Analysis Date2014-07-01 11:57:55
MD5bb1096717c8769739530f6667d74d1d1
SHA1c9cdc5c874bd09d8a2ef8de4d15bc74231bd722a

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 61ffce4768976fa0dd2a8f6a97b1417a sha1: 1a4a6e903ba8481730da89043acebb85caaecabf size: 526336
Section.rdata md5: 0354bc5f2376b5e9a4a3ba38b682dff1 sha1: e70510edd94f414dcc71e0a8ed797f2ebcb61897 size: 57344
Section.data md5: 8033f5a38941b4685bc2299e78f31221 sha1: e525097f0c6a472b209669ddf8c3d82ba5a8dfb4 size: 26624
Section.rsrc md5: 01d901c63f42f417bbf9784f26e06e64 sha1: 86973cb23db3d7fddf56dee51b7df931ba5bd39f size: 77824
Timestamp2012-01-29 21:32:28
VersionCompiledScript: AutoIt v3 Script: 3, 3, 8, 1
FileVersion: 3, 3, 8, 1
FileDescription:
PackerMicrosoft Visual C++ ?.?
PEhash30c36f7491c87e91483190405bc3d1214e2ae91f
IMPhashd3bf8a7746a8d1ee8f6e5960c3f69378
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)MalOb-GB [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumno_virus
AVAvira (antivir)no_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)Win32/Injector.Autoit.ANW
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusno_virus
AVK7Trojan ( 700000111 )
AVKasperskyTrojan.Win32.Autoit.pik
AVMalwareBytesno_virus
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVNormanno_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr ➝
1
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\javaupdate ➝
C:\Documents and Settings\Administrator\javaupdate\xbqDj.exe\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions ➝
1
Creates FileC:\malware.exe
Creates FileC:\Documents and Settings\Administrator\JdjtcnmnjQvk.txt
Creates ProcessC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Creates ProcessC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Creates ProcessC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Creates ProcessC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Creates ProcessC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Creates ProcessC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Creates ProcessC:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Process
↳ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Process
↳ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Process
↳ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\7286_appcompat.txt

Process
↳ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Process
↳ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Process
↳ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Process
↳ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe

Network Details:


Raw Pcap

Strings
 
CC
0
.
00-+ 
-E-
-0
-0010+-0
-0
.
0
0- 
0
0
.
5
S.S...
P
.v^^U()*+BCDE5678
]Uu
dffhsS
.
Q
.
.
.\
TU]U.
.
.
^^
..
P
Iu.
..
-----
:;<=>?@
[\]^_`
\*.*
0.0.0.0
0123456789ABCDEF
%02d
04090000
080904b0
0x%p
255.255.255.255
#32770
3, 3, 8, 1
%.3d
3This keyword cannot be used after a "Then" keyword.
%4d%02d%02d%02d%02d%02d
- abort() has been called
ACOS
ACTIVE
[ACTIVE
AddRef
ADDSTRING
ADLIBREGISTER
ADLIBUNREGISTER
 alias PlayMe
align
[ALL
All files (*.*)
ALTDOWN
ALTUP
am/pm
APPDATACOMMONDIR
APPDATADIR
APPSKEY
April
Array
Array maximum size exceeded.+"Func" statement has no matching "EndFunc".
ASCW
ASIN
Assert Failed!
ASSIGN
ATAN
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
*.au3;*.a3x
August
AutoIt
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
AutoIt3GUI
/AutoIt3OutputDebug
AUTOITCALLVARIABLE%d
AutoIt Error
AutoIt.Error
AUTOITEXE
AutoIt has detected the stack has become corrupt.
AutoIt Input Box
>>>AUTOIT NO CMDEXECUTE<<<
AUTOITPID
>>>AUTOIT SCRIPT<<<
AutoIt script files (*.au3, *.a3x)
AUTOITSETOPTION
AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions.  The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead.  See the DllCall() documentation for details on changing the calling convention.
AUTOITUNICODE
AutoIt v3
AutoIt v3 GUI
AutoIt v3 Script: 3, 3, 8, 1
AUTOITVERSION
AUTOITWINGETTITLE
AUTOITWINSETTITLE
AUTOITX64
BACKSPACE
Badly formated Enum statement
!Badly formatted "Func" statement.
BEEP
Binary
BINARY
BINARYLEN
BINARYMID
BINARYTOSTRING
BITAND
BITNOT
BITOR
BITROTATE
BITSHIFT
BITXOR
blank
BLOCKINPUT
bool
Bool
boolean
BREAK
BROWSER_BACK
BROWSER_FAVORTIES
BROWSER_FORWARD
BROWSER_HOME
BROWSER_REFRESH
BROWSER_SEARCH
BROWSER_STOP
bstr
button
BUTTON
BYREF
byte
CALL
CALLARGARRAY
Cancel
Cannot parse #include
Can not redeclare a constant.5Can not redeclare a parameter inside a user function.
Can't install a new Errorhandler when one is still active.
CAPSLOCK
CaretCoordMode
CASE
cdecl
cdrom
CDROM
CDTRAY
CEILING
char
CHECK
CHRW
CLASS
[CLASS:
CLASSNAME=
CLASSNN
CLEAR
CLIPGET
CLIPPUT
close
close all
close cd wait
closed
close PlayMe
\CLSID
CMDLINE
CMDLINERAW
COLLAPSE
Combobox
ComboBox
@COM_EVENTOBJ
#comments-end
#comments-start
COMMONFILESDIR
COMPILED
CompiledScript
COMPUTERNAME
COMSPEC
CONSOLEREAD
CONSOLEWRITE
CONSOLEWRITEERROR
CONST
Container
Context1
CONTINUECASE
CONTINUELOOP
CONTROLCLICK
CONTROLCOMMAND
CONTROLDISABLE
CONTROLENABLE
CONTROLFOCUS
CONTROLGETFOCUS
CONTROLGETHANDLE
CONTROLGETPOS
CONTROLGETTEXT
CONTROLHIDE
CONTROLLISTVIEW
CONTROLMOVE
Control Panel\Appearance
Control Panel\Mouse
CONTROLSEND
CONTROLSETTEXT
CONTROLSHOW
CONTROLTREEVIEW
CPUARCH
CRLF
- CRT not initialized
CTRLDOWN
CTRLUP
CURRENTTAB
d0#1
d0#2
%d/%02d/%02d
d0r0,1023
d0r0,3
d100m0
d10m0
d124c
d1#3
D%.15g
d1r0,2
d1r1,2
d250m0
D%4d
d5m0
DASC
dddd, MMMM dd, yyyy
December
default
Default
DEFAULT
DefaultLangCodepage
DELETE
DELSTRING
DESCRIPTION
DESELECT
DESKTOPCOMMONDIR
DESKTOPDEPTH
DESKTOPDIR
DESKTOPHEIGHT
DESKTOPREFRESH
DESKTOPWIDTH
details
D@GUI_DRAGID
DIRCOPY
DIRCREATE
DIRGETSIZE
DIRMOVE
DIRREMOVE
DISPLAY
.dll
DLLCALL
DLLCALLADDRESS
DLLCALLBACKFREE
DLLCALLBACKGETPTR
DLLCALLBACKREGISTER
DLLCLOSE
DLLOPEN
DLLStruct
DLLSTRUCTCREATE
DLLSTRUCTGETDATA
DLLSTRUCTGETPTR
DLLSTRUCTGETSIZE
DLLSTRUCTSETDATA
DMUILANG
DOCUMENTSCOMMONDIR
DOMAIN error
double
Double
DOWN
DRIVEGETDRIVE
DRIVEGETFILESYSTEM
DRIVEGETLABEL
DRIVEGETSERIAL
DRIVEGETTYPE
DRIVEMAPADD
DRIVEMAPDEL
DRIVEMAPGET
DRIVESETLABEL
DRIVESPACEFREE
DRIVESPACETOTAL
DRIVESTATUS
DSeAssignPrimaryTokenPrivilege
DUMMYSPEEDTEST
Duplicate function name.
dword
dword_ptr
edit
EDITPASTE
ELSE
ELSEIF
ENDFUNC
ENDIF
ENDSELECT
endstruct
ENDSWITCH
ENDWITH
ENTER
ENUM
ENVGET
Environment
ENVSET
ENVUPDATE
Error: 
ERROR
^ ERROR
^ ERROR 
Error allocating memory.
Error in expression.
Error opening the file
Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.
/ErrorStdOut
ESCAPE
EVAL
.exe
EXECUTE
EXISTS
Exit
E&xit
EXIT
@EXITCODE
EXITLOOP
@EXITMETHOD
EXPAND
ExpandEnvStrings
ExpandVarStrings
EXTENDED
Failed to create object
Failed to create the Error Handler
Failed to create the Event Object.
False
FALSE
FAVORITESCOMMONDIR
FAVORITESDIR
February
FILECHANGEDIR
FILECLOSE
FILECOPY
FILECREATENTFSLINK
FILECREATESHORTCUT
FILEDELETE
FileDescription
FILEEXISTS
FILEFINDFIRSTFILE
FILEFINDNEXTFILE
FILEFLUSH
FILEGETATTRIB
FILEGETENCODING
FILEGETLONGNAME
FILEGETPOS
FILEGETSHORTCUT
FILEGETSHORTNAME
FILEGETSIZE
FILEGETTIME
FILEGETVERSION
FILEINSTALL
FILEMOVE
FILEOPEN
FILEOPENDIALOG
FILEREAD
FILEREADLINE
FILERECYCLE
FILERECYCLEEMPTY
FILESAVEDIALOG
FILESELECTFOLDER
FILESETATTRIB
FILESETPOS
FILESETTIME
FileVersion
FILEWRITE
FILEWRITELINE
FINDITEM
FINDSTRING
First parameter must be of type 'Object'.
fixed
Fixed
float
- floating point support not loaded
FLOOR
Friday
FTPSETPROXY
FUNC
GETCURRENTCOL
GETCURRENTLINE
GETCURRENTSELECTION
GETITEMCOUNT
GETLINE
GETLINECOUNT
get__NewEnum
GETSELECTED
GETSELECTEDCOUNT
GETSUBITEMCOUNT
GETTEXT
GETTOTALCOUNT
GLOBAL
Gnul
GUICloseOnESC
GUICoordMode
GUICREATE
GUICTRLCREATEAVI
GUICTRLCREATEBUTTON
GUICTRLCREATECHECKBOX
GUICTRLCREATECOMBO
GUICTRLCREATECONTEXTMENU
GUICTRLCREATEDATE
GUICTRLCREATEDUMMY
GUICTRLCREATEEDIT
GUICTRLCREATEGRAPHIC
GUICTRLCREATEGROUP
GUICTRLCREATEICON
GUICTRLCREATEINPUT
GUICTRLCREATELABEL
GUICTRLCREATELIST
GUICTRLCREATELISTVIEW
GUICTRLCREATELISTVIEWITEM
GUICTRLCREATEMENU
GUICTRLCREATEMENUITEM
GUICTRLCREATEMONTHCAL
GUICTRLCREATEOBJ
GUICTRLCREATEPIC
GUICTRLCREATEPROGRESS
GUICTRLCREATERADIO
GUICTRLCREATESLIDER
GUICTRLCREATETAB
GUICTRLCREATETABITEM
GUICTRLCREATETREEVIEW
GUICTRLCREATETREEVIEWITEM
GUICTRLCREATEUPDOWN
GUICTRLDELETE
GUICTRLGETHANDLE
GUICTRLGETSTATE
@GUI_CTRLHANDLE
@GUI_CTRLID
GUICTRLREAD
GUICTRLRECVMSG
GUICTRLREGISTERLISTVIEWSORT
GUICTRLSENDMSG
GUICTRLSENDTODUMMY
GUICTRLSETBKCOLOR
GUICTRLSETCOLOR
GUICTRLSETCURSOR
GUICTRLSETDATA
GUICTRLSETDEFBKCOLOR
GUICTRLSETDEFCOLOR
GUICTRLSETFONT
GUICTRLSETGRAPHIC
GUICTRLSETIMAGE
GUICTRLSETLIMIT
GUICTRLSETONEVENT
GUICTRLSETPOS
GUICTRLSETRESIZING
GUICTRLSETSTATE
GUICTRLSETSTYLE
GUICTRLSETTIP
GUIDataSeparatorChar
GUIDELETE
@GUI_DRAGFILE
@GUI_DROPID
GUIEventOptions
GUIGETCURSORINFO
GUIGETMSG
GUIGETSTYLE
GUIOnEventMode
GUIREGISTERMSG
GUIResizeMode
GUI_RUNDEFMSG
GUISETACCELERATORS
GUISETBKCOLOR
GUISETCOORD
GUISETCURSOR
GUISETFONT
GUISETHELP
GUISETICON
GUISETONEVENT
GUISETSTATE
GUISETSTYLE
GUISTARTGROUP
GUISWITCH
@GUI_WINHANDLE
                                 H
         (((((                  H
handle
HANDLE
[HANDLE:
HANDLE=
HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.
HCONOUT$
HELPCONTEXT
HELPFILE
         h((((                  H
HH:mm:ss
HIDEDROPDOWN
Hjjj
Hjjjj
HKCC
HKCR
HKCU
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKLM
HMicrosoft Visual C++ Runtime Library
HOME
HOMEDRIVE
HOMEPATH
HOMESHARE
HOTKEYPRESSED
HOTKEYSET
HOUR
hresult
HTTPSETPROXY
HTTPSETUSERAGENT
hwnd
HWND
IA64
.icl
idispatch
Ijjj
#include
#include depth exceeded.  Make sure there are no recursive includes
#include-once
Incorrect Object type in FOR..IN loop
Incorrect Parameter format
Incorrect parameters to object property !
INETCLOSE
INETGET
INETGETACTIVE
INETGETBYTESREAD
INETGETINFO
INETGETSIZE
INETREAD
info
INIDELETE
INIREAD
INIREADSECTION
INIREADSECTIONNAMES
INIRENAMESECTION
INIWRITE
INIWRITESECTION
INPUTBOX
INSERT
InstallLanguage
INSTANCE
Int32
int64
Int64
InterfaceDispatch
int_ptr
INVALID
Invalid characters behind Object assignment !
Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.
Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.
Invalid parameter
IPADDRESS1
IPADDRESS2
IPADDRESS3
IPADDRESS4
\IPC$
ISADMIN
ISARRAY
ISBINARY
ISBOOL
ISCHECKED
ISDECLARED
ISDLLSTRUCT
ISENABLED
ISFLOAT
ISHWND
ISINT
ISKEYWORD
ISNUMBER
ISOBJ
ISPTR
ISSELECTED
ISSTRING
ISVISIBLE
January
jjjj
jjjjh
jjjjj
July
June
KBLAYOUT
Keyword
LALT
largeicons
LAST
[LAST
LASTDLLERROR
LAUNCH_APP1
LAUNCH_APP2
LAUNCH_MAIL
LAUNCH_MEDIA
LCTRL
LEFT
Line: 
Line %d:
Line %d  (File "%s"):
list
Listbox
ListBox
.lnk
<local>
LOCAL
LOGONDNSDOMAIN
LOGONDOMAIN
LOGONSERVER
long
long_ptr
lparam
lresult
LSHIFT
LWIN
LWINDOWN
LWINUP
MAIN
March
MDAY
MEDIA_NEXT
MEDIA_PLAY_PAUSE
MEDIA_PREV
MEDIA_STOP
MEMGETSTATS
MENU
MIDDLE
Missing operator in expression."Unbalanced brackets in expression.
(Missing right bracket ')' in expression.
MM/dd/yy
Monday
MOUSECLICK
MouseClickDelay
MouseClickDownDelay
MOUSECLICKDRAG
MouseClickDragDelay
MouseCoordMode
MOUSEDOWN
MOUSEGETCURSOR
MOUSEGETPOS
MOUSE_LBUTTON
MOUSE_MBUTTON
MOUSEMOVE
MOUSE_RBUTTON
MOUSEUP
MOUSEWHEEL
MOUSE_XBUTTON1
MOUSE_XBUTTON2
mscoree.dll
msctls_progress32
Msctls_Progress32
msctls_statusbar321
msctls_trackbar32
msctls_updown32
MSEC
MSGBOX
MS Shell Dlg
MustDeclareVars
MYDOCUMENTSDIR
NAME
network
Network
_NewEnum
NEXT
nKERNEL32.DLL
#NoAutoIt3Execute
none
Not an Object type
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
#notrayicon
NOTREADY
November
\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
(null)
NULL
Null Object assignment in FOR..IN loop
NULL Pointer assignment
NUMBER
NUMLOCK
NUMPAD0
NUMPAD1
NUMPAD2
NUMPAD3
NUMPAD4
NUMPAD5
NUMPAD6
NUMPAD7
NUMPAD8
NUMPAD9
NUMPADADD
NUMPADDIV
NUMPADDOT
NUMPADENTER
NUMPADMULT
NUMPADSUB
NUMPARAMS
OBJCREATE
OBJCREATEINTERFACE
object
Object
OBJEVENT
OBJGET
OBJNAME
Obsolete function/parameter.4Invalid Exitcode (reserved for AutoIt internal use).
oclsid
October
ONAUTOITEXITREGISTER
ONAUTOITEXITUNREGISTER
#OnAutoItStartRegister
open
open 
OSARCH
OSBUILD
OSLANG
OSSERVICEPACK
OSTYPE
OSVERSION
PAUSE
	(Paused) 
pccs
PGDN
PGUP
PING
PIXELCHECKSUM
PixelCoordMode
PIXELGETCOLOR
PIXELSEARCH
play PlayMe
play PlayMe wait
PLUGINCLOSE
PLUGINOPEN
PRIMARY
PRINTSCREEN
PROCESSCLOSE
PROCESSEXISTS
PROCESSGETSTATS
PROCESSLIST
PROCESSORARCH
PROCESSSETPRIORITY
PROCESSWAIT
PROCESSWAITCLOSE
Program: 
PROGRAMFILESDIR
<program name unknown>
PROGRAMSCOMMONDIR
PROGRAMSDIR
PROGRESSOFF
PROGRESSON
PROGRESSSET
Prompt
- pure virtual function call
QueryInterface
question
R6002
R6008
R6009
R6010
R6016
R6017
R6018
R6019
R6024
R6025
R6026
R6027
R6028
R6030
R6031
R6032
R6033
RAISE
RALT
ramdisk
RAMDisk
RANDOM
RCTRL
READONLY
READY
REDIM
Reference
REG_BINARY
REGDELETE
REG_DWORD
REGENUMKEY
REGENUMVAL
REGEXP=
REG_EXPAND_SZ
REGEXPCLASS
REGEXPTITLE
[REGEXPTITLE:
REG_MULTI_SZ
REG_QWORD
REGREAD
REG_SZ
REGWRITE
Release
removable
Removable
#requireadmin
RETCODE
RETURN
RIGHT
rInclude
ROUND
RSHIFT
runas
RUNAS
RUNASWAIT
Run Script:
runtime error 
Runtime Error!
RUNWAIT
RWIN
RWINDOWN
RWINUP
\??\%s
Saturday
SchemeLangID
SCRIPTDIR
SCRIPTFULLPATH
SCRIPTLINE
SCRIPTLINENUMBER
SCRIPTNAME
Script Paused
Script &Paused
SCROLLLOCK
%s%d
%s (%d) : ==> %s:
%s (%d) : ==> %s: 
%s (%d) : ==> %s.: 
SECONDARY
SeDebugPrivilege
SeIncreaseQuotaPrivilege
SELECT
SELECTALL
SELECTCLEAR
SELECTINVERT
>"Select" statement is missing "EndSelect" or "Case" statement.+"If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated.  Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.
SELECTSTRING
SEND
SendAttachMode
SendCapsLockMode
SENDCOMMANDID
SENDKEEPACTIVE
SendKeyDelay
SendKeyDownDelay
September
SeShutdownPrivilege
set cd door 
SETCURRENTSELECTION
SETERROR
SetExitCode
SETEXTENDED
SHELLDLL_DefView
SHELLEXECUTE
SHELLEXECUTEWAIT
Shell_TrayWnd
SHIFTDOWN
SHIFTUP
short
SHOWDROPDOWN
SHUTDOWN
SING error
SLEEP
smallicons
Software\AutoIt v3\AutoIt
SOFTWARE\Classes\
SOUNDPLAY
SOUNDSETWAVEVOLUME
SOURCE
SPACE
SPLASHIMAGEON
SPLASHOFF
SPLASHTEXTON
SQRT
SRANDOM
Stack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.
STARTMENUCOMMONDIR
STARTMENUDIR
STARTUPCOMMONDIR
STARTUPDIR
static
STATIC
STATUSBARGETTEXT
status PlayMe mode
stdcall
STDERRREAD
STDINWRITE
STDIOCLOSE
STDOUTREAD
STEP
stop
STOP
String
STRING
STRINGADDCR
STRINGCOMPARE
StringFileInfo
StringFileInfo\
STRINGFORMAT
STRINGFROMASCIIARRAY
STRINGINSTR
STRINGISALNUM
STRINGISALPHA
STRINGISASCII
STRINGISDIGIT
STRINGISFLOAT
STRINGISINT
STRINGISLOWER
STRINGISSPACE
STRINGISUPPER
STRINGISXDIGIT
STRINGLEFT
STRINGLEN
STRINGLOWER
STRINGMID
String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.
STRINGREGEXP
STRINGREGEXPREPLACE
STRINGREPLACE
STRINGRIGHT
STRINGSPLIT
STRINGSTRIPCR
STRINGSTRIPWS
STRINGTOASCIIARRAY
STRINGTOBINARY
STRINGTRIMLEFT
STRINGTRIMRIGHT
STRINGUPPER
struct
%s%u
Sunday
SwapMouseButtons
SW_DISABLE
SW_ENABLE
SW_HIDE
SWITCH
SW_LOCK
SW_MAXIMIZE
SW_MINIMIZE
SW_RESTORE
SW_SHOW
SW_SHOWDEFAULT
SW_SHOWMAXIMIZED
SW_SHOWMINIMIZED
SW_SHOWMINNOACTIVE
SW_SHOWNA
SW_SHOWNOACTIVATE
SW_SHOWNORMAL
SW_UNLOCK
SysAnimate32
SysDateTimePick32
SysListView32
SysMonthCal32
SysTabControl32
SYSTEM\CurrentControlSet\Control\Nls\Language
SYSTEMDIR
SysTreeView32
TABLEFT
TABRIGHT
TaskbarCreated
TCPACCEPT
TCPCLOSESOCKET
TCPCONNECT
TCPLISTEN
TCPNAMETOIP
TCPRECV
TCPSEND
TCPSHUTDOWN
TCPSTARTUP
TCPTimeout
TEMPDIR
TEXT
THEN
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
ThumbnailClass
Thursday
TIMERDIFF
TIMERINIT
TITLE
TLOSS error
TOOLTIP
tooltips_class32
Translation
TrayAutoPause
TRAYCREATEITEM
TRAYCREATEMENU
TRAYGETMSG
TrayIconDebug
TRAYICONFLASHING
TrayIconHide
TRAYICONVISIBLE
@TRAY_ID
TRAYITEMDELETE
TRAYITEMGETHANDLE
TRAYITEMGETSTATE
TRAYITEMGETTEXT
TRAYITEMSETONEVENT
TRAYITEMSETSTATE
TRAYITEMSETTEXT
TrayMenuMode
TrayOnEventMode
TRAYSETCLICK
TRAYSETICON
TRAYSETONEVENT
TRAYSETPAUSEICON
TRAYSETSTATE
TRAYSETTOOLTIP
TRAYTIP
True
TRUE
Tuesday
 type cdaudio alias cd wait
UBOUND
ubyte
UDPBIND
UDPCLOSESOCKET
UDPOPEN
UDPRECV
UDPSEND
UDPSHUTDOWN
UDPSTARTUP
uint
uint64
uint_ptr
ulong
ulong_ptr
*Unable to get a list of running processes. Unable to get the process token.
- unable to initialize heap
- unable to open console device
Unable to open the script file.
Unable to parse line.
UNCHECK
- unexpected heap error
- unexpected multithread lock error
UNICODE
unknown
Unknown
UNKNOWN
Unknown function name.
Unknown macro.
Unterminated group of comments
Unterminated string
UNTIL
USERDNSDOMAIN
USERDOMAIN
USERNAME
USERPROFILE
USERPROFILEDIR
ushort
UTF-16LE
UTF-8
%u.%u.%u.%u
VarFileInfo
\VarFileInfo\Translation
VARGETTYPE
Variable is not of type 'Object'.
Variable must be of type 'Object'.
variant
VIEWCHANGE
VOLUME_DOWN
VOLUME_MUTE
VOLUME_UP
VS_VERSION_INFO
 wait
warning
wchar
WDAY
Wednesday
WEND
WHILE
WIN_2000
WIN_2003
WIN_2008
WIN_2008R2
WIN32_NT
WIN_7
WIN_8
WINACTIVATE
WINACTIVE
winapi
WINCLOSE
WINDESCRIPTION
WinDetectHiddenText
WINDOWSDIR
WINEXISTS
WINFLASH
WINGETCARETPOS
WINGETCLASSLIST
WINGETCLIENTSIZE
WINGETHANDLE
WINGETPOS
WINGETPROCESS
WINGETSTATE
WINGETTEXT
WINGETTITLE
WINKILL
WINLIST
WINMENUSELECTITEM
WINMINIMIZEALL
WINMINIMIZEALLUNDO
WINMOVE
WinSearchChildren
WINSETONTOP
WINSETSTATE
WINSETTITLE
WINSETTRANS
winsta0
winsta0\default
WinTextMatchMode
WinTitleMatchMode
WIN_VISTA
WINWAIT
WINWAITACTIVE
WINWAITCLOSE
WinWaitDelay
WINWAITNOTACTIVE
WIN_XP
WIN_XPe
WITH
WM_GETCONTROLNAME
word
WORKINGDIR
wparam
wstr
WUSER32.DLL
YDAY
YEAR
                          
\$,+\$$
+~<+^@
																																																						
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0aZ6s%
0]Fz#r
*0in[;J>M
0Y;79"
1E Rh0
_~1IRY
1>kt^-8oZLJ
1#QNAN
1#SNAN
}1;wls
$25e	L
25~	vy1
%2lYcU
2S&,xQ#
39^ebr|
3,|WS[*
(3^ZDr{
474!D]
47+ f"
4DC&@x
"4P	6GN
4/QS8k
4Q".U2
5,"E v
 5\hVA\N
5Lnd'{
>+5;mR
/=;(5u
5{$]x[
)6.Jgp
6qBbb"
}6;wls
7A5F	b
7D=?8"_%kk
7gB}P2
_|'7h>c
8crtsu
8ERCPt!
8FA1Bm
8fXoL	
8\t	j\
8\ueFVS
8|u&j|
:8W&l+
@8-_xfM
9^cK?5
9$dlm*
9E vgPQj
9G<t	;wh
+9IdA.\1U?
9k4w}25
9M(t`;
9U$tE+
9U tO9U$uE9U(uE3
9u(vEVSj
9u v&VQj
9whQH(
}9;wls
a*8g{;=
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
`abcdefghijkmno]
ACCEPT
a<cTV|
AddAce
AdjustTokenPrivileges
AdjustWindowRectEx
advapi32.dll
ADVAPI32.dll
A,Ht*Ht
&_AjmK
an argument is not allowed for (*ACCEPT), (*FAIL), or (*COMMIT)
AngleArc
a numbered reference must not be zero
ANYCRLF)
Arabic
Armenian
</assembly>
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
assertion expected after (?(
\ at end of pattern
AttachThreadInput
AU3_FreeVar
AU3_GetPluginDetails
August
.?AVbad_alloc@std@@
Avestan
.?AVexception@std@@
.?AVtype_info@@
{+axIL&R
	b-.[//
))|b'9ar
bad allocation
Balinese
 Base Class Array'
 Base Class Descriptor at (
__based(
b AU3!EA06
BeginPaint
BeginPath
Bengali
(Bk_~v"
BlockInput
Bopomofo
Braille
Brf&%Xwr]
BRPj,S
BSR_ANYCRLF)
BSR_UNICODE)
Buginese
C;\$8r
C9P<t>
Canadian_Aboriginal
Carian
\c at end of pattern
__cdecl
character value in \x{...} sequence is too large
CharLowerBuffW
CharNextW
CharUpperBuffW
CheckMenuRadioItem
Cherokee
)CHjGj
 Class Hierarchy Descriptor'
ClientToScreen
CloseClipboard
CloseDesktop
CloseFigure
CloseHandle
CloseServiceHandle
CloseWindowStation
closing ) for (?C expected
__clrcall
CLSIDFromProgID
CLSIDFromString
cmD\:/(
\c must be followed by an ASCII character
\C not allowed in lookbehind assertion
CoCreateInstance
CoCreateInstanceEx
c^oik 
CoInitialize
CoInitializeSecurity
COMCTL32.dll
COMDLG32.dll
COMMIT
Common
CompareStringW
 Complete Object Locator'
conditional group contains more than two branches
Coptic
`copy constructor closure'
CopyFileW
CopyImage
CopyRect
CopySid
CorExitProcess
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CountClipboardFormats
CreateAcceleratorTableW
CreateBindCtx
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDirectoryW
CreateEnvironmentBlock
CreateEventW
CreateFileW
CreateFontW
CreateHardLinkW
CreateIconFromResourceEx
CreateMenu
CreatePen
CreatePipe
CreatePopupMenu
CreateProcessAsUserW
CreateProcessW
CreateProcessWithLogonW
CreateSolidBrush
CreateStreamOnHGlobal
CreateThread
CreateToolhelp32Snapshot
CreateWindowExW
\csjKGr
Cuneiform
Cypriot
Cyrillic
D$0_^[
(d0CO 
D$0;D$(
)D$0)D$4
D$0Ft5
D$0hlPH
D$0h\QH
D$49D$
D$4PQR
D4V~o`
D$8PQhx
D$$9D$
{D9{ v
@.data
;D$$|};D$,
D$(+D$ 
dddd, MMMM dd, yyyy
December
`default constructor closure'
DefDlgProcW
DEFINE
DEFINE group contains more than one branch
DefWindowProcW
 delete
 delete[]
DeleteCriticalSection
DeleteDC
DeleteFileW
DeleteMenu
DeleteObject
  </dependency>
  <dependency>
    </dependentAssembly>
    <dependentAssembly>
Deseret
DestroyAcceleratorTable
DestroyEnvironmentBlock
DestroyIcon
DestroyMenu
DestroyWindow
Devanagari
DeviceIoControl
DialogBoxParamW
different names for subpatterns of the same number are not allowed
digit expected after (?+
DispatchMessageW
|D|Ky(
+Dn?!=
D$p9D$\
D$p;D$D
D$$PjeQ
D$|Pjp
D$$PQh0
D$ PQW
D$$PVh0
D$`PWQ
DragFinish
DragQueryFileW
DragQueryPoint
DrawFocusRect
DrawFrameControl
DrawMenuBar
DrawTextW
D$@RPh
{dU}`fN
DuplicateHandle
DuplicateTokenEx
D$x;D$\
`dynamic atexit destructor for '
`dynamic initializer for '
E3.~,#
+E?3iy!
__eabi
ed	n"O
^EghFR
E#G@PO
Egyptian_Hieroglyphs
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
eJonWn I
)EktV9y
Ellipse
EmptyClipboard
EnableWindow
EndDialog
EndPaint
EndPath
EnterCriticalSection
EnumChildWindows
EnumProcesses
EnumProcessModules
EnumResourceNamesW
EnumThreadWindows
EnumWindows
=ERCPt
>ERCPt,
E,Rh$MH
erroffset passed as NULL
Error text not found (please report)
Ethiopic
eT[#P{
E t	;u
|eV&arc
^E|wL$
ExitProcess
ExitThread
ExitWindowsEx
ExtCreatePen
ExtractIconExW
eY! V0
]=f0+S
~	f1<C@;
F4;D$0~
failed to get memory
__fastcall
FD9D$Dt
February
f	F~_^
"f\fA7
FileTimeToLocalFileTime
FileTimeToSystemTime
FillRect
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FindWindowExW
FindWindowW
'f=Kg	
FlashWindow
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
	F@;N<~
FN`;tHM
FormatMessageW
f$Qr6	
FrameRect
FreeEnvironmentStringsW
FreeLibrary
Friday
F;t$$|
FtpGetFileSize
FtpOpenFileW
;..fVf@w
@FVh0 
+ '+fXD
fXg5Cldh
`F?ydg
g0m.kA
}G_96Ao
&Gdg0J
GDI32.dll
Georgian
G}ePH:v
GetAce
GetAclInformation
GetACP
GetActiveWindow
GetAsyncKeyState
GetCaretPos
GetClassLongW
GetClassNameW
GetClientRect
GetClipboardData
GetCommandLineW
GetComputerNameW
GetConsoleCP
GetConsoleMode
GetCPInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCursorInfo
GetCursorPos
GetDateFormatW
GetDesktopWindow
GetDeviceCaps
GetDIBits
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDlgCtrlID
GetDlgItem
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileType
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFocus
GetForegroundWindow
GetFullPathNameW
GetKeyboardLayoutNameW
GetKeyboardState
GetKeyState
GetLastActivePopup
GetLastError
GetLengthSid
GetLocalTime
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoW
GetMenuStringW
GetMessageW
GetModuleBaseNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetMonitorInfoW
GetNativeSystemInfo
GetObjectW
GetOEMCP
GetOpenFileNameW
GetParent
GetPixel
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetProcessIoCounters
GetProcessMemoryInfo
GetProcessWindowStation
GetSaveFileNameW
GetSecurityDescriptorDacl
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStockObject
GetStringTypeW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemDirectoryW
GetSystemInfo
GetSystemMetrics
GetSystemTimeAsFileTime
GetSystemWow64DirectoryW
GetTempFileNameW
GetTempPathW
GetTextExtentPoint32W
GetTextFaceW
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetTokenInformation
GetUserNameW
GetUserObjectInformationW
GetUserObjectSecurity
GetVersionExW
GetVolumeInformationW
GetWindowDC
GetWindowLongW
GetWindowRect
GetWindowsDirectoryW
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
=GI-s4
\g is not followed by a braced, angle-bracketed, or quoted name/number or by a plain number
=G;j@Y
Glagolitic
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
-GM\#N
Gothic
gqbm|j
GtHt'Ht
Gujarati
g@u'Mf
Gurmukhi
{}.+?Gzb
`h````
?.h;+:
h6(p1e
Hangul
Hanunoo
H}AU3!EA06
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
Hebrew
@HFw%7
^HFxC<
`h`hhh
HH:mm:ss
HHt$HHt
Hiragana
H&j y@b
\{*HMwo@
H>/QJ?/SI>.SH=-SG<-SF;,SE:+SD8)SC7(SB6'S@5&S>3%Q
Ht2Hub
Ht4Ht*Ht 
HtcHt.
Ht^HtTW
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW
_hypot
HYYtJHt9H
HZJ7Nh
\I1!SW
=(( iC
IcmpCloseHandle
IcmpCreateFile
ICMP.DLL
IcmpSendEcho
$Id: qmath.h,v 1.1 2004/01/15 19:50:35 jonbennett Exp $
?If90t
IIDFromString
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_EndDrag
ImageList_Remove
ImageList_ReplaceIcon
ImageList_SetDragCursorImage
Imperial_Aramaic
inconsistent NEWLINE options
InflateRect
Inherited
InitCommonControlsEx
InitializeAcl
InitializeCriticalSectionAndSpinCount
InitializeSecurityDescriptor
InitiateSystemShutdownExW
Inscriptional_Pahlavi
Inscriptional_Parthian
InsertMenuItemW
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
internal error: code overflow
internal error: overran compiling workspace
internal error: previously-checked referenced subpattern not found
internal error: unexpected repeat
InternetCloseHandle
InternetConnectW
InternetCrackUrlW
InternetOpenUrlW
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionW
InternetReadFile
InternetSetOptionW
InvalidateRect
invalid condition (?(0)
invalid escape sequence in character class
invalid UTF-8 string
iOF'%a)
iR[c.$:
i><+s_
] is an invalid data character in JavaScript compatibility mode
IsCharAlphaNumericW
IsCharAlphaW
IsCharLowerW
IsCharUpperW
IsClipboardFormatAvailable
IsDebuggerPresent
IsDialogMessageW
IsDlgButtonChecked
IsIconic
IsMenu
IsProcessorFeaturePresent
IsThemeActive
IsValidCodePage
IsWindow
IsWindowEnabled
IsWindowVisible
IsWow64Process
IsZoomed
<I?uNl
ivPlV>
[#i	xB
JanFebMarAprMayJunJulAugSepOctNovDec
January
Javanese
*JcO`Wl
	/j^*d
~Jd}&{
j?E7"Z
JF	NKOb
 -JIA7"
j!j j 
j@j ^V
]:]js;
j SWRQ
.?Jt7_
	]_J@w9
j#z-z0
k8Hy{7
Kaithi
Kannada
|kaOoP
Katakana
Kayah_Li
ke5zZG
kernel32.dll
KERNEL32.dll
keybd_event
Kharoshthi
KillTimer
kIw~(P/
 !""""""##$%&'())))))**+,-./KKKKKKKK001234566678789:;<=;<=KKKKK>?@ABCDEFGH
KteKt)KuB
k?)uw?K
L$09L$(
L$0hhPH
L$0htPH
}&l1\^
/L&1o(	
L}37?)H
l6K>Wo
L$$;B0u
LCMapStringW
LeaveCriticalSection
Lepcha
L$Hh,aH
L$,HPQ
L$HQPP
L$HQSP
&Lh>|Uq
L$ h\VH
Linear_B
LineTo
L$ +L$
L$LQVS
L$LQVW
L!M}&?jZT,p
LoadCursorW
LoadIconW
LoadImageW
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LoadStringW
LoadUserProfileW
LocalFileTimeToFileTime
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
LockResource
LockServiceDatabase
LockWindowUpdate
LogonUserW
lookbehind assertion is not fixed length
LookupPrivilegeValueW
L$p9L$\
L$$PjkQ
L$$PjlQ
L$$PjmQ
L$$PjnQ
L$,PVQ
L$<Qj@Vj
L$(QRh0
L$$QRh0
L$,QVW
L$,RPQ
lstrcmpiW
lstrcpyW
lstrlenW
> L	"u
L$XQP3
L$XQPhx
L$XQVS
Lycian
Lydian
M 9E$u
Malayalam
malformed number or name after (?(
malformed \P or \p sequence
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
MapVirtualKeyW
(*MARK) must have an argument
mciSendStringW
^MDkwb
Meetei_Mayek
MessageBeep
MessageBoxA
MessageBoxW
missing )
missing ) after comment
missing terminating ] for character class
MkParseDisplayName
MM/dd/yy
"[M"MhD\
Monday
Mongolian
MonitorFromPoint
MonitorFromRect
mouse_event
MoveFileW
MoveToEx
MoveWindow
MPR.dll
M QRh0
mT<'z+
MulDiv
MultiByteToWideChar
M WRSPht
Mwy Qa
Myanmar
-N+2I;g
 new[]
New_Tai_Lue
_nextafter
*N'gC>
no error
NO_START_OPT)
nothing to repeat
November
nQ7D!#b
(null)
number after (?C is > 255
number is too big
numbers out of order in {} quantifier
number too big in {} quantifier
$NVr!S
O.AEG]
octal value is greater than \377 (not in UTF-8 mode)
October
|oe3UDmrn/N
Ol_Chiki
Old_Italic
Old_Persian
Old_South_Arabian
Old_Turkic
ole32.dll
OLEAUT32.dll
OleInitialize
OleSetContainedObject
OleSetMenuDescriptor
OleUninitialize
`omni callsig'
OpenClipboard
OpenDesktopW
OpenProcess
OpenProcessToken
OpenSCManagerW
OpenThreadToken
OpenWindowStationW
operand of unlimited repeat could match the empty string
operator
OqzT0^
Osmanya
OutputDebugStringW
[$OY-A
p00ZRG2
p6Ts[-5e2
parentheses nested too deeply
__pascal
PCRE does not support \L, \l, \N{name}, \U, or \u
PeekMessageW
{p}GZI\
Phags_Pa
Phoenician
Pj SWV
PjxPPh
`placement delete closure'
`placement delete[] closure'
PolyDraw
POSIX collating elements are not supported
POSIX named classes are supported only within a class
PostMessageW
PostQuitMessage
PPPPPPPP
@PQj+S
PQRh`VH
pqrstuvwxyz{$--%"!' 	&,[\
PQRSWV
Process32FirstW
Process32NextW
ProgIDFromCLSID
PSAPI.DLL
PtInRect
__ptr64
PVQRSh
PVQRSh$WH
PVQSRj
p\<yf+
pZm8pr
q|5O.-F
Q9)1#f
qB.U2PGt
QDLE?o
Qkkbal
qp	8	:
 Q?q Oxb
QQSVWh
QRPSWV
 Q<t3^Y~-
QueryPerformanceCounter
QueryPerformanceFrequency
}Q;wls+
\QyiKD
 ^%q}yk
R$-4H>
RaiseException
range out of order in character class
rb_+Z#
`.rdata
ReadFile
ReadProcessMemory
Rectangle
recursive call could loop indefinitely
RedrawWindow
reference to non-existent subpattern
RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegisterClassExW
RegisterHotKey
RegisterWindowMessageW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
regular expression is too large
Rejang
ReleaseCapture
ReleaseDC
RemoveDirectoryW
repeated subpattern is too long
repeating a DEFINE group is not allowed
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
__restrict
ResumeThread
Ri'3VH
r #j`8
+&r/?ji
RK?I+)H
(?R or (?[+-]digits must be followed by )
RoundRect
RPQSWV
RQPSWV
_+r*sb#
rsL\A[
RtlUnwind
	Ru^0d
RVPQSh
Samaritan
Saturday
Saurashtra
`scalar deleting destructor'
ScreenToClient
    </security>
    <security>
sej\Yf
SelectObject
SendDlgItemMessageW
SendInput
SendMessageTimeoutW
SendMessageW
September
SetActiveWindow
SetBkColor
SetBkMode
SetCapture
SetClipboardData
SetCurrentDirectoryW
SetCursor
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
SetFocus
SetForegroundWindow
SetHandleCount
SetKeyboardState
SetLastError
SetLayeredWindowAttributes
SetMenu
SetMenuDefaultItem
SetMenuItemInfoW
SetPixel
SetPriorityClass
SetProcessWindowStation
SetRect
SetSecurityDescriptorDacl
SetStdHandle
SetSystemPowerState
SetTextColor
SetTimer
SetUnhandledExceptionFilter
SetUserObjectSecurity
SetViewportOrgEx
SetVolumeLabelW
SetWindowLongW
SetWindowPos
SetWindowTextW
Shavian
SHBrowseForFolderW
SHELL32.dll
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
SHEmptyRecycleBinW
SHFileOperationW
SHGetDesktopFolder
SHGetFolderPathW
SHGetMalloc
SHGetPathFromIDListW
ShowWindow
Sinhala
SizeofResource
s%j.Zf
(sNfwG*;
spare error
S\RPQV
SS2.Rg
^SSSSS
__stdcall
StretchBlt
`string'
StringFromGUID2
StrokeAndFillPath
StrokePath
subpattern name expected
subpattern name is too long (maximum 32 characters)
Sundanese
Sunday
SunMonTueWedThuFriSat
support for \P, \p, and \X has not been compiled
SVWj*P3
@SVWjX
SVWPh0
s]W3\]T
"\@sWL
Syloti_Nagri
syntax error in subpattern name (missing terminator)
Syriac
SystemParametersInfoW
SystemTimeToFileTime
'sztz6
t$ ;\$$
T$0h8PH
T$0hdPH
T$0hpPH
T$0htQH
]t	[_2
t29s u-P
<=t4<>t
t[8X@tV
T$$9T$
t,9U(u$
Tagalog
Tagbanwa
Tai_Le
Tai_Tham
Tai_Viet
.t C;]
tCHt(Ht 
Telugu
TerminateProcess
TerminateThread
t;f99t6C;]
t%@F;E
tgY4{g
t$h9t$l
Thaana
t#h,}H
+t HHt
__thiscall
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
!This program cannot be run in DOS mode.
this version of PCRE is not compiled with PCRE_UCP support
this version of PCRE is not compiled with PCRE_UTF8 support
T$hRh0
t"Ht	_^2
t`HtNHuf
Thursday
Tibetan
Tifinagh
timeGetTime
t=jch_0C
t	j\Yf
t$lFVj
T$LRVS
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
tL<_tH<
TO#a\n
too many named subpatterns (maximum 10000)
toq T-
T$p9T$\~
T$ PQRVS
T$pRQW
T$,PRV
T$ QRh
T$ QRj
t QWQV
TrackPopupMenuEx
TranslateAcceleratorW
TranslateMessage
tRJt6JuV
T$<Rj@Vj
T$ @RP
T$$RPh0
T$,RPj}
T$ RPQ
T$,RQP
T$(RSP
T$\RSP
T$ RS@Phx
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
T$(RWh+
t"SS9] u
<}t <-t
<+t"<-t
T$$+T$
t$$t4Ht
tth\VH
T$<t<j
<)t^<:tW
<(t|<"tx<%tt<'tp<$tl<&th<!td<ot`<]t\<[tX<\tT<
<)t)<|u
Tuesday
;t$,v-
t%;wlsG
two named subpatterns have the same name
T$,WRP
T$XR@Q
T$x;T$p
 Type Descriptor'
`typeof'
u2PPP8E
U6mvec  
>:u8FV
U 9M$u
`udt returning'
u#e*E<
uEVWh$
Ugaritic
u h4SH
u)jAXf;
uk$@Hzo
uM9p0uH
__unaligned
UnhandledExceptionFilter
UNICODE
Unknown exception
unknown option bit(s) set
unknown POSIX class name
unknown property name after \P or \p
UnloadUserProfile
UnlockServiceDatabase
unmatched parentheses
unrecognized character after (?<
unrecognized character after (? or (?-
unrecognized character after (?P
unrecognized character follows \
UnregisterHotKey
upPPPj
u:P-RP
UQPXY]Y[
URPQQh
USER32.dll
USERENV.dll
\$$u#Sj
u'SSWVh
UTF-16LE
uu7k5]o
UV@{__
uxtheme.dll
 -#}*V
V0Qj	h
V3_:X3	l
va8] t
`vbase destructor'
`vbtable'
`vcall'
_vDvaL
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
(*VERB) not recognized
VerQueryValueW
VERSION.dll
`vftable'
VirtualAlloc
VirtualAllocEx
`virtual displacement map'
VirtualFree
VirtualFreeEx
VkKeyScanW
v	N+D$
V.oMg@
VPGWQR
VQGWRP
(V*qUZ
VRGWPQ
V\RPQW
:VrZ"a
VVVVVQRSSj
W.0qI4;
w`?(~8	
WaitForSingleObject
waveOutSetVolume
Wednesday
wf*"ae
}WhsYl
WideCharToMultiByte
WindowFromPoint
WININET.dll
WINMM.dll
wi[v4k
 wlh?$
';wls,
WNetAddConnection2W
WNetCancelConnection2W
WNetGetConnectionW
WNetUseConnectionW
WPQRSV
WQ$;jB"
WQRPSV
<~%wRI
WriteConsoleW
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
WriteProcessMemory
?w^R.o\
WRPQCSV
WRPQSV
W\RPQV
WSOCK32.dll
wsprintfW
WUCo??
	X 9} 
Xd_^[]
xdigit
-#x'FM
X)jv3%
XMn@5>
XNU~b<
xppwpp
xpxxxx
%XT&*e
 !\y[|
Y5|*wz
+yG$9=Au
y}=/II
`*z1bDb
 za8+|
Z@B~]p
|\ze$N
@zlRD1)
ZNe;EP