Trojan-Dropper.Win32.Agent.dtkj (Kaspersky), Trojan.Dropper.SSK (B) (Emsisoft), Trojan.Dropper.SSK (AdAware), GenericAutorunWorm.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, WormAutorun, IRCBot
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 7f1931ba70ce188da24162797cd7c867
SHA1: 661511fe7dbfd4abf3a132a2d42920f38edbe655
SHA256: a7b26b560c4f3434a75ea28a80011486a5fd0cbb199156a96ed10f4b12549be2
SSDeep: 768:Ggr0wYSq1In5GF rPX oJpZ1LxUJZI5FSYP/Iq6HoGpfrP1CT:b9S1InA r2oTxUJi5gIAfDIT
Size: 41984 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2008-11-26 02:11:04
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
IRCBot | A bot can communicate with command and control servers via IRC channel. |
Process activity
The Trojan creates the following process(es):
wkisvr.exe:552
%original file name%.exe:1264
The Trojan injects its code into the following process(es):
wkisvr.exe:444
File activity
The process %original file name%.exe:1264 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\wkisvr.exe (41 bytes)
Registry activity
The process wkisvr.exe:444 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 80 69 50 17 95 A9 E7 69 01 91 CC 01 7E 67 36"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
The process %original file name%.exe:1264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 97 93 C5 B1 32 E1 B2 E2 73 59 01 B3 DC CA 93"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Msn" = "C:\Windows\wkisvr.exe"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
wkisvr.exe:552
%original file name%.exe:1264 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\wkisvr.exe (41 bytes)
- Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Msn" = "C:\Windows\wkisvr.exe" - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: Project1
Product Version: 1.00
Legal Copyright:
Legal Trademarks:
Original Filename: Project1.exe
Internal Name: Project1
File Version: 1.00
File Description:
Comments:
Language: English (United States)
Company Name: Product Name: Project1Product Version: 1.00Legal Copyright: Legal Trademarks: Original Filename: Project1.exeInternal Name: Project1File Version: 1.00File Description: Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 4284 | 4608 | 3.85912 | 3a301263060cfaaa444943f30889f781 |
.rdata | 12288 | 588 | 1024 | 2.08826 | 1664a906080244b688be142f827fcc8c |
.data | 16384 | 636 | 512 | 3.98584 | 877f567186682d86a8e97fd90976868f |
.rsrc | 20480 | 34508 | 34816 | 5.52828 | feba0bc5f41fce9f3be31805b6f5500d |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
wkisvr.exe_444:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
FVSSh
FVSSh
SSSh8
SSSh8
PSShmV@
PSShmV@
[DDoS]: Send error: <%d>.
[DDoS]: Send error: <%d>.
ddos.random
ddos.random
wonk.ack
wonk.ack
ddos.ack
ddos.ack
wonk.syn
wonk.syn
ddos.syn
ddos.syn
%s Done with flood (%iKB/sec).
%s Done with flood (%iKB/sec).
%s Flooding %s:%s with %s for %s seconds
%s Flooding %s:%s with %s for %s seconds
%s Bad URL or DNS Error, error: <%d>
%s Bad URL or DNS Error, error: <%d>
%s Update failed: Error executing file: %s.
%s Update failed: Error executing file: %s.
%s Process Finished: "%s", Total Running Time: %s.
%s Process Finished: "%s", Total Running Time: %s.
%s Created process: "%s", PID: <%d>
%s Created process: "%s", PID: <%d>
%s Failed to create process: "%s", error: <%d>
%s Failed to create process: "%s", error: <%d>
%s Couldn't parse path, error: <%d>
%s Couldn't parse path, error: <%d>
%s File download: %.1fKB to: %s @ %.1fKB/sec.
%s File download: %.1fKB to: %s @ %.1fKB/sec.
A%s Couldn't open file for writing: %s.
A%s Couldn't open file for writing: %s.
[UDP] Finished sending packets to %s
[UDP] Finished sending packets to %s
[UDP] Error sending udp packets to %s.
[UDP] Error sending udp packets to %s.
%s Failed to get requested URL from HTTP server.
%s Failed to get requested URL from HTTP server.
%s URL visited.
%s URL visited.
%s Failed to connect to HTTP server.
%s Failed to connect to HTTP server.
%s Could not open a connection.
%s Could not open a connection.
%s Invalid URL.
%s Invalid URL.
\autorun.inf
\autorun.inf
icon=%SystemRoot%\system32\SHELL32.dll,4
icon=%SystemRoot%\system32\SHELL32.dll,4
autorunme.exe
autorunme.exe
[.ShellClassInfo]
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
\Desktop.ini
\Desktop.ini
Infected drive: %s
Infected drive: %s
ddos.supersyn
ddos.supersyn
ddos.udp
ddos.udp
msn.spread
msn.spread
msn.msg
msn.msg
msn.stats
msn.stats
msn.addcontact
msn.addcontact
[UDP] Failed to start flood thread, error: <%d>
[UDP] Failed to start flood thread, error: <%d>
[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)
[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)
[DDoS]: Failed to start flood thread, error: <%d>.
[DDoS]: Failed to start flood thread, error: <%d>.
%s Flooding %s:%s for %s seconds
%s Flooding %s:%s for %s seconds
%s Downloading update from: %s to: %s.
%s Downloading update from: %s to: %s.
%seraseme_%d%d%d%d%d.exe
%seraseme_%d%d%d%d%d.exe
%s Downloading URL: %s to: %s.
%s Downloading URL: %s to: %s.
%s address %s added to msn.
%s address %s added to msn.
%s Thread Activated: Sending Message.
%s Thread Activated: Sending Message.
%s Thread Activated: Sending Zipfile.
%s Thread Activated: Sending Zipfile.
%s Thread Activated: Sending Zipfile and Message.
%s Thread Activated: Sending Zipfile and Message.
%s Visiting Website Now
%s Visiting Website Now
MSN MSG
MSN MSG
%s Failed to parse command.
%s Failed to parse command.
USER %s * 0 :%s
USER %s * 0 :%s
NICK %s
NICK %s
PASS %s
PASS %s
QUIT %s
QUIT %s
PRIVMSG %s :%s
PRIVMSG %s :%s
JOIN %s
JOIN %s
JOIN %s %s
JOIN %s %s
MODE %s %s %s
MODE %s %s %s
MODE %s %s
MODE %s %s
Ping Timeout? (%d-%d)%d/%d
Ping Timeout? (%d-%d)%d/%d
PONG %s
PONG %s
NICK
NICK
PRIVMSG
PRIVMSG
JOIN
JOIN
icmp.dll
icmp.dll
shlwapi.dll
shlwapi.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
FtpPutFileA
FtpPutFileA
FtpGetFileA
FtpGetFileA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
user32.dll
user32.dll
kernel32.dll
kernel32.dll
%s!%s@%s
%s!%s@%s
%s No %s thread found.
%s No %s thread found.
%s %s thread stopped. (%d thread(s) stopped.)
%s %s thread stopped. (%d thread(s) stopped.)
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
%s\%s
%s\%s
del "%s">nul
del "%s">nul
if exist "%s" goto Repeat
if exist "%s" goto Repeat
ping 0.0.0.0>nul
ping 0.0.0.0>nul
%s\removeMe%i%i%i%i.bat
%s\removeMe%i%i%i%i.bat
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
WS2_32.dll
WS2_32.dll
MSVCR71.dll
MSVCR71.dll
_acmdln
_acmdln
_amsg_exit
_amsg_exit
VkKeyScanA
VkKeyScanA
keybd_event
keybd_event
USER32.dll
USER32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
%s Welcome Bitch.
%s Welcome Bitch.
%s Fail.
%s Fail.
%s %s out.
%s %s out.
%s <%i> out.
%s <%i> out.
%s No user at: <%i>
%s No user at: <%i>
%s Invalid slot: <%i>
%s Invalid slot: <%i>
%s Kill: <%d> threads
%s Kill: <%d> threads
%s No threads
%s No threads
%s Killed thread: <%s>
%s Killed thread: <%s>
%s %s already running: <%d>.
%s %s already running: <%d>.
%s Fail start %s, err: <%d>.
%s Fail start %s, err: <%d>.
[msn]: Message & Zipfile sent to: %d contacts.
[msn]: Message & Zipfile sent to: %d contacts.
[msn]: Message sent to: %d Contacts.
[msn]: Message sent to: %d Contacts.
[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
Go fuck yourself %s.
Go fuck yourself %s.
%s logged in.
%s logged in.
Removed by: %s!%s@%s
Removed by: %s!%s@%s
%s main thread
%s main thread
%s mis param.
%s mis param.
uNkbot - uNkn0wn.eu
uNkbot - uNkn0wn.eu
C:\Windows\
C:\Windows\
wkisvr.exe
wkisvr.exe
*@admin.com
*@admin.com
dances.instalprivileges.com
dances.instalprivileges.com
wkisvr.exe_444_rwx_00400000_0004E000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
FVSSh
FVSSh
SSSh8
SSSh8
PSShmV@
PSShmV@
[DDoS]: Send error: <%d>.
[DDoS]: Send error: <%d>.
ddos.random
ddos.random
wonk.ack
wonk.ack
ddos.ack
ddos.ack
wonk.syn
wonk.syn
ddos.syn
ddos.syn
%s Done with flood (%iKB/sec).
%s Done with flood (%iKB/sec).
%s Flooding %s:%s with %s for %s seconds
%s Flooding %s:%s with %s for %s seconds
%s Bad URL or DNS Error, error: <%d>
%s Bad URL or DNS Error, error: <%d>
%s Update failed: Error executing file: %s.
%s Update failed: Error executing file: %s.
%s Process Finished: "%s", Total Running Time: %s.
%s Process Finished: "%s", Total Running Time: %s.
%s Created process: "%s", PID: <%d>
%s Created process: "%s", PID: <%d>
%s Failed to create process: "%s", error: <%d>
%s Failed to create process: "%s", error: <%d>
%s Couldn't parse path, error: <%d>
%s Couldn't parse path, error: <%d>
%s File download: %.1fKB to: %s @ %.1fKB/sec.
%s File download: %.1fKB to: %s @ %.1fKB/sec.
A%s Couldn't open file for writing: %s.
A%s Couldn't open file for writing: %s.
[UDP] Finished sending packets to %s
[UDP] Finished sending packets to %s
[UDP] Error sending udp packets to %s.
[UDP] Error sending udp packets to %s.
%s Failed to get requested URL from HTTP server.
%s Failed to get requested URL from HTTP server.
%s URL visited.
%s URL visited.
%s Failed to connect to HTTP server.
%s Failed to connect to HTTP server.
%s Could not open a connection.
%s Could not open a connection.
%s Invalid URL.
%s Invalid URL.
\autorun.inf
\autorun.inf
icon=%SystemRoot%\system32\SHELL32.dll,4
icon=%SystemRoot%\system32\SHELL32.dll,4
autorunme.exe
autorunme.exe
[.ShellClassInfo]
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
\Desktop.ini
\Desktop.ini
Infected drive: %s
Infected drive: %s
ddos.supersyn
ddos.supersyn
ddos.udp
ddos.udp
msn.spread
msn.spread
msn.msg
msn.msg
msn.stats
msn.stats
msn.addcontact
msn.addcontact
[UDP] Failed to start flood thread, error: <%d>
[UDP] Failed to start flood thread, error: <%d>
[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)
[UDP] Sending %d packets to: %s. Packet size: %d, Delay: %d(ms)
[DDoS]: Failed to start flood thread, error: <%d>.
[DDoS]: Failed to start flood thread, error: <%d>.
%s Flooding %s:%s for %s seconds
%s Flooding %s:%s for %s seconds
%s Downloading update from: %s to: %s.
%s Downloading update from: %s to: %s.
%seraseme_%d%d%d%d%d.exe
%seraseme_%d%d%d%d%d.exe
%s Downloading URL: %s to: %s.
%s Downloading URL: %s to: %s.
%s address %s added to msn.
%s address %s added to msn.
%s Thread Activated: Sending Message.
%s Thread Activated: Sending Message.
%s Thread Activated: Sending Zipfile.
%s Thread Activated: Sending Zipfile.
%s Thread Activated: Sending Zipfile and Message.
%s Thread Activated: Sending Zipfile and Message.
%s Visiting Website Now
%s Visiting Website Now
MSN MSG
MSN MSG
%s Failed to parse command.
%s Failed to parse command.
USER %s * 0 :%s
USER %s * 0 :%s
NICK %s
NICK %s
PASS %s
PASS %s
QUIT %s
QUIT %s
PRIVMSG %s :%s
PRIVMSG %s :%s
JOIN %s
JOIN %s
JOIN %s %s
JOIN %s %s
MODE %s %s %s
MODE %s %s %s
MODE %s %s
MODE %s %s
Ping Timeout? (%d-%d)%d/%d
Ping Timeout? (%d-%d)%d/%d
PONG %s
PONG %s
NICK
NICK
PRIVMSG
PRIVMSG
JOIN
JOIN
icmp.dll
icmp.dll
shlwapi.dll
shlwapi.dll
ShellExecuteA
ShellExecuteA
shell32.dll
shell32.dll
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
InternetCrackUrlA
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlA
FtpPutFileA
FtpPutFileA
FtpGetFileA
FtpGetFileA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
wininet.dll
wininet.dll
ws2_32.dll
ws2_32.dll
user32.dll
user32.dll
kernel32.dll
kernel32.dll
%s!%s@%s
%s!%s@%s
%s No %s thread found.
%s No %s thread found.
%s %s thread stopped. (%d thread(s) stopped.)
%s %s thread stopped. (%d thread(s) stopped.)
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
%s\%s
%s\%s
del "%s">nul
del "%s">nul
if exist "%s" goto Repeat
if exist "%s" goto Repeat
ping 0.0.0.0>nul
ping 0.0.0.0>nul
%s\removeMe%i%i%i%i.bat
%s\removeMe%i%i%i%i.bat
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
WS2_32.dll
WS2_32.dll
MSVCR71.dll
MSVCR71.dll
_acmdln
_acmdln
_amsg_exit
_amsg_exit
VkKeyScanA
VkKeyScanA
keybd_event
keybd_event
USER32.dll
USER32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
%s Welcome Bitch.
%s Welcome Bitch.
%s Fail.
%s Fail.
%s %s out.
%s %s out.
%s <%i> out.
%s <%i> out.
%s No user at: <%i>
%s No user at: <%i>
%s Invalid slot: <%i>
%s Invalid slot: <%i>
%s Kill: <%d> threads
%s Kill: <%d> threads
%s No threads
%s No threads
%s Killed thread: <%s>
%s Killed thread: <%s>
%s %s already running: <%d>.
%s %s already running: <%d>.
%s Fail start %s, err: <%d>.
%s Fail start %s, err: <%d>.
[msn]: Message & Zipfile sent to: %d contacts.
[msn]: Message & Zipfile sent to: %d contacts.
[msn]: Message sent to: %d Contacts.
[msn]: Message sent to: %d Contacts.
[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
[msn]: Sent Stats - Messages: %d :: Files: %d :: Message & Files: %d.
Go fuck yourself %s.
Go fuck yourself %s.
%s logged in.
%s logged in.
Removed by: %s!%s@%s
Removed by: %s!%s@%s
%s main thread
%s main thread
%s mis param.
%s mis param.
uNkbot - uNkn0wn.eu
uNkbot - uNkn0wn.eu
C:\Windows\
C:\Windows\
wkisvr.exe
wkisvr.exe
*@admin.com
*@admin.com
dances.instalprivileges.com
dances.instalprivileges.com