Gen.Variant.Kazy.532173_5113b613d4 – Adaware

Trojan.Win32.IRCbot.ewt (Kaspersky), Gen:Variant.Kazy.532173 (B) (Emsisoft), Gen:Variant.Kazy.532173 (AdAware), GenericAutorunWorm.YR, GenericInjector.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 5113b613d4b06cb620409cfbec71c1a0

SHA1: 7bd142cb48ccc60ce67cddd07484a9de2feb551a

SHA256: eee4e45004c3f36502d77c9b148cdaa2b38e3c5d51491be645c349f2abff6150

SSDeep: 6144:QuqPHCVmU1pYV9Xu6gAKOyGBlpcdUY6JcgZ77neXGiiKkPG2I0:QuRUU1STu65dyGBiS7zoinX

Size: 410112 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: no certificate found

Created at: 2015-01-09 04:06:33

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The Trojan creates the following process(es):

Applaunch.exe:800

The Trojan injects its code into the following process(es):

%original file name%.exe:552
Explorer.EXE:888

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

The process Applaunch.exe:800 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 19 2D F4 10 2C 6F AE 1D 62 DF 7C AA DF 53 9F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Stub.exe" = "%Documents and Settings%\%current user%\Application Data\stub.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Stub.exe" = "%Documents and Settings%\%current user%\Application Data\stub.exe"

The process %original file name%.exe:552 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CA FF 6F 35 E4 0B 3D 55 98 58 13 F0 B4 CC D1 F9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

MD5	File path
170d73be3fe846e9070cfae530f5a31c	c:\Documents and Settings\"%CurrentUserName%"\Application Data\stub.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
Applaunch.exe:800
Delete the original Trojan file.
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Stub.exe" = "%Documents and Settings%\%current user%\Application Data\stub.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Stub.exe" = "%Documents and Settings%\%current user%\Application Data\stub.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: fud2.exe
Internal Name: fud2.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: 0.0.0.0Legal Copyright: Legal Trademarks: Original Filename: fud2.exeInternal Name: fud2.exeFile Version: 0.0.0.0File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	404516	404992	3.8397	a182cc0b1b3a3f305cddef46affdde67
.rsrc	417792	4096	4096	0.461601	4a54cd189cf68f208020eba6108bed76
.reloc	425984	12	512	0.070639	faa032810abb1e597b45060a211ff748

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://api.wipmania.com/

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

User-Agent: Mozilla/5.0 (compatible)

Host: api.wipmania.com

HTTP/1.1 200 OK

Server: nginx

Date: Wed, 14 Jan 2015 22:48:47 GMT

Content-Type: text/html

Content-Length: 21

Connection: keep-alive

Keep-Alive: timeout=20

193.138.244.231<br>UAHTTP/1.1 200 OK..Server: nginx..Date: Wed, 14 Jan 2015 22:48:47 GMT..Content-Type: text/html..Content-Length: 21..Connection: keep-alive..Keep-Alive: timeout=20..193.138.244.231<br>UA..

PASS 45u..

:xi990desfi.com NOTICE AUTH :*** Looking up your hostname.....:xi990desfi.com NOTICE AUTH :*** Looking up your hostname.....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

DW20.EXE_460:

.text

`.data

.cdata

.rsrc

watson.microsoft.com

.mdmp

%s?szAppName=%S&szAppVer=%S&szAppStamp=%S&szModName=%S&szModVer=%S&szModStamp=%S&fDebug=%S&offset=%S

/dw/stagetwo.asp

%s/%S/%S/%S/%S/%S/%S/%S/%S.htm

Failed to fill report params from generic params

Not offering reporting

%s Mode

Failed to get a reporting destination

Nothing to report from queue

No reports left to send. Removing queue triggers and bailing.

Failed to plug UI; LCID=%u

Ignoring %S due to unknown queue version

Reporting is disabled

SignOff queue reporting is disabled

Queued Reporting Mode called but still want to report to the queue

Bad queue type to report from

No reports for given queue mask - %u

Invalid queue mask - %u

Suspending: Force cancel to queued reporting

Suspending: Force cancel to network reporting

CreateWindowExA failed with %d.

Application Error Reporting %d

WatsonQueuedReportingInstanceVerification

riched20.dll

qMicrosoft\PCHealth\ErrorReporting\DW

msaccess.exe

hXXp://watson.microsoft.com/dw/dcp.asp

hXXp://watson.microsoft.com/dw/watsoninfo.asp

dwintl20.dll

Launching lightweight browser with URL

mshtml.dll

Not reporting

Reporting

DWBypassQueue

DWExplainerURL

DWNoSignOffQueueReporting

DWAlwaysReport

DWReporteeName

DWURLLaunch

DWNoExternalURL

DWStressReport

ole32.dll

imm32.dll

BTLog.dll

Microsoft\PCHealth\ErrorReporting\DW

HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger

hXXp://

hXXps://

Software\Microsoft\PCHealth\ErrorReporting\DW\Debug

%s\%s

https

DwBTLog.log

Failed to get minidump for %S!

szAppName=%s

szAppVer=%d.%d.%d.%d

szAppStamp=x

szModName=%s

szModVer=%d.%d.%d.%d

szModStamp=x

fDebug=%s

offset=x

microsoft.com

.msn.com

.microsoft.com

d:d:d d-d-d

/dw/generictwo.asp

kernel32.dll

psapi.dll

mso.dll

MsoDWRecover%x

MsoDWHang%x

Launching browser with URL

shell32.dll

%d.%d.%d.%d

%d.%d.%d.%d.x.%d.%d

shfolder.dll

unknown.sig

%s dw20.exe %d.%d.%d.%d

RegKey=

ResponseURL=

URLLaunch=

NoExternalURL=

%s:(%s) XX

%s:(%s) X

%s:(%s)

%s:(%s) %s

registry.txt

wql.txt

Windows NT Version %d.%d Build: %d

Stage 1 server response: %s

Stage 2 server response: %s

Stage 4 server response: %s

StatusCode: %d

Opening server: %s

HttpOpen failed.

Opening %s Request:

HTTPS

HttpSend Failed.

HttpWrite Failed, GLE=%d.

HttpEndReq failed.

Count filename length greater than MAX_PATH, can't report.

Filesystem reporting: count file updated

FReportToQueue: GetLastError=%u

FReportToQueue: File Tree Root does not exist: %S

Failed to add heap file to cab: %S

memory.dmp

mdmpmem.hdmp

version.txt

Network reporting complete.

Network reporting failed.

Application Error Reporting Transfer %d

Filesystem reporting complete

Filesystem reporting: cab successfully written

Filesystem reporting: could not find/create directory for cab/count

Filesystem reporting: redirection failure, too many redirects

Filesystem reporting: redirection failure, no previous roots

Filesystem reporting: improper file tree root

Filesystem reporting cancelled

Filesystem reporting: file tree root is too long

Record: 0xxx

Address: 0xxx

Code: 0xx

Flags: 0xx

x:x

(%d.%d:%d.%d)

Checksum: 0xx

Time Stamp: 0xx

Image Base: 0xx

Image Size: 0xx

Module %d

Windows NT %d.%d Build: %d

CPU AMD Feature Code: X

CPU Version: X CPU Feature Code: X

CPU Vendor Code: X - X - X

0xx:

0xx: x x x x

EFlags: 0xx ESP: 0xx SegSs: 0xx

EIP: 0xx EBP: 0xx SegCs: 0xx

EBX: 0xx ECX: 0xx EDX: 0xx

EDI: 0xx ESI: 0xx EAX: 0xx

Thread ID: 0xx

Thread %d

Memory Range %d

Software\Microsoft\PCHealth\ErrorReporting\DW

OkToReportFromTheseQueues

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Failed to obtain queue mutex. GetLastError=%u

FGetQueueMutex: WaitForSingleObject returned %u

Failed to open or create queue mutex. GetLastError=%u

Failed queued reporting pester check

Failed to create run reg key

Persistent run key is set.

CoInitializeEx() returned 0x%x.

Reporting to Admin Queue

Reporting to Regular Queue

Reporting to SignOff Queue

Reporting to Headless Queue

Reporting from Regular Queue

Reporting from SignOff Queue

Reporting from Headless Queue

OOM Failed to alloc QueuedReportData

FAllocSD: GetLastError=%u

%s%s%s

FEnsureQueueDirW: GetLastError=%u

Failed to write snt. GLE: %u

Failed to create snt. GLE: %u

Failed to set info; bad queue type: %u

Failed to open reg key for queue

Failed to get windows folder path for queue: %u

Failed to move instr file from queue A to queue B - %u

Failed to move cab file from queue A to queue B - %u

Did not move any reports from admin q to user q

Did not move any reports from user q to headless q

Queue types that have reports: %u

Setting triggerAtConnectionMade to: %u

Setting triggerAtLogon to: %u

Setting the queue trigger based upon: %u

SUCCESS adding report to queue

Launched (%S)

Failed to store the SensSubscription. hr: %d

failed to allocate PROGID string: %S

Failed putting SubscriberInterface. hr: %d

Failed putting PerUser. hr: %d

Failed putting Enabled. hr: %d

Failed putting MachineName. hr: %d

Failed putting OwnerSID. hr: %d

Failed putting Description. hr: %d

Failed putting InterfaceID. hr: %d

Failed putting EventClassID. hr: %d

Failed putting MethodName. hr: %d

Failed putting SubscriptionName. hr: %d

Failed putting PublisherID. hr: %d

Failed putting SubscriberCLSID. hr: %d

Failed putting SubscriptionID. hr: %d

Failed CoCreateInstance on EventSubscription. hr: %d

Failed to remove the SensSubscription. hr: %d

failed to allocate query string: %S

Failed CoCreateInstance on EventSystem. hr: %d

SENS: StringFromIID() returned

DWSHARED: SysAllocString(%s) failed!

Failed to subscribe subscription %u. hr: %d

Failed to get data for subscription %u. hr: %d

Failed to query install reg key

Failed to open install reg key

Software\Microsoft\PCHealth\ErrorReporting\DW\Installed

HKEY_USERS\

HKEY_CURRENT_CONFIG\

HKEY_CLASSES_ROOT\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

initing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

freeing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

0addref CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

QIing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

releasing CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

deleting CDwAccessible: hwnd %x, idc %d, m_pDefAcc %x, cRef %d

creating CDwAccessible: hwnd %x, idc %d

WriteAtOffset.Write(0x%x) failed, 0xx

WriteAtOffset.Seek(0x%x) failed, 0xx

WriteMemoryFromProcess.Read(0x%I64x, 0x%x) failed, 0xx

WriteStringToPool.Write(0x%x) failed, 0xx

WriteFunctionTable.RawEntries.Write(0x%x) failed, 0xx

WriteFunctionTable.RawTable.Write(0x%x) failed, 0xx

WriteFunctionTableList.DumpTable.Write(0x%x) failed, 0xx

WriteFunctionTableList.Seek(0x%x) failed, 0xx

WriteDirectoryEntry.Write(0x%x) failed, 0xx

Thread(0x%x) callback returned FALSE

WriteSystemInfo.GetOsCsdString failed, 0xx

WriteSystemInfo.GetCpuInfo failed, 0xx

CalculateSizeForSystemInfo.GetOsCsdString failed, 0xx

WriteHeader.GetCurrentTimeDate failed, 0xx

WriteDirectoryTable.Seek(0x%x) failed, 0xx

WriteMemoryInfo.Write(0x%x) failed, 0xx

WriteMemoryInfo.QueryVirtual(0x%I64x) failed, 0xx

WriteFullMemory virtual memory layout changed, retries %d, 0x%I64x (0x%I64x:0x%I64x) vs. 0x%I64x (0x%I64x:0x%I64x)

WriteFullMemory.Memory.Write(0x%x) failed, 0xx

WriteFullMemory.Memory.Read(0x%I64x, 0x%x) failed, retries %d, 0xx

WriteFullMemory.QueryVirtual(0x%I64x) for data failed, 0xx

WriteFullMemory.Desc.Write(0x%x) failed, 0xx

WriteFullMemory.QueryVirtual(0x%I64x) for info failed, 0xx

Kernel minidump write failed, 0xx

MarshalExceptionPointers.CxRecord.Read(0x%I64x, 0x%x) failed, 0xx

MarshalExceptionPointers.ExRecord.Read(0x%I64x, 0x%x) failed, 0xx

Invalid exception record parameter count (0x%x)

Invalid exception record size (0x%x)

Invalid CPU type (0x%x)

Invalid function table size (0x%x)

GetSystemType.GetOsInfo failed, 0xx

GetSystemType.GetCpuType failed, 0xx

Write.Start failed, 0xx

Dump type requires streaming but output provider does not support streaming

Invalid dump type 0x%x

dbghelp.dll

Alloc(0x%x) failed

Thread(0x%x) will not be included

GenGetImageSections.Section.Read(0x%I64x, 0x%x) failed, 0xx

GenGetImageSections.GenImageNtHeader(0x%I64x) failed

GenGetImageSections.Read(0x%I64x, 0x%x) failed, 0xx

0GenAllocateThreadObject.GetTebInfo(0x%x) failed, 0xx

GenAllocateThreadObject.GetContext(0x%x) failed, 0xx

GenAllocateThreadObject.Open(0x%x) failed, 0xx

GenReadTlsDirectory.Index(0x%I64x, %ws) failed, 0xx

GenReadTlsDirectory(0x%I64x, %ws) unknown machine 0x%x

GenReadTlsDirectory.Read(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GenDebugRecord(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GenImageNtHeader(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GetImageHeaderInfo(0x%I64x, %ws) failed, 0xx

GenAllocateModuleObject.GetVersion(0x%I64x, %ws) failed, 0xx

GenAllocateProcessObject.GetPeb(0x%x) failed, 0xx

GenIncludeUnwindInfoMemory.Enum(0x%I64x, 0x%x) failed, 0xx

GenGenTebMemory.TLS(0x%I64x) failed, 0xx

GenScanAddressSpace.QueryVirtual(0x%I64x) failed, 0xx

0GenGetAuxMemory(%ws) failed, 0xx

GenGetProcessInfo.EnumUnloadedModules(0x%x) failed, 0xx

GenGetProcessInfo.EnumUnloadedModules(0x%x) looped

GenGetProcessInfo.EnumFunctionTableEntries(0x%I64x, 0x%x) failed, 0xx

GenGetProcessInfo.EnumFunctionTables(0x%x) failed, 0xx

GenGetProcessInfo.EnumFunctionTables(0x%x) looped

GenGetProcessInfo.EnumModules(0x%x) failed, 0xx

GenGetProcessInfo.EnumModules(0x%x) looped

GenGetProcessInfo.EnumThreads(0x%x) failed, 0xx

GenGetProcessInfo.EnumThreads(0x%x) looped

GenGetProcessInfo.Start(0x%x) failed, 0xx

GenWriteHandleData.Desc.Write(0x%x) failed, 0xx

GenWriteHandleData.Header.Write(0x%x) failed, 0xx

GenWriteHandleData.ObjectName.Write(0x%x) failed, 0xx

GenWriteHandleData.ObjectNameLen.Write(0x%x) failed, 0xx

GenWriteHandleData.TypeName.Write(0x%x) failed, 0xx

GenWriteHandleData.TypeNameLen.Write(0x%x) failed, 0xx

GenWriteHandleData.Start(0x%x) failed, 0xx

GenWriteHandleData.Seek(0x%x) failed, 0xx

Software\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDlls

Software\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDlls

version.dll

ntdll.dll

%$%,%4%

S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%

b%c%d%e%f%g%h%i%j%k%l%

!"#$%&'()* ,-./0123456789:;

!!!!2222

%%%f||||

!!!!2222||||

!"#$%&'(

'()* ,-./0

&'()* ,-./

&'()* ,-./012345

3456789

.ASex

!"#$%&'()* ,-./012

!"#$%&'()

?msodatad.dat

msodatalast.dat

Unicows.dll

Kernel32.dll

SHLWAPI.DLL

GDI32.DLL

wintrust.dll

1108160

0u.hN

0SSh

t.WWWj

PSSh07

t5SSh(

PSSSSSSh

0SSSSh

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

KERNEL32.dll

OLEACC.dll

OLEAUT32.dll

MSVCRT.dll

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

ReportEventA

ReportEventW

RegEnumKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyW

GetProcessHeap

GetSystemWindowsDirectoryW

_amsg_exit

_acmdln

ShellExecuteExA

UrlGetPartA

CreateURLMoniker

CreateDialogIndirectParamA

EnumWindows

HttpQueryInfoA

HttpSendRequestExA

HttpOpenRequestA

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpEndRequestA

dw20.pdb

\devsplab1\otools\BBT_TEMP\DW20O.pdb

winword.exe

wwordlt.exe

excel.exe

excellt.exe

mspub.exe

frontpg.exe

outlook.exe

powerpnt.exe

powpntlt.exe

onenote.exe

infopath.exe

winproj.exe

ois.exe

visio.exe

`!`'`)` `

e%f-f|3 f'f/f

]!^"^#^ ^$^

t.uGuHu

x4x7x%x-x x

h&h(h.hMh:h%h h,k/k-k1k4kmk

k%lzmcmdmvm

^Q]Q~NzP}P\PGPCPLPZPIPePvPNPUPuPtPwPOP

]8^6^3^7^

ichczc]eVeQeYeWe_UOeXeUeTe

{1{ {-{/{2{8{

r6s%s4s)s:t*t3t"t%t5t6t4t/t

t&t(t%u&ukuju

WHX%X

`IaJa aEa6a2a.aFa/aOa)a@a bh

d@d%d'd

duewexei

kCpDpJpHpIpEpFp

S$S%S&S'S(S)S S,S.S2S3S5S6S8S:S;SBSFSKSNSOSPSUSVSXSYS[S]S_SbSdSeSgShSiSjSkSmStSvSzS}S~S

U U!U"U#U$U%U(U)U U:U=U?UBUGUIULUSUTUXUYUZU[U]U`UgUhUiUkUlUmUnUoUpUqUrUsUtUxUyUzU

c c!c"c#c$c%c&c'c.c0c1c5c7c?cRcSc[c\c]c^c_c`cacbcccdcfcjclcsctcyc~c

m!m#m$m&mCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWm[m\m]mkmqmrmsm

nRsSsh

evg%f

m.tRa

gtr%x

Q%SKg

f.ebp>QI

y.yxT

fn:q%uN

aw.Toiz

RMeXe

S#S$S%S;ScSdSrSsStSuS

`!`"`&`'`)`*` `,`-`.`/`0`2`3`4`5`6`:`=`>`?`

^ ^!^"^#^$^%^&^'^.^}^

c c!c"c#c$c%c&c'c*c7c:c;cSc[c1e?e@eAeBeCeDeEe

f f!f"f#f$f%f&f'f(f)f*f f,f-f

m m!m"m#m$m%m&m'm(m)m*m m,m-m.m1m2m3m4m5m6m7m8m9m:m;mm?m@mBmCmDmGmHmImJmKmLmMmNmOmPmQmRmSmTmUm

u u-u.uFuGuHuIuJuKuLuMuNuOuPuQuRuSu

U U!U"U#U$U%U&U'U(U4UJU

](^)^*^ ^,^-^/^0^1^

m/mAmFmVmWmXmYmZm[m\m]m^m_m`mambmcmdmemfmgmhmimjmkmlmmmnmompmqmrmsmtmumvmwmxmymzm{m|m}m~m

x x!x"x#x$x%x'x(x)x*x x,x.x/x0x1x2x3x4x5x6x7x8x9x:x;xx?x@xAxXy_yaycydyeygyiyjykylynyoy

} }!}"}#}$}%}&}'}

] ]!]"]#]$]%]&]'](])]*] ],]-].]/]0]

]2^3^4^5^6^7^8^9^:^;^^

cMeNeOePeQeReSeTeUeWeXeYeZe[e]ebe

X X!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X3X4X6X7X8X9X:X;XX?X@XAXBXCXDXEXFXGXHXJXTX_X`XfXmX

d%d-d0d=dRdad2e\e^e_e`eaecedeeefegeheiejele

s"s#s$s%s&s(s)s,s-s/s0s1s2s3s4s5s6s8s9s>s@sGs

u$u%u&u/ujukulumunuouqurusutu

duewexeyeze{e

~ ~!~"~#~$~%~&~'~(~*~ ~-~8~:~0

| |!|"|#|$|%|&|(|)|*|-|.|/|0|1|2|6|

{3~3}3|3

eZl%u

Q.YeY

R:\Sg|p5rL

e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexei

s4s/s)s%s>sNsOs

s&t*t)t.tbt

2%2.bx

{ | }9},

d6exe9j

]%sOu4](n

m.t.zB}

w%xIyWy

^vcÃ“v

%f?iCt

U>_.lE

f.ebp

.nrR=

{fn:q%uN

%original file name%.exe

name="Microsoft.Windows.ErrorReporter"

version="5.1.0.0"

publicKeyToken="6595b64144ccf1df" />

Windows Error Reporting

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

1%s\%s\%s\%s\%s\%s\%s\%s

AppName: %s AppVer: %s AppStamp:%s

ModName: %s ModVer: %s ModStamp:%s

fDebug: %s Offset: %s

Main_AlwaysReportBtn=

Main_NoReportBtn=

Main_ReportBtn=

General_Reportee=

CheckBoxRegKey=

ReportingFlags=

Stage1URL=

Stage2URL=

%General_Reportee%

%u %s

%u.%u %s

%s %s %s %s in %s %s %s fDebug %s at offset %s

Bucket: d

BucketTable %d

%s, %s, %s, %s, %s, %s, %s, %s, %s, %s %s

\dw.log

policy.txt

crash.log

status.txt

hits.log

count.txt

%s\%s\%s

%s\%s\%s\%s

eDWQueuedReporting

DWPersistentQueuedReporting

"%s\%s" -%c

dwtrig20.exe

ReportSize=

\*.cab

dwq.snt

"%s" -%c %u

SEventSystem.EventSubscription

SubscriptionID=%s

#$%&%&'(

Comctl32.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\459E4.dmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

.NET Runtime 2.0 Error Reporting

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\dw.log

Microsoft Application Error Reporting

11.0.8160

Windows

DW20.Exe

%original file name%.exe_552_rwx_01120000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_00FF0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02100000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02110000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02170000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02180000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02190000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_021A0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_021B0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_021C0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_021D0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_021E0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_021F0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02200000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02210000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02220000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02230000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02240000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02250000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_022A0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_022B0000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02300000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02310000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02320000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02330000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02340000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02350000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02360000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02370000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

v2SSSh

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02380000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe

Explorer.EXE_888_rwx_02390000_0000E000:

.data

.idata

.rsrc

@.reloc

Successfully Killed And Removed Malicious File: "%s"

Usage: %s IP PORT DELAY LENGTH

Failed To Start Thread: "%d"

Failed: "%d"

Failed: Mis Parameter, Usage: %s [SHOW/HIDE] [URL]

Filed To Visit: "%s"

Successfully Visited: "%s"

%s #%s

%s %s

Running From: "%s"

[%s][%s] - "%s"

{%s}: %s

Successfully Executed Process: "%s"

Failed To Create Process: "%s", Reason: "%d"

Successfully Downloaded File To: "%s"

Downloading File: "%s"

hXXp://api.wipmania.com/

JOIN

NICK

PRIVMSG

AryaN{%s-%s-x%d}%s

New{%s-%s-x%d}%s

%s "" "%s" :%s

%s %s :[AryaN]: %s

%s %s %s

Finished Flooding "%s:%d"

Terminated UDP Flood Thread

%d%d%d%d%d%d%d%d

Flooding: "%s:%d", Delay: "%d(ms)", For "%d" Seconds

LNK Infected Removable Device: "%s\", Created: "%d" Lnk Files

AutoRun Infected Removable Device: "%s\"

j[YPSSh

SSSSh

VSSSh

5170511

udp.stop

dl.stop

join

xi990desfi.com

MSVCRT.dll

GetProcessHeap

KERNEL32.dll

WS2_32.dll

SHLWAPI.dll

InternetOpenUrlA

WININET.dll

ole32.dll

PSAPI.DLL

ShellExecuteA

SHELL32.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

stub.exe

%userprofile%

%s\removethis_%d%d%d.exe

%temp%\oldfile.exe

Mozilla/5.0 (compatible)

%s\%d%d%d.exe

explorer.exe

Kernel32.dll

%s-deadlock

%s\SysWOW64

advapi32.dll

comsupp.dll

shell32.dll

wininet.dll

shlwapi.dll

dnsapi.dll

user32.dll

ws2_32.dll

psapi.dll

Ole32.dll

kernel32.dll

msvcrt.dll

dwm.exe

alg.exe

csrss.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

%s-readfile

cmd.exe

Software\Microsoft\Windows\CurrentVersion\Run

%temp%\deletethis.exe

Removable_Drive.exe

%s\{%s-%s}

/k "%s" Open %s

%windir%\System32\cmd.exe

%s\Removable_Drive.exe

%s\%s

%s\%s.lnk

icon=Shell32.dll,7

shell\open\Command=%s

open=%s

shell\explore\Command=%s

%s\autorun.inf

%Documents and Settings%\%current user%\Application Data\stub.exe

%WinDir%\Microsoft.NET\Framework\v2.0.50727\Applaunch.exe