.Downadup.B_06B37 W32.Downadup.B_66FE8 W32.Downadup.B_FCEB6 W32.Downadup.B_C6B38 W32.Downadup.B_C01C2 W32.Downadup.B_BB469 W32.Downadup.B_961D1 W32.Downadup.B_89F09 W32.Downadup.B_71879 W32.Downadup.B_6A9FF W32.Downadup.B_44F43 W32.Downadup.B_2A9D4 W32.Downadup.B_18EE9 W32.Downadup.B_1873E W32.Downadup.B_07980 W32.Downadup.B_0E734 W32.Downadup.B_CA162 W32.Downadup.B_ABF28 W32.Downadup.B_1A696 W32.Downadup.B_81DB5 W32.Downadup.B_62B93 W32.Downadup.B_6F289 W32.Downadup.B_71156 W32.Bobax.dr_2ADBF W32.Virut.B_C68F4 W32.IRCBot_8D503 W32.Spybot.Worm_A8908 W32.Bobax.dr_2F892 W32.IRCBot_6D8A1 W32.Spybot.Worm_E61E0 W32.Spybot.Worm_8A37E W32.Bobax.dr_E02B0 W32.Spybot.Worm_1F47A W32.Spybot.Worm_18EC5 W32.Virut.B_6E3D3 W32.Spybot.Worm_FA5A5 W32.Virut.W_BD328 W32.Virut.W_A84CE W32.Bobax.dr_9D253 W32.IRCBot_8CD0A W32.IRCBot_83D47 W32.IRCBot_6C675 W32.IRCBot_26517 W32.Virut.B_57DC3 W32.Virut.W_78016 W32.Virut.W_34B7F W32.Virut.W_77D64 W32.Spybot.Worm_F125A W32.Spybot.Worm_ED62B W32.Spybot.Worm_CF5CB W32.Virut.W_ABA2E W32.Virut.W_A4FC8 W32.Spybot.Worm_8D1A4 W32.Virut.U_7E9CC W32.Spybot.Worm_70837 W32.Spybot.Worm_6670D W32.Spybot.Worm_5A43B W32.Spybot.Worm_524C5 W32.Spybot.Worm_2BE83 W32.Virut.B_2972F W32.Spybot.Worm_1D4DF W32.Spybot.Worm_043DC W32.Spybot.Worm_15823 W32.Virut.W_D8391 W32.Virut.W_E6F70 W32.Spybot.Worm_5C62C W32.Virut.W_FBBE7 W32.Virut.W_F000D W32.Randex_C2D89 W32.Virut.W_B63B0 W32.Virut.W_7EBC3 W32.Virut.W_78E96 W32.Virut.W_5625B W32.Virut.W_52C7B W32.Virut.W_4783F W32.Virut.W_014C2 W32.Spybot.Worm_07B34 W32.Spybot.Worm_FBDC4 W32.Virut.W_E548A W32.Virut.W_D25D9 W32.Virut.W_AB933 W32.Virut.W_9C6B3 W32.Spybot.Worm_75FB2 W32.Virut.W_6EDA4 W32.Virut.W_65BE8 W32.Virut.W_622F2 W32.Virut.W_5DDCE W32.Virut.W_3BA80 W32.Virut.W_47A8B W32.Virut.W_FBF6B W32.Virut.W_E765B W32.Virut.CF_32D72 W32.Spybot.Worm_74116 W32.Spybot.Worm_B56C3 W32.Spybot.Worm_B0A1B W32.Spybot.Worm_8E6FF W32.Spybot.Worm_0B9F2 W32.Spybot.Worm_0F6B2 W32.Spybot.Worm_F5E2A W32.Spybot.Worm_E7D99 W32.Virut.W_D0929 W32.Virut.W_4895F W32.Virut.W_12C13 W32.Spybot.Worm_43BF6 W32.Spybot.Worm_6870E W32.Spybot.Worm_4931D W32.Spybot.Worm_0799E W32.Spybot.Worm_10899 W32.IRCBot_8BB70 W32.IRCBot_21D85 W32.IRCBot_373F1 W32.Virut.W_A093D Backdoor.IRC.Bot_B6544 W32.Linkbot.M_470D8 W32.Linkbot.M_53D8D W32.Linkbot.M_F1BA4 Trojan.Dropper_94452 W32.Linkbot_C58F3 W32.Linkbot_44D4D W32.Linkbot_FCBB6 W32.Linkbot_BFE1A W32.Linkbot_BDD68 W32.Linkbot_7BE48 W32.Linkbot_750AF W32.Linkbot_744F5 W32.Linkbot_0F276 W32.Linkbot_671FF W32.IRCBot_D09E9 Trojan.Horse_48086 W32.Spybot.Worm_F101F W32.IRCBot_1BBD8 W32.Linkbot.M_EA06D W32.Virut.W_36C09 W32.IRCBot.Gen_97289 W32.Virut.W_9F9A0 W32.Virut.W_BACF5 W32.IRCBot_D5E55 W32.IRCBot_D087B W32.IRCBot_CE0D9 W32.IRCBot_CB836 W32.IRCBot_C2F18 W32.IRCBot_C167D W32.IRCBot_204B9 W32.IRCBot_3287C W32.IRCBot.Gen_760B7 W32.Virut.W_25E62 W32.Virut.W_A6CE1 W32.Virut.W_FBCBC W32.Virut.W_F02DF W32.IRCBot.Gen_E537E W32.Virut.W_D928D W32.Virut.W_9D89F W32.Spybot.Worm_9D6C6 W32.Virut.W_94764 W32.Virut.W_7C332 W32.Spybot.Worm_5F5DD W32.IRCBot.Gen_567D7 W32.IRCBot.Gen_51CBF W32.Virut.W_1F568 Trojan.Horse_49DAD W32.Virut.W_A9A78 W32.Virut.W_3DA53 W32.Virut.W_96EA1 W32.Spybot.Worm_E69FE W32.Spybot.Worm_D9517 W32.Spybot.Worm_F7BC3 Trojan.Horse_70D7F W32.IRCBot_C5A8B W32.IRCBot_EF27C W32.Rinbot.V_112EF W32.Virut.W_10A27 W32.IRCBot.Gen_C16CC W32.Virut.B_22575 W32.IRCBot.Gen_D27FA W32.Virut.W_635FC W32.Virut.W_8F421 W32.IRCBot.Gen_A5151 W32.Virut.W_46295 W32.Virut.W_F69AE W32.Virut.W_735DD W32.Virut.W_A55A2 W32.Virut.W_E7E60 W32.Virut.W_F95E6 W32.IRCBot.Gen_42DEE W32.Spybot.Worm_00D47 Trojan.Horse_3AE9C W32.Spybot.Worm_5C02C W32.IRCBot_6B0E5 W32.IRCBot_F20BA W32.IRCBot_E5D80 W32.IRCBot_DB0EC W32.IRCBot_D1255 W32.IRCBot_B0613 W32.IRCBot_2DC6A W32.IRCBot_4F61D W32.IRCBot_72A85 W32.Virut.R_33B38 W32.IRCBot_02970 W32.IRCBot_E0E1B W32.Spybot.Worm_AE243 W32.IRCBot_C91C3 W32.Spybot.Worm_DD07A W32.Spybot.Worm_5E022 W32.Spybot.Worm_7A454 W32.IRCBot_4CC4D W32.IRCBot.Gen_2CC72 W32.Virut.A_A9E6B W32.Spybot.Worm_DCF1C W32.IRCBot.Gen_2AE7A W32.IRCBot.Gen_9AF36 W32.IRCBot_5A63E W32.IRCBot_BCBA7 W32.IRCBot_FDD66 W32.IRCBot_FBDA2 W32.IRCBot_F6FEA W32.IRCBot_F13F2 W32.Bobax.dr_E8F51 W32.Virut.W_E80BD W32.Virut.W_E71A9 W32.IRCBot_DE26A W32.Virut.W_DDCC4 W32.Virut.W_DA16B W32.Virut.W_BF575 W32.Virut.A_BCF01 W32.Virut.gen_BC3F0 W32.IRCBot_BC1F7 W32.IRCBot_B84E7 W32.Virut.A_B077B W32.Virut.W_B06A8 W32.IRCBot_A69D2 W32.IRCBot_A5740 W32.IRCBot_9F756 W32.Virut.gen_9753F W32.Virut.W_922E2 W32.IRCBot_8DB16 W32.IRCBot_845ED W32.IRCBot_8067E W32.IRCBot_7B1C3 W32.Virut.W_7AD6A W32.Virut.W_7A13E W32.Virut.W_76828 W32.IRCBot_74F77 W32.Virut.W_73339 W32.IRCBot_67A4E W32.IRCBot_5D13E W32.Virut.W_54D96 W32.Virut.W_509F5 W32.IRCBot_44E37 W32.IRCBot_35A07 W32.IRCBot_32761 W32.Virut.W_32005 W32.Virut.W_3161E W32.IRCBot_299E9 W32.IRCBot_2898F W32.IRCBot_287F2 W32.Virut.W_238E5 W32.IRCBot_169DF W32.Virut.W_136CC W32.Virut.W_02A61 W32.Virut.W_12E5B W32.IRCBot_244E2 Trojan.Dropper_B88A4 W32.IRCBot_FF6C2 W32.IRCBot_FF547 W32.IRCBot_FBD52 W32.IRCBot_FBB1F W32.IRCBot_F9864 W32.IRCBot_F8495 W32.IRCBot_F4211 W32.IRCBot_F379B W32.IRCBot_F1D0F W32.IRCBot_EA056 W32.IRCBot_E21E7 W32.IRCBot_E1F72 W32.IRCBot_E0DBB W32.IRCBot_E0A04 W32.IRCBot_DDAB2 W32.IRCBot_DA6F0 W32.IRCBot_D970C W32.IRCBot_D733D W32.IRCBot_D59F3 W32.IRCBot_D44FF W32.IRCBot_D3F77 W32.IRCBot_D37AE W32.IRCBot_D2415 W32.IRCBot_CD9CA W32.IRCBot_CC931 W32.IRCBot_C8EF0 W32.IRCBot_C7823 W32.IRCBot_C45CE W32.IRCBot_C42EF W32.IRCBot_C15CC W32.IRCBot_BFC9B W32.IRCBot_BDBEB W32.IRCBot_B7DFD W32.IRCBot_B7137 W32.IRCBot_B6003 W32.IRCBot_B2AED W32.IRCBot_B1A4A W32.IRCBot_AF61D W32.IRCBot_AE954 W32.IRCBot_AE954 W32.IRCBot_AE2B1 W32.IRCBot_AD202 W32.IRCBot_ACCE2 W32.IRCBot_AC914 W32.IRCBot_AC115 W32.IRCBot_AC084 W32.IRCBot_A92CE W32.IRCBot_A8310 W32.IRCBot_A7818 W32.IRCBot_9CEBE W32.IRCBot_97659 W32.IRCBot_95B0E W32.IRCBot_94DA5 W32.IRCBot_94632 W32.IRCBot_9352E W32.IRCBot_91FEF W32.IRCBot_88CF6 W32.IRCBot_882F5 W32.IRCBot_882C5 W32.IRCBot_86B54 W32.IRCBot_828E4 W32.IRCBot_824B8 W32.IRCBot_822AF W32.IRCBot_81AFB W32.IRCBot_7E1CF W32.IRCBot_7AA2A W32.IRCBot_79CCA W32.IRCBot_7778E W32.IRCBot_7628A W32.IRCBot_743A3 W32.IRCBot_735C7 W32.IRCBot_70A40 W32.IRCBot_6F2B4 W32.IRCBot_6EA2B W32.IRCBot_6D8D4 W32.IRCBot_6C2D6 W32.IRCBot_6B043 W32.IRCBot_6A231 W32.IRCBot_675BB W32.IRCBot_65E4B W32.IRCBot_65A3B W32.IRCBot_5ECD7 W32.IRCBot_5B607 W32.IRCBot_56F47 W32.IRCBot_56F0F W32.IRCBot_56CF1 W32.IRCBot_5471C W32.IRCBot_540D8 W32.IRCBot_537DF W32.IRCBot_50480 W32.IRCBot_4E873 W32.IRCBot_4E6A9 W32.IRCBot_4C12D W32.IRCBot_4B0DE W32.IRCBot_48C9C W32.IRCBot_48A42 W32.IRCBot_4703E W32.IRCBot_45D1C W32.IRCBot_4595A W32.IRCBot_458C8 W32.IRCBot_4544D W32.IRCBot_43E22 W32.IRCBot_42835 W32.IRCBot_424C4 W32.IRCBot_40DFD W32.IRCBot_3EFF5 W32.IRCBot_3D93B W32.IRCBot_3CE3C W32.IRCBot_3CB28 W32.IRCBot_3B86D W32.IRCBot_3A443 W32.IRCBot_39837 W32.IRCBot_39701 W32.IRCBot_39673 W32.IRCBot_364CC W32.IRCBot_32A19 W32.IRCBot_3169F W32.IRCBot_2FA8F W32.IRCBot_2E70C W32.IRCBot_2AE6F W32.IRCBot_27756 W32.IRCBot_24366 W32.IRCBot_22800 W32.IRCBot_21903 W32.IRCBot_20D32 W32.IRCBot_2064C W32.IRCBot_2050D W32.IRCBot_1DAEC W32.IRCBot_1D8DA W32.IRCBot_15534 W32.IRCBot_12A92 W32.IRCBot_1185D W32.IRCBot_09768 W32.IRCBot_08706 W32.IRCBot_08047 W32.IRCBot_07484 W32.IRCBot_07246 W32.IRCBot_047AB W32.IRCBot_02F56 W32.IRCBot_009BF W32.IRCBot_02642 W32.Virut.B_F8930 W32.IRCBot_E6233 W32.IRCBot_D6FAE W32.IRCBot_B25AB W32.IRCBot_A639C W32.IRCBot_A6384 W32.IRCBot_A32CC W32.IRCBot_99C88 W32.IRCBot_8A2CC W32.IRCBot_873B8 W32.IRCBot_7B56C W32.IRCBot_6D36D W32.IRCBot_50B2D W32.IRCBot_3ED7F W32.IRCBot_3841E W32.IRCBot_27180 W32.IRCBot_11A83 W32.IRCBot_13A50 W32.IRCBot.Gen_DC864 W32.Virut.W_7BA04 W32.Spybot.Worm_A694A Infostealer.Gampass_BDAD3 W32.IRCBot_EE851 W32.IRCBot_1D2CE W32.IRCBot_3A683 W32.IRCBot_DEBE3 W32.Rinbot.V_A71F4 W32.Spybot.Worm_F28E8 W32.IRCBot_5D025 W32.IRCBot_14ECA W32.Rinbot.V_862C8 W32.IRCBot_9A841 W32.IRCBot_69200 W32.Virut.W_33655 W32.Virut.W_564E8 W32.Virut.W_13B66 W32.Virut.W_2CC25 W32.Virut.A_8AB0E W32.Virut.H_C88C8 W32.Virut.B_C3B42 W32.Virut.B_2BAF3 W32.Bobax.dr_C13A1 W32.Virut.B_D5345 W32.Bobax.dr_51CBE W32.Bobax.dr_55617 Suspicious.MH690_35ADE W32.Virut.W_DECD1 W32.Virut.W_34487 W32.Virut.W_4AD62 W32.Virut.W_8C6BC W32.Virut.W_56CFC W32.Virut.W_71FEF W32.Virut.W_CE9FC W32.Virut.W_0440F W32.Virut.W_9ACCA W32.Virut.W_39E25 W32.Virut.W_5676F W32.Virut.W_EBA38 W32.Virut.W_D1B9D W32.Virut.W_CD39F W32.Virut.W_1F7C2 W32.Virut.W_F19F7 W32.Virut.W_57F0E W32.Virut.W_5C54C W32.Virut.W_3AB1B W32.Virut.W_97ED2 W32.Virut.W_B0D69 W32.Virut.W_035A4 W32.Virut.W_A2CAD W32.Virut.W_CA16F W32.Virut.W_AEC49 W32.Virut.W_A1851 W32.Virut.W_5B6D2 W32.Virut.W_23668 W32.Virut.W_1F51D W32.Virut.W_A4300 W32.Virut.W_CBDDB W32.Spybot.Worm_E0202 W32.Virut.W_BE68F W32.Spybot.Worm_8F7D4 W32.Virut.W_795FB W32.Virut.W_6CC27 W32.Virut.R_59EA7 W32.Virut.W_2B80D W32.Virut.W_27A19 W32.Virut.W_52D00 W32.Virut.W_E0FED W32.Virut.W_185E8 W32.Virut.W_46035 W32.Virut.W_497EC W32.Virut.W_CD292 W32.Virut.W_A586C W32.Virut.W_F49CE W32.Virut.W_7B334 W32.Virut.W_9B01E W32.Virut.W_F94FB W32.Virut.W_F82D9 W32.Virut.W_EBF86 W32.Virut.W_EBD96 W32.Virut.W_E2EC6 W32.Virut.W_D267A W32.Virut.W_D1FDB W32.Virut.W_CC7BA W32.Virut.W_C8FA2 Suspicious.MH690_C047E W32.Virut.W_BEB03 W32.Virut.W_B3E52 W32.Virut.W_B392E W32.Virut.W_A7E9E W32.Virut.W_9E6C4 W32.Virut.W_9566A W32.Virut.W_9532E W32.Virut.W_934F8 W32.Virut.W_89104 W32.Virut.W_86358 W32.Virut.W_7F132 W32.Virut.W_7ECDD W32.Spybot.Worm_6DEC5 W32.Virut.W_5CDF1 W32.Virut.W_51C0F W32.Virut.W_4520A W32.Virut.W_25EDE W32.Spybot.Worm_25419 W32.Virut.W_17E82 W32.Virut.W_17CF4 W32.Virut.W_05487 W32.Spybot.Worm_17AA6 W32.Spybot.Worm_35270 W32.Virut.W_C293B W32.IRCBot_20038 W32.IRCBot.Gen_C4E8A W32.IRCBot.Gen_9EE1B W32.IRCBot.Gen_5C17A W32.IRCBot.Gen_CFF61 W32.Spybot.Worm_B56DA W32.Spybot.Worm_EED6C W32.IRCBot_A3EAB W32.IRCBot_1DED3 W32.IRCBot_5FD15 W32.IRCBot_51DA8 W32.IRCBot_819F2 W32.Spybot.Worm_6600C W32.IRCBot_98A8E W32.IRCBot_699AD W32.IRCBot_85A54 W32.Virut.W_1B7DA W32.Spybot.Worm_EB0FC W32.Spybot.Worm_8B9EE Adware.Slagent_5AE02 W32.Spybot.Worm_B7D0B W32.Spybot.Worm_606EB W32.Virut.W_29F75 W32.Virut.W_503DF W32.Virut.W_10DFA W32.Virut.W_AE984 W32.Virut.W_D8CB9 W32.IRCBot_0313E W32.Virut.W_9FFCC W32.Virut.W_64E82 W32.Virut.W_63257 W32.Virut.W_04EFA W32.Virut.W_FB9B1 W32.Virut.W_E30B7 W32.Virut.W_D6252 W32.Virut.W_42D6E W32.Virut.W_4D2CF W32.Spybot.Worm_8ADEE W32.IRCBot_93240 W32.Virut.W_B9F18 W32.Virut.W_E68AE W32.Virut.W_BA82B W32.Spybot.Worm_BE04D W32.Virut.R_588D1 W32.Virut.W_7C895 W32.Spybot.Worm_5DEE7 W32.Virut.W_03BE6 W32.Virut.W_A508B W32.Spybot.Worm_858C1 W32.Virut.W_900B9 W32.Virut.W_200D8 W32.Spybot.Worm_F168D W32.Virut.W_C9255 W32.IRCBot_B0721 W32.Virut.W_6248A W32.Virut.W_D001F W32.Virut.W_D5F82 W32.IRCBot_DDBFD W32.Spybot.Worm_8131D W32.Rinbot.V_24A0E W32.Bobax.dr_B7272 W32.IRCBot_2E82D W32.IRCBot_54402 W32.IRCBot.Gen_CB368 W32.IRCBot.Gen_E36D7 W32.IRCBot_D0EFA W32.IRCBot_84EE1 W32.IRCBot_C92A7 W32.IRCBot_9DF52 W32.IRCBot_6631D W32.IRCBot_2836C W32.IRCBot_F5E0F Backdoor.Sdbot_A4CED W32.Spybot.Worm_7E100 W32.Virut.W_B5271 W32.IRCBot.Gen_9C3CD W32.Spybot.Worm_B473D W32.IRCBot_20A79 W32.IRCBot_4F8D5 Backdoor.IRC.Bot_AA9DA Backdoor.IRC.Bot_0769A Backdoor.IRC.Bot_C4132 Backdoor.IRC.Bot_D5C6E Downloader_BA5E6 W32.IRCBot_D7855 W32.IRCBot_E325D Trojan.Horse_80B03 Backdoor.IRC.Bot_2CE02 Trojan.Horse_43DFA Backdoor.Trojan_7EF24 W32.Virut.W_97FFC W32.Virut.W_3ED81 Backdoor.Trojan_3769D Backdoor.Trojan_0288D W32.Virut.W_191D5 W32.Spybot.Worm_9557D W32.IRCBot_058D7 W32.Virut.W_7643F W32.Virut.W_00EB8 W32.IRCBot_532AA W32.IRCBot_2AC84 UNKNOWN_69646 W32.Virut.W_3C82E W32.IRCBot_93A68 W32.IRCBot_2BE09 W32.IRCBot_DA46A W32.IRCBot_A5A07 W32.IRCBot_E5B06 W32.Virut.W_A4F72 W32.IRCBot_0CACC W32.Virut.W_649D4 UNKNOWN_F3613 W32.Virut.W_ECB71 W32.Virut.W_D9857 W32.Virut.W_CDFCA W32.Virut.W_6D2AC W32.Virut.W_2BCAE W32.Virut.W_65969 W32.IRCBot_C1918 W32.IRCBot_E50C7 W32.Spybot.Worm_65BEE W32.Virut.W_AC484 W32.IRCBot_33FD8 W32.Sality.U_8F4BB W32.Bobax.dr_A6470 W32.IRCBot_F63E6 W32.IRCBot_EED58 W32.IRCBot_C6D16 W32.IRCBot_DAD84 Trojan.Donbot_841FC Trojan.Donbot_97DE8 Trojan.Donbot_8F531 Trojan.Donbot_A7963 W32.Spybot.Worm_F995A W32.Spybot.Worm_F0855 W32.Spybot.Worm_EA596 W32.Spybot.Worm_E285E W32.Spybot.Worm_DC869 W32.Spybot.Worm_D7A16 W32.Spybot.Worm_D27A6 W32.Spybot.Worm_D1CB6 W32.Spybot.Worm_CFFB8 W32.Spybot.Worm_CEF99 W32.Spybot.Worm_B9492 W32.Spybot.Worm_B2BFF W32.Spybot.Worm_AD22C W32.Spybot.Worm_AC3CD W32.Spybot.Worm_AB1E3 W32.Spybot.Worm_87193 W32.Spybot.Worm_846E7 W32.Spybot.Worm_5EB53 W32.Spybot.Worm_3F93B W32.Spybot.Worm_39459 W32.Spybot.Worm_36B84 W32.Spybot.Worm_35584 W32.Spybot.Worm_2C073 W32.Spybot.Worm_1A207 W32.Spybot.Worm_0C899 W32.Spybot.Worm_044E8 W32.Spybot.Worm_08F7B W32.Spybot.Worm_9C5F7 W32.Spybot.Worm_0829D W32.IRCBot_10CCC W32.Virut.B_FCFA4 W32.Virut.W_E69C6 W32.Virut.W_D78DA W32.Virut.W_C9BB5 W32.Virut.W_C6E20 W32.Virut.W_BBA01 W32.Virut.W_8A4CA W32.Virut.W_87526 W32.Virut.W_6DAB4 W32.IRCBot.Gen_691E3 W32.Virut.W_61DA7 W32.Virut.W_5E4D0 W32.Virut.W_4FEBB W32.Virut.W_43895 W32.Virut.W_088A9 W32.Virut.W_4272C W32.Virut.W_6B8E6 W32.Virut.B_812B7 W32.Virut.B_C8946 W32.Virut.B_00548 W32.Virut.B_4A C Conficker.A/B/B++ Rahack 94% Rahack.W Rahack.H 2 Rahack.W Rahack.H 98% 4 1 Backdoor.Trojan [94] IRC [95] IRCBot Virut [96] Virut

85 5.6 C 71 IRC C 95% Conficker.B 5.6 C 95% Conficker.B++ Rahack.W IRCBot % C 66% 95% 73.3% 90% 5.7

86 C 90% Conficker.B Conficker.B++ Rahack.W Rahack.H IRCBot % 90% % 90% 86.1% 2,500 3, % % % 90% 86.1%

87 C 50% 20% % [97, 98]

88 C 20% ( ) sdbot v0.4b (sdbot04b) sdbot v0.5a (sdbot05a) sdbot v0.5b (sdbot05b) rxbot v0.7.7 Sass (rxbot) Visual C++, lcc-win32 Visual C++, lcc-win32 Visual C++, lcc-win32, MinGW Visual C