So what looked like anti-detection padding or something in the RoguePlanet.cpp is an ISO file. At the same time, where's the EICAR that he's writing to wermgr.exe?
Of course, you say, it has to be in the ISO file. And sure it is. In a ZIP file, being extracted to a subdir named 4444.
