恶意软件分析 & URL链接扫描免费在线病毒分析平台

分析任务

分析类型	虚拟机标签	开始时间	结束时间	持续时间
文件 (Windows)	win7-sp1-x64-hpdapp03-2	2017-08-22 22:16:07	2017-08-22 22:18:32	145 秒

魔盾分数

1.5

正常的

文件详细信息

文件名	info.exe
文件大小	2225152 字节
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	5a0ea574c6e0a7afb20f1441a7732ca2
SHA1	7505741a7b76e6662fdf087776f73c212e6d9213
SHA256	ff688dbeaef912c25356945067bbd5c3a590122da2e3c0703c9d637588b49c23
SHA512	8bca538406eab94264238e805327cb80984b45ad34cf1580fe0d5c43632689dce63a71cb2384acfd5412f2b7873b9e28d490c76c7de99b6cd33082d786a922fa
CRC32	3DE5AFF4
Ssdeep	49152:oheTl2Eq5F2gmnfT7JxzG2bHE2mQCpFFmqR:0qDfZxzfCFm
Yara	登录查看Yara规则
	样本下载提交漏报

登录查看威胁特征

运行截图

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

摘要

登录查看详细行为信息

PE 信息

初始地址	0x00400000
入口地址	0x004b8016
声明校验值	0x002297cf
实际校验值	0x002297cf
最低操作系统版本要求	5.0
编译时间	2017-05-19 06:59:04
载入哈希	deaa8a23751bddf0090ee8db5432c4bf
图标
图标精确哈希值	b574ed4988f7c634af27b4a4b6f8039b
图标相似性哈希值	ad09383b017e160111bb9fda74793b8a
导出DLL库名称	AutoHotkey.exe

版本信息

LegalCopyright
InternalName
FileVersion
ProductName
ProductVersion
FileDescription
OriginalFilename
Translation

PE 数据组成

名称	虚拟地址	虚拟大小	原始数据大小	特征	熵(Entropy)
.text	0x00001000	0x000b831d	0x000b8400	IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ	6.62
.rdata	0x000ba000	0x000281f2	0x00028200	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	4.88
.data	0x000e3000	0x00008498	0x00002600	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	4.35
.tls	0x000ec000	0x00000002	0x00000200	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	0.00
.rsrc	0x000ed000	0x0013c0c1	0x0013c200	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ	7.97

资源

名称	偏移量	大小	语言	子语言	熵(Entropy)	文件类型
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
LIB	0x000f4bfc	0x00000145	LANG_ENGLISH	SUBLANG_ENGLISH_US	7.27	Zip archive data
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_ICON	0x001302ac	0x00000468	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.89	GLS_BINARY_LSB_FIRST
RT_MENU	0x00130714	0x000002c8	LANG_ENGLISH	SUBLANG_ENGLISH_US	3.37	data
RT_DIALOG	0x001309dc	0x000000e8	LANG_ENGLISH	SUBLANG_ENGLISH_US	2.82	data
RT_ACCELERATOR	0x00130ac4	0x00000048	LANG_ENGLISH	SUBLANG_ENGLISH_US	2.96	data
RT_RCDATA	0x001c1c80	0x000666fa	LANG_ENGLISH	SUBLANG_ENGLISH_US	8.00	Zip archive data
RT_RCDATA	0x001c1c80	0x000666fa	LANG_ENGLISH	SUBLANG_ENGLISH_US	8.00	Zip archive data
RT_RCDATA	0x001c1c80	0x000666fa	LANG_ENGLISH	SUBLANG_ENGLISH_US	8.00	Zip archive data
RT_RCDATA	0x001c1c80	0x000666fa	LANG_ENGLISH	SUBLANG_ENGLISH_US	8.00	Zip archive data
RT_GROUP_ICON	0x002284b0	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	2.08	MS Windows icon resource - 1 icon, 16x16
RT_GROUP_ICON	0x002284b0	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	2.08	MS Windows icon resource - 1 icon, 16x16
RT_GROUP_ICON	0x002284b0	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	2.08	MS Windows icon resource - 1 icon, 16x16
RT_GROUP_ICON	0x002284b0	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	2.08	MS Windows icon resource - 1 icon, 16x16
RT_GROUP_ICON	0x002284b0	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	2.08	MS Windows icon resource - 1 icon, 16x16
RT_VERSION	0x002284c4	0x000001f0	LANG_ENGLISH	SUBLANG_ENGLISH_US	3.07	MS Windows COFF PowerPC object file
RT_MANIFEST	0x002286b4	0x00000a0d	LANG_ENGLISH	SUBLANG_ENGLISH_US	5.21	XML 1.0 document, ASCII text, with CRLF line terminators

导入

库: WSOCK32.dll:

• 0x4ba914 socket

• 0x4ba918 getservbyname

• 0x4ba91c WSASetLastError

• 0x4ba920 closesocket

• 0x4ba924 gethostbyaddr

• 0x4ba928 gethostbyname

• 0x4ba92c send

• 0x4ba930 WSAAsyncSelect

• 0x4ba934 recv

• 0x4ba938 gethostname

• 0x4ba93c inet_ntoa

• 0x4ba940 connect

• 0x4ba944 inet_addr

• 0x4ba948 WSAStartup

• 0x4ba94c ioctlsocket

• 0x4ba950 htonl

• 0x4ba954 WSAGetLastError

• 0x4ba958 htons

• 0x4ba95c ntohs

• 0x4ba960 shutdown

• 0x4ba964 getservbyport

• 0x4ba968 WSACleanup

库: WINMM.dll:

• 0x4ba8e0 mixerGetLineControlsW

• 0x4ba8e4 mixerGetLineInfoW

• 0x4ba8e8 mixerSetControlDetails

• 0x4ba8ec waveOutGetVolume

• 0x4ba8f0 mixerGetDevCapsW

• 0x4ba8f4 mixerOpen

• 0x4ba8f8 mixerGetControlDetailsW

• 0x4ba8fc mixerClose

• 0x4ba900 mciSendStringW

• 0x4ba904 joyGetDevCapsW

• 0x4ba908 waveOutSetVolume

• 0x4ba90c joyGetPosEx

库: VERSION.dll:

• 0x4ba8d0 GetFileVersionInfoSizeW

• 0x4ba8d4 VerQueryValueW

• 0x4ba8d8 GetFileVersionInfoW

库: COMCTL32.dll:

• 0x4ba06c ImageList_ReplaceIcon

• 0x4ba070 ImageList_GetIconSize

• 0x4ba074 ImageList_Create

• 0x4ba078 CreateStatusWindowW

• 0x4ba07c InitCommonControlsEx

• 0x4ba080 ImageList_AddMasked

• 0x4ba084 ImageList_Destroy

库: SHLWAPI.dll:

• 0x4ba628 HashData

库: CRYPT32.dll:

• 0x4ba09c CryptBinaryToStringA

• 0x4ba0a0 CryptStringToBinaryW

• 0x4ba0a4 CryptStringToBinaryA

库: PSAPI.DLL:

• 0x4ba5e0 GetModuleFileNameExW

• 0x4ba5e4 GetModuleBaseNameW

库: KERNEL32.dll:

• 0x4ba138 InitializeCriticalSection

• 0x4ba13c SetErrorMode

• 0x4ba140 GetCurrentDirectoryW

• 0x4ba144 LoadLibraryW

• 0x4ba148 AddVectoredExceptionHandler

• 0x4ba14c GlobalLock

• 0x4ba150 GlobalUnlock

• 0x4ba154 GetEnvironmentVariableW

• 0x4ba158 FreeLibrary

• 0x4ba15c WideCharToMultiByte

• 0x4ba160 GetSystemDirectoryA

• 0x4ba164 LoadLibraryA

• 0x4ba168 GetCurrentThreadId

• 0x4ba16c SuspendThread

• 0x4ba170 ResumeThread

• 0x4ba174 EnterCriticalSection

• 0x4ba178 LeaveCriticalSection

• 0x4ba17c OpenThread

• 0x4ba180 lstrcmpiW

• 0x4ba184 CreateThread

• 0x4ba188 SetThreadPriority

• 0x4ba18c GetExitCodeThread

• 0x4ba190 CloseHandle

• 0x4ba194 CreateMutexW

• 0x4ba198 GetLastError

• 0x4ba19c GetModuleHandleW

• 0x4ba1a0 MultiByteToWideChar

• 0x4ba1a4 SystemTimeToFileTime

• 0x4ba1a8 SetFilePointerEx

• 0x4ba1ac ReadFile

• 0x4ba1b0 SetFilePointer

• 0x4ba1b4 GlobalSize

• 0x4ba1b8 lstrcpyA

• 0x4ba1bc lstrlenA

• 0x4ba1c0 lstrcmpiA

• 0x4ba1c4 lstrcmpA

• 0x4ba1c8 LocalFileTimeToFileTime

• 0x4ba1cc CreateDirectoryA

• 0x4ba1d0 CreateDirectoryW

• 0x4ba1d4 IsBadReadPtr

• 0x4ba1d8 CreateFileW

• 0x4ba1dc CreateFileA

• 0x4ba1e0 WriteFile

• 0x4ba1e4 VirtualProtect

• 0x4ba1e8 DuplicateHandle

• 0x4ba1ec LoadResource

• 0x4ba1f0 LockResource

• 0x4ba1f4 SizeofResource

• 0x4ba1f8 GetCurrentDirectoryA

• 0x4ba1fc FileTimeToSystemTime

• 0x4ba200 GetLocalTime

• 0x4ba204 GetFileInformationByHandle

• 0x4ba208 GetFileSize

• 0x4ba20c lstrlenW

• 0x4ba210 FindFirstFileW

• 0x4ba214 FindNextFileW

• 0x4ba218 FindClose

• 0x4ba21c UnmapViewOfFile

• 0x4ba220 CreateFileMappingW

• 0x4ba224 MapViewOfFile

• 0x4ba228 SetLastError

• 0x4ba22c VirtualAlloc

• 0x4ba230 VirtualFree

• 0x4ba234 GetTempPathA

• 0x4ba238 GetNativeSystemInfo

• 0x4ba23c HeapAlloc

• 0x4ba240 GetProcessHeap

• 0x4ba244 HeapFree

• 0x4ba248 HeapDestroy

• 0x4ba24c GetCommandLineW

• 0x4ba250 WaitForSingleObject

• 0x4ba254 GetThreadLocale

• 0x4ba258 VirtualQuery

• 0x4ba25c HeapCreate

• 0x4ba260 FlushInstructionCache

• 0x4ba264 GetVersionExW

• 0x4ba268 InterlockedIncrement

• 0x4ba26c InterlockedDecrement

• 0x4ba270 GetModuleFileNameW

• 0x4ba274 GetFileAttributesW

• 0x4ba278 OpenProcess

• 0x4ba27c GetCurrentProcessId

• 0x4ba280 GetFullPathNameW

• 0x4ba284 LocalFree

• 0x4ba288 FileTimeToLocalFileTime

• 0x4ba28c SetEnvironmentVariableW

• 0x4ba290 Beep

• 0x4ba294 MoveFileW

• 0x4ba298 CreateProcessW

• 0x4ba29c GetExitCodeProcess

• 0x4ba2a0 WriteProcessMemory

• 0x4ba2a4 ReadProcessMemory

• 0x4ba2a8 TerminateProcess

• 0x4ba2ac SetPriorityClass

• 0x4ba2b0 GetDateFormatW

• 0x4ba2b4 GetTimeFormatW

• 0x4ba2b8 GetDiskFreeSpaceW

• 0x4ba2bc SetVolumeLabelW

• 0x4ba2c0 DeviceIoControl

• 0x4ba2c4 GetDriveTypeW

• 0x4ba2c8 GetVolumeInformationW

• 0x4ba2cc DeleteFileW

• 0x4ba2d0 CopyFileW

• 0x4ba2d4 SetFileAttributesW

• 0x4ba2d8 GetFileSizeEx

• 0x4ba2dc GetSystemTime

• 0x4ba2e0 GetSystemDefaultUILanguage

• 0x4ba2e4 GetComputerNameW

• 0x4ba2e8 GetWindowsDirectoryW

• 0x4ba2ec GetTempPathW

• 0x4ba2f0 GetShortPathNameW

• 0x4ba2f4 TryEnterCriticalSection

• 0x4ba2f8 QueryDosDeviceW

• 0x4ba2fc CompareStringW

• 0x4ba300 RemoveDirectoryW

• 0x4ba304 FormatMessageW

• 0x4ba308 GetPrivateProfileStringW

• 0x4ba30c GetPrivateProfileSectionW

• 0x4ba310 GetPrivateProfileSectionNamesW

• 0x4ba314 WritePrivateProfileStringW

• 0x4ba318 WritePrivateProfileSectionW

• 0x4ba31c SetEndOfFile

• 0x4ba320 GetACP

• 0x4ba324 GetFileType

• 0x4ba328 GetStdHandle

• 0x4ba32c VirtualAllocEx

• 0x4ba330 VirtualFreeEx

• 0x4ba334 EnumResourceNamesW

• 0x4ba338 LoadLibraryExW

• 0x4ba33c RemoveVectoredExceptionHandler

• 0x4ba340 ExitProcess

• 0x4ba344 ExitThread

• 0x4ba348 GetSystemTimeAsFileTime

• 0x4ba34c GetProcessTimes

• 0x4ba350 GetCurrentProcess

• 0x4ba354 CheckRemoteDebuggerPresent

• 0x4ba358 GetCurrentThread

• 0x4ba35c GetProcAddress

• 0x4ba360 GlobalFree

• 0x4ba364 _lclose

• 0x4ba368 _lopen

• 0x4ba36c _lread

• 0x4ba370 GetModuleFileNameA

• 0x4ba374 GlobalAlloc

• 0x4ba378 GetModuleHandleA

• 0x4ba37c FindResourceW

• 0x4ba380 GetCPInfo

• 0x4ba384 OutputDebugStringW

• 0x4ba388 SetCurrentDirectoryW

• 0x4ba38c Sleep

• 0x4ba390 GetTickCount

• 0x4ba394 MulDiv

• 0x4ba398 InterlockedExchange

• 0x4ba39c InterlockedCompareExchange

• 0x4ba3a0 HeapSetInformation

• 0x4ba3a4 GetStartupInfoW

• 0x4ba3a8 SetUnhandledExceptionFilter

• 0x4ba3ac QueryPerformanceCounter

• 0x4ba3b0 UnhandledExceptionFilter

• 0x4ba3b4 IsDebuggerPresent

• 0x4ba3b8 SetFileTime

• 0x4ba3bc IsProcessorFeaturePresent

库: USER32.dll:

• 0x4ba630 ScrollWindow

• 0x4ba634 SetScrollInfo

• 0x4ba638 ExitWindowsEx

• 0x4ba63c GetMenuStringW

• 0x4ba640 GetSubMenu

• 0x4ba644 GetMenuItemID

• 0x4ba648 GetMenuItemCount

• 0x4ba64c GetLastInputInfo

• 0x4ba650 GetCursor

• 0x4ba654 ClientToScreen

• 0x4ba658 MessageBeep

• 0x4ba65c SetDlgItemTextW

• 0x4ba660 GetDlgItem

• 0x4ba664 SendDlgItemMessageW

• 0x4ba668 DialogBoxParamW

• 0x4ba66c SetForegroundWindow

• 0x4ba670 DefWindowProcW

• 0x4ba674 FillRect

• 0x4ba678 DrawIconEx

• 0x4ba67c GetSysColorBrush

• 0x4ba680 GetSysColor

• 0x4ba684 RegisterWindowMessageW

• 0x4ba688 IsIconic

• 0x4ba68c IsZoomed

• 0x4ba690 EnumWindows

• 0x4ba694 GetWindowTextLengthW

• 0x4ba698 EnableWindow

• 0x4ba69c InvalidateRect

• 0x4ba6a0 SetLayeredWindowAttributes

• 0x4ba6a4 SetWindowPos

• 0x4ba6a8 SetWindowRgn

• 0x4ba6ac SetFocus

• 0x4ba6b0 GetGUIThreadInfo

• 0x4ba6b4 SetActiveWindow

• 0x4ba6b8 EnumChildWindows

• 0x4ba6bc MoveWindow

• 0x4ba6c0 GetQueueStatus

• 0x4ba6c4 GetWindowRect

• 0x4ba6c8 GetClientRect

• 0x4ba6cc SystemParametersInfoW

• 0x4ba6d0 AdjustWindowRectEx

• 0x4ba6d4 DrawTextW

• 0x4ba6d8 SetRect

• 0x4ba6dc GetIconInfo

• 0x4ba6e0 SetWindowTextW

• 0x4ba6e4 IsWindowVisible

• 0x4ba6e8 GetMenu

• 0x4ba6ec CheckMenuItem

• 0x4ba6f0 SetMenu

• 0x4ba6f4 FlashWindow

• 0x4ba6f8 GetPropW

• 0x4ba6fc SetPropW

• 0x4ba700 RemovePropW

• 0x4ba704 MapWindowPoints

• 0x4ba708 RedrawWindow

• 0x4ba70c SetParent

• 0x4ba710 GetClassInfoExW

• 0x4ba714 GetAncestor

• 0x4ba718 UpdateWindow

• 0x4ba71c GetMessagePos

• 0x4ba720 GetClassLongW

• 0x4ba724 DefDlgProcW

• 0x4ba728 CallWindowProcW

• 0x4ba72c CheckRadioButton

• 0x4ba730 LoadImageW

• 0x4ba734 ChangeClipboardChain

• 0x4ba738 SetClipboardViewer

• 0x4ba73c LoadAcceleratorsW

• 0x4ba740 CreateWindowExW

• 0x4ba744 RegisterClassExW

• 0x4ba748 DestroyAcceleratorTable

• 0x4ba74c IntersectRect

• 0x4ba750 PtInRect

• 0x4ba754 GetTopWindow

• 0x4ba758 BringWindowToTop

• 0x4ba75c GetWindow

• 0x4ba760 EnumClipboardFormats

• 0x4ba764 CreateIconFromResourceEx

• 0x4ba768 CopyImage

• 0x4ba76c GetDesktopWindow

• 0x4ba770 CreateIconIndirect

• 0x4ba774 TrackPopupMenuEx

• 0x4ba778 DestroyMenu

• 0x4ba77c AppendMenuW

• 0x4ba780 SetMenuInfo

• 0x4ba784 CreatePopupMenu

• 0x4ba788 CreateMenu

• 0x4ba78c GetMenuItemInfoW

• 0x4ba790 IsMenu

• 0x4ba794 SetMenuItemInfoW

• 0x4ba798 RemoveMenu

• 0x4ba79c UnregisterClassW

• 0x4ba7a0 DestroyIcon

• 0x4ba7a4 DestroyWindow

• 0x4ba7a8 IsCharAlphaW

• 0x4ba7ac MapVirtualKeyW

• 0x4ba7b0 MapVirtualKeyExW

• 0x4ba7b4 VkKeyScanExW

• 0x4ba7b8 GetWindowTextW

• 0x4ba7bc mouse_event

• 0x4ba7c0 GetSystemMetrics

• 0x4ba7c4 keybd_event

• 0x4ba7c8 SetKeyboardState

• 0x4ba7cc GetKeyboardState

• 0x4ba7d0 GetCursorPos

• 0x4ba7d4 GetAsyncKeyState

• 0x4ba7d8 AttachThreadInput

• 0x4ba7dc SendInput

• 0x4ba7e0 UnregisterHotKey

• 0x4ba7e4 RegisterHotKey

• 0x4ba7e8 PostQuitMessage

• 0x4ba7ec SendMessageTimeoutW

• 0x4ba7f0 UnhookWindowsHookEx

• 0x4ba7f4 SetWindowsHookExW

• 0x4ba7f8 PostThreadMessageW

• 0x4ba7fc IsCharUpperW

• 0x4ba800 IsCharLowerW

• 0x4ba804 IsCharAlphaNumericW

• 0x4ba808 ToUnicodeEx

• 0x4ba80c GetKeyboardLayout

• 0x4ba810 CallNextHookEx

• 0x4ba814 CharLowerW

• 0x4ba818 ReleaseDC

• 0x4ba81c GetDC

• 0x4ba820 MessageBoxW

• 0x4ba824 OpenClipboard

• 0x4ba828 GetClipboardData

• 0x4ba82c GetClipboardFormatNameW

• 0x4ba830 CloseClipboard

• 0x4ba834 SetClipboardData

• 0x4ba838 EmptyClipboard

• 0x4ba83c PostMessageW

• 0x4ba840 FindWindowW

• 0x4ba844 EndDialog

• 0x4ba848 IsWindow

• 0x4ba84c DispatchMessageW

• 0x4ba850 TranslateMessage

• 0x4ba854 ShowWindow

• 0x4ba858 CountClipboardFormats

• 0x4ba85c SetWindowLongW

• 0x4ba860 ScreenToClient

• 0x4ba864 IsDialogMessageW

• 0x4ba868 WindowFromPoint

• 0x4ba86c SendMessageW

• 0x4ba870 IsWindowEnabled

• 0x4ba874 GetWindowLongW

• 0x4ba878 GetKeyState

• 0x4ba87c TranslateAcceleratorW

• 0x4ba880 KillTimer

• 0x4ba884 PeekMessageW

• 0x4ba888 GetFocus

• 0x4ba88c GetClassNameW

• 0x4ba890 GetWindowThreadProcessId

• 0x4ba894 GetForegroundWindow

• 0x4ba898 GetMessageW

• 0x4ba89c SetTimer

• 0x4ba8a0 GetScrollInfo

• 0x4ba8a4 GetParent

• 0x4ba8a8 GetDlgCtrlID

• 0x4ba8ac CharUpperW

• 0x4ba8b0 IsClipboardFormatAvailable

• 0x4ba8b4 SetMenuDefaultItem

• 0x4ba8b8 InsertMenuItemW

• 0x4ba8bc CreateAcceleratorTableW

• 0x4ba8c0 CharLowerA

• 0x4ba8c4 CreateDialogIndirectParamW

• 0x4ba8c8 LoadCursorW

库: GDI32.dll:

• 0x4ba0ac GetClipBox

• 0x4ba0b0 FillRgn

• 0x4ba0b4 GetClipRgn

• 0x4ba0b8 GetCharABCWidthsW

• 0x4ba0bc SetTextColor

• 0x4ba0c0 CreateDIBSection

• 0x4ba0c4 GdiFlush

• 0x4ba0c8 SetBkMode

• 0x4ba0cc CreatePatternBrush

• 0x4ba0d0 ExcludeClipRect

• 0x4ba0d4 EnumFontFamiliesExW

• 0x4ba0d8 SetBkColor

• 0x4ba0dc GetPixel

• 0x4ba0e0 BitBlt

• 0x4ba0e4 CreateCompatibleBitmap

• 0x4ba0e8 GetSystemPaletteEntries

• 0x4ba0ec GetDIBits

• 0x4ba0f0 CreateCompatibleDC

• 0x4ba0f4 CreatePolygonRgn

• 0x4ba0f8 CreateRectRgn

• 0x4ba0fc CreateRoundRectRgn

• 0x4ba100 CreateEllipticRgn

• 0x4ba104 DeleteDC

• 0x4ba108 GetObjectW

• 0x4ba10c GetTextMetricsW

• 0x4ba110 GetTextFaceW

• 0x4ba114 SelectObject

• 0x4ba118 GetStockObject

• 0x4ba11c CreateDCW

• 0x4ba120 CreateSolidBrush

• 0x4ba124 CreateFontW

• 0x4ba128 DeleteObject

• 0x4ba12c SetBrushOrgEx

• 0x4ba130 GetDeviceCaps

库: COMDLG32.dll:

• 0x4ba08c GetOpenFileNameW

• 0x4ba090 GetSaveFileNameW

• 0x4ba094 CommDlgExtendedError

库: ADVAPI32.dll:

• 0x4ba000 RegDeleteKeyW

• 0x4ba004 RegConnectRegistryW

• 0x4ba008 RegCloseKey

• 0x4ba00c RegOpenKeyExW

• 0x4ba010 RegQueryInfoKeyW

• 0x4ba014 CryptReleaseContext

• 0x4ba018 CryptDestroyKey

• 0x4ba01c CryptDestroyHash

• 0x4ba020 CryptDeriveKey

• 0x4ba024 CryptHashData

• 0x4ba028 CryptCreateHash

• 0x4ba02c CryptAcquireContextW

• 0x4ba030 RegDeleteValueW

• 0x4ba034 RegEnumValueW

• 0x4ba038 RegEnumKeyExW

• 0x4ba03c GetUserNameW

• 0x4ba040 OpenSCManagerW

• 0x4ba044 LockServiceDatabase

• 0x4ba048 UnlockServiceDatabase

• 0x4ba04c CloseServiceHandle

• 0x4ba050 OpenProcessToken

• 0x4ba054 LookupPrivilegeValueW

• 0x4ba058 AdjustTokenPrivileges

• 0x4ba05c RegQueryValueExW

• 0x4ba060 RegCreateKeyExW

• 0x4ba064 RegSetValueExW

库: SHELL32.dll:

• 0x4ba5ec DragQueryFileW

• 0x4ba5f0 DragFinish

• 0x4ba5f4 ExtractIconW

• 0x4ba5f8 DragQueryPoint

• 0x4ba5fc SHEmptyRecycleBinW

• 0x4ba600 SHFileOperationW

• 0x4ba604 SHGetPathFromIDListW

• 0x4ba608 SHBrowseForFolderW

• 0x4ba60c SHGetDesktopFolder

• 0x4ba610 SHGetMalloc

• 0x4ba614 SHGetFolderPathW

• 0x4ba618 ShellExecuteExW

• 0x4ba61c CommandLineToArgvW

• 0x4ba620 Shell_NotifyIconW

库: ole32.dll:

• 0x4ba970 OleInitialize

• 0x4ba974 CoInitialize

• 0x4ba978 CoCreateInstance

• 0x4ba97c CoUninitialize

• 0x4ba980 CLSIDFromString

• 0x4ba984 CoGetObject

• 0x4ba988 StringFromGUID2

• 0x4ba98c CreateStreamOnHGlobal

库: OLEAUT32.dll:

• 0x4ba58c SafeArrayCreate

• 0x4ba590 GetActiveObject

• 0x4ba594 SysStringLen

• 0x4ba598 SysFreeString

• 0x4ba59c OleLoadPicture

• 0x4ba5a0 SafeArrayUnaccessData

• 0x4ba5a4 SafeArrayGetElemsize

• 0x4ba5a8 SafeArrayAccessData

• 0x4ba5ac SafeArrayUnlock

• 0x4ba5b0 SafeArrayPtrOfIndex

• 0x4ba5b4 SafeArrayLock

• 0x4ba5b8 SafeArrayGetDim

• 0x4ba5bc SafeArrayGetLBound

• 0x4ba5c0 SafeArrayGetUBound

• 0x4ba5c4 VariantCopyInd

• 0x4ba5c8 SafeArrayCopy

• 0x4ba5cc SysAllocString

• 0x4ba5d0 VariantChangeType

• 0x4ba5d4 VariantClear

• 0x4ba5d8 SafeArrayDestroy

库: MSVCR100.dll:

• 0x4ba3c4 ftell

• 0x4ba3c8 _ultoa

• 0x4ba3cc strcpy_s

• 0x4ba3d0 __RTtypeid

• 0x4ba3d4 fread

• 0x4ba3d8 fgets

• 0x4ba3dc strtol

• 0x4ba3e0 _wfopen

• 0x4ba3e4 atoi

• 0x4ba3e8 strchr

• 0x4ba3ec strstr

• 0x4ba3f0 calloc

• 0x4ba3f4 _wtoi

• 0x4ba3f8 strncmp

• 0x4ba3fc memmove

• 0x4ba400 _atoi64

• 0x4ba404 sprintf_s

• 0x4ba408 _itoa

• 0x4ba40c _strnicmp

• 0x4ba410 sprintf

• 0x4ba414 _stricmp

• 0x4ba418 wcschr

• 0x4ba41c _purecall

• 0x4ba420 __iob_func

• 0x4ba424 setvbuf

• 0x4ba428 wcsrchr

• 0x4ba42c ??2@YAPAXI@Z

• 0x4ba430 _swprintf

• 0x4ba434 __wargv

• 0x4ba438 __argc

• 0x4ba43c _wcsnicmp

• 0x4ba440 realloc

• 0x4ba444 free

• 0x4ba448 ??3@YAXPAX@Z

• 0x4ba44c malloc

• 0x4ba450 _wtoi64

• 0x4ba454 _wcstoi64

• 0x4ba458 isxdigit

• 0x4ba45c _wcsicmp

• 0x4ba460 _i64tow

• 0x4ba464 wcstombs

• 0x4ba468 wcstoul

• 0x4ba46c fwrite

• 0x4ba470 _wsplitpath

• 0x4ba474 wcstod

• 0x4ba478 wcscspn

• 0x4ba47c _msize

• 0x4ba480 _expand

• 0x4ba484 strcat_s

• 0x4ba488 fseek

• 0x4ba48c atof

• 0x4ba490 _isctype

• 0x4ba494 fclose

• 0x4ba498 strncpy_s

• 0x4ba49c wcsstr

• 0x4ba4a0 ??_U@YAPAXI@Z

• 0x4ba4a4 qsort

• 0x4ba4a8 ??_V@YAXPAX@Z

• 0x4ba4ac _itow

• 0x4ba4b0 exit

• 0x4ba4b4 wcstol

• 0x4ba4b8 isdigit

• 0x4ba4bc rand

• 0x4ba4c0 _beginthreadex

• 0x4ba4c4 wcsncpy

• 0x4ba4c8 _snwprintf

• 0x4ba4cc iswspace

• 0x4ba4d0 _wtof

• 0x4ba4d4 iswdigit

• 0x4ba4d8 wcsncmp

• 0x4ba4dc tolower

• 0x4ba4e0 toupper

• 0x4ba4e4 iswxdigit

• 0x4ba4e8 fwprintf

• 0x4ba4ec fputws

• 0x4ba4f0 _vsnwprintf

• 0x4ba4f4 _wcstoui64

• 0x4ba4f8 _ultow

• 0x4ba4fc towupper

• 0x4ba500 _wcsupr

• 0x4ba504 _wcsdup

• 0x4ba508 _scwprintf

• 0x4ba50c ?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z

• 0x4ba510 _vsnprintf

• 0x4ba514 _unlock

• 0x4ba518 __dllonexit

• 0x4ba51c _lock

• 0x4ba520 _onexit

• 0x4ba524 _amsg_exit

• 0x4ba528 __wgetmainargs

• 0x4ba52c _cexit

• 0x4ba530 _exit

• 0x4ba534 _XcptFilter

• 0x4ba538 _wcmdln

• 0x4ba53c _initterm

• 0x4ba540 _initterm_e

• 0x4ba544 _configthreadlocale

• 0x4ba548 __setusermatherr

• 0x4ba54c _commode

• 0x4ba550 _fmode

• 0x4ba554 __set_app_type

• 0x4ba558 ?terminate@@YAXXZ

• 0x4ba55c ?_type_info_dtor_internal_method@type_info@@QAEXXZ

• 0x4ba560 _except_handler4_common

• 0x4ba564 _invoke_watson

• 0x4ba568 _controlfp_s

• 0x4ba56c _crt_debugger_hook

• 0x4ba570 memcpy

• 0x4ba574 memset

• 0x4ba578 __RTDynamicCast

• 0x4ba57c __CxxFrameHandler3

• 0x4ba580 _except_handler3

• 0x4ba584 strtoul

导出

序列	地址	名称
1	0x40c8c0	ADDFILE
2	0x40cb90	ADDSCRIPT
3	0x40c420	AHKASSIGN
4	0x40ce60	AHKEXEC
5	0x40c4c0	AHKEXECUTELINE
6	0x40c150	AHKFINDFUNC
7	0x40c170	AHKFINDLABEL
8	0x40d0e0	AHKFUNCTION
9	0x40c190	AHKGETVAR
10	0x40c080	AHKISUNICODE
11	0x40c540	AHKLABEL
12	0x40c090	AHKPAUSE
13	0x40c5a0	AHKPOSTFUNCTION
14	0x40c8c0	AddFile
15	0x40cb90	AddScript
16	0x40c8c0	Addfile
17	0x40cb90	Addscript
18	0x40c420	AhkAssign
19	0x40ce60	AhkExec
20	0x40c4c0	AhkExecuteLine
21	0x40c4c0	AhkExecuteline
22	0x40c150	AhkFindFunc
23	0x40c170	AhkFindLabel
24	0x40c150	AhkFindfunc
25	0x40c170	AhkFindlabel
26	0x40d0e0	AhkFunction
27	0x40c190	AhkGetVar
28	0x40c190	AhkGetvar
29	0x40c080	AhkIsUnicode
30	0x40c080	AhkIsunicode
31	0x40c540	AhkLabel
32	0x40c090	AhkPause
33	0x40c5a0	AhkPostFunction
34	0x40c5a0	AhkPostfunction
35	0x40c420	Ahkassign
36	0x40ce60	Ahkexec
37	0x40c4c0	AhkexecuteLine
38	0x40c4c0	Ahkexecuteline
39	0x40c150	AhkfindFunc
40	0x40c170	AhkfindLabel
41	0x40c150	Ahkfindfunc
42	0x40c170	Ahkfindlabel
43	0x40d0e0	Ahkfunction
44	0x40c190	AhkgetVar
45	0x40c190	Ahkgetvar
46	0x40c080	AhkisUnicode
47	0x40c080	Ahkisunicode
48	0x40c540	Ahklabel
49	0x40c090	Ahkpause
50	0x40c5a0	AhkpostFunction
51	0x40c5a0	Ahkpostfunction
52	0x40c8c0	addFile
53	0x40cb90	addScript
65	0x40c8c0	addfile
66	0x40cb90	addscript
67	0x40c420	ahkAssign
54	0x40ce60	ahkExec
55	0x40c4c0	ahkExecuteLine
68	0x40c4c0	ahkExecuteline
56	0x40c150	ahkFindFunc
57	0x40c170	ahkFindLabel
69	0x40c150	ahkFindfunc
70	0x40c170	ahkFindlabel
58	0x40d0e0	ahkFunction
71	0x40c190	ahkGetVar
72	0x40c190	ahkGetvar
59	0x40c080	ahkIsUnicode
73	0x40c080	ahkIsunicode
60	0x40c540	ahkLabel
61	0x40c090	ahkPause
62	0x40c5a0	ahkPostFunction
74	0x40c5a0	ahkPostfunction
63	0x40c420	ahkassign
75	0x40ce60	ahkexec
76	0x40c4c0	ahkexecuteLine
77	0x40c4c0	ahkexecuteline
78	0x40c150	ahkfindFunc
79	0x40c170	ahkfindLabel
80	0x40c150	ahkfindfunc
81	0x40c170	ahkfindlabel
82	0x40d0e0	ahkfunction
83	0x40c190	ahkgetVar
64	0x40c190	ahkgetvar
84	0x40c080	ahkisUnicode
85	0x40c080	ahkisunicode
86	0x40c540	ahklabel
87	0x40c090	ahkpause
88	0x40c5a0	ahkpostFunction
89	0x40c5a0	ahkpostfunction

.text
`.rdata
@.data
.rsrc
WhxvN
D$@Pj
D$$@\@
T$8VhhPN
VhhPN
PWQVUj
95 ]N
;5 ]N
tk95 ]N
95 ]N
;-@[N
<MD[N
<MF[N
PQh(ZN
T$8Pj
;=@]N
D$0Pj
D$0Pj
tZjLj
H49NPvEj
D$ =MZ
rYj@h
|$DSj
B=$gN
u Vh\5M
Pht5M
L$<Qj
T$(Rj
D$4p3E
D$<t5M
RhX7M
t2hd7M
PhP8M
Ph,9M
PhX9M
\$(hP9M
Uh0<M
PhX=M
Rhl=M
Shd9M
Rh(:M
Wh@:M
Uhl;M
O<Qh8>M
Ph,9M
RhX9M
MhQh0<M
QhX=M
Phl=M
MdVhd9M
Qh(:M
Mdh@:M
UhRhl;M
Mdhd9M
C<Ph8>M
Qh@4N
Ph@4N
Sh@4N
WhPAM
Vh@4N
WhD?M
Whp?M
D$(h0@M
WhDEM
RhxFM
u/Ph(HM
Rh0HM
tehP9M
?{u$j
RhHIM
PhD?M
L$DQj
RhdKM
PhdKM
PhdKM
Vh(JM
Wh LM
Sh LM
Wh`LM
Sh`MM
PhPNM
PhdOM
Sh(PM
PhdOM
Vh(PM
Ph(PM
Vh4MM
Sh(QM
Rh`QM
Rh4MM
QhxQM
QhxQM
Ph4MM
VhdOM
Vh@RM
u*hHTM
ShXTM
Sh`MM
Wh`MM
Sh`LM
ShXXM
ShDYM
W<RhtYM
D$ Pj
Sh\iM
Vh8ZM
PhdZM
Vh|\M
Vh8\M
Wh@:M
WhT]M
Qht]M
95 nN
PhH_M
QS@PBRj
T$$h0`M
D$&h8`M
L$&hH`M
T$&h\`M
T$&hl`M
L$&h|`M
L$&hl`M
D$&hH`M
T$&h8`M
L$&h\`M
D$$h0aM
L$&h8aM
L$ hHaM
T$ h`aM
D$ hxaM
T$$h(bM
D$,h8bM
D$,hDbM
L$ hLbM
L$ hTbM
T$ hdbM
D$ htbM
T$ h0cM
D$ hDcM
L$ hXcM
T$ hdcM
T$ h dM
D$ hLdM
L$ hpdM
D$ h$eM
L$ h8eM
T$ hTeM
D$ hteM
D$ h fM
L$ h<fM
T$ hTfM
D$ hdfM
L$ hpfM
L$ h$*M
T$ h,*M
D$ h4*M
L$ h<*M
T$ hD*M
D$ hP*M
L$ h\*M
D$&h$gM
T$&h,gM
D$&h@gM
T$&hLgM
D$&h\gM
L$&hpgM
T$&hxgM
T$&h,2M
D$&h$hM
L$&h<hM
T$&hLhM
D$&h\hM
L$&hlhM
T$&hxhM
D$,h8aM
L$ h,iM
T$ hDiM
D$ Ph\iM
Rh\iM
;5tvN
t';5tvN
t*;5tvN
Sh(JM
WhDYM
L$0h88M
Ph@oM
RhdKM
PhdKM
QhdKM
RhdKM
PhdKM
<GQhdKM
RhdKM
Ph`rM
L$@Rj
t&h`2M
Wh$rM
D$xDrM
D$XPh$rM
D$<Pj
L$DQj
T$@RhPrM
RhpuM
$h(vM
D$8HvM
D$XTvM
QPh@yM
UhhyM
D$ (zM
D$ hTzM
PWQh {M
RhP{M
tDhp7M
tLhp7M
T$4Rj
t$,SRVPht5M
D$hPj
L$hQj
t2-  
#=lmN
#5pmN
tIj7j
#5lmN
#5lmN
D$(h 
L$8RPWVj
D$(Pj
D$(Pj
#5lmN
T$"Rj
D$Ph 
QRPSWj
D$PPj
LF=(vN
LF=0sN
L$(Qj
#=pmN
L$(Qj
PhhPN
T$XRh$rM
Ph$rM
ShHSN
D$@@gM
3hPPN
D$dPj
L$dQj
L$<Qj
L$$Qj
T$,Rj
Pht5M
T$(+T$ j
#5tmN
#=lmN
tSh,2M
OhPPN
;-tvN
L$HSh`MM
L$HWh
T$hRj
D$4PQj
L$hQj
D$4PQj
!h`4M
T$XRj
D$\PUj
D$8PUj
D$\PQj
u#hH'M
u&hP4M
T$,Rj
T$dRPj
L$4Qj
L$T+T$H+L$Lj
L$$Qj
L$$Qj
T$$Rj
L$`Qj
VWh(,M
D$,Pj
D$XPj
T$4RPj
L$ Qj
SUVWj
T$,RPj
T$8Rj
T$(Rj
L$(Qj
VhXTM
O RPj
Qh(JM
RSVh0PN
T$$RVh0PN
D$00PN
D$8P^M
T$4Rj
T$@SPj
WSRPj
PWSQRh
t^f9]
D$ Pj
Yh(/M
QPRUj
WSQUj
Uh\iM
D$Lh0@M
VhHlM
T$@Rj
Qhp-J
Php-J
Uh@(J
Ph GJ
T$$Rj
L$$Qj
D$$Pj
t$lVj
 !"#$%%%%%%&&'()*+%%%%%%&&'()*+,,,,,,--./012QQQQQQQQ334556789999:;<;<=>=?@AB=?@ABQQQQQCDEFGHIJKLMN
YQPSh
ntdll.dll
NtQueryInformationProcess
NtSetInformationThread
RtlQueryPerformanceFrequency
RtlQueryPerformanceCounter
127.0.0.1
CryptEncrypt
CryptDecrypt
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
source
typemap_get
stderr
stdout
breakpoint_list
breakpoint_remove
breakpoint_update
breakpoint_get
breakpoint_set
feature_set
feature_get
property_value
property_set
property_get
context_names
context_get
stack_depth
stack_get
status
detach
break
step_out
step_over
step_into
freeaddrinfo
getnameinfo
getaddrinfo
65535
\ws2_32
\wship6
starting
running
<response command="status" status="%s" reason="ok" transaction_id="%e"/>
language_
supports_threads
AutoHotkey
version
1.1.25.02 (Unicode)
encoding
UTF-8
protocol_version
supports_async
breakpoint_types
multiple_sessions
max_data
max_children
max_depth
<response command="feature_get" feature_name="%e" supported="%i" transaction_id="%e">%s</response>
<response command="feature_set" feature="%e" success="%i" transaction_id="%e"/>
enabled
disabled
<response command="breakpoint_set" transaction_id="%e" state="%s" id="%i"/>
<breakpoint id="%i" type="line" state="%s" filename="
" lineno="%u"/>
<response command="breakpoint_get" transaction_id="%e">
</response>
<response command="breakpoint_list" transaction_id="%e">
<response command="stack_depth" depth="%i" transaction_id="%e"/>
<response command="stack_get" transaction_id="%e">
<stack level="%i" type="file" filename="
" lineno="%u" where="
%e thread
%e sub
<response command="context_names" transaction_id="%e"><context name="Local" id="0"/><context name="Static" id="1"/><context name="Global" id="2"/></response>
<response command="context_get" context="%i" transaction_id="%e">
<response command="typemap_get" transaction_id="%e" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><map type="string" name="string" xsi:type="xsd:string"/><map type="int" name="integer" xsi:type="xsd:long"/><map type="float" name="float" xsi:type="xsd:double"/><map type="object" name="object"/></response>
Alias 
Builtin 
Static 
ClipboardAll 
integer
float
undefined
string
<property name="%s" fullname="%s" type="%s" facet="%s" children="0" encoding="base64" size="
</property>
object
<property name="%e" fullname="%e" type="%s" facet="" children="0" encoding="base64" size="
<response command="property_get" transaction_id="%e"><property name="%e" fullname="%e" type="undefined" facet="" size="0" children="0"/></response>
<response command="property_get" transaction_id="%e">
<response command="property_value" transaction_id="%e" encoding="base64" size="
<response command="property_set" success="%i" transaction_id="%e"/>
<response command="source" success="1" transaction_id="%e" encoding="base64">
<response command="source" success="0" transaction_id="%e"/>
<response command="%s" success="1" transaction_id="%e"/>
<stream type="%s">
</stream>
<response command="%s" transaction_id="%e
<error code="%i"/></response>
<response command="%s" transaction_id="%e"/>
<response command="%s" status="%s" reason="%s" transaction_id="%e"/>
<?xml version="1.0" encoding="UTF-8"?>
<init appid="AutoHotkey" ide_key="%e" session="%e" thread="%u" parent="" language="AutoHotkey" protocol_version="1.0" fileuri="
error
stopped
-_.!~*'()/\
file:///
-_.!~*()/
%%%02X
file://
[%Ii]
[Object(%Ii)]
class 
<property name="%e" fullname="%e" type="%s" classname="%s" address="%p" size="0" page="%i" pagesize="%i" children="%i" numchildren="%i">
<property name="%e" fullname="%e" type="%s" size="0" page="0" pagesize="%i" children="%i" numchildren="%i">
SendInput
Arabic
Armenian
Avestan
Balinese
Bamum
Batak
Bengali
Bopomofo
Brahmi
Braille
Buginese
Buhid
Canadian_Aboriginal
Carian
Cherokee
Common
Coptic
Cuneiform
Cypriot
Cyrillic
Deseret
Devanagari
Egyptian_Hieroglyphs
Ethiopic
Georgian
Glagolitic
Gothic
Greek
Gujarati
Gurmukhi
Hangul
Hanunoo
Hebrew
Hiragana
Imperial_Aramaic
Inherited
Inscriptional_Pahlavi
Inscriptional_Parthian
Javanese
Kaithi
Kannada
Katakana
Kayah_Li
Kharoshthi
Khmer
Latin
Lepcha
Limbu
Linear_B
Lycian
Lydian
Malayalam
Mandaic
Meetei_Mayek
Mongolian
Myanmar
New_Tai_Lue
Ogham
Ol_Chiki
Old_Italic
Old_Persian
Old_South_Arabian
Old_Turkic
Oriya
Osmanya
Phags_Pa
Phoenician
Rejang
Runic
Samaritan
Saurashtra
Shavian
Sinhala
Sundanese
Syloti_Nagri
Syriac
Tagalog
Tagbanwa
Tai_Le
Tai_Tham
Tai_Viet
Tamil
Telugu
Thaana
Tibetan
Tifinagh
Ugaritic
ACCEPT
COMMIT
PRUNE
alpha
lower
upper
alnum
ascii
blank
cntrl
digit
graph
print
punct
space
xdigit
no error
\ at end of pattern
\c at end of pattern
unrecognized character follows \
numbers out of order in {} quantifier
number too big in {} quantifier
missing terminating ] for character class
invalid escape sequence in character class
range out of order in character class
nothing to repeat
operand of unlimited repeat could match the empty string
internal error: unexpected repeat
unrecognized character after (? or (?-
POSIX named classes are supported only within a class
missing )
reference to non-existent subpattern
erroffset passed as NULL
unknown option bit(s) set
missing ) after comment
parentheses nested too deeply
regular expression is too large
failed to get memory
unmatched parentheses
internal error: code overflow
unrecognized character after (?<
lookbehind assertion is not fixed length
malformed number or name after (?(
conditional group contains more than two branches
assertion expected after (?(
(?R or (?[+-]digits must be followed by )
unknown POSIX class name
POSIX collating elements are not supported
this version of PCRE is compiled without UTF support
spare error
character value in \x{...} sequence is too large
invalid condition (?(0)
\C not allowed in lookbehind assertion
PCRE does not support \L, \l, \N{name}, \U, or \u
number after (?C is > 255
closing ) for (?C expected
recursive call could loop indefinitely
unrecognized character after (?P
syntax error in subpattern name (missing terminator)
two named subpatterns have the same name
invalid UTF-8 string
support for \P, \p, and \X has not been compiled
malformed \P or \p sequence
unknown property name after \P or \p
subpattern name is too long (maximum 32 characters)
too many named subpatterns (maximum 10000)
repeated subpattern is too long
octal value is greater than \377 in 8-bit non-UTF-8 mode
internal error: overran compiling workspace
internal error: previously-checked referenced subpattern not found
DEFINE group contains more than one branch
repeating a DEFINE group is not allowed
inconsistent NEWLINE options
\g is not followed by a braced, angle-bracketed, or quoted name/number or by a plain number
a numbered reference must not be zero
an argument is not allowed for (*ACCEPT), (*FAIL), or (*COMMIT)
(*VERB) not recognized
number is too big
subpattern name expected
digit expected after (?+
] is an invalid data character in JavaScript compatibility mode
different names for subpatterns of the same number are not allowed
(*MARK) must have an argument
this version of PCRE is not compiled with Unicode property support
\c must be followed by an ASCII character
\k is not followed by a braced, angle-bracketed, or quoted name
internal error: unknown opcode in find_fixedlength()
\N is not supported in a class
too many forward references
disallowed Unicode code point (>= 0xd800 && <= 0xdfff)
invalid UTF-16 string
Unknown zip result code
Success
Can't create/open file
Failed to allocate memory
Error writing to file
Entry not found in the zip archive
Still more data to unzip
Zip archive is corrupt or not a zip archive
Error reading file
The entry is in a format that can't be decompressed by this Unzip add-on
Faulty arguments
Can get memory only of a memory-mapped zip
Not enough space allocated for memory zip
There was a previous error
Additions to the zip have already been ended
The anticipated size turned out wrong
Mixing creation and opening of zip
Trying to seek the unseekable
Tried to change mind, but not allowed
An internal error during flation
Password is incorrect
Aborted
CreateActCtxA
DeactivateActCtx
ActivateActCtx
RtlPcToFileHeader
AutoHotkey.MemoryModule.temp.manifest
RtlGetVersion
RemoveClipboardFormatListener
AddClipboardFormatListener
BlockInput
GetProcessId
Value
GetLayeredWindowAttributes
EnumDisplayMonitors
GetMonitorInfoW
localhost
GetDiskFreeSpaceExW
GetCursorInfo
Count
array
GetProcessImageFileNameW
CreateProcessWithLogonW
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetReadFileExA
InternetReadFile
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DllGetClassObject
AtlAxGetControl
VarType
DispatchType
DispatchIID
EventSink
Object
Prefix
AtlAxWinInit
StrCmpLogicalW
SetMenuInfo
RegDeleteKeyExW
IsWow64Process
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromFile
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
SetWindowTheme
EnableThemeDialogTexture
IsAppThemed
IsHungAppWindow
argument is not a compiled regular expression
argument is compiled in 8 bit mode
internal error: opcode not recognized
internal error: missing capturing bracket
failed to get memory
Error text not found (please report)
DEFINE
UTF16)
NO_START_OPT)
CRLF)
ANYCRLF)
BSR_ANYCRLF)
BSR_UNICODE)
8M%iB
WSOCK32.dll
joyGetPosEx
mciSendStringW
mixerOpen
mixerGetDevCapsW
mixerGetLineInfoW
mixerClose
mixerGetLineControlsW
mixerGetControlDetailsW
mixerSetControlDetails
waveOutGetVolume
waveOutSetVolume
joyGetDevCapsW
WINMM.dll
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
VERSION.dll
InitCommonControlsEx
ImageList_GetIconSize
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW
COMCTL32.dll
HashData
SHLWAPI.dll
CryptStringToBinaryW
CryptBinaryToStringA
CryptStringToBinaryA
CRYPT32.dll
GetModuleBaseNameW
GetModuleFileNameExW
PSAPI.DLL
MulDiv
GetTickCount
Sleep
SetCurrentDirectoryW
OutputDebugStringW
GetCPInfo
FindResourceW
GetModuleHandleA
GlobalAlloc
GetModuleFileNameA
_lread
_lopen
_lclose
GlobalFree
GetProcAddress
GetCurrentThread
CheckRemoteDebuggerPresent
GetCurrentProcess
GetProcessTimes
GetSystemTimeAsFileTime
VirtualProtect
InitializeCriticalSection
SetErrorMode
GetCurrentDirectoryW
LoadLibraryW
AddVectoredExceptionHandler
GlobalLock
GlobalUnlock
GetEnvironmentVariableW
FreeLibrary
WideCharToMultiByte
GetSystemDirectoryA
LoadLibraryA
GetCurrentThreadId
SuspendThread
ResumeThread
EnterCriticalSection
LeaveCriticalSection
OpenThread
lstrcmpiW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
GetLastError
GetModuleHandleW
MultiByteToWideChar
SystemTimeToFileTime
SetFilePointerEx
ReadFile
SetFilePointer
GlobalSize
lstrcpyA
lstrlenA
lstrcmpiA
lstrcmpA
LocalFileTimeToFileTime
CreateDirectoryA
CreateDirectoryW
IsBadReadPtr
CreateFileW
CreateFileA
WriteFile
SetFileTime
DuplicateHandle
LoadResource
LockResource
SizeofResource
GetCurrentDirectoryA
FileTimeToSystemTime
GetLocalTime
GetFileInformationByHandle
GetFileSize
lstrlenW
FindFirstFileW
FindNextFileW
FindClose
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SetLastError
VirtualAlloc
VirtualFree
GetTempPathA
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
HeapDestroy
GetCommandLineW
WaitForSingleObject
GetThreadLocale
VirtualQuery
HeapCreate
FlushInstructionCache
GetVersionExW
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
GetFileAttributesW
OpenProcess
GetCurrentProcessId
GetFullPathNameW
LocalFree
FileTimeToLocalFileTime
SetEnvironmentVariableW
MoveFileW
CreateProcessW
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
TerminateProcess
SetPriorityClass
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceW
SetVolumeLabelW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
DeleteFileW
CopyFileW
SetFileAttributesW
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetWindowsDirectoryW
GetTempPathW
GetShortPathNameW
TryEnterCriticalSection
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
RemoveVectoredExceptionHandler
ExitProcess
ExitThread
KERNEL32.dll
IsClipboardFormatAvailable
CharUpperW
GetDlgCtrlID
GetParent
GetScrollInfo
SetTimer
GetMessageW
GetForegroundWindow
GetWindowThreadProcessId
GetClassNameW
GetFocus
PeekMessageW
KillTimer
TranslateAcceleratorW
GetKeyState
GetWindowLongW
IsWindowEnabled
SendMessageW
WindowFromPoint
IsDialogMessageW
ScreenToClient
SetWindowLongW
CountClipboardFormats
ShowWindow
TranslateMessage
DispatchMessageW
IsWindow
EndDialog
FindWindowW
PostMessageW
EmptyClipboard
SetClipboardData
CloseClipboard
GetClipboardFormatNameW
GetClipboardData
OpenClipboard
MessageBoxW
GetDC
ReleaseDC
CharLowerW
CallNextHookEx
GetKeyboardLayout
ToUnicodeEx
IsCharAlphaNumericW
IsCharLowerW
IsCharUpperW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
SendMessageTimeoutW
PostQuitMessage
RegisterHotKey
UnregisterHotKey
SendInput
AttachThreadInput
GetAsyncKeyState
GetCursorPos
GetKeyboardState
SetKeyboardState
keybd_event
GetSystemMetrics
mouse_event
GetWindowTextW
VkKeyScanExW
MapVirtualKeyExW
MapVirtualKeyW
IsCharAlphaW
DestroyWindow
DestroyIcon
UnregisterClassW
DestroyAcceleratorTable
LoadCursorW
RegisterClassExW
CreateWindowExW
LoadAcceleratorsW
SetClipboardViewer
ChangeClipboardChain
LoadImageW
CharLowerA
CheckMenuItem
GetMenu
IsWindowVisible
SetWindowTextW
GetIconInfo
SetRect
DrawTextW
AdjustWindowRectEx
SystemParametersInfoW
GetClientRect
GetWindowRect
GetQueueStatus
MoveWindow
EnumChildWindows
SetActiveWindow
GetGUIThreadInfo
SetFocus
SetWindowRgn
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
GetWindowTextLengthW
EnumWindows
IsZoomed
IsIconic
RegisterWindowMessageW
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcW
SetForegroundWindow
DialogBoxParamW
SendDlgItemMessageW
GetDlgItem
SetDlgItemTextW
MessageBeep
ClientToScreen
GetCursor
GetLastInputInfo
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetScrollInfo
ScrollWindow
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetParent
GetClassInfoExW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongW
DefDlgProcW
CallWindowProcW
CheckRadioButton
IntersectRect
PtInRect
CreateDialogIndirectParamW
CreateAcceleratorTableW
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
CreateIconIndirect
GetDesktopWindow
CopyImage
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
USER32.dll
GetDeviceCaps
DeleteObject
CreateFontW
CreateSolidBrush
CreateDCW
GetStockObject
SelectObject
GetTextFaceW
GetTextMetricsW
GetObjectW
DeleteDC
CreateEllipticRgn
CreateRoundRectRgn
CreateRectRgn
CreatePolygonRgn
CreateCompatibleDC
GetDIBits
GetSystemPaletteEntries
CreateCompatibleBitmap
BitBlt
GetPixel
SetBkColor
SetTextColor
ExcludeClipRect
GetClipRgn
FillRgn
GetClipBox
GetCharABCWidthsW
SetBkMode
CreatePatternBrush
SetBrushOrgEx
EnumFontFamiliesExW
CreateDIBSection
GdiFlush
GDI32.dll
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
COMDLG32.dll
RegConnectRegistryW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
GetUserNameW
OpenSCManagerW
LockServiceDatabase
UnlockServiceDatabase
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
ADVAPI32.dll
DragQueryFileW
DragFinish
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW
SHGetMalloc
SHGetDesktopFolder
SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
SHEmptyRecycleBinW
DragQueryPoint
ExtractIconW
SHELL32.dll
OleInitialize
CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromString
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal
ole32.dll
OLEAUT32.dll
_i64tow
_wcsicmp
isxdigit
_wcstoi64
_wtoi64
malloc
??3@YAXPAX@Z
realloc
_wcsnicmp
__argc
__wargv
_swprintf
??2@YAPAXI@Z
wcsrchr
setvbuf
__iob_func
_purecall
wcschr
_stricmp
sprintf
_strnicmp
_itoa
sprintf_s
_atoi64
memmove
strncmp
_wtoi
calloc
strstr
strchr
_wfopen
strtol
fgets
fread
__RTtypeid
strcpy_s
_ultoa
ftell
strtoul
strcat_s
fseek
_isctype
fclose
strncpy_s
wcsstr
??_U@YAPAXI@Z
qsort
??_V@YAXPAX@Z
_itow
wcstol
isdigit
_beginthreadex
wcsncpy
_snwprintf
iswspace
_wtof
iswdigit
wcsncmp
tolower
toupper
iswxdigit
fwprintf
fputws
_vsnwprintf
_wcstoui64
_ultow
towupper
_wcsupr
_wcsdup
_scwprintf
wcstoul
wcstombs
fwrite
_wsplitpath
wcstod
wcscspn
_msize
_expand
MSVCR100.dll
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_vsnprintf
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
memcpy
memset
__RTDynamicCast
__CxxFrameHandler3
_except_handler3
IsProcessorFeaturePresent
AutoHotkey.exe
ADDFILE
ADDSCRIPT
AHKASSIGN
AHKEXEC
AHKEXECUTELINE
AHKFINDFUNC
AHKFINDLABEL
AHKFUNCTION
AHKGETVAR
AHKISUNICODE
AHKLABEL
AHKPAUSE
AHKPOSTFUNCTION
AddFile
AddScript
Addfile
Addscript
AhkAssign
AhkExec
AhkExecuteLine
AhkExecuteline
AhkFindFunc
AhkFindLabel
AhkFindfunc
AhkFindlabel
AhkFunction
AhkGetVar
AhkGetvar
AhkIsUnicode
AhkIsunicode
AhkLabel
AhkPause
AhkPostFunction
AhkPostfunction
Ahkassign
Ahkexec
AhkexecuteLine
Ahkexecuteline
AhkfindFunc
AhkfindLabel
Ahkfindfunc
Ahkfindlabel
Ahkfunction
AhkgetVar
Ahkgetvar
AhkisUnicode
Ahkisunicode
Ahklabel
Ahkpause
AhkpostFunction
Ahkpostfunction
addFile
addScript
ahkExec
ahkExecuteLine
ahkFindFunc
ahkFindLabel
ahkFunction
ahkIsUnicode
ahkLabel
ahkPause
ahkPostFunction
ahkassign
ahkgetvar
addfile
addscript
ahkAssign
ahkExecuteline
ahkFindfunc
ahkFindlabel
ahkGetVar
ahkGetvar
ahkIsunicode
ahkPostfunction
ahkexec
ahkexecuteLine
ahkexecuteline
ahkfindFunc
ahkfindLabel
ahkfindfunc
ahkfindlabel
ahkfunction
ahkgetVar
ahkisUnicode
ahkisunicode
ahklabel
ahkpause
ahkpostFunction
ahkpostfunction
.?AVtype_info@@
.?AVTextFile@@
.?AVTextStream@@
.?AUIDebugProperties@@
.?AUPropertyWriter@Debugger@@
.?AVCStringTCharFromUTF8@@
.?AVCStringUTF8FromWChar@@
.?AV?$CKuStringT@_WVCKuStringUtilW@@@@
.?AV?$CKuStringT@DVCKuStringUtilA@@@@
JJJJKRJJJJOLJJJJJJJJUE@JJJEYMFJ]JJJJJJJJJJJJJJacgNJJkmJJEmJJDEJJ
.?AUIObject@@
.?AVObject@@
.?AVCriticalObject@@
.?AVStruct@@
.?AVComObject@@
.?AVTextMem@@
.?AVExprOpFunc@@
.?AVObjectBase@@
.?AVProperty@@
.?AVLabel@@
.?AUIUnknown@@
.?AUIDispatch@@
.?AUIObjectComCompatible@@
.?AVFunc@@
""""&*.266::>>>CCCCCHMMVV$
.?AVCStringCharFromWChar@@
.?AVCStringWCharFromChar@@
.?AVDynaToken@@
.?AVRegExMatchObject@@
.?AVEnumBase@@
.?AVComArrayEnum@@
.?AVComEnum@@
.?AVComEvent@@
.?AVBoundFunc@@
.?AVMetaObject@@
.?AVEnumerator@Object@@
.?AVEnumerator@Struct@@
.?AVFileObject@@
DJKY^
2x]A@2
NQ*y[1
x[~N2
QZUF+
;X)U*
4|,@+
lb!?'E
""""""""""" 
fffffffff
5-l*:3
;0Xk2
9);7V
,Aemo<
my>|_
->]3^j
#)QK@
'Ku}q\W:
,:ia2
w-o_0
X!$U-
@%.yw
#m8)w
q`b0]
&`g\i7
`cS@z
he9{>q
Dgip)
\E<ps/
g>|:+
d42Ygu
`W`G_
~}j0/
.V7-\!Y
OgcrR
Q6ZSv?
#O8`#
0`^C^
g\BfmO_
k#\&H?
zVn |
1-N9]
J#0Xd
`cS@z
]O E;i
Cj~Gr0^
W9:**
xF/EWv
ly:jRD
wBQi4+w
?5cQY
jjjjh
N<<>>
#32770
SysTreeView32
SysListView32
OnClipboardChange
Timer
OnMessage
E4847ED08866458F8DD35F94B37001C0
/restart
/force
/ErrorStdOut
/iLib
/Execute
/Debug
advapi32.dll
AutoHotkey
Note: To avoid this message, see #SingleInstance in the help file.
Could not close the previous instance of this script.  Keep waiting?
Clipboard
I%0.6f
Can't open clipboard for reading.
GlobalLock
GlobalAlloc
Can't open clipboard for writing.
EmptyClipboard
SetClipboardData
Link Source
ObjectLink
OwnerLink
Native
Embed Source
MSDEVColumnSelect
MSDEVLineSelect
Object(
Continue running the script without the debugger?
Failed to connect to an active debugger client.
DBGP_IDEKEY
DBGP_COOKIE
Continue running the script without the debugger?
>%s: Object(0x%p)
 <= ComObject(0x%04hX, 0x%I64X)
@Out of memory.
Too few parameters passed to function.
Right
NumpadEnter
Launch_App2
Launch_App1
Launch_Media
Launch_Mail
Media_Play_Pause
Media_Stop
Media_Prev
Media_Next
Volume_Up
Volume_Down
Volume_Mute
Browser_Home
Browser_Favorites
Browser_Search
Browser_Stop
Browser_Refresh
Browser_Forward
Browser_Back
XButton2
XButton1
MButton
RButton
LButton
Shift
RShift
LShift
RCtrl
LCtrl
RControl
LControl
AppsKey
CtrlBreak
PrintScreen
NumpadPgDn
NumpadPgUp
NumpadEnd
NumpadHome
NumpadRight
NumpadLeft
NumpadDown
NumpadUp
NumpadClear
NumpadIns
NumpadDel
Enter
Backspace
Escape
CapsLock
ScrollLock
Numlock
NumpadDot
NumpadSub
NumpadAdd
NumpadDiv
NumpadMult
Numpad9
Numpad8
Numpad7
Numpad6
Numpad5
Numpad4
Numpad3
Numpad2
Numpad1
Numpad0
WinGetActiveStats
WinGetActiveTitle
IfLessOrEqual
IfLess
IfGreaterOrEqual
IfGreater
IfNotEqual
IfEqual
EnvDiv
EnvMult
EnvSub
EnvAdd
SetEnv
FileEncoding
Shutdown
ExitApp
GuiControlGet
GuiControl
Reload
ListHotkeys
ListVars
ListLines
KeyHistory
SetStoreCapslockMode
SetCapslockState
SetScrollLockState
SetNumlockState
BlockInput
DetectHiddenText
DetectHiddenWindows
StringCaseSense
AutoTrim
Pause
Suspend
FormatTime
SetFormat
SetTitleMatchMode
SetBatchLines
SetControlDelay
SetWinDelay
SetMouseDelay
SetKeyDelay
OutputDebug
SetRegView
RegDelete
RegWrite
RegRead
IniDelete
IniWrite
IniRead
FileCreateShortcut
FileGetShortcut
FileSelectFolder
FileSelectFile
SetWorkingDir
FileGetVersion
FileGetSize
FileSetTime
FileGetTime
FileSetAttrib
FileGetAttrib
FileRemoveDir
FileCreateDir
FileMoveDir
FileCopyDir
FileMove
FileCopy
FileInstall
FileRecycleEmpty
FileRecycle
FileDelete
FileReadLine
FileRead
FileAppend
SoundPlay
SoundBeep
SoundSetWaveVolume
SoundGetWaveVolume
SoundSet
SoundGet
DriveGet
Drive
DriveSpaceFree
GroupClose
GroupDeactivate
GroupActivate
GroupAdd
ImageSearch
PixelSearch
PixelGetColor
SendMessage
PostMessage
SysGet
WinGetText
WinGetPos
WinGet
WinGetClass
WinGetTitle
WinSetTitle
WinSet
Process
WinMenuSelectItem
WinMove
WinKill
WinClose
WinMinimizeAllUndo
WinMinimizeAll
WinShow
WinHide
WinRestore
WinMaximize
WinMinimize
WinWaitNotActive
WinWaitActive
WinWaitClose
WinWait
WinActivateBottom
WinActivate
Throw
Finally
Catch
ContinueIf
Continue
BreakIf
Break
Until
While
Return
Thread
Critical
SetTimer
OnExit
Gosub
Random
Sleep
KeyWait
ClipWait
StatusBarWait
StatusBarGetText
MouseGetPos
MouseClickDrag
MouseClick
SetDefaultMouseSpeed
CoordMode
SendLevel
SendMode
ControlGet
Control
ControlGetText
ControlSetText
ControlGetFocus
ControlFocus
ControlGetPos
ControlMove
ControlClick
ControlSendRaw
ControlSend
SendEvent
SendPlay
SendInput
SendRaw
GetKeyState
URLDownloadToFile
RunWait
RunAs
EnvUpdate
EnvSet
EnvGet
SplitPath
StringSplit
StringReplace
StringGetPos
StringLen
StringUpper
StringLower
StringTrimRight
StringTrimLeft
StringMid
StringRight
StringLeft
Transform
TrayTip
SplashImage
SplashTextOff
SplashTextOn
InputBox
MsgBox
IfMsgBox
IfNotExist
IfExist
IfNotInString
IfInString
IfWinNotActive
IfWinActive
IfWinNotExist
IfWinExist
not between
between
is not
not contains
contains
not in
Static
Insert
Delete
Click
Progress
Hotkey
MouseMove
Input
WheelUp
WheelDown
WheelLeft
WheelRight
ToolTip
Space
#32771
#32768
AHK Keybd
AHK Mouse
Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.
-------------------------------------------------------------------------------------------------------------
not found
UseErrorLevel
Exist
Toggle
AltTab
ShiftAltTab
AltTabMenu
AltTabAndMenu
AltTabMenuDismiss
(see #MaxHotkeysPerInterval in the help file)
IfWin
Active
Parameter #3 must be blank in this case.
Parameter #2 must match an existing #If expression.
Target label does not exist.
Parameters of hotkey functions must be optional.
Nonexistent hotkey.
Nonexistent hotkey variant (IfWin).
Max hotkeys.
The AltTab hotkey "%s" must specify which key (L or R).
The AltTab hotkey "%s" must have exactly one modifier/prefix.
"%s" is not allowed as a prefix key.
"%s" is not a valid key name.
k-hook
m-hook
2-hooks
joypoll
%i-%i
{Raw}
Hotstring max abbreviation length is 40.
RIGHT
MIDDLE
user32
{Blind}
{Click
^+!#{}
LWin 
RWin 
LShift 
RShift 
LCtrl 
RCtrl 
LAlt 
RAlt 
sc%03X
vk%02X
ALTDOWN
ALTUP
SHIFTDOWN
SHIFTUP
CTRLDOWN
CONTROLDOWN
CTRLUP
CONTROLUP
LWINDOWN
LWINUP
RWINDOWN
RWINUP
\P{Xsp}
\p{L}
\P{Nd}
\p{Nd}
\p{Xsp}
\P{Xwd}
\p{Xwd}
\p{Ll}
\p{Lu}
\p{Xan}
\p{Xps}
\P{L}
\P{Ll}
\P{Lu}
\P{Xan}
\P{Xps}
kernel32.dll
ntdll.dll
%u.%u.%u
YWeek
WorkingDir
WinDir
WinDelay
UserName
TitleMatchModeSpeed
TitleMatchMode
TimeSinceThisHotkey
TimeSincePriorHotkey
TimeIdlePhysical
TimeIdle
TickCount
ThisMenuItemPos
ThisMenuItem
ThisMenu
ThisLabel
ThisHotkey
ThisFunc
StoreCapslockMode
StartupCommon
Startup
StartMenuCommon
StartMenu
ScriptStruct
ScriptName
ScriptHwnd
ScriptFullPath
ScriptDir
ScreenWidth
ScreenHeight
ScreenDPI
RegView
PtrSize
ProgramsCommon
Programs
PriorKey
PriorHotkey
OSVersion
OSType
NumBatchLines
NowUTC
MyDocuments
MouseDelayPlay
MouseDelay
ModuleHandle
MemoryModule
LoopRegType
LoopRegTimeModified
LoopRegSubKey
LoopRegName
LoopRegKey
LoopReadLine
LoopFileTimeModified
LoopFileTimeCreated
LoopFileTimeAccessed
LoopFileSizeMB
LoopFileSizeKB
LoopFileSize
LoopFileShortPath
LoopFileShortName
LoopFileName
LoopFileLongPath
LoopFileFullPath
LoopFileExt
LoopFileDir
LoopFileAttrib
LoopField
LineNumber
LineFile
LastError
Language
KeyDurationPlay
KeyDuration
KeyDelayPlay
KeyDelay
IsUnicode
IsSuspended
IsPaused
IsMini
IsDll
IsCritical
IsCompiled
IsAdmin
Is64bitOS
IPAddress4
IPAddress3
IPAddress2
IPAddress1
Index
IconTip
IconNumber
IconHidden
IconFile
GuiWidth
GuiHeight
GuiEvent
GuiControlEvent
GlobalStruct
FormatInteger
FormatFloat
ExitReason
EventInfo
EndChar
DllPath
DllDir
DesktopCommon
Desktop
DefaultTreeView
DefaultMouseSpeed
DefaultListView
DefaultGui
Cursor
CoordModeToolTip
CoordModePixel
CoordModeMouse
CoordModeMenu
CoordModeCaret
ControlDelay
ComputerName
CaretY
CaretX
BatchLines
AppDataCommon
AppData
AhkVersion
AhkPath
AhkDir
ProgramFiles
False
ComSpec
ClipboardAll
%s[%Iu of %Iu]: %-1.60s%s
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
REG_SZ
REG_EXPAND_SZ
REG_MULTI_SZ
REG_DWORD
REG_BINARY
Default
Master
Speakers
Headphones
Digital
Microphone
Synth
Telephone
PCSpeaker
Analog
Volume
OnOff
Loudness
StereoEnh
BassBoost
QSoundPan
Treble
Equalizer
RegEx
MonitorCount
MonitorPrimary
Monitor
MonitorWorkArea
MonitorName
Deref
Round
Floor
BitAnd
BitOr
BitXOr
BitNot
BitShiftLeft
BitShiftRight
Rename
Check
Uncheck
ToggleCheck
Enable
Disable
ToggleEnable
Standard
NoStandard
Color
NoDefault
DeleteAll
NoIcon
MainWindow
NoMainWindow
Submit
Cancel
Minimize
Maximize
Restore
Destroy
Margin
ListView
TreeView
Flash
MoveDraw
Focus
Choose
ChooseString
FocusV
Enabled
Visible
Button
Checkbox
Radio
DropDownList
ComboBox
ListBox
UpDown
Slider
GroupBox
Picture
DateTime
MonthCal
StatusBar
ActiveX
Custom
Priority
Interrupt
NoTimers
Close
WaitClose
Style
ExStyle
ShowDropDown
HideDropDown
TabLeft
TabRight
EditPaste
Checked
FindString
Choice
LineCount
CurrentLine
CurrentCol
Selected
Eject
Unlock
Label
FileSystem
SetLabel:
Serial
Status
StatusCD
Capacity
Trans
Transparent
TransColor
AlwaysOnTop
Topmost
Bottom
Redraw
Region
IDLast
ProcessName
ProcessPath
Count
MinMax
ControlList
AlwaysOn
AlwaysOff
Locale
Permit
Mouse
SendAndMouse
MouseMoveOff
Event
ThenEvent
ThenPlay
CANCEL
ABORT
IGNORE
RETRY
CONTINUE
TRYAGAIN
Timeout
Screen
Relative
Window
Client
Pixel
Caret
Integer
Float
Number
Digit
Xdigit
Alnum
Alpha
Upper
Lower
UTF-8
UTF-8-RAW
UTF-16
UTF-16-RAW
No tray mem
AutoHotkey2
status AHK_PlayMe mode
close AHK_PlayMe
\AutoHotkey.chm
"ms-its:%s::/docs/Welcome.htm"
hh.exe
AutoHotkey v1.1.25.02
%s\%s - %s
RegClass
Shell_TrayWnd
CreateWindow
Lucida Console
Consolas
Auto-execute
notepad.exe
Could not open script.
/restart "%s"
The program will exit.
ErrorLevel
<>=/|^,:*&~!()[]{}+-?."'\;`
WHILE
Class
#CommentFlag
<>=/|^,:
<>=/|^,:.+-*&!?~
Continuation section too long.
LTrim
RTrim
Missing ")"
Functions cannot contain functions.
Missing "{"
Not a valid method, class or property definition.
Not a valid property getter/setter.
Hotkeys/hotstrings are not allowed inside functions.
IfWin should be #IfWin.
This hotstring is missing its abbreviation.
Duplicate hotkey.
Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.
This line does not contain a recognized action.
*%s::
if not GetKeyState("%s")
{LCtrl up}
{RCtrl up}
{Blind}%s%s{%s DownTemp}
*%s up::
{Blind}{%s Up}
Missing "}"
Too many includes.
#Include
Script
%s file "%s" cannot be opened.
Could not extract script from EXE.
#IncludeAgain
Parameter #1 required
Function library not found.
%A_ScriptDir%
%A_LineFile%
%A_AppData%
A_AppData
%A_AppDataCommon%
A_AppDataCommon
#NoEnv
#NoTrayIcon
#Persistent
#SingleInstance
Force
Ignore
#InstallKeybdHook
#InstallMouseHook
#UseHook
#IfTimeout
#IfWin
Literal commas and percent signs must be escaped (e.g. `%)
#Hotstring
EndChars
NoMouse
#HotkeyModifierTimeout
#HotkeyInterval
#MaxHotkeysPerInterval
#MaxThreadsPerHotkey
#MaxThreadsBuffer
#MaxThreads
#ClipboardTimeout
#LTrim
#WinActivateForce
#ErrorStdOut
#MaxMem
#KeyHistory
Parameter #1 invalid.
#EscapeChar
#DerefChar
#Delimiter
#MenuMaskKey
#InputLevel
#WarnContinuableException
#Warn
UseUnsetLocal
UseUnsetGlobal
UseEnv
LocalSameAsGlobal
StdOut
Parameter #2 invalid.
#DllImport
Duplicate label.
Global
Local
Global variables must not be declared in this function.
Local variables must not be declared in this function.
Parameters must not be declared.
Duplicate declaration.
Declaration conflicts with existing var.
Built-in variables must not be declared.
Too many declarations.
BETWEEN requires the word AND.
:+-*/|&^.
<>=/|^,:*&~!()[]{}+-?."
Invalid hotkey.
This "For" is missing its "in".
Syntax error or too many variables in "For" statement.
"%s" requires at least %d parameter%s.
"%s" requires that parameter #%u be non-blank.
Parse
Unexpected %
Not allowed as an output variable.
default
<>=/|^,:*&~!()[]{}"
<>=/|^,:*&~!()[]{}+-?
Missing close-quote
Quote marks are required around this key.
<>=/|^,:*&~!()[]{}+-?.
The leftmost character above is illegal in an expression.
Ambiguous or invalid use of "."
Too many var/func refs.
Parameter #2 required
Parameter #3 invalid.
Divide by zero
Files
Parameter #4 invalid.
Invalid Gui name.
Parameter #4 must be blank in this case.
Parameter #2 and beyond should be omitted in this case.
Parameter #3 and beyond should be omitted in this case.
Return's parameter should be blank except inside a function.
Parameter #5 invalid.
Parameters 3 through 7 must not be blank.
Parameter #8 invalid.
X & Y must be either both absent or both present.
Parameter #6 invalid.
Parameter #7 invalid.
Parameter #4 and 5 required.
Must not contain variables.
+-^RASHNOT
Parameter #3 must be an integer in this case.
Parameter #3 must be a number in this case.
Parameter #3 must be a positive integer in this case.
Parameter #4 must be an integer in this case.
Parameter #4 must be a positive integer in this case.
Parameter #4 must be blank or an integer in this case.
Parameter #4 must be a number in this case.
Supported only for the tray menu
Parameter #4 and beyond should be omitted in this case.
Parameter #3 must not be blank in this case.
Parameter #2 must not be blank in this case.
Parameter #2 must be blank in this case.
Parameter #1 must not be blank in this case.
LBNAHR
If present, parameter #3 must be a positive number in this case.
Requires at least one of its window parameters.
Parameter #3 required
Parameter #9 must be blank.
A label must not point to an ELSE or UNTIL or CATCH.
This parameter contains a variable name missing its ending percent sign.
Invalid `%.
Empty variable reference (%%).
Variable name too long.
%s.%s
Duplicate function definition.
value
Too many params.
ByRef
Blank parameter
Duplicate parameter.
Expected ":="
Missing comma
false
Unsupported parameter default.
Parameter default required.
Invalid function declaration.
A label must not point to a function.
This class definition is nested too deep.
extends
Syntax error in class definition.
Missing class name.
__Class
Invalid class name.
Full class name is too long.
Duplicate class definition.
Missing "]"
%.*s.Get%s
Invalid class variable declaration.
Unknown class var.
%s.%.*s := %.*s, 
Declaration too long.
__Init
__Init()
base.__Init()
Unknown class.
C974C3B7677A402D93B047DA402587C7
\Lib\
\AutoHotkey\Lib\
Lib.lnk
USHORT
INT64
SHORT
FLOAT
DOUBLE
GetNext
GetCount
GetText
Modify
InsertCol
ModifyCol
DeleteCol
SetImageList
GetParent
GetChild
GetPrev
GetSelection
Create
SB_SetText
SB_SetParts
SB_SetIcon
StrLen
SubStr
InStr
RegExMatch
RegExReplace
StrReplace
StrSplit
GetKey
State
Format
StrGet
StrPut
NumGet
NumPut
IsLabel
IsFunc
IsByRef
DllCall
Struct
Sizeof
CriticalObject
FindFunc
FindLabel
Alias
getTokenValue
CacheEnable
Getvar
ResourceLoadLibrary
MemoryLoadLibrary
MemoryCallEntryPoint
MemoryGetProcAddress
MemoryFreeLibrary
MemoryFindResource
MemorySizeOfResource
MemoryLoadResource
MemoryLoadString
DynaCall
CryptAES
ZipRawMemory
UnZipRawMemory
ZipCreateFile
ZipCreateBuffer
ZipCloseFile
ZipCloseBuffer
ZipAddFile
ZipAddFolder
ZipAddBuffer
ZipOptions
ZipInfo
UnZip
UnZipBuffer
VarSetCapacity
FileExist
WinExist
WinActive
RegisterCallback
IsObject
InsertAt
Remove
RemoveAt
Length
MinIndex
MaxIndex
HasKey
GetCapacity
SetCapacity
GetAddress
NewEnum
Clone
BindMethod
AddRef
Release
RawSet
Array
FileOpen
ComObj
Connect
Error
Value
Flags
Query
Exception
MenuGetHandle
MenuGetName
LoadPicture
Function name too long.
Invalid method name.
This dynamically built variable name is too long.  If this variable was not intended to be dynamic, remove the % symbols from it.
This dynamic variable is blank. If this variable was not intended to be dynamic, remove the % symbols from it.
Illegal parameter name.
Blank group name.
Group name too long.
Illegal group name.
Call to nonexistent function.
Unexpected function
Unexpected "}"
Break/Continue must be enclosed by a Loop.
Jumps cannot exit a FINALLY block.
ELSE with no matching IF
UNTIL with no matching LOOP
CATCH with no matching TRY
FINALLY with no matching TRY or CATCH
Cannot jump from inside a function to outside.
Expression too long
Unexpected "{"
Object
+-*&~!
This character is not allowed here.
Unexpected ")"
Unexpected "]"
Too many parameters passed to function.
Missing "key:" in object literal.
Unsupported method call syntax.
A ":" is missing its "?"
Missing ")" before ":"
Missing "]" before ":"
Missing "}" before ":"
An exception was thrown.
A "return" must be encountered prior to this "}".
%s\%s
_NewEnum
%s%s%s
ahk_group
Environment
ERROR
Press OK to continue.
%%%s%s%s
ahk_default
Press [F5] to refresh.
%03u: 
STILL WAITING (%0.2f): 
if %s %s %s and %s
%s%s %s %s
For %s,%s in %s
 (%0.2f)
Message
Extra
Out of memory.  The current thread will exit.
The current thread will exit.
The script was not reloaded; the old version will remain in effect.
The program will exit.
Continue running the script?
For more details, read the documentation for #Warn.
 in #include file "%s"
Warning
Critical Error
Error at line %u
Error: 
Unhandled exception.
The thread has exited.
local
global
static
 with same name as a global
%s  (a %s variable%s)
This variable has not been assigned a value.
%s  (in function %s)
This local variable has the same name as a global variable.
Static Variables for %s()%s
Local Variables for %s()%s
%sGlobal Variables (alphabetical)%s
 (preempted: they will resume when the current thread finishes)
Key History has been disabled via #KeyHistory 0.
explore
print
properties
System verbs unsupported with RunAs.
String too long.
%s %s
.exe.bat.com.cmd.hta
Verb: <%s>
Launch Error (possibly related to RunAs):
Failed attempt to launch program or document:
Params: <%-0.400s%s>
UpArrow
SizeWE
SizeNWSE
SizeNS
SizeNESW
SizeAll
IBeam
Cross
Arrow
AppStarting
InputThenPlay
thorn
yacute
ucirc
uacute
ugrave
oslash
divide
otilde
ocirc
oacute
ograve
ntilde
icirc
iacute
igrave
ecirc
eacute
egrave
ccedil
aelig
aring
atilde
acirc
aacute
agrave
szlig
THORN
Yacute
Ucirc
Uacute
Ugrave
Oslash
times
Otilde
Ocirc
Oacute
Ograve
Ntilde
Icirc
Iacute
Igrave
Ecirc
Eacute
Egrave
Ccedil
AElig
Aring
Atilde
Acirc
Aacute
Agrave
iquest
frac34
frac12
frac14
raquo
cedil
middot
micro
acute
plusmn
laquo
brvbar
curren
pound
iexcl
REG_DWORD_BIG_ENDIAN
REG_LINK
REG_RESOURCE_LIST
REG_FULL_RESOURCE_DESCRIPTOR
REG_RESOURCE_REQUIREMENTS_LIST
REG_QWORD
Max window number is 10.
DISPLAY
msctls_progress32
Max window number is 20.
tooltips_class32
M&quot;
&amp;
&OElig;
&oelig;
&Scaron;
&scaron;
&Yuml;
&fnof;
&circ;
&tilde;
&ndash;
&mdash;
&lsquo;
&rsquo;
&sbquo;
&ldquo;
&rdquo;
&bdquo;
&dagger;
&Dagger;
&bull;
&hellip;
&permil;
&lsaquo;
&rsaquo;
&euro;
&trade;
&#%d;
Match
EndKey:
NewInput
ahk_parent
Focused
msctls_statusbar321
0x%08X
0x%06X
s%sLeft
%sTop
%sRight
%sBottom
TaskbarCreated
AHK_ATTACH_DEBUGGER
Could not launch file:
The script could not be reloaded.
AU3_Spy.exe
AutoHotkey.chm
https://autohotkey.com
Could not open URL https://autohotkey.com in default browser.
InstallDir
SOFTWARE\AutoHotkey
The maximum number of InputBoxes has been reached.
The InputBox window could not be displayed.
Segoe UI
YDay0
ShortDate
LongDate
YearMonth
hHmst
Wkernel32
closed
set cdaudio door %s wait
open %s type cdaudio alias cd wait shareable
set cd door %s wait
close cd wait
\\.\%c:
CDRom
Removable
Fixed
Network
Ramdisk
Unknown
CDROM
RAMDisk
Ready
Invalid
NotReady
ReadOnly
status cdaudio mode
status cd mode
Invalid Control Type or Component Type
Can't Open Specified Mixer
Mixer Doesn't Support This Component Type
Mixer Doesn't Have That Many of That Component Type
Component Doesn't Support This Control Type
Can't Get Current Setting
Can't Change Setting
open "%s" alias AHK_PlayMe
play AHK_PlayMe
stopped
The maximum number of File Dialogs has been reached.
Select File - %s
%s%c%s%cAll Files (*.*)%c*.*%c
All Files (*.*)
Text Documents (*.txt)
*.txt
A Goto/Gosub must not jump into a block that doesn't enclose it.
Logoff
Single
1.1.25.02
WIN32_NT
WIN_XP
WIN_7
WIN_8.1
WIN_8
WIN_VISTA
WIN_2003
WIN_2000
%04hX
comspec
0x%Ix
Short
Int64
Double
gdi32
comctl32
This DynaCall requires a prior VarSetCapacity. The program is now unstable and will exit.
DllImport
This DllCall requires a prior VarSetCapacity. The program is now unstable and will exit.
CDecl
Pos%s
Len%s
Pos%d
Len%d
pcre_callout
Compile error %d at offset %d: %hs
-+0 #
diouxX
eEfgGaA
ULlTt
CreateTime
ModifyTime
AccessTime
Attributes
CompressedSize
UncompressedSize
%0.*f
Callback
Select
Center
Logical
NoSort
First
Expand
JoyPOV
JoyName
JoyButtons
JoyAxes
JoyInfo
psapi
@advapi32
RunAs: Missing advapi32.dll.
WCreateProcessWithLogonW.
0.0.0.0
Combo
wininet
The maximum number of Folder Dialogs has been reached.
Select Folder - %s
%u.%u.%u.%u
SeShutdownPrivilege
ComObjType
No valid COM object!
0x%08X - 
%s%ws
Memory limit reached (see #MaxMem in the help file).
ColClick
RightClick
DoubleClick
Normal
+LastFoundExist
Could not create window.
Menu does not exist.
NoHide
Exact
Tab name doesn't exist yet.
ahk_autosize
AutoHotkeyGUI
%sGui
ContextMenu
DropFiles
Too many controls.
Too many tab controls.
Too many status bars.
Button%s
ahk_dlg
SysLink
button
Combobox
Listbox
SysDateTimePick32
SysMonthCal32
msctls_hotkey32
msctls_updown32
msctls_trackbar32
SysTabControl32
AtlAxWin
A window class is required.
Can't create control.
Owner
Parent
Invalid or nonexistent owner or parent window.
Border
Scroll
HScroll
VScroll
Requires at least one of its output variables.
No object to invoke.
Caption
Delimiter
Disabled
LastFound
MaximizeBox
MinimizeBox
MinSize
MaxSize
OwnDialogs
Resize
SysMenu
Theme
ToolWindow
DPIScale
Invalid option.
Section
AltSubmit
Tabstop
NoTab
Group
Hidden
Background
The same variable cannot be used for more than one control.
Small
Report
ImageList
Check3
Multi
WantReturn
WantTab
WantCtrlA
WantF2
Lowercase
Uppercase
Password
Limit
Simple
Invert
NoTicks
TickInterval
Thick
Buddy
Vertical
Range
Smooth
Buttons
Unregistered window class.
This control type should not have an associated subroutine.
A control's variable must be global or static.
AutoSize
NoActivate
italic
underline
strike
Too many fonts.
Can't create font.
shlwapi
Can't load icon.
Nonexistent menu item.
Menu name too long.
Tray menu must not be deleted.
Can't delete menu (in use?).
Can't delete items (in use?).
Submenu does not exist.
Submenu must not contain its parent menu.
Too many menu items.
Menu item name too long.
Rename failed (name too long?).
BarBreak
o&Open
&Help
&Window Spy
&Reload This Script
&Edit This Script
&Suspend Hotkeys
&Pause Script
E&xit
__New
__Delete
__Call
__Set
__Get
MinParams
MaxParams
IsBuiltIn
IsVariadic
IsOptional
i)^(union|struct)?\s*(\{|\})\s*\K
 UInt 
struct
Invalid structure definition.
Bit field must not be a pointer
 bool 
Variable was not found in function.
Error dumping Object.
0123456789ABCDEF
 TCHAR LPTSTR LPCTSTR LPWSTR LPCWSTR WCHAR 
 CHAR LPSTR LPCSTR UCHAR 
 PTR SHORT INT INT8 INT16 INT32 INT64 CHAR ACCESS_MASK PVOID VOID HALF_PTR BOOL LONG LONG32 LONGLONG LONG64 USN INT_PTR LONG_PTR POINTER_64 POINTER_SIGNED SIGNED SSIZE_T WPARAM __int64 
 FLOAT DOUBLE PFLOAT PDOUBLE 
Offset
IsPointer
Encoding
GetPointer
CountOf
Empty pointer, dynamic Structure fields must be initialized manually first.
Write
RawRead
RawWrite
AtEOF
__Handle
Position
FileObject
Failed to open file.
 INT64 UINT64 DOUBLE __int64 LONGLONG LONG64 USN DWORDLONG DWORD64 ULONGLONG ULONG64 
 SIGNED UNSIGNED INT ACCESS_MASK UINT FLOAT INT32 LONG LONG32 HFILE HRESULT BOOL COLORREF DWORD DWORD32 LCID LCTYPE LGRPID LRESULT UINT32 ULONG ULONG32 PTR UPTR PINT8 PINT16 PINT32 INT_PTR LONG_PTR POINTER_64 POINTER_SIGNED SSIZE_T WPARAM PBOOL PBOOLEAN PBYTE PCHAR PCSTR PCTSTR PCWSTR PDWORD PDWORDLONG PDWORD_PTR PDWORD32 PDWORD64 PFLOAT PHALF_PTR DWORD_PTR HACCEL HANDLE HBITMAP HBRUSH HCOLORSPACE HCONV HCONVLIST HCURSOR HDC HDDEDATA HDESK HDROP HDWP HENHMETAFILE HFONT HGDIOBJ HGLOBAL HHOOK HICON HINSTANCE HKEY HKL HLOCAL HMENU HMETAFILE HMODULE HMONITOR HPALETTE HPEN HRGN HRSRC HSZ HWINSTA HWND LPARAM LPBOOL LPBYTE LPCOLORREF LPCSTR LPCTSTR LPCVOID LPCWSTR LPDWORD LPHANDLE LPINT LPLONG LPSTR LPTSTR LPVOID LPWORD LPWSTR PHANDLE PHKEY PINT PINT_PTR PINT32 PINT64 PLCID PLONG PLONGLONG PLONG_PTR PLONG32 PLONG64 POINTER_32 POINTER_UNSIGNED PSHORT PSIZE_T PSSIZE_T PSTR PTBYTE PTCHAR PTSTR PUCHAR PUHALF_PTR PUINT PUINT_PTR PUINT32 PUINT64 PULONG PULONGLONG PULONG_PTR PULONG32 PULONG64 PUSHORT PVOID PWCHAR PWORD PWSTR SC_HANDLE SC_LOCK SERVICE_STATUS_HANDLE SIZE_T UINT_PTR ULONG_PTR VOID 
 ATOM INT16 LANGID WCHAR WORD USAGE SHORT USHORT BYTE TCHAR HALF_PTR UHALF_PTR 
 CHAR UCHAR BOOLEAN BYTE INT8 
%04d%02d
%04d%02d%02d%02d%02d%02d
Black
Silver
White
Maroon
Purple
Fuchsia
Green
Olive
Yellow
hicon:
hbitmap:
gdiplus
uxtheme
dA_ScriptDir
%A_AhkPath%
A_AhkPath
%A_AhkDir%
A_AhkDir
%A_DllDir%
A_DllDir
%A_DllPath%
A_DllPath
Reference not allowed here, use & where possible. Only %A_AhkPath% %A_AhkDir% %A_DllPath% %A_DllDir% %A_ScriptDir% %A_AppData[Common]% can be used here.
^\s*[A-Fa-f0-9]+(:[A-Fa-f0-9]+)?\s*$
Could not commit memory for DllImport.
%0.17f
NONCONTINUABLE
CONTINUABLE
LineFile: %.260s
An object.
Invalid value.
An environment variable is being accessed; see #NoEnv.
variable
function
"%-1.300s"
The maximum number of MsgBoxes has been reached.
wahk_
parent
group
class
Program Manager
WINGETPIDLIST.AHK C974C3B7677A402D93B047DA402587C7 E4847ED08866458F8DD35F94B37001C0 F903E44B8A904483A1732BA84EA6191F FC2328B39C194A4788051A3B01B1E7D5
&File
Ctrl+R
Ctrl+E
&Window Spy
Pause
&Suspend Hotkeys
E&xit (Terminate Script)
&View
Ctrl+L
Ctrl+V
Ctrl+H
Ctrl+K
&Help
&Web Site
Dialog
MS Shell Dlg
Cancel
Prompt
VS_VERSION_INFO
StringFileInfo
040904B0
FileDescription
FileVersion
InternalName
LegalCopyright
OriginalFilename
ProductName
ProductVersion
VarFileInfo
Translation

防病毒引擎/厂商	病毒名/规则匹配	病毒库日期
Bkav	未发现病毒	20170822
MicroWorld-eScan	未发现病毒	20170821
nProtect	未发现病毒	20170822
CMC	未发现病毒	20170821
CAT-QuickHeal	未发现病毒	20170821
McAfee	未发现病毒	20170822
Cylance	未发现病毒	20170822
Zillya	未发现病毒	20170821
AegisLab	未发现病毒	20170822
TheHacker	未发现病毒	20170821
K7GW	未发现病毒	20170821
K7AntiVirus	未发现病毒	20170821
Invincea	未发现病毒	20170818
Baidu	未发现病毒	20170817
F-Prot	未发现病毒	20170822
Symantec	未发现病毒	20170822
ESET-NOD32	未发现病毒	20170822
TrendMicro-HouseCall	未发现病毒	20170822
Paloalto	未发现病毒	20170822
ClamAV	未发现病毒	20170822
Kaspersky	未发现病毒	20170821
BitDefender	未发现病毒	20170822
NANO-Antivirus	未发现病毒	20170822
SUPERAntiSpyware	未发现病毒	20170822
Tencent	未发现病毒	20170822
Ad-Aware	未发现病毒	20170822
Emsisoft	未发现病毒	20170822
Comodo	未发现病毒	20170822
F-Secure	未发现病毒	20170822
DrWeb	未发现病毒	20170822
VIPRE	未发现病毒	20170822
TrendMicro	未发现病毒	20170822
McAfee-GW-Edition	未发现病毒	20170822
Sophos	未发现病毒	20170821
SentinelOne	未发现病毒	20170806
Cyren	未发现病毒	20170822
Jiangmin	未发现病毒	20170822
Webroot	未发现病毒	20170822
Avira	未发现病毒	20170822
Fortinet	未发现病毒	20170822
Antiy-AVL	未发现病毒	20170822
Kingsoft	未发现病毒	20170822
Endgame	未发现病毒	20170821
Arcabit	未发现病毒	20170822
ViRobot	未发现病毒	20170822
ZoneAlarm	未发现病毒	20170822
Microsoft	未发现病毒	20170822
AhnLab-V3	未发现病毒	20170822
ALYac	未发现病毒	20170822
AVware	未发现病毒	20170822
MAX	未发现病毒	20170822
VBA32	未发现病毒	20170821
Malwarebytes	未发现病毒	20170822
WhiteArmor	未发现病毒	20170817
Panda	未发现病毒	20170821
Zoner	未发现病毒	20170822
Rising	未发现病毒	20170822
Yandex	未发现病毒	20170821
Ikarus	未发现病毒	20170821
GData	未发现病毒	20170822
AVG	未发现病毒	20170822
Avast	未发现病毒	20170822
CrowdStrike	未发现病毒	20170804
Qihoo-360	未发现病毒	20170822

进程树

info.exe id: 2076

搜索
info.exe (2076)

info.exe, PID: 2076, 上一级进程 PID: 1224

缺省注册表文件系统网络进程线程服务设备同步加密浏览器全部

下载PCAP包

访问主机纪录 (可点击查询WPING实时安全评级)

无主机纪录.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

域名解析 (可点击查询WPING实时安全评级)

无域名信息.

TCP

无TCP连接纪录.

UDP

无UDP连接纪录.

HTTP 请求

未发现HTTP请求.

SMTP 流量

无SMTP流量.

IRC 流量

无IRC请求.

ICMP 流量

无ICMP流量.

CIF 报告

无 CIF 结果

网络警报

无警报

TLS

No TLS

Suricata HTTP

No Suricata HTTP

未发现网络提取文件

抱歉! 没有任何文件投放。

没有发现相似的分析.

HTML 总结报告 (需15-60分钟同步)	下载

Processing ( 15.324 seconds )

7.2 Suricata
2.835 Static
2.543 TargetInfo
1.537 VirusTotal
0.513 peid
0.341 NetworkAnalysis
0.187 Strings
0.098 AnalysisInfo
0.037 Debug
0.026 BehaviorAnalysis
0.004 Memory
0.003 config_decoder

Signatures ( 0.489 seconds )

0.347 md_bad_drop
0.021 md_url_bl
0.019 antiav_detectreg
0.012 md_domain_bl
0.01 persistence_autorun
0.008 antiav_detectfile
0.007 infostealer_ftp
0.007 ransomware_files
0.006 ransomware_extensions
0.005 antianalysis_detectreg
0.004 tinba_behavior
0.004 infostealer_bitcoin
0.004 infostealer_im
0.003 antivm_vbox_files
0.003 disables_browser_warn
0.003 infostealer_mail
0.002 betabot_behavior
0.002 geodo_banking_trojan
0.002 modify_proxy
0.002 browser_security
0.001 network_tor
0.001 kazybot_behavior
0.001 kibex_behavior
0.001 shifu_behavior
0.001 stealth_timeout
0.001 antianalysis_detectfile
0.001 antidbg_devices
0.001 banker_zeus_mutex
0.001 bot_drive
0.001 bot_drive2
0.001 browser_addon
0.001 disables_system_restore
0.001 modify_security_center_warnings
0.001 modify_uac_prompt
0.001 office_security
0.001 rat_spynet
0.001 stealth_hiddenreg
0.001 stealth_hide_notifications

Reporting ( 1.021 seconds )

0.544 ReportHTMLSummary
0.477 Malheur


Task ID	111350
Mongo ID	599c3d49a093ef39d7c523aa
Cuckoo release	1.4-Maldun