Gen.Variant.Symmi.19271_2de7d07e73 – Adaware

Gen:Variant.Symmi.19271 (BitDefender), HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Win32.Kryptik.awym (v) (VIPRE), Gen:Variant.Symmi.19271 (B) (Emsisoft), Trojan-FBYN!2DE7D07E7381 (McAfee), Win32.Torbot (Ikarus), Gen:Variant.Symmi.19271 (FSecure), Generic_r.CDH (AVG), Win32:Torbot [Trj] (Avast), Gen:Variant.Symmi.19271 (AdAware), Trojan-PSW.Win32.Zbot.6.FD, BackdoorCaphaw_QKKBAL.YR, GenericInjector.YR, GenericIRCBot.YR, TrojanPSWZbot.YR, PUPTorClient.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Backdoor, PUP, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 2de7d07e7381c6215e3e7759c33674d2

SHA1: 98824b4b10157179ad92a00b20e189ba24b6fb11

SHA256: 6caef340d59f396b6c5a7b72ad8c2d535376115a5eaebc2f6aa164b646445832

SSDeep: 49152:1nl4WZGNzfgDSkCMFipKZux/UoAl4fdHCH/P T9F96nvezz1rIzy73azmzVmI5xN:12WZGNE2kCMQpKZuFUJ fs6FMnWn1l8

Size: 3776512 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualCv71EXE, MicrosoftVisualCv70, UPolyXv05_v6

Company: Premium Installer

Created at: 2010-12-14 06:52:10

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan-PSW. Trojan program intended for stealing users passwords.

Dynamic Analysis

Payload

Behaviour	Description
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The Trojan creates the following process(es):

muolc.exe:1280
%original file name%.exe:204

The Trojan injects its code into the following process(es):

svchost.exe:516
Explorer.EXE:128

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

The process muolc.exe:1280 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 A5 93 43 B4 1A 37 96 48 CE 00 6E 0C 38 EE 7C"

The process %original file name%.exe:204 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE 10 D8 A6 E0 52 B3 28 F3 7D C3 28 51 1D 7F 69"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
muolc.exe:1280
%original file name%.exe:204
Delete the original Trojan file.
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	3720724	3723264	4.09777	b92754844e5fbc1bd0e8ed9ed3637199
.rdata	3727360	10455	12288	3.29986	d33d691ee22c2251c98c142a7acdbab4
.data	3739648	6360	4096	2.81261	e6a08d6a43f6f9791eda6efe1edfb27d
.rsrc	3747840	30560	32768	4.20076	a4e1179bf52637b69d9d2069144b0a24

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://checkip.dyndns.com/
hxxp://checkip.dyndns.org/	216.146.38.70

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Host: checkip.dyndns.org

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/html

Server: DynDNS-CheckIP/1.0

Connection: close

Cache-Control: no-cache

Pragma: no-cache

Content-Length: 105

<html><head><title>Current IP Check</title></head><body>Current IP Address: "%local server IP%"</body></html>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

svchost.exe_516:

.text

`.rdata

@.data

.rsrc

@.reloc

TT T!"TT#$TTTT%&'TTT(T)*T TTT,-.TT/0123TTTTTT4TTTTTTT5TTTTTT6789:;TTTTTTTT?@ABCDTTTTETTTTFTTTTTTGTTHITTTTTJKTTTLLTTMTTTTTTTTTNTTOTPQRS

!"FFF#F$FÃ¿&F'()FFFFFFFFFFFFF*FFFFFFFFFFFF FF,-FFFFFFFFFFF.F/FFFFFFFFFFFFFF01FF234FF56789FFFFFFFF:;FFFF?FFFFF@ABFFFFFCFDFFFFFE

%u$Vj%

t.Gj:W

127.0.0.1

hXXp://%s/test.txt

hXXp://%s:%d/%s

iplist.txt

PRIVMSG

NICK

JOIN

127.0.0.1 VVV.trendmicro.com

127.0.0.1 VVV.symantec.com

127.0.0.1 VVV.sophos.com

[HTTPBW] Stopping %s

[HTTPBW] Started raping %s

socks4a://127.0.0.1:9050

%s :%s

%s %s :%s

%s %s %s

%s %s "" "lo" :%s

%s %s

[IDLE] I'm idle for %d seconds.

[VSPOST] Parameters: [url] [post]

[VS] Parameters: [url]

[HTTPBW] Failed to start!, missing parameters: [URL] [SIZE] [TIME]

[SL] Failed to start!, missing parameters: [DNS] [PORT] [HOLD_DELAY] [TIME in sec] [SOCKETS]

[UDP] Failed to start!, missing parameters: [HOST] [PORT] [MIN_SIZE in bytes] [MAX_SIZE in bytes] [DELAY](lower for more traffic) [DURATION in sec]

[SYN] Failed to start!, missing parameters: [HOST] [PORT] [WAITTIME in msec] [DURATION in sec]

[D&E MEM] Failed to download: %d

[D&E MEM] Parameters: [URL]

[D&E] Failed 2 Execute! [ A.V DETECTION ].

[D&E] Downloaded & Executed!

[D&E] Parameters: [URL]

[HASHES] %s MH/s

[AV: %s] [GPU: %s] [MEM: %d MB] [HASHES: %s MH/s] [IDLE: %s]

%d sec

%d min

[AV] %S

[HS] %s

[IP] %s

[HW] GPU: %s MEM: %d MB

[VER] %s

hXXp://checkip.dyndns.org/

dnsapi.dll

ntdll.dll

reverseproxy.txt

[%s-%s-%s]%s

[SL] Stopping %s

[SL] Started attacking %s

GET / HTTP/1.1

Host: %s

User-Agent: %s

Content-Length: %d

[SYN] Stopping %s

[SYN] Started flooding %s

O[UDP] Stopping to %s, sent %.1f GB

>[UDP] Stopping to %s, sent %.1f MB

>[UDP] Stopping to %s, sent %.1f kB

P?[UDP] Started flooding %s

6ceyqong6nxy7hwp.onion

owbm3sjqdnndmydf.onion

4njzp3wzi6leo772.onion

qdzjxwujdtxrjkrz.onion

x3wyzqg6cfbqrwht.onion

niazgxzlrbpevgvq.onion

ua4ttfm47jt32igm.onion

6tkpktox73usm5vq.onion

4bx2tfgsctov65ch.onion

3kc3wgsbq5bjikyf.onion

24v63yidnlfeke45.onion

wg6ry5rlzfoosbir.onion

rxrhv2ajbmjw3kyq.onion

mh4vqvfvjk5imf2a.onion

uf5aizcddahngjbz.onion

kv5fkk7csqonp64x.onion

dpuzn6fhxqr2kfx6.onion

eamxnonwsr76nbit.onion

kexxw7qevamewdkc.onion

gpt2u5hhaqvmnwhr.onion

7wuwk3aybq5z73m7.onion

742yhnr32ntzhx3f.onion

f2ylgv2jochpzm4c.onion

6m7m4bsdbzsflego.onion

xvauhzlpkirnzghg.onion

h266x4kmvmpdfalv.onion

jr6t4gi4k2vpry5c.onion

ceif2rmdoput3wjh.onion

uzvyltfdj37rhqfy.onion

uy5t7cus7dptkchs.onion

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts)

Mozilla/4.0 (compatible; U; MSIE 9.0; WIndows NT 9.0; en-US)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/5.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; FDM; .NET4.0C; .NET4.0E; chromeframe/11.0.696.57)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; Tablet PC 2.0; InfoPath.3; .NET4.0E)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; FDM; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E; Tablet PC 2.0)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.2; .NET4.0C; .NET4.0E)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; AskTB5.5)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 7.1; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C)

Mozilla/4.0 (compatible; MSIE 9.0; Windows 98; .NET CLR 3.0.04506.30)

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4; OfficeLivePatch.1.3; .NET4.0C; .NE)

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 5.1; Trident/5.0)

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0; FDM; MSIECrawler; Media Center PC 5.0)

Mozilla/5.0 ( ; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; chromeframe/11.0.696.57)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) chromeframe/10.0.648.205

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; chromeframe/11.0.696.57)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; chromeframe/13.0.782.215)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET CLR 1.1.4322; .NET4.0C; Tablet PC 2.0)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; yie8)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Zune 4.0; Tablet PC 2.0; InfoPath.3; .NET4.0C; .NET4.0E)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 2.0.50727; Media Center PC 6.0)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 2.0.50727; Media Center PC 6.0)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; chromeframe/12.0.742.112)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Zune 4.0; InfoPath.3; MS-RTC LM 8; .NET4.0C; .NET4.0E)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Mozilla/1.22 (compatible; MSIE 10.0; Windows 3.1)

Mozilla/4.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Mozilla/5.0 (compatible; MSIE 10.6; Windows NT 6.1; Trident/5.0; InfoPath.2; SLCC1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727) 3gpp-gba UNTRUSTED/1.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110613 Firefox/6.0a2

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0) Gecko/20100101 Firefox/9.0

Mozilla/5.0 (Windows NT 6.2; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0a2) Gecko/20111101 Firefox/9.0a2

Mozilla/5.0 (Macintosh; I; Intel Mac OS X 11_7_9; de-LI; rv:1.9b4) Gecko/2012010317 Firefox/10.0a4

Mozilla/6.0 (Macintosh; I; Intel Mac OS X 11_7_9; de-LI; rv:1.9b4) Gecko/2012010317 Firefox/10.0a4

Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.6 (KHTML, like Gecko) Chrome/16.0.897.0 Safari/535.6

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7

Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7

Mozilla/5.0 (Windows NT 5.2; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g

Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7

Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7

Mozilla/5.0 (X11; CrOS i686 1193.158.0) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.8 (KHTML, like Gecko) Chrome/17.0.940.0 Safari/535.8

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.12 Safari/535.11

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/18.6.872.0 Safari/535.2 UNTRUSTED/1.0 3gpp-gba UNTRUSTED/1.0

[VS] Visited %s

[VSPOST] Visited %s

Could not resolve %s: %s; %s

getaddrinfo() failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

%s:%d

Added %s:%d:%s to DNS cache

Resolve %s found illegal!

%5[^:]:%d:%5s

About to connect() to %s%s port %ld (#%ld)

Connected to %s (%s) port %ld (#%ld)

IDN support not present, can't parse Unicode domains

Protocol %s not supported or disabled in libcurl

http_proxy

%5[^:@]:%5[^@]

:%5[^@]

Port number too large: %lu

%s://%s%s%s:%hu%s%s%s

;type=%c

[%*45[0123456789abcdefABCDEF:.]%c

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

malformed

:]://%[^

[^:]:%[^

Re-using existing connection! (#%ld) with host %s

%s://%s

Connection #%ld to host %s left intact

operation aborted by callback

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

Problem (%d) in the Chunked-Encoded data

HTTP server doesn't seem to support byte ranges. Cannot resume.

Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)

Excess found in a non pipelined read: excess = %zu, size = %lld, maxdownload = %lld, bytecount = %lld

Rewinding stream by : %zu bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %zd)

Rewinding stream by : %zd bytes on url %s (zero-length body)

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

No URL set!

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Violate RFC 2616/10.3.3 and switch from POST to GET

Disables POST, goes with %s

Issue another request to this URL: '%s'

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %lld

#HttpOnly_

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

httponly

23[^;

=]=I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/docs/http-cookies.html

# This file was generated by libcurl! Edit at your own risk.

WARNING: failed to save cookies in %s

[%s %s %s]

Send failure: %s

Recv failure: %s

Failed to set SO_KEEPALIVE on fd %d

bind failed with errno %d: %s

Local port: %hu

Couldn't bind to '%s'

Local Interface %s is ip %s using address family %i

getsockname() failed with errno %d: %s

Bind to local port %hu failed, trying next

Name '%s' family %i resolved to '%s' family %i

ssloc inet_ntop() failed with errno %d: %s

ssrem inet_ntop() failed with errno %d: %s

getpeername() failed with errno %d: %s

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Trying %s...

sa_addr inet_ntop() failed with errno %d: %s

Failed connect to %s:%ld; %s

Unable to parse FTP file list

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized or bad HTTP Content or Transfer-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with given CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH remote key was not OK

An unknown option was passed in to libcurl

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: The server did not accept the PRET command.

FTP: Accepting server connect has timed out

FTP: The server failed to connect to data port

FTP: weird server reply

A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

Internal error removing splay node = %d

Internal error clearing splay node = %d

%d.%d.%d.%d

%s%s%s%s%s%s

Session: %s

%s %s RTSP/1.0

Range: %s

Referer: %s

Accept-Encoding: %s

Refusing to issue an RTSP SETUP without a Transport: header.

Transport: %s

Transport:

Refusing to issue an RTSP request [%s] without a session ID.

Got RTSP Session ID Line [%s], but wanted ID [%s]

Unable to read the CSeq header: [%s]

SMTP

EHLO %s

HELO %s

No known authentication mechanisms supported!

AUTH %s %s

AUTH %s

Got unexpected smtp-server response: %d

Remote access denied: %d

Access denied: %d

smtp

Authentication failed: %d

MAIL FROM:%s SIZE=%s

MAIL FROM:%s AUTH=%s SIZE=%s

MAIL FROM:%s AUTH=%s

MAIL FROM:%s

RCPT TO:

RCPT TO:%s

MAIL failed: %d

RCPT failed: %d

SMTPS not supported!

STARTTLS denied. %c

USER %s

APOP %s %s

No known SASL authentication mechanisms supported!

No known authentication types supported!

Access denied. %c

PASS %s

POP3S not supported!

%s LOGIN %s %s

%s STARTTLS

%s SELECT %s

%s FETCH 1 BODY[TEXT]

%s LOGOUT

IMAPS not supported!

TFTP

set timeouts for state %d; Total %ld, retry %d maxtry %d

invalid tsize -:%s:- value in OACK packet

%s (%ld)

blksize is smaller than min supported

%s (%d)

blksize is larger than max supported

%s (%d) %s (%d)

got option=(%s) value=(%s)

tftp_rx: internal error

Timeout waiting for block %d ACK. Retries = %d

Received unexpected DATA packet block %d, expecting block %d

tftp_tx: internal error, event: %i

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

TFTP response timeout

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

CLIENT libcurl 7.27.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Unknown telnet option %s

Syntax error in telnet option: %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSAEnumNetworkEvents failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

PORT

FTP response aborted due to select/poll error: %d

FTP response timeout

Failure sending PORT command: %s

,%d,%d

Failure sending EPRT command: %s

%s |%d|%s|%hu|

bind() failed, we ran out of ports!

bind(port=%hu) failed: %s

bind(port=%hu) on non-local address failed: %s

socket failure: %s

failed to resolve the address provided to PORT: %s

getsockname() failed: %s

Connect data stream passively

PRET RETR %s

PRET STOR %s

PRET %s

REST %d

SIZE %s

STOR %s

APPE %s

Failed to do PORT

Got a d response code instead of the assumed 200

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

ACCT rejected by server: d

TYPE %c

Connecting to %s (%s) port %d

Failure sending QUIT command: %s

Uploading to a URL without a file name!

FTPS not supported!

Preparing for accepting server on data port

MDTM %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%hu

Can't resolve proxy host %s:%hu

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

Failed FTP upload:

RETR response: d

QUOT string not accepted: %s

Wildcard - "%s" skipped by user

Wildcard - START of "%s"

CWD %s

PRET command not accepted: d

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

Got a d ftp-server response when 220 was expected

server did not report OK, got %d

Failure sending ABOR command: %s

Remembering we are in dir "%s"

%sAuthorization: Basic %s

%s:%s

%s auth using %s with user '%s'

HTTP/

Avoided giant realloc for header (max is %d)!

The requested URL returned error: %d

The requested URL returned error: %s

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

%s%s=%s

%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

PTF://%s:%s@%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

PTF://

Host: %s%s%s:%hu

Host: %s%s%s

Chunky upload is not supported by HTTP 1.0

HTTP error before end of send, stop sending

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

RTSP/%d.%d =

HTTP =

HTTP/%d.%d =

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

SOCKS4%s request granted.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

--:--:--

%3lld %s %3lld %s %3lld %s %s %s %s %s %s %s

Received HTTP code %d from proxy after CONNECT

TUNNEL_STATE switched to: %d

HTTP/1.%d %d

CONNECT %s HTTP/%s

%s%s%s%s

%s%s%s:%hu

%s:%hu

Establish HTTP proxy tunnel to %s:%hu

password

Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds

%s, algorithm="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop=%s, response="%s"

%s:%s:x:%s:%s:%s

%s:%.*s

%s:%s:%s

d:d

d:d:d

%s xxxxxxxxxxxxxxxx

12345678

00000001

0123456789-

%c%c==

%c%c%c=

.jpeg

.html

--%s--

couldn't open file "%s"

Content-Type: %s

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

operator

GetProcessHeap

KERNEL32.dll

USER32.dll

RegOpenKeyExW

RegCloseKey

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

WS2_32.dll

URLDownloadToFileW

urlmon.dll

HttpQueryInfoA

InternetOpenUrlA

HttpSendRequestA

HttpOpenRequestA

WININET.dll

PeekNamedPipe

GetCPInfo

127.0.0.1:42348

admin.invalid

ip.external

join

download.mem

udp.stop

syn.stop

slowloris.stop

http.bwrape

http.bwrape.stop

visit.post

zcÃ

H.FT>u

.OCHl>

L1Ã¾

q.lk6g

.AsGA

{.tQ,

6%x9%

^k.qQ

s6v5C.Ot

S ;xR%C

,yv

H2G2x.OM

;O.KZ

(%CnXl

@qh%3uk

r5SSHT

SÃ’}

'-Z}

Yz%x7_

Fw.Ve

f4oÃ’d

4;2%s

?S.Jv8

KERNEL32.DLL

ADVAPI32.DLL

msvcrt.dll

OpenCL.dll

.file

crt1.c

.data

cygming-crtbegin.c

.rdata

_set_url

sha256_sse2_i386.c.text

curl_rand.c

url.c

_Curl_doD

curl_addrinfo.c

http.c

PTF.c

_ftp_do

tPTF.c

_tftp_rx

_tftp_txX

_tftp_do

smtp.c

_smtp_doD

http_digest.c

http_proxy.c

http_chunks.c

curl_memrchr.c

ftplistparser.c

curl_sasl.c

curl_gethostname.c

curl_fnmatch.c

.CRT$XPU

.CRT$XCU

.dtors

.ctors

.idata$7

.idata$5

.idata$4

.idata$6d

.idata$6

.idata$6|

.idata$5|

.idata$6$

.idata$5l

.idata$64

.idata$5h

.idata$5x

.idata$5`

.idata$6P

.idata$5t

.idata$6`

.idata$5p

.idata$6N

.idata$5d

.idata$68

.idata$2P

.idata$7H

.idata$6\

.idata$7D

.idata$6J

.idata$5@

.idata$4d

.idata$6p

.idata$5L

.idata$4p

.idata$7`

.idata$4

.idata$5P

.idata$4t

.idata$4@

.idata$7\

.idata$5,

.idata$4P

.idata$6@

.idata$7X

.idata$5$

.idata$4H

.idata$6&

.idata$7|

.idata$4

.idata$54

.idata$4X

.idata$6R

.idata$5

.idata$4D

.idata$7P

.idata$6z

.idata$7@

.idata$6

.idata$7x

.idata$48

.idata$50

.idata$4T

.idata$7p

.idata$40

.idata$7t

.idata$44

.idata$5H

.idata$4l

.idata$7d

.idata$4$

.idata$7L

.idata$6h

.idata$7h

.idata$4(

.idata$5D

.idata$4h

.idata$6x

.idata$58

.idata$4\

.idata$6Z

.idata$5

.idata$4`

.idata$6f

.idata$7T

.idata$5(

.idata$4L

.idata$62

.idata$7l

.idata$4,

.idata$2x

.idata$4x

.idata$5T

_keypad

.CRT$XLD

.CRT$XLC

.CRT$XLZ

.CRT$XLA

.tls$ZZZ

.tls$AAA

.CRT$XDZ

.CRT$XDA

CRTglob.c

CRTfmode.c

CRT_fp10.c

crtst.c

.idata$74

.idata$70

.idata$6F

.idata$6t

.idata$7(

.idata$78

.idata$7,

.idata$7

.idata$6l

.idata$2(

wcrtomb.c

_wcrtomb

.idata$6,

.idata$6L

.idata$6j

.idata$6V

.idata$60

.idata$6~

.idata$7

.idata$5\

.idata$6"

.idata$6

.idata$6(

.idata$6:

.idata$6D

.idata$5X

.idata$4|

.idata$6v

.idata$66

.idata$7$

.idata$2

.idata$6X

.idata$2

.idata$2d

.idata$6.

.idata$6H

.idata$6*

.idata$6^

.idata$6r

.idata$6n

cygming-crtend.c

_execv

_cmds

__CRT_MTH

___mingw_CRTStartup

_mainCRTStartup

_WinMainCRTStartup

.eh_frame

_workio_cmd_free

_select_longpoll_pool.part.9

___kill_work.part.15

_thread_reportin

_mt_disable.isra.16

_set_userpass

_total_passes

_total_userpasses

_set_pass

_total_urls

_mutex_lock.part.23

_mutex_unlock.part.24

_disable_curses.part.25

_dec_queued.isra.28

_push_curl_entry

_recruit_curl

_pop_curl_entry

_test_work_current.part.36

_opt_cmdline_table

.text.unlikely

.text.startup

_mutex_lock.part.1

_mutex_unlock.part.2

_WSAErrorMsg

_mutex_lock.part.0

_mutex_unlock.part.1

_copyadvanceafter.constprop.16

_msg_buffer

_checkcommand.part.3

_devdetails.part.4

_poolstatus.part.12

_sprintf.constprop.1

_sprintf.constprop.2

_curl_global_init

_curl_global_init_mem

_curl_global_cleanup

_curl_easy_init

_curl_easy_setopt

_curl_easy_perform

_curl_easy_cleanup

_Curl_easy_addmulti

_Curl_easy_initHandleData

_curl_easy_getinfo

_curl_easy_duphandle

_curl_easy_reset

_curl_easy_pause

_curl_easy_recv

_curl_easy_send

_curl_slist_append

_curl_slist_free_all

_Curl_slist_duplicate

_Curl_rand

_Curl_srand

_Curl_global_host_cache_init

_Curl_global_host_cache_dtor

_Curl_num_addresses

_Curl_printable_address

_Curl_hostcache_prune

_Curl_cache_addr

_Curl_resolv

_Curl_resolv_timeout

_Curl_resolv_unlock

_Curl_mk_dnscache

_Curl_hostcache_destroy

_Curl_loadhostpairs

_signalPipeClose

_fix_hostname.isra.2

_IsPipeliningPossible.isra.3

_Curl_freeset

_Curl_dupset

_Curl_mk_connc

_Curl_rm_connc

_Curl_init_userdefined

_Curl_open

_Curl_isPipeliningEnabled

_Curl_disconnect

_Curl_handler_dummy

_Curl_close

_Curl_ch_connc

_Curl_setopt

_Curl_addHandleToPipeline

_Curl_removeHandleFromPipeline

_Curl_getoff_all_pipelines

_Curl_connected_proxy

_Curl_verboseconnect

_Curl_protocol_getsock

_Curl_doing_getsock

_Curl_protocol_connecting

_Curl_protocol_doing

_Curl_protocol_connect

_Curl_setup_conn

_Curl_connect

_Curl_done

_Curl_do_more

_Curl_reset_reqproto

_strcpy_url

_Curl_fillreadbuffer

_Curl_readrewind

_Curl_meets_timecondition

_Curl_readwrite

_Curl_single_getsock

_Curl_sleep_time

_Curl_pretransfer

_Curl_posttransfer

_Curl_follow

_Curl_reconnect_request

_Curl_retry_request

_Curl_do_perform

_Curl_perform

_Curl_setup_transfer

_Curl_hash_init

_Curl_hash_alloc

_Curl_hash_add

_Curl_hash_delete

_Curl_hash_pick

_Curl_hash_clean

_Curl_hash_clean_with_criterium

_Curl_hash_destroy

_Curl_hash_str

_Curl_str_key_compare

_Curl_initinfo

_Curl_getinfo

_Curl_cookie_add

_Curl_cookie_init

_Curl_cookie_loadfiles

_Curl_cookie_getlist

_Curl_cookie_freelist

_Curl_cookie_clearall

_Curl_cookie_clearsess

_Curl_cookie_cleanup

_Curl_cookie_list

_Curl_flush_cookies

_Curl_write

_Curl_read_plain

_Curl_read

_Curl_debug

_Curl_sendf

_Curl_failf

_Curl_client_write

_Curl_recv_plain

_Curl_send_plain

_Curl_write_plain

_Curl_infof

_Curl_timeleft

_Curl_persistconninfo

_Curl_updateconninfo

_Curl_sndbufset

_Curl_getconnectinfo

_Curl_closesocket

_Curl_socket

_Curl_connecthost

_Curl_is_connected

_curl_msnprintf

_curl_mvsnprintf

_curl_maprintf

_curl_mvaprintf

_curl_msprintf

_curl_mprintf

_curl_mfprintf

_curl_mvsprintf

_curl_mvprintf

_curl_mvfprintf

_Curl_freeaddrinfo

_Curl_he2ai

_Curl_ip2addr

_Curl_str2addr

_Curl_inet_ntop

_curl_share_init

_curl_share_setopt

_curl_share_cleanup

_Curl_share_lock

_Curl_share_unlock

_Curl_ipvalid

_Curl_ipv4_resolve_r

_Curl_getaddrinfo

_http_should_fail

_http_getsock_do

_http_perhapsrewind

_Curl_http_done

_Curl_http_connect

_checkhttpprefix.isra.2

_Curl_checkheaders

_Curl_http_auth_act

_Curl_http_output_auth

_Curl_http_input_auth

_Curl_add_buffer_init

_Curl_add_buffer_send

_Curl_add_buffer

_Curl_add_bufferf

_Curl_compareheader

_Curl_add_custom_headers

_Curl_add_timecondition

_Curl_http

_Curl_http_readwrite_headers

_ftp_state_user

_ftp_state_pwd

_ftp_state_loggedin

_ftp_easy_statemach

_ftp_disconnect

_ftp_getsock

_ftp_multi_statemach

_isBadFtpString

_ftp_init

_ftp_connect

_ftp_endofresp

_ftp_state_post_retr_size

_ftp_state_use_pasv

_ftp_state_ul_setup

_ftp_state_use_port

_ftp_state_pasv_resp

_ftp_timeleft_accept

_ftp_parse_url_path

_ftp_setup_connection

_Curl_handler_ftp_proxy

_ftp_domore_getsock

_ftp_nb_type

_ftp_state_post_mdtm

_ftp_state_post_cwd

_ftp_state_quote

_ftp_state_post_rest

_ftp_state_post_size

_ftp_state_post_type

_ftp_state_type_resp

_Curl_GetFTPResponse

_ftp_statemach_act

_ftpauth.20723

_ftp_do_more

_ftp_dophase_done

_ftp_doing

_Curl_ftpsendf

_ftp_done

_telnetcmds

_send_negotiation.isra.3

_printsub.part.4

_suboption.isra.5

_tftp_translate_code

_tftp_disconnect

_tftp_getsock

_tftp_set_timeouts

_tftp_connect_for_rx

_tftp_connect_for_tx

_tftp_connect

_tftp_done

_tftp_setup_connection

_tftp_state_timeout.isra.0

_tftp_option_add.isra.1

_tftp_state_machine

_tftp_receive_packet

_tftp_multi_statemach

_tftp_doing

_imap_state_login

_Curl_handler_imap_proxy

_Curl_handler_pop3_proxy

_Curl_pop3_write

_smtp_state_ehlo

_smtp_rcpt_to

_smtp_easy_statemach

_smtp_disconnect

_smtp_getsock

_smtp_multi_statemach

_smtp_connect

_smtp_endofresp

_smtp_setup_connection

_Curl_handler_smtp_proxy

_smtp_authenticate

_smtp_done

_smtp_doing

_smtp_statemach_act

_Curl_smtp_escape_eob

_Curl_rtsp_connisdead

_Curl_rtsp_parseheader

_fd_key_compare

_multi_freeamsg

_multistate.isra.0

_add_next_timeout.isra.4

_multi_timeout.isra.6.part.7

_multi_getsock.part.9.constprop.11

_curl_multi_init

_Curl_multi_canPipeline

_Curl_multi_handlePipeBreak

_curl_multi_fdset

_curl_multi_cleanup

_curl_multi_info_read

_curl_multi_setopt

_curl_multi_timeout

_Curl_expire

_checkPendPipeline

_curl_multi_perform

_curl_multi_socket_all

_curl_multi_socket_action

_curl_multi_socket

_curl_multi_remove_handle

_curl_multi_add_handle

_curl_multi_assign

_Curl_llist_alloc

_Curl_llist_insert_next

_Curl_llist_remove

_Curl_llist_destroy

_Curl_llist_count

_Curl_llist_move

_Curl_ssl_config_matches

_Curl_clone_ssl_config

_Curl_free_ssl_config

_Curl_raw_toupper

_Curl_raw_equal

_Curl_raw_nequal

_Curl_strntoupper

_Curl_speedinit

_Curl_speedcheck

_curlx_tvnow

_curlx_tvdiff

_curlx_tvdiff_secs

_Curl_tvlong

_Curl_pgrsResetTimesSizes

_Curl_pgrsTime

_Curl_pgrsStartNow

_Curl_pgrsSetDownloadCounter

_Curl_pgrsSetUploadCounter

_Curl_pgrsSetDownloadSize

_Curl_pgrsSetUploadSize

_Curl_pgrsUpdate

_Curl_pgrsDone

_curl_easy_escape

_curl_escape

_Curl_urldecode

_curl_easy_unescape

_curl_unescape

_curl_free

_curl_getenv

_Curl_parsenetrc

_curlx_ultous

_curlx_ultouc

_curlx_ultosi

_curlx_uztosi

_curlx_uztoul

_curlx_uztoui

_curlx_sltosi

_curlx_sltoui

_curlx_sltous

_curlx_uztosz

_curlx_sotouz

_curlx_sztosi

_curlx_sitouz

_Curl_wait_ms

_Curl_socket_check

_Curl_poll

_curl_strequal

_curl_strnequal

_Curl_strlcat

_Curl_input_digest

_Curl_output_digest

_Curl_digest_cleanup

_Curl_set_dns_servers

_Curl_blockread_all

_Curl_SOCKS4

_Curl_SOCKS5

_Curl_proxyCONNECT

_Curl_proxy_connect

_Curl_httpchunk_init

_Curl_httpchunk_read

_curl_easy_strerror

_curl_multi_strerror

_curl_share_strerror

_Curl_strerror

_Curl_wildcard_init

_Curl_wildcard_dtor

_Curl_strtok_r

_Curl_memrchr

_curl_getdate

_Curl_gmtime

_Curl_inet_pton

_curlx_nonblock

_Curl_if_is_interface_name

_Curl_if2ip

_curl_formadd

_Curl_formclean

_curl_formfree

_Curl_FormInit

_Curl_FormReader

_Curl_formpostheader

_Curl_FormBoundary

_Curl_getformdata

_curl_formget

_Curl_base64_decode

_Curl_base64_encode

_Curl_pp_state_timeout

_Curl_pp_multi_statemach

_Curl_pp_easy_statemach

_Curl_pp_init

_Curl_pp_vsendf

_Curl_pp_sendf

_Curl_pp_readresp

_Curl_pp_getsock

_Curl_pp_flushsend

_Curl_pp_disconnect

_PL_ERROR.isra.1

_ftp_pl_insert_finfo.isra.2

_Curl_ftp_parselist_data_alloc

_Curl_ftp_parselist_data_free

_Curl_ftp_parselist_geterror

_Curl_ftp_parselist

_Curl_md5it

_Curl_MD5_init

_Curl_MD5_update

_Curl_MD5_final

_sasl_digest_get_key_value

_Curl_sasl_create_plain_message

_Curl_sasl_create_login_message

_Curl_sasl_create_cram_md5_message

_Curl_sasl_create_digest_md5_message

_Curl_sasl_cleanup

_Curl_gethostname

_Curl_splay

_Curl_splayinsert

_KEY_NOTUSED.16922

_Curl_splaygetbest

_Curl_splayremovebyaddr

_Curl_fileinfo_alloc

_Curl_fileinfo_dtor

_Curl_fnmatch

_Curl_HMAC_init

_Curl_HMAC_update

_Curl_HMAC_final

_hash_key

_key_equal

_jsonp_object_iter_fullkey

_json_object_iter_key

_object_key_compare_serials

_object_key_compare_keys

_hashtable_iter_key

_ptw32_mcs_flag_wait.part.0

_pthread_mutex_init.part.1

_pthread_win32_thread_detach_np.part.5

_pthread_key_create

_pthread_key_delete

_ptw32_processTerminate.part.4

_pthread_join

_critical_factorization.part.0

_sprintf.constprop.0

_PDC_get_key_modifiers

_PDC_save_key_modifiers

_PDC_return_key_modifiers

_PDC_set_keyboard_binary

_PDC_check_key

_key_count

_PDC_get_key

_left_key

___report_error

___write_memory.part.0

___mingwthr_run_key_dtors.part.0

_key_dtor_list

____w64_mingwthr_add_key_dtor

____w64_mingwthr_remove_key_dtor

___wcrtomb_cp

.ctors.65535

.weak.__Jv_RegisterClasses.___gcc_register_frame

__imp__execv

_opt_loginput

_Curl_handler_smtp

__libmsvcrt_a_iname

.weak.___register_frame_info.___gcc_register_frame

_Curl_handler_http

___crt_xl_start__

_Curl_handler_pop3

_PeekNamedPipe@24

_opt_api_port

___crt_xi_start__

_Curl_handler_dict

___crt_xi_end__

_Curl_crealloc

_ptw32_selfThreadKey

_Curl_cfree

_Curl_HMAC_MD5

__imp__RegCloseKey@4

_Curl_wkday

___crt_xp_start__

_Curl_handler_telnet

_Curl_handler_file

__imp__RegOpenKeyExA@20

___crt_xp_end__

_ptw32_cleanupKey

__imp__GetLargestConsoleWindowSize@4

__head_libmsvcrt_a

__imp__GetConsoleOutputCP@0

_Curl_ccalloc

_MapVirtualKeyA@8

__CRT_fmode

___crt_xc_end__

___crt_xc_start__

_Curl_DIGEST_MD5

__imp__GetKeyState@4

_pdc_key_modifiers

_Curl_cmalloc

_Curl_handler_tftp

_Curl_month

_Curl_handler_gopher

_RegOpenKeyExA@20

__imp__MapVirtualKeyA@8

.weak.___deregister_frame_info.___gcc_register_frame

_GetKeyState@4

_Curl_cstrdup

___crt_xt_start__

_GetLargestConsoleWindowSize@4

__imp__PeekNamedPipe@24

_Curl_handler_imap

__CRT_glob

_Curl_handler_ftp

_GetConsoleOutputCP@0

_RegCloseKey@4

_Curl_handler_rtsp

___crt_xt_end__

c:\workarea\8.98\stream\opencl\api\opencl\khronos\icd\build\w8\B_rel\OpenCL.pdb

RegOpenKeyExA

clGetSupportedImageFormats

6$6(6,6064686

7(7/74787

7&8,8084888

_%uX3

6.Rjd

%sUv/

,.VrW,

W%UKR

XA.EG

.Oq[!

%x=9;2

1.emu

%3%c}K

@D.bNo

k.vce

l4.Uk[_M

.VaXy

V6sZQ%S

.OTxm0CaN

nc.Ktf

$RU-%d

..Wh\

".cn1

ÃŸm;4

Z.YK6Z#

G-BT}

{"%C

.ZPl:

`:?1(%D

.MNR]?

.rdig

M.BsU

.xct?

.DtPh

k.qHP

u.iPwu

.aV:O

Xrmsg4>6

0Kw5%s

O %D

YV6%D

0x.HW

31`)0.-#

n%d@y3

.kJ#L

5%uTN

J:.yc

1'wd%C

.,'.aOS

.Zl d

-dCP}

%FIJ{

*8 .nL

f.kC0:

!.nQ?

.Qv_*

j t.Ax

isqL@.

%F~h.

S-K?z%X

.ZKEi

V.dv4

.dY-E! D

Kc]%u

8ÃŠ`

GDI32.dll

SHELL32.DLL

`.data

.reloc

squvUDPZy^K]|FANZ

"'48%6*|8$:

*#/2(3.$="4

MK[(bocmdgs

'*()%"6*##=

8>66?1'

''&07#?>>|

$$&!eja&".NY

/1915?~!

&74> :2(,

HTTP/1.1

gdiplus.dll

GdiplusShutdown

gdi32.dll

PR_OpenTCPSocket

hXXp://

hXXps://

HTTP/1.

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

cabinet.dll

hXXp://VVV.google.com/webhp

SSSh0E@

SetKeyboardState

MapVirtualKeyW

GetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

OpenWindowStationW

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

RegEnumKeyExW

RegCreateKeyExW

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

Secur32.dll

SetViewportOrgEx

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

InternetCrackUrlA

HttpAddRequestHeadersA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

NETAPI32.dll

6%6 646;6

5_5x5

0(1.141\1

6!7 777\8&9:9

3 3$3(3,3034383

8 8$8(80848

7$7,747084888

0 0$0(0,0004080

6 6$6(6,6064686

7 7$7(7,7

%s\%s

%WINDIR%\SysWOW64\OpenCL.dll

%WINDIR%\System32\OpenCL.dll

%WINDIR%\system32\svchost.exe

"%s" %s

%TEMP%\svchost.exe

http\\shell\\open\\command

!\sddplos.exe

\System32\svchost.exe

sdsdpl.exe

"%s" ext "%s"

%s\tor\hidden_service\hostname

"%s" --HiddenServiceDir "%s\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"

Global\%s

n\EXETEPELEHEDE

mscoree.dll

EKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

-o hXXp://%S -u user6 -p UB97ad2 -w 128 -I d -k poclbm --api-listen

-o stratum tcp://%S -u user6 -p UB97ad2 -w 128 -I d -k poclbm --api-listen

--HiddenServiceDir "%s\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"

DE\EXETEPELEHE

%System%\svchost.exe

1.2.2.0

SysShadow

nspr4.dll

kernel32.dll

/c "%s"

%sx.%s

%sx

e.dat

cGlobal\XXX

svchost.exe_516_rwx_00400000_001DB000: