Trojan.Generic.7418640_1b7327ede5 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:452

The Trojan injects its code into the following process(es):

Explorer.EXE:1684

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

The process %original file name%.exe:452 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 3F C9 95 BC 6C 37 37 2C 4D 06 38 7E F8 3E 5B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"svmhost.exe" = "%Documents and Settings%\%current user%\Application Data\svmhost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"svmhost.exe" = "%Documents and Settings%\%current user%\Application Data\svmhost.exe"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:452
Delete the original Trojan file.
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"svmhost.exe" = "%Documents and Settings%\%current user%\Application Data\svmhost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"svmhost.exe" = "%Documents and Settings%\%current user%\Application Data\svmhost.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	12288	12288	3.2632	97aced61d02cbaaf6101ac753674aedb
.data	16384	29533	29696	3.83593	77d9114a0b098c98deaf120bfc5de70d
.rsrc	49152	1000	1024	0	0f343b0931126a20f133d67c2b018a3b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://api.wipmania.com/	212.83.168.196

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

User-Agent: Mozilla/5.0 (compatible)

Host: api.wipmania.com

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 08 Apr 2015 04:57:31 GMT

Content-Type: text/html

Content-Length: 20

Connection: keep-alive

Keep-Alive: timeout=20

91.200.159.131<br>UA..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

Explorer.EXE_1684_rwx_00EE0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_00FF0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_01590000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_017F0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_01A10000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_01FF0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02060000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02070000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02080000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02220000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02230000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02240000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_023A0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_023B0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_023C0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_023E0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_028B0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_028C0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_028D0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_028F0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02900000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02910000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02930000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_029A0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_029C0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02B80000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

y0SSSh

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Explorer.EXE_1684_rwx_02B90000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

1018420

udp.stop

dload.stop

join

yaboyyoshi.info

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

svmhost.exe

7$7*70767

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\svmhost.exe

c:\%original file name%.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps