Analysis Date2013-10-05 03:04:57
MD573b2079c688efe50202fa162b8d19793
SHA101ef2bef67dd34d9e647c20a2f08ce5304d8b68a

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: df9d487ccb89217c1c9c5dbdb0458426 sha1: efd3d654c3a1d396a866c0b2e670ba72ea33b140 size: 408576
Section.rdata md5: 5c569435b0b27f95e349586e4a6f2872 sha1: 551d70bb48043c76fda1191828715affd5f0b3b5 size: 57856
Section.data md5: d58a13d82d8b598632f6ea1ecac49697 sha1: d3b7e6e4d94625255f38b81518b877313e19d881 size: 11264
Section.rsrc md5: beafbde081a00045c5646597f1b5b055 sha1: a5543faea2b5cdca709114e17b3eebac1c7b580a size: 35840
Timestamp2007-09-10 14:57:50
VersionNuyer.........: ...... .. ...... : ., ., ., .
Virus.Name.: ., ., ., .
FileDescription:
PackerMicrosoft Visual C++ ?.?
PEhash78aecbdf9f89da09087800f05c4569bc3a5d4d9c
AVmsseWorm:Win32/Yuner.A
AVclamavTrojan.KillAV-235
AVavgMay be infected by unknown virus
AVaviraWORM/Autorun.856215

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\Software\Classes\CLV.Classes\Com1 ➝
32302D7A9C5683236D4576DD77232CDF7D8364A8\\x00
Creates FileC:\WINDOWS\system32\axnxxtjsgsaqu.exe
Creates FileC:\WINDOWS\system32\uavpvxqkljuvqmf.exe
Creates FileC:\WINDOWS\mydoc.rtf
Creates FileC:\WINDOWS\system32\vlakqajy.exe
Creates FileC:\WINDOWS\system32\zrfepmuamh.exe
Creates Processzrfepmuamh.exe
Creates Processaxnxxtjsgsaqu.exe
Creates Processuavpvxqkljuvqmf.exe
Creates Processvlakqajy.exe

Process
↳ zrfepmuamh.exe

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan ➝
NULL
RegistryHKEY_CLASSES_ROOT\.wsh\ ➝
txtfile\\x00
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR ➝
1
RegistryHKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\DisableCMD ➝
2
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden ➝
NULL
RegistryHKEY_CLASSES_ROOT\.wsf\ ➝
txtfile\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun ➝
145
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ShowAll\CheckedValue ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools ➝
1
RegistryHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ➝
VirusBenci\\x00
RegistryHKEY_CLASSES_ROOT\.vbs\ ➝
txtfile\\x00
RegistryHKEY_CLASSES_ROOT\.wsc\ ➝
txtfile\\x00
RegistryHKEY_CLASSES_ROOT\.bat\ ➝
txtfile\\x00
RegistryHKEY_CLASSES_ROOT\.reg\ ➝
txtfile\\x00
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\AntiVirusDisableNotify ➝
1
RegistryHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ComputerName\ComputerName ➝
VirusBenci\\x00
Creates FileC:\WINDOWS\system32\pckhar.exe
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Security Center.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\desktop.ini
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Activate Windows.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Backup.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Scheduled Tasks.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\System Information.lnk
Deletes FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\System Restore.lnk
Creates ProcessC:\WINDOWS\system32\vlakqajy.exe

Process
↳ uavpvxqkljuvqmf.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\wxudmqhq ➝
zrfepmuamh.exe\\x00

Process
↳ C:\WINDOWS\system32\vlakqajy.exe

Process
↳ vlakqajy.exe

Creates Filec:\Documents and Settings\Administrator\Templates\winword2.doc.exe
Creates Filec:\Documents and Settings\Default User\Templates\winword2.doc.exe
Creates Filec:\Documents and Settings\Default User\Templates\winword.doc.exe
Creates Filec:\Documents and Settings\Administrator\Templates\winword.doc.exe

Process
↳ axnxxtjsgsaqu.exe

Network Details:


Raw Pcap

Strings
-----
:;<=>?@
., ., ., .
...... .. ...... : ., ., ., .
[\]^_`
\*.*
0.0.0.0
0123456789ABCDEF
%02d
04090000
080904b0
0x%p
@%.15g
%.2d
#32770
3, 2, 8, 1
%.3d
%4d%02d%02d%02d%02d%02d
A%4d
abort
ACOS
ACTIVE
[ACTIVE
ADDSTRING
ADLIBDISABLE
ADLIBENABLE
 alias PlayMe
[ALL
All files (*.*)
AppData
APPDATACOMMONDIR
APPDATADIR
Array maximum size exceeded.+"Func" statement has no matching "EndFunc".
ASCW
ASIN
Assert Failed!PAutoIt has encountered a fatal crash as a result of:
ASSIGN
ATAN
*.au3;*.a3x
AutoIt
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
@AutoIt3GUI
/AutoIt3OutputDebug
AUTOITATTRIB
AUTOITCALLVARIABLE%d
AutoIt Error
AutoIt.Error
AUTOITEXE
AutoIt has detected the stack has become corrupt.
AutoIt Input Box
AUTOITPID
>>>AUTOIT SCRIPT<<<
AutoIt script files (*.au3, *.a3x)
AUTOITSETOPTION
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions.  The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead.  See the DllCall() documentation for details on changing the calling convention.
AutoIt v3
AUTOITVERSION
AUTOITWINGETTITLE
AUTOITWINSETTITLE
Badly formated Enum statement!Badly formated variable or macro.3This keyword cannot be used after a "Then" keyword.
BEEP
BINARY
BINARYLEN
BINARYMID
BINARYTOSTRING
BITAND
BITNOT
BITOR
BITROTATE
BITSHIFT
BITXOR
blank
BLOCKINPUT
BREAK
button
BUTTON
BYREF
byte
CALL
CALLARGARRAY
Cancel
Cannot parse #include
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.
Can't install a new Errorhandler when one is still active.
CaretCoordMode
CASE
ccs=
cdecl
cdrom
CDROM
CDTRAY
CEILING
char
CHECK
CHRW
CLASS
[CLASS:
CLASSNAME=
CLASSNN
CLEAR
CLIPGET
CLIPPUT
close
close all
close cd wait
closed
close PlayMe
\CLSID
CLSID\
CMDLINE
CMDLINERAW
*ColGUI
ColorMode
Combobox
@ComboBox
COMBOBOX
@COM_EVENTOBJ
#comments-end
#comments-start
Common AppData
Common Desktop
Common Documents
Common Favorites
CommonFilesDir
COMMONFILESDIR
Common Programs
Common Start Menu
Common Startup
COMPILED
COMPUTERNAME
COMSPEC
CONSOLEREAD
CONSOLEWRITE
CONSOLEWRITEERROR
CONST
Container
Context1
CONTINUECASE
CONTINUELOOP
CONTROLCLICK
CONTROLCOMMAND
CONTROLDISABLE
CONTROLENABLE
CONTROLFOCUS
CONTROLGETFOCUS
CONTROLGETHANDLE
CONTROLGETPOS
CONTROLGETTEXT
CONTROLHIDE
CONTROLLISTVIEW
CONTROLMOVE
Control Panel\Mouse
CONTROLSEND
CONTROLSETTEXT
CONTROLSHOW
Conversion of parameters failed
CRLF
CURRENTTAB
d0#1
d0#2
%d/%02d/%02d
d0b*ColGUI
d0r0,1023
d0r0,3
d100m0
d10m0
d124c
d1#3
d1r0,2
d1r1,2
d250m0
d5m0
Default
DEFAULT
.DEFAULT\Control Panel\Desktop\ResourceLocale
DefaultLangCodepage
DELSTRING
DESCRIPTION
DESELECT
Desktop
DESKTOPCOMMONDIR
DESKTOPDEPTH
DESKTOPDIR
DESKTOPHEIGHT
DESKTOPREFRESH
DESKTOPWIDTH
details
diouxXeEfgGs
DIRCOPY
DIRCREATE
DIRGETSIZE
DIRMOVE
DIRREMOVE
DISPLAY
.dll
DLLCALL
DLLCLOSE
DLLOPEN
DLLSTRUCTCREATE
DLLSTRUCTGETDATA
DLLSTRUCTGETPTR
DLLSTRUCTGETSIZE
DLLSTRUCTSETDATA
DOCUMENTSCOMMONDIR
D'OnAutoItExit'S
double
DOWN
DRIVEGETDRIVE
DRIVEGETFILESYSTEM
DRIVEGETLABEL
DRIVEGETSERIAL
DRIVEGETTYPE
DRIVEMAPADD
DRIVEMAPDEL
DRIVEMAPGET
DRIVESETLABEL
DRIVESPACEFREE
DRIVESPACETOTAL
DRIVESTATUS
DUMMYSPEEDTEST
Duplicate function name.
dword
edit
EDIT
EDITPASTE
ELSE
ELSEIF
ENDFUNC
ENDIF
ENDSELECT
ENDSWITCH
ENDWITH
ENUM
ENVGET
Environment
ENVSET
ENVUPDATE
Error: 
ERROR
^ ERROR
Error allocating memory.
Error in expression.
Error opening the file
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
/ErrorStdOut
EVAL
.exe
EXECUTE
Exit
E&xit
EXIT
@EXITCODE
EXITLOOP
@EXITMETHOD
ExpandEnvStrings
ExpandVarStrings
EXTENDED
Failed to create the Error Handler
Failed to create the Event Object.
Failed to retrieve outgoing Event Interface from Object.
False
FALSE
Favorites
FAVORITESCOMMONDIR
FAVORITESDIR
FILECHANGEDIR
FILECLOSE
FILECOPY
FILECREATENTFSLINK
FILECREATESHORTCUT
FILEDELETE
FileDescription
FILEEXISTS
FILEFINDFIRSTFILE
FILEFINDNEXTFILE
FILEGETATTRIB
FILEGETLONGNAME
FILEGETSHORTCUT
FILEGETSHORTNAME
FILEGETSIZE
FILEGETTIME
FILEGETVERSION
FILEINSTALL
FILEMOVE
FILEOPEN
FILEOPENDIALOG
FILEREAD
FILEREADLINE
FILERECYCLE
FILERECYCLEEMPTY
FILESAVEDIALOG
FILESELECTFOLDER
FILESETATTRIB
FILESETTIME
FILEWRITE
FILEWRITELINE
FINDITEM
FINDSTRING
First parameter must be of type 'Object'.
fixed
Fixed
float
FLOOR
FtpBinaryMode
FTPSETPROXY
FUNC
GETCURRENTCOL
GETCURRENTLINE
GETCURRENTSELECTION
GETITEMCOUNT
GETLINE
GETLINECOUNT
get__NewEnum
GETSELECTED
GETSELECTEDCOUNT
GETSUBITEMCOUNT
GETTEXT
GLOBAL
GUICloseOnESC
GUICoordMode
GUICREATE
GUICTRLCREATEAVI
GUICTRLCREATEBUTTON
GUICTRLCREATECHECKBOX
GUICTRLCREATECOMBO
GUICTRLCREATECONTEXTMENU
GUICTRLCREATEDATE
GUICTRLCREATEDUMMY
GUICTRLCREATEEDIT
GUICTRLCREATEGRAPHIC
GUICTRLCREATEGROUP
GUICTRLCREATEICON
GUICTRLCREATEINPUT
GUICTRLCREATELABEL
GUICTRLCREATELIST
GUICTRLCREATELISTVIEW
GUICTRLCREATELISTVIEWITEM
GUICTRLCREATEMENU
GUICTRLCREATEMENUITEM
GUICTRLCREATEMONTHCAL
GUICTRLCREATEOBJ
GUICTRLCREATEPIC
GUICTRLCREATEPROGRESS
GUICTRLCREATERADIO
GUICTRLCREATESLIDER
GUICTRLCREATETAB
GUICTRLCREATETABITEM
GUICTRLCREATETREEVIEW
GUICTRLCREATETREEVIEWITEM
GUICTRLCREATEUPDOWN
GUICTRLDELETE
GUICTRLGETHANDLE
GUICTRLGETSTATE
@GUI_CTRLHANDLE
@GUI_CTRLID
GUICTRLREAD
GUICTRLRECVMSG
GUICTRLREGISTERLISTVIEWSORT
GUICTRLSENDMSG
GUICTRLSENDTODUMMY
GUICTRLSETBKCOLOR
GUICTRLSETCOLOR
GUICTRLSETCURSOR
GUICTRLSETDATA
GUICTRLSETFONT
GUICTRLSETGRAPHIC
GUICTRLSETIMAGE
GUICTRLSETLIMIT
GUICTRLSETONEVENT
GUICTRLSETPOS
GUICTRLSETRESIZING
GUICTRLSETSTATE
GUICTRLSETSTYLE
GUICTRLSETTIP
GUIDataSeparatorChar
GUIDELETE
@GUI_DRAGFILE
@GUI_DRAGID
@GUI_DROPID
GUIEventOptions
GUIGETCURSORINFO
GUIGETMSG
GUIGETSTYLE
GUIOnEventMode
GUIREGISTERMSG
GUIResizeMode
GUI_RUNDEFMSG
GUISETBKCOLOR
GUISETCOORD
GUISETCURSOR
GUISETFONT
GUISETHELP
GUISETICON
GUISETONEVENT
GUISETSTATE
GUISETSTYLE
GUISTARTGROUP
GUISWITCH
@GUI_WINHANDLE
                                 H
         (((((                  H
HANDLE
[HANDLE:
HANDLE=
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
HELPCONTEXT
HELPFILE
         h((((                  H
HIDEDROPDOWN
HKCC
HKCR
HKCR\
HKCU
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKLM
HOMEDRIVE
HOMEPATH
HOMESHARE
HOTKEYPRESSED
HOTKEYSET
HOUR
HTTPSETPROXY
hwnd
HWND
IA64
.icl
idispatch
idispatch_ptr
#include
#include depth exceeded.  Make sure there are no recursive includes
#include-once
Incorrect Object type in FOR..IN loop
Incorrect Parameter format
Incorrect parameters to object property !
INETGET
INETGETACTIVE
INETGETBYTESREAD
INETGETSIZE
info
INIDELETE
INIREAD
INIREADSECTION
INIREADSECTIONNAMES
INIRENAMESECTION
INIWRITE
INIWRITESECTION
inprocserver32
INPUTBOX
InstallLanguage
INSTANCE
int64
interface
interface\
Interface\
int_ptr
INVALID
Invalid characters behind Object assignment !
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.
Invalid file handle used.
IPADDRESS1
IPADDRESS2
IPADDRESS3
IPADDRESS4
\IPC$
ISADMIN
ISARRAY
ISBINARY
ISBOOL
ISCHECKED
ISDECLARED
ISDLLSTRUCT
ISENABLED
ISFLOAT
ISHWND
ISINT
ISKEYWORD
ISNUMBER
ISOBJ
ISSELECTED
ISSTRING
ISVISIBLE
KBLAYOUT
largeicons
LAST
[LAST
LASTDLLERROR
LEFT
Line: 
Line %d:
Line %d  (File "%s"):
list
Listbox
ListBox
.lnk
<local>
LOCAL
localserver32
LOGONDNSDOMAIN
LOGONDOMAIN
LOGONSERVER
long
long_ptr
MAIN
MDAY
MEMGETSTATS
MENU
MIDDLE
Missing operator in expression."Unbalanced brackets in expression.
MOUSECLICK
MouseClickDelay
MouseClickDownDelay
MOUSECLICKDRAG
MouseClickDragDelay
MouseCoordMode
MOUSEDOWN
MOUSEGETCURSOR
MOUSEGETPOS
MOUSEMOVE
MOUSEUP
MOUSEWHEEL
msctls_progress32
Msctls_Progress32
msctls_statusbar321
msctls_trackbar32
msctls_updown32
MSGBOX
MS Shell Dlg
MustDeclareVars
MYDOCUMENTSDIR
network
Network
_NewEnum
NEXT
none
Not an Object type
#notrayicon
NOTREADY
(null)
NULL
Null Object assignment in FOR..IN loop
NULL Pointer assignment
NUMBER
NUMPARAMS
Nuyer.........
OBJCREATE
-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
OBJEVENT
OBJGET
OBJNAME
Obsolete function/parameter.4Invalid Exitcode (reserved for AutoIt internal use).
ONAUTOITEXIT
ONAUTOITSTART
OnExitFunc
open
open 
OSBUILD
OSLANG
OSSERVICEPACK
OSTYPE
OSVERSION
	(Paused) 
Personal
PING
PIXELCHECKSUM
PixelCoordMode
PIXELGETCOLOR
PIXELSEARCH
play PlayMe
play PlayMe wait
PLUGINCLOSE
PLUGINOPEN
PRIMARY
PROCESSCLOSE
PROCESSEXISTS
PROCESSLIST
PROCESSORARCH
PROCESSSETPRIORITY
PROCESSWAIT
PROCESSWAITCLOSE
ProgID
ProgramFilesDir
PROGRAMFILESDIR
Programs
PROGRAMSCOMMONDIR
PROGRAMSDIR
PROGRESSOFF
PROGRESSON
PROGRESSSET
Prompt
question
RAISE
ramdisk
RAMDisk
RANDOM
READONLY
READY
REDIM
REG_BINARY
REGDELETE
REG_DWORD
REGENUMKEY
REGENUMVAL
REGEXP=
REG_EXPAND_SZ
REGEXPTITLE
[REGEXPTITLE:
REG_MULTI_SZ
REGREAD
REG_SZ
REGWRITE
removable
Removable
#requireadmin
RETCODE
RETURN
RIGHT
rInclude
ROUND
runas
RUNASSET
RunErrorsFatal
Run Script:
RUNWAIT
==> %s
\??\%s
SCRIPTDIR
SCRIPTFULLPATH
SCRIPTLINE
SCRIPTLINENUMBER
SCRIPTNAME
Script Paused
Script &Paused
%s%d
%s (%d) : ==> %s: 
%s (%d) : ==> %s.: 
SECONDARY
SELECT
SELECTALL
SELECTCLEAR
SELECTINVERT
>"Select" statement is missing "EndSelect" or "Case" statement.+"If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.:Only Object-type variables allowed in an "With" statement.
SELECTSTRING
SEND
SendAttachMode
SendCapsLockMode
SendKeyDelay
SendKeyDownDelay
SeShutdownPrivilege
set cd door 
SETCURRENTSELECTION
SETERROR
SetExitCode
SETEXTENDED
SHELLDLL_DefView
SHELLEXECUTE
SHELLEXECUTEWAIT
Shell_TrayWnd
short
short_ptr
SHOWDROPDOWN
SHUTDOWN
SLEEP
smallicons
Software\AutoIt v3\AutoIt
SOFTWARE\Classes\
SOFTWARE\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOUNDPLAY
SOUNDSETWAVEVOLUME
SOURCE
SPLASHIMAGEON
SPLASHOFF
SPLASHTEXTON
SQRT
SRANDOM
Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.
Start Menu
STARTMENUCOMMONDIR
STARTMENUDIR
Startup
STARTUPCOMMONDIR
STARTUPDIR
static
STATUSBARGETTEXT
status PlayMe mode
stdcall
STDERRREAD
STDINWRITE
STDOUTREAD
STEP
stop
STOP
string
STRING
STRINGADDCR
STRINGCOMPARE
StringFileInfo
StringFileInfo\
STRINGFORMAT
STRINGINSTR
STRINGISALNUM
STRINGISALPHA
STRINGISASCII
STRINGISDIGIT
STRINGISFLOAT
STRINGISINT
STRINGISLOWER
STRINGISSPACE
STRINGISUPPER
STRINGISXDIGIT
STRINGLEFT
STRINGLEN
STRINGLOWER
STRINGMID
String missing closing quote.
STRINGREGEXP
STRINGREGEXPREPLACE
STRINGREPLACE
STRINGRIGHT
STRINGSPLIT
STRINGSTRIPCR
STRINGSTRIPWS
STRINGTOBINARY
STRINGTRIMLEFT
STRINGTRIMRIGHT
STRINGUPPER
%s%u
SwapMouseButtons
SW_DISABLE
SW_ENABLE
SW_HIDE
SWITCH
SW_LOCK
SW_MAXIMIZE
SW_MINIMIZE
SW_RESTORE
SW_SHOW
SW_SHOWDEFAULT
SW_SHOWMAXIMIZED
SW_SHOWMINIMIZED
SW_SHOWMINNOACTIVE
SW_SHOWNA
SW_SHOWNOACTIVATE
SW_SHOWNORMAL
SW_UNLOCK
SysAnimate32
SysDateTimePick32
SysListView32
SysMonthCal32
SysTabControl32
SYSTEM\CurrentControlSet\Control\Nls\Language
SYSTEMDIR
SysTreeView32
TABLEFT
TABRIGHT
TaskbarCreated
TCPACCEPT
TCPCLOSESOCKET
TCPCONNECT
TCPLISTEN
TCPNAMETOIP
TCPRECV
TCPSEND
TCPSHUTDOWN
TCPSTARTUP
TCPTimeout
TEMPDIR
TEXT
THEN
TIMERDIFF
TIMERINIT
TITLE
ToolBoxBitmap32
TOOLTIP
tooltips_class32
Translation
TrayAutoPause
TRAYCREATEITEM
TRAYCREATEMENU
TRAYGETMSG
TrayIconDebug
TRAYICONFLASHING
TrayIconHide
TRAYICONVISIBLE
@TRAY_ID
TRAYITEMDELETE
TRAYITEMGETHANDLE
TRAYITEMGETSTATE
TRAYITEMGETTEXT
TRAYITEMSETONEVENT
TRAYITEMSETSTATE
TRAYITEMSETTEXT
TrayMenuMode
TrayOnEventMode
TRAYSETCLICK
TRAYSETICON
TRAYSETONEVENT
TRAYSETPAUSEICON
TRAYSETSTATE
TRAYSETTOOLTIP
TRAYTIP
True
TRUE
 type cdaudio alias cd wait
\TypeLib
UBOUND
ubyte
UDPBIND
UDPCLOSESOCKET
UDPOPEN
UDPRECV
UDPSEND
UDPSHUTDOWN
UDPSTARTUP
udword
uint
uint64
Unable to access RunAs API.
 Unable to execute DLLCall.
Unable to open the script file.!Badly formatted "Func" statement.
Unable to parse line.(Missing right bracket ')' in expression.
UNCHECK
UNICODE
.UNICODE
UNKN%d
unknown
Unknown
UNKNOWN
Unknown function name.
Unknown macro.'Unable to execute the external program.*Unable to get a list of running processes.*Missing separator character after keyword.
Unterminated group of comments
Unterminated string
UNTIL
URLDOWNLOADTOFILE
USERDNSDOMAIN
USERDOMAIN
USERNAME
USERPROFILE
USERPROFILEDIR
ushort
UTF-16LE
UTF-8
%u.%u.%u.%u
VarFileInfo
\VarFileInfo\Translation
Variable is not of type 'Object'.
Variable must be of type 'Object'.
VARTYPE
Version
VIEWCHANGE
Virus.Name.
VS_VERSION_INFO
 wait
warning
WAutoIt v3 GUI
wchar
WDAY
WEND
WHILE
WIN_2000
WIN_2003
WIN32_NT
WIN32_WINDOWS
WIN_95
WIN_98
WINACTIVATE
WINACTIVE
winapi
WINCLOSE
WINDESCRIPTION
WinDetectHiddenText
WINDOWSDIR
WINEXISTS
WINFLASH
WINGETCARETPOS
WINGETCLASSLIST
WINGETCLIENTSIZE
WINGETHANDLE
WINGETPOS
WINGETPROCESS
WINGETSTATE
WINGETTEXT
WINGETTITLE
WINKILL
WINLIST
WIN_LONGHORN
WIN_ME
WINMENUSELECTITEM
WINMINIMIZEALL
WINMINIMIZEALLUNDO
WINMOVE
WIN_NT4
WinSearchChildren
WINSETONTOP
WINSETSTATE
WINSETTITLE
WINSETTRANS
WinTextMatchMode
WinTitleMatchMode
WIN_VISTA
WINWAIT
WINWAITACTIVE
WINWAITCLOSE
WinWaitDelay
WINWAITNOTACTIVE
WIN_XP
WITH
WORKINGDIR
wstr
wstring
YDAY
YEAR
|$(;|$,~
                          
											
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0A@@Ju
0{PQMJIFCB>
0SSSSS
0WWWWW
119216726109
1#QNAN
1#SNAN
20128124609450
2211/U.RTONPL-ffJJdcb
229626881650
250647255390
2AAA@??>><[[88WW1/USb
2If90t
,*3)Ji
;>3XVH9
412396829082
460259769695
4~f9.u
4Tf&6V
540838793985
556886070510
~55Z.*Hh}^s
5:6'#IxF
[5SROo
7t>Ht*Ht
 8^8t WQ
8ERCPt$
|$8PSSS
8Tt	;u
8VVVVV
8]'Yt%
8]'Yt+
9|$0t\
9|$4Yv6VS
98t	C;
9ED~8;
9ET|:9E
9E vMPQj
9|$HYt
9P u%8
9\$ t"
9t$8YY
9(tK;=@
9] tL9]$uB9](uB3
9(u#;= 
9_<u-8_
9U tr;
9u(v(V
9Uxu	9U|
9W0t	;wP
 aAeEiIoOuUyYnN 
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ACCEPT
AdjustTokenPrivileges
AdjustWindowRectEx
Advapi32.dll
ADVAPI32.dll
ALTDOWN
An application has made an attempt to load the C runtime library incorrectly.
AngleArc
ANYCRLF)
APPSKEY
AQueue: Out of bounds.
Arabic
Armenian
ASC 0%d
</assembly>
	<assemblyIdentity
			<assemblyIdentity
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
assertion expected after (?(
aSSQRMONKLef|{zz
AStack: top(): Out of bounds.
\ at end of pattern
AttachThreadInput
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
AU3!EA06276957785817268
AU3_FreeVar
AU3_GetPluginDetails
August
.?AVbad_alloc@std@@
AVector: back(): Out of bounds.
AVector: []: Out of bounds.
.?AVexception@std@@
.?AVtype_info@@
BACKSPACE
bad allocation
Balinese
 Base Class Array'
 Base Class Descriptor at (
__based(
@@BBf;
BBFFf;
bb`_ywwttus
BeginPaint
BeginPath
Bengali
Bf9<Hu
BI:4UX
BitBlt
Bj"_f;
BlockInput
Bopomofo
Braille
BROWSER_BACK
BROWSER_FAVORTIES
BROWSER_FORWARD
BROWSER_HOME
BROWSER_REFRESH
BROWSER_SEARCH
BROWSER_STOP
Bt2HHt*
Buginese
C5]]4ZT5
Canadian_Aboriginal
CAPSLOCK
\c at end of pattern
 CCGGf
__cdecl
character value in \x{...} sequence is too large
CharLowerBuffW
CharNextW
CharUpperBuffW
CharUpperW
Ch;Cdu
CheckMenuRadioItem
Cherokee
 Class Hierarchy Descriptor'
ClientToScreen
CloseClipboard
CloseFigure
CloseHandle
CloseServiceHandle
closing ) for (?C expected
__clrcall
CLSIDFromProgID
CLSIDFromString
\C not allowed in lookbehind assertion
CoCreateInstance
CoCreateInstanceEx
CoInitialize
CoInitializeSecurity
COMCTL32.dll
comdlg32.dll
COMMIT
Common
CompareStringA
CompareStringW
 Complete Object Locator'
conditional group contains more than two branches
CONOUT$
Coptic
`copy constructor closure'
CopyFileW
CopyImage
CopyRect
CorExitProcess
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CountClipboardFormats
CreateBindCtx
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateDirectoryW
CreateFileA
CreateFileMappingW
CreateFileW
CreateFontW
CreateHardLinkW
CreateIcon
CreateIconFromResourceEx
CreateMenu
CreatePen
CreatePipe
CreatePopupMenu
CreateProcessW
CreateProcessWithLogonW
CreateSolidBrush
CreateStreamOnHGlobal
CreateThread
CreateToolhelp32Snapshot
CreateWindowExW
- CRT not initialized
}*CrWx
CTRLDOWN
CTRLUP
Cuneiform
C;wTsm
Cypriot
Cyrillic
D$0+D$
D$0+D$(
D$0+D$(9}
D$49D$
D$4+D$
D$4+D$,j
D$4+D$,j P
D$4+D$,WWW
D7 /INW
D$8+D$0PWWW
D$8t,3
D$8t"3
D$ 9|$ 
D$ 9D$(Yt
@.data
D$ ;D$
D$ ;D$(}
D$D9D$
 !!!!!!""#$%&'(((((())*+,-.DDDDDDDD//01234555676789:;<:;<DDD=>?@ABC
dddd, MMMM dd, yyyy
D$D+D$<P
D$d;D$T
D$$+D$<j
D$ ;D$(|T;D$,~d
December
DecodePointer
`default constructor closure'
DEFINE
DEFINE group contains more than one branch
DefWindowProcW
 delete
 delete[]
DELETE
DeleteCriticalSection
DeleteDC
DeleteFileW
DeleteMenu
DeleteObject
	</dependency>
	<dependency>
		</dependentAssembly>
		<dependentAssembly>
	<description>AutoIt v3</description>
Deseret
DestroyIcon
DestroyMenu
DestroyWindow
Devanagari
DeviceIoControl
D$(G9|$
D$H9D$
D$h;D$X
DialogBoxParamW
DispatchMessageW
DOMAIN error
D$P+D$$9D$
D$@Pj@V
D$PPS3
D$PPVj
D$PPVSS
D$\PQ3
dQg1[x
D$$QPW
D$ r9j
DragFinish
DragQueryFileW
DragQueryPoint
DrawFocusRect
DrawFrameControl
DrawMenuBar
DrawTextW
D$`SS@P
D$T)D$\
D$T+F<
D$tFt<
D$<t=j$
;D$ tP
D$TPS3
D$  tv
DuplicateHandle
;D$ ux
D$$X9D$
D$X+F@
`dynamic atexit destructor for '
`dynamic initializer for '
E09E@~
@@;E0r
;E8vD9}$t
E(C@Pj
E<;G(|
E<;G(}
EgSSPSS
Ehtw9E
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
EL;E<~
Ellipse
EmptyClipboard
EnableWindow
EncodePointer
EndDialog
EndPaint
EndPath
EnterCriticalSection
EnumChildWindows
EnumProcesses
EnumProcessModules
EnumResourceNamesW
EnumThreadWindows
EnumWindows
EP9UPu
>ERCPt6
=ERCPYt
<Er.<Fv9<Hv&<Jv1<Lw
erroffset passed as NULL
ESCAPE
Ethiopic
E u)Sh
E$u)Sh
ExitProcess
ExitThread
ExitWindowsEx
ExpressionStack: topnext(): Out of bounds.
ExpressionStack: top(): Out of bounds.
ExtCreatePen
ExtractIconExW
f-00f=
~	f1<HA;
f90t Vj
F90};Wj
$f95,pG
f97j[u
@@f98u
F9uH~"
f9X0vZ
failed to get memory
__fastcall
Fatal Error
F@BBf9:u
FC;t$0r
February
F@;F4u
fffffff
FF;u@r
FileTimeToLocalFileTime
FileTimeToSystemTime
FillRect
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FindWindowExW
FindWindowW
f+~jf+}
FlashWindow
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
f+~nf+}
F\=`NG
f+Nhf+M
FormatMessageW
FrameRect
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
Friday
F;t$0r
FT8^8t
FtpGetFileSize
FtpOpenFileW
F@;~<u
F;w8YYr
]g8]gt`
]g8]gtT
]g8]gtZ
	G8;O4
GAIsProcessorFeaturePresent
GDI32.dll
Georgian
GetACP
GetActiveWindow
GetAsyncKeyState
GetCaretPos
GetClassNameW
GetClassWord
GetClientRect
GetClipboardData
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetCursor
GetCursorPos
GetDesktopWindow
GetDeviceCaps
GetDIBits
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDlgCtrlID
GetDlgItem
GetDriveTypeW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileType
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFocus
GetForegroundWindow
GetFullPathNameW
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
GetKeyboardState
GetKeyState
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocalTime
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
GetMenuStringW
GetMessageW
GetModuleBaseNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetMonitorInfoW
GetNativeSystemInfo
GetNextDlgTabItem
GetObjectW
GetOEMCP
GetOpenFileNameW
GetParent
GetPixel
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetProcessWindowStation
GetSaveFileNameW
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStockObject
GetStringTypeA
GetStringTypeW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemDirectoryW
GetSystemInfo
GetSystemMetrics
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTextExtentPoint32W
GetTextFaceW
GetTickCount
GetTimeZoneInformation
GetUserNameW
GetUserObjectInformationA
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindow
GetWindowDC
GetWindowLongW
GetWindowRect
GetWindowsDirectoryW
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
 GGBBf;
\g is not followed by a braced name or an optionally braced non-zero number
Glagolitic
GlobalAlloc
GlobalFindAtomW
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalMemoryStatusEx
GlobalUnlock
Gothic
?;GoXUG
Gt0Ht&
Gujarati
Gurmukhi
`h````
$" /-+;h7
H 91t	B
H9D$ }
Hangul
Hanunoo
H}AU3!EA06
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
Hebrew
hfg9bc]_Y\
++)'HG&FEDBA@\[
`h`hhh
HH:mm:ss
HHt@HHt
HHt?Ht5Ht
HHt\Ht/H
HHtnHHtHH
HHtOHt0Huaj
HHtyHH
HHtYHt
Hiragana
Ht1Ht*Ht'Ht
Ht7Ht-H
Ht7Ht&Ht
HtFHt<Ht+Ht
Ht>Ht4Ht#Ht
Ht_Ht>HHt
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW
HtVHt,Ht
HtwHtX
Hu&QRVh 
HVtlHteHt^Ht
HVWt{HtqHt_Ht&
HWttHtQHt1Ht	
_hypot
HYYtJHt9H
IcmpCloseHandle
IcmpCreateFile
ICMP.DLL
IcmpSendEcho
	<!-- Identify the application dependencies. -->
	<!-- Identify the application security requirements. -->
$Id: qmath.h,v 1.1 2004/01/15 19:50:35 jonbennett Exp $
IIDFromString
IItLIt7I
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_EndDrag
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetDragCursorImage
inconsistent NEWLINE options
InflateRect
Inherited
InitCommonControlsEx
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
INSERT
InsertMenuItemW
InterlockedDecrement
InterlockedIncrement
internal error: code overflow
internal error: overran compiling workspace
internal error: previously-checked referenced subpattern not found
internal error: unexpected repeat
InternetCloseHandle
InternetConnectW
InternetCrackUrlW
InternetOpenUrlW
InternetOpenW
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InvalidateRect
invalid condition (?(0)
invalid escape sequence in character class
invalid UTF-8 string
IsCharAlphaNumericW
IsCharAlphaW
IsCharLowerW
IsCharUpperW
IsChild
IsClipboardFormatAvailable
IsDebuggerPresent
IsDialogMessageW
IsIconic
IsMenu
IsThemeActive
IsValidCodePage
IsWindow
IsWindowEnabled
IsWindowVisible
IsWow64Process
IsZoomed
It	HtOHHt9
It}ItTIt-It
j0FlZnP
j8j ^V
JanFebMarAprMayJunJulAugSepOctNovDec
January
jCYWWWW
jDj$Y+
j$[Gf;
j!j j 
j"^SSSSS
jThp	G
<Jv;<L
j'WWWWW
k3%\^2
KA@@f98u
Kannada
Katakana
KERNEL32
kernel32.dll
KERNEL32.DLL
keybd_event
Kharoshthi
KillTimer
KpIIt-It-
KtVKt%KuI
=K.xu7,GGr
L$4+L$,
L$4QPh=
				language="*"
LAUNCH_APP1
LAUNCH_APP2
LAUNCH_MAIL
LAUNCH_MEDIA
LCMapStringA
LCMapStringW
LeaveCriticalSection
					level="asInvoker"
L$hj@SWj$Q
Linear_B
LineTo
LoadCursorW
LoadIconW
LoadImageW
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LoadStringW
LoAxUq
LocalFileTimeToFileTime
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
LockResource
LockServiceDatabase
LockWindowUpdate
lookbehind assertion is not fixed length
LookupPrivilegeValueW
LSHIFT
lstrcmpiW
LWINDOWN
LWINUP
L$X)L$`
lxZ}>[
Malayalam
malformed number or name after (?(
malformed \P or \p sequence
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
MapViewOfFile
MapVirtualKeyW
mciSendStringW
MEDIA_NEXT
MEDIA_PLAY_PAUSE
MEDIA_PREV
MEDIA_STOP
MessageBeep
MessageBoxA
MessageBoxW
@;MHt";M
Microsoft Visual C++ Runtime Library
missing )
missing ) after comment
missing terminating ] for character class
.mixcrt
MkParseDisplayName
MM/dd/yy
Monday
Mongolian
MonitorFromPoint
mouse_event
MOUSE_LBUTTON
MOUSE_MBUTTON
MOUSE_RBUTTON
MOUSE_XBUTTON1
MOUSE_XBUTTON2
MoveFileW
MoveToEx
MoveWindow
MPR.dll
mscoree.dll
MultiByteToWideChar
Myanmar
	    name="AutoIt3"
				name="Microsoft.Windows.Common-Controls"
NC9U|u*
 new[]
New_Tai_Lue
_nextafter
no error
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
nothing to repeat
November
(null)
number after (?C is > 255
number is too big
numbers out of order in {} quantifier
number too big in {} quantifier
NUMLOCK
NUMPAD0
NUMPAD1
NUMPAD2
NUMPAD3
NUMPAD4
NUMPAD5
NUMPAD6
NUMPAD7
NUMPAD8
NUMPAD9
NUMPADADD
NUMPADDIV
NUMPADDOT
NUMPADENTER
NUMPADMULT
NUMPADSUB
}_N.)xY	
octal value is greater than \377 (not in UTF-8 mode)
October
OffsetRect
Old_Italic
Old_Persian
ole32.dll
OLEAUT32.dll
OleInitialize
OleSetContainedObject
OleSetMenuDescriptor
OleUninitialize
`omni callsig'
OpenClipboard
OpenProcess
OpenProcessToken
OpenSCManagerW
operand of unlimited repeat could match the empty string
operator
(?+ or (?- or (?(+ or (?(- must be followed by a non-zero number
Osmanya
OutputDebugStringW
o@v ;w
p&&&''
parentheses nested too deeply
__pascal
PCRE does not support \L, \l, \N, \U, or \u
PeekMessageW
PeekNamedPipe
Phags_Pa
Phoenician
@pHt_H
P}$j%h
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
PolyBezierTo
PolyDraw
POSIX collating elements are not supported
POSIX named classes are supported only within a class
PostMessageW
PostQuitMessage
pp&&&'''
ppp&''
ppp&&'
ppp&&'''
ppp&&&''
pppp&&''
PPPPPPPP
PPPPPW
PPPPQWhT
PRINTSCREEN
Process32FirstW
Process32NextW
	    processorArchitecture="*"
				processorArchitecture="*"
Program: 
<program name unknown>
Psapi.dll
PShd$B
PtInRect
__ptr64
				publicKeyToken="6595b64144ccf1df"
PUH*%4J
- pure virtual function call
PVVVVh
P@=WCJ<r
Q,8^=u
$QgbWB
QQSVj*
QQSVWh
QueryPerformanceCounter
QueryPerformanceFrequency
$QWSVt
R2"Pto
RaiseException
range out of order in character class
`.rdata
ReadFile
ReadProcessMemory
Rectangle
recursive call could loop indefinitely
RedrawWindow
reference to non-existent subpattern
RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegisterClassExW
RegisterHotKey
RegisterWindowMessageW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
regular expression is too large
ReleaseCapture
ReleaseDC
RemoveDirectoryW
repeated subpattern is too long
repeating a DEFINE group is not allowed
				<requestedExecutionLevel
			</requestedPrivileges>
			<requestedPrivileges>
__restrict
ResumeThread
R?%hs1
rn<Jv7<Lwf3
(?R or (?[+-]digits must be followed by )
RoundRect
RSHIFT
RtlUnwind
@r u&j
runtime error 
Runtime Error!
RWINDOWN
RWINUP
,Rx1 |
Saturday
`scalar deleting destructor'
ScreenToClient
SCROLLLOCK
		</security>
		<security>
SelectObject
SendDlgItemMessageW
SendInput
SendMessageTimeoutW
SendMessageW
September
SetActiveWindow
SetBkColor
SetBkMode
SetCapture
SetClassLongW
SetClipboardData
SetCurrentDirectoryW
SetCursor
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetFileAttributesW
SetFilePointer
SetFileTime
SetFocus
SetForegroundWindow
SetHandleCount
SetKeyboardState
SetLastError
SetLayeredWindowAttributes
SetMenu
SetMenuDefaultItem
SetMenuItemInfoW
SetPixel
SetPriorityClass
SetProcessWorkingSetSize
SetRect
SetStdHandle
SetSystemPowerState
SetTextColor
SetTimer
SetUnhandledExceptionFilter
SetViewportOrgEx
SetVolumeLabelW
SetWindowLongW
SetWindowPos
SetWindowTextW
Shavian
SHBrowseForFolderW
shell32.dll
SHELL32.dll
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
SHEmptyRecycleBinW
SHFileOperationW
SHGetDesktopFolder
SHGetMalloc
SHGetPathFromIDListW
SHIFTDOWN
SHIFTUP
ShowWindow
SING error
Sinhala
SizeofResource
spare error
SQWYY`
SSSSPSh
^SSSSS
__stdcall
StMItJItGIt;IuP
`string'
StringFromCLSID
StringFromIID
StrokeAndFillPath
StrokePath
subpattern name is too long (maximum 32 characters)
SubtractRect
Sunday
SunMonTueWedThuFriSat
support for \P, \p, and \X has not been compiled
SUV}5h
SVW|D;E
\SVWh`
SVWjD3
SVWupj
Syloti_Nagri
syntax error in subpattern name (missing terminator)
Syriac
SystemParametersInfoW
SystemTimeToFileTime
t08],t
+t0IIu/
t0WWWWW
t29~$u
t5HHt#
t6!Eh!Ep
t8IIt*P
t=8X-t8
;t$8YY
t^9(uZ
Tagalog
Tagbanwa
Tai_Le
tb9} u
tD9(u@
tEHHt2Ht(Ht
Telugu
TerminateProcess
t<f99t7C;]
t	FF;w r
tGFB;U
	t	GGf9
tGHt.Ht&
Thaana
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
!This program cannot be run in DOS mode.
this version of PCRE is not compiled with PCRE_UTF8 support
<*th<?tdj
t-Ht"Ht
t.Ht Ht
t+Ht$Ht
Thursday
TI0B^^
Tibetan
Tifinagh
timeGetTime
t]jPSSP
t>Jt3JuF
<[tL9]
tLHt4Ht
tlItRIt5It
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
too many named subpatterns (maximum 10000)
tPHt'HHu-
tP<#uLF
TQ(Z+mC<
TrackPopupMenuEx
TranslateMessage
T$`RhXqF
	</trustInfo>
	<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
T$,RVP
T$@RVP
!tSHHt 
<+t(<-t$:
Tuesday
tUHt;Ht4Ht
;t$,v-
tVHtKHtAHul
tVlL`{
tW98uS
!twHHtj
two named subpatterns have the same name
t+WWVPV
tXHHtOHHtFHHt=
t$xj	W
 Type Descriptor'
`typeof'
	    type="win32"
				type="win32"
u2VSh+
u5;u`s0
>:u8FV
<;U:987654SRQ~
u99_$u4
u	AAf9
'uDG9]
`udt returning'
u'FB;U
u&f!;f;
Ugaritic
ugFB;U
U]h	zj
					uiAccess="false"/>
u&j)_j
uL9x$uG
uLj]Yf;
<)ul+u@9
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
Unknown exception
unknown option bit(s) set
unknown POSIX class name
unknown property name after \P or \p
UnlockServiceDatabase
UnmapViewOfFile
unmatched parentheses
unrecognized character after (?
unrecognized character after (?<
unrecognized character after (?P
unrecognized character follows \
UnregisterHotKey
u&PPSVh
UQPXY]Y[
URPQQh
user32.dll
USER32.dll
USER32.DLL
UTF-16LE
<#u(<+u
?UUUUUU
uV4VW2TRzLGk
uxtheme.dll
}<\uYj
?uZEeu
`vbase destructor'
`vbtable'
`vcall'
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
(*VERB) not recognized
(*VERB) with an argument is not supported
VerQueryValueW
	    version="3.0.0.0"
				version="6.0.0.0"
VERSION.dll
`vftable'
VirtualAlloc
VirtualAllocEx
`virtual displacement map'
VirtualFree
VirtualFreeEx
VkKeyScanA
v	N+D$
VOLUME_DOWN
VOLUME_MUTE
VOLUME_UP
VVjdh,
_VVVVV
VVVVVj
.VVVVVSRSSj
VWSSj SSS
VWu3Uj
WaitForSingleObject
waveOutSetVolume
Wednesday
wFCCf9
WideCharToMultiByte
WindowFromPoint
Wininet.dll
WINMM.dll
WNetAddConnection2W
WNetCancelConnection2W
WNetGetConnectionW
WNetUseConnectionW
WPRPQV
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
WriteProcessMemory
WSOCK32.dll
wsprintfW
Wto=xTG
}/;wTs!
@;wTsf
@;wTsm
@;wTss
WWWWVSW
^WWWWW
wwwwwp
WWWWWP
wwwwwww
wwwwwwwwwwwp
X8Fpu=9G
<;X8Kl
	X 9} 
~X9~\uv
xdigit
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
X@@Pjf
xppwpp
xpxxxx
xtqE&h
>_^][Y
Y}3SSV
ysrqpnlj?i=
>=Yt/j
YUUWPj
YWWSPV
YWWWWW
YYj	^9u
YYt<+E
YYt>F;w
YYt	G;}
YYtjSWj
YYt)Shp
YYt SVW
YYt\VV
YYu/8]
YYu-9D$
YYu+hL
YY_^[u+j
YYuTVWhw?E
YYWu,j
ZQO2PLKJ`_lk