p004 1 Content-type: multipart/related
p005 1/1 Content-type: multipart/alternative
p001 1/1/1 Content-type: text/plain
p002 1/1/2 Content-type: text/html
p003 1/2 Content-type: image/gif, name: image001.gif
p.path: "P=p004,L=1,M=multipart/related | P=p003,L=1/2,M=image/gif,T=gif,N=image001.gif"
p.path: "P=p004,L=1,M=multipart/related | P=p005,L=1/1,M=multipart/alternative | P=p001,L=1/1/1,M=text/plain,T=asc"
p.path: "P=p004,L=1,M=multipart/related | P=p005,L=1/1,M=multipart/alternative | P=p002,L=1/1/2,M=text/html,T=html"

p006 1 Content-type: multipart/mixed
p001 1/1 Content-type: text/plain
p002 1/2 Content-type: application/vnd.ms-excel, name: kal_ftr1.xls
p003 1/3 Content-type: application/vnd.ms-excel, name: Prikaz-projekt-04-NPD-NET.xls
p004 1/4 Content-type: application/vnd.ms-excel, name: Prikaz-ur-04-NPD-Net.xls
p005 1/5 Content-type: application/vnd.ms-excel, name: NPD_plan.xls
p.path: "P=p006,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain,T=txt"
p.path: "P=p006,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/vnd.ms-excel,T=doc,N=kal_ftr1.xls"
p.path: "P=p006,L=1,M=multipart/mixed | P=p003,L=1/3,M=application/vnd.ms-excel,T=doc,N=Prikaz-projekt-04-NPD-NET.xls"
p.path: "P=p006,L=1,M=multipart/mixed | P=p004,L=1/4,M=application/vnd.ms-excel,T=doc,N=Prikaz-ur-04-NPD-Net.xls"
p.path: "P=p006,L=1,M=multipart/mixed | P=p005,L=1/5,M=application/vnd.ms-excel,T=doc,N=NPD_plan.xls"

p004 1 Content-type: multipart/mixed
p005 1/1 Content-type: multipart/alternative
p001 1/1/1 Content-type: text/plain
p002 1/1/2 Content-type: text/html
p003 1/2 Content-type: application/msword, name: Bilten 2004 - 09.doc
p.path: "P=p004,L=1,M=multipart/mixed | P=p003,L=1/2,M=application/msword,T=doc,N=Bilten 2004 - 09.doc"
p.path: "P=p004,L=1,M=multipart/mixed | P=p005,L=1/1,M=multipart/alternative | P=p001,L=1/1/1,M=text/plain,T=txt"
p.path: "P=p004,L=1,M=multipart/mixed | P=p005,L=1/1,M=multipart/alternative | P=p002,L=1/1/2,M=text/html,T=html"

p003 1 Content-type: multipart/mixed
p001 1/1 Content-type: text/plain
p002 1/2 Content-type: application/octet-stream, name: transcript.zip
p.path: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain,T=asc"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/octet-stream,T=zip,N=transcript.zip | P=p004,L=1/2/1,T=exe,T=exe-ms,N=transcript.exe"

p005 1/1 Content-type: multipart/alternative
p001 1/1/1 Content-type: text/plain
p002 1/1/2 Content-type: text/html
p003 1/2 Content-type: audio/x-wav, name: message.scr
p.path: "P=p004,L=1,M=multipart/related | P=p003,L=1/2,M=audio/x-wav,T=exe,T=exe-ms,N=message.scr"
p.path: "P=p004,L=1,M=multipart/related | P=p005,L=1/1,M=multipart/alternative | P=p001,L=1/1/1,M=text/plain"
p.path: "P=p004,L=1,M=multipart/related | P=p005,L=1/1,M=multipart/alternative | P=p002,L=1/1/2,M=text/html,T=html"

p003 1 Content-type: multipart/mixed
p001 1/1 Content-type: text/plain
p002 1/2 Content-type: application/octet-stream, name: message_details.pif
p.path: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain,T=asc"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/octet-stream,T=exe,T=exe-ms,N=message_details.pif"

W32/Bagle-AA
p003 1 Content-type: multipart/mixed
p001 1/1 Content-type: text/html
p002 1/2 Content-type: application/octet-stream, name: MoreInfo.hta
p.path: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/html,T=html"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/octet-stream,T=html,N=MoreInfo.hta"

Troj/BagleDl-A
p003 1 Content-type: multipart/mixed
p001 1/1 Content-type: text/plain
p002 1/2 Content-type: application/x-zip-compressed, name: =?koi8-r?B?Zm90by56aXA=?=
p.path: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain,T=asc"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-zip-compressed,T=zip,N==?koi8-r?B?Zm90by56aXA=?=,N=foto.zip | P=p004,L=1/2/1,T=html,N=foto.html"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-zip-compressed,T=zip,N==?koi8-r?B?Zm90by56aXA=?=,N=foto.zip | P=p005,L=1/2/2,N=foto/,A=D"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-zip-compressed,T=zip,N==?koi8-r?B?Zm90by56aXA=?=,N=foto.zip | P=p006,L=1/2/3,T=exe,T=exe-ms,N=foto/expander.exe"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-zip-compressed,T=zip,N==?koi8-r?B?Zm90by56aXA=?=,N=foto.zip | P=p007,L=1/2/4,T=doc,N=foto/Thumbs.db"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-zip-compressed,T=zip,N==?koi8-r?B?Zm90by56aXA=?=,N=foto.zip | P=p008,L=1/2/5,T=jpg,N=foto/photo.jpg"

W32/Netsky-N
p007 1 Content-type: multipart/report
p001 1/1 Content-type: text/plain
p002 1/2 Content-type: message/delivery-status
p008 1/3 Content-type: message/rfc822
p009 1/3/1 Content-type: multipart/mixed
p010 1/3/1/1 Content-type: multipart/related
p011 1/3/1/1/1 Content-type: multipart/alternative
p003 1/3/1/1/1/1 Content-type: text/plain
p004 1/3/1/1/1/2 Content-type: text/html
p005 1/3/1/1/2 Content-type: image/gif, name: symantec.gif
p006 1/3/1/2 Content-type: application/octet-stream, name: document_all_elson.zip
p.path: "P=p007,L=1,M=multipart/report | P=p001,L=1/1,M=text/plain,T=asc"
p.path: "P=p007,L=1,M=multipart/report | P=p002,L=1/2,M=message/delivery-status,T=asc"
p.path: "P=p007,L=1,M=multipart/report | P=p008,L=1/3,M=message/rfc822 | P=p009,L=1/3/1,M=multipart/mixed | P=p010,L=1/3/1/1,M=multipart/related | P=p005,L=1/3/1/1/2,M=image/gif,T=gif,N=symantec.gif"
p.path: "P=p007,L=1,M=multipart/report | P=p008,L=1/3,M=message/rfc822 | P=p009,L=1/3/1,M=multipart/mixed | P=p006,L=1/3/1/2,M=application/octet-stream,T=zip,N=document_all_elson.zip | P=p012,L=1/3/1/2/1,T=exe,T=exe-ms,N=your_details.scr"
p.path: "P=p007,L=1,M=multipart/report | P=p008,L=1/3,M=message/rfc822 | P=p009,L=1/3/1,M=multipart/mixed | P=p010,L=1/3/1/1,M=multipart/related | P=p011,L=1/3/1/1/1,M=multipart/alternative | P=p003,L=1/3/1/1/1/1,M=text/plain,T=asc"
p.path: "P=p007,L=1,M=multipart/report | P=p008,L=1/3,M=message/rfc822 | P=p009,L=1/3/1,M=multipart/mixed | P=p010,L=1/3/1/1,M=multipart/related | P=p011,L=1/3/1/1/1,M=multipart/alternative | P=p004,L=1/3/1/1/1/2,M=text/html,T=html"

W32/Mabutu-A
p003 1 Content-type: multipart/mixed
p001 1/1 Content-type: text/plain
p002 1/2 Content-type: application/x-zip-compressed, name: photo.zip
p.path: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-zip-compressed,T=zip,N=photo.zip | P=p004,L=1/2/1,T=exe,T=exe-ms,N=photo.jpg            .scr"

p003 1 Content-type: multipart/mixed
p001 1/1 Content-type: text/plain
p002 1/2 Content-type: application/x-tgz, name: 00.tar.gz
p.path: "P=p003,L=1,M=multipart/mixed | P=p001,L=1/1,M=text/plain"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p005,L=1/2/1/1,N=aa"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p006,L=1/2/1/2,N=alpha,A=D"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p007,L=1/2/1/3,N=one"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p008,L=1/2/1/4,N=two"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p009,L=1/2/1/5,N=three"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p010,L=1/2/1/6,N=bravo,A=D"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p011,L=1/2/1/7,N=first"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p012,L=1/2/1/8,N=second"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p013,L=1/2/1/9,N=charlie,A=D"
p.path: "P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/x-tgz,T=gz,N=00.tar.gz | P=p004,L=1/2/1,T=tar,N=00.tar | P=p014,L=1/2/1/10,N=last"