7a140758f0844d3bc0cc23e2785ad7b2

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2019-Jun-05 08:23:04
Detected languages Chinese - Taiwan
English - United States
Debug artifacts D:\OSCE-Common-MAIN_1.0\src\Setup\NTClientUninstaller\NTRmv\x64\Release\NTRmv.pdb
CompanyName Trend Micro Inc.
CoverageBuild NO
CompileOption Release
BuildType Rel
FileDescription Trend Micro Common Client Uninstallation Service
FileVersion 14.0.0.3048
InternalName Common Client NT uninstaller
LegalCopyright Copyright (C) 2019 Trend Micro Incorporated. All rights reserved.
LegalTrademarks Copyright (C) Trend Micro Inc.
OriginalFilename webntrmv.EXE
PrivateBuild Build 3048 - 6/5/2019
ProductName Trend Micro OfficeScan (common client)
ProductVersion 14.0
SpecialBuild 3048

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • regedit.exe
  • regsvr32.exe
  • sc.exe
Contains references to security software:
  • AUpdate.exe
  • NTRtScan.exe
  • ntrtscan.exe
  • otFix.exe
May have dropper capabilities:
  • %ALLUSERSPROFILE%
  • CurrentControlSet\Services
  • CurrentVersion\Run
Accesses the WMI:
  • root\Security
Miscellaneous malware strings:
  • EXPLOIT
  • Exploit
  • Virus
  • virus
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA256
Uses constants related to SHA512
Microsoft's Cryptography API
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LoadLibraryExW
  • LoadLibraryW
  • LoadLibraryA
  • GetProcAddress
Functions which can be used for anti-debugging purposes:
  • SwitchToThread
  • CreateToolhelp32Snapshot
  • FindWindowA
Code injection capabilities (PowerLoader):
  • FindWindowA
  • GetWindowLongA
Can access the registry:
  • RegEnumKeyExW
  • RegCloseKey
  • RegCreateKeyExA
  • RegOpenKeyExA
  • RegQueryValueExA
  • RegSetValueExA
  • RegDeleteValueA
  • RegDeleteKeyValueA
  • RegDeleteKeyA
  • RegDeleteKeyExA
  • RegEnumKeyExA
  • RegOpenKeyExW
  • RegQueryValueExW
  • RegDeleteValueW
  • RegSetValueExW
  • RegCreateKeyExW
  • RegDeleteKeyW
  • RegEnumValueA
  • RegQueryValueA
  • RegEnumKeyA
  • RegEnumValueW
  • RegDeleteKeyExW
  • SHDeleteKeyW
Possibly launches other programs:
  • CreateProcessW
  • WinExec
  • CreateProcessA
  • ShellExecuteA
Uses Microsoft's cryptographic API:
  • CryptAcquireContextA
  • CryptReleaseContext
  • CryptDestroyKey
  • CryptSetKeyParam
  • CryptGetHashParam
  • CryptImportKey
  • CryptEncrypt
  • CryptDecrypt
  • CryptCreateHash
  • CryptHashData
  • CryptDestroyHash
  • CryptMsgGetParam
  • CryptMsgControl
  • CryptQueryObject
  • CryptMsgClose
  • CryptUnprotectData
  • CryptCATAdminCalcHashFromFileHandle
  • CryptCATCatalogInfoFromContext
  • CryptCATAdminEnumCatalogFromHash
  • CryptCATAdminReleaseCatalogContext
  • CryptCATAdminReleaseContext
  • CryptCATAdminAcquireContext
Can create temporary files:
  • CreateFileW
  • GetTempPathW
  • GetTempPathA
  • CreateFileA
Uses functions commonly found in keyloggers:
  • GetAsyncKeyState
  • MapVirtualKeyA
  • CallNextHookEx
  • GetForegroundWindow
Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
Has Internet access capabilities:
  • InternetReadFile
  • InternetOpenA
  • InternetQueryOptionA
  • InternetSetOptionA
  • InternetCloseHandle
  • InternetConnectA
Functions related to the privilege level:
  • OpenProcessToken
  • DuplicateTokenEx
Interacts with services:
  • OpenSCManagerA
  • OpenServiceA
  • DeleteService
  • QueryServiceStatus
  • OpenSCManagerW
  • OpenServiceW
  • ControlService
  • ChangeServiceConfigW
Enumerates local disk drives:
  • GetVolumeInformationA
  • GetDriveTypeW
  • GetLogicalDriveStringsW
  • GetLogicalDriveStringsA
  • GetDriveTypeA
Manipulates other processes:
  • Process32NextW
  • Process32FirstW
  • Process32Next
  • Process32First
  • OpenProcess
Changes object ACLs:
  • SetFileSecurityW
Can take screenshots:
  • FindWindowA
  • GetDC
  • BitBlt
  • CreateCompatibleDC
Interacts with the certificate store:
  • CertOpenStore
Info The PE is digitally signed. Signer: Trend Micro
Issuer: VeriSign Class 3 Code Signing 2010 CA
Safe VirusTotal score: 0/68 (Scanned on 2019-08-13 22:05:19) All the AVs think this file is safe.

Hashes

MD5 7a140758f0844d3bc0cc23e2785ad7b2
SHA1 b6fa33f519c7f13f5b0f6daff6d5f6a31df79009
SHA256 71e5c2670ba4b81b8b7dc877f8e6f9bc5928c3540e767030bb461ecda81384e5
SHA3 7cd70ee5ed9ae33d405135cbb4629229fd610945357a28435a82e7afa1f59b25
SSDeep 49152:OrWvNFcKWz0aPGmK8kGDxEtwb/HY1V8wZpyKiASvlecTyY4aiPAp7cbI6RGEuR30:oW0KWCmUzm5cbI6IF35EEQmOZmgTFh0m
Imports Hash 73caf9ccb79528feaa74227da1fa6ecc

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x168

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2019-Jun-05 08:23:04
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x357400
SizeOfInitializedData 0x232600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000002C0C94 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x59b000
SizeOfHeaders 0x400
Checksum 0x5b231a
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x200000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 7efeeb460cceb0aa06179f9877e8e951
SHA1 d9360ba0676727b296aeb8dcfa730886b3cee778
SHA256 c240cbb51daee746f17c9a686327b13e5edf404cccaddc3d9f369ddea28417cf
SHA3 ccdeab9aed7a916064fa577d4f209de707c865c2b1e69439f348f6d1fca4ee29
VirtualSize 0x357328
VirtualAddress 0x1000
SizeOfRawData 0x357400
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.37971

.rdata

MD5 7849673e6c60dbbffc261b5d94fb7f36
SHA1 380d216d725150e8480dfe7032d6135b55c22f2d
SHA256 7cceee84acf8c6ac754b1312b09126bfaa750a9aa17c1351c6d8925c0184690e
SHA3 1ac26f41412ba72e9ec790ab7fba0d5877e45aa3eb59916f98275498230fbd20
VirtualSize 0x16d7e2
VirtualAddress 0x359000
SizeOfRawData 0x16d800
PointerToRawData 0x357800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.6761

.data

MD5 a743a8e0d106e48cec2a73af8875ea78
SHA1 97ea9d4f185fb9a26f24979a09377788df765148
SHA256 182ff49b77aa77eab0fc05f8fb44e20dca15e575c34b7480b158ac277577a47a
SHA3 923c6b9ab5086420f0af34cbf8d105cfea367dea06b35109dff2fc56ac00ae88
VirtualSize 0x1cdc4
VirtualAddress 0x4c7000
SizeOfRawData 0xe600
PointerToRawData 0x4c5000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.32905

.pdata

MD5 afe898c00c739228615661b4b088f617
SHA1 4bde05127f43c7bacabee17b2faf242fc06bff41
SHA256 89ea9b74db4150fb7aaabd40f232906bfd07c229d79557b5ed388b1079b6691e
SHA3 873b34897ed5d6b553dc1fa79b91f68c3a39d69caf090c113c58387e904623e3
VirtualSize 0x29cdc
VirtualAddress 0x4e4000
SizeOfRawData 0x29e00
PointerToRawData 0x4d3600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.35222

.rsrc

MD5 151494be5e02e798134c5f059bacc4d0
SHA1 4a76dadd75a0695394b37b3a9e9df6612d91bcac
SHA256 58113635a13279565a08dc46c43514c94f97103e5c8217dfc699378ed6eebb30
SHA3 62a221707c668ec3c4089395ccb5cb744ef981590b2ddaf0069fcc4c35b8b435
VirtualSize 0x7bb98
VirtualAddress 0x50e000
SizeOfRawData 0x7bc00
PointerToRawData 0x4fd400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.42051

.reloc

MD5 fe34ef9a19d4ea8053c5af4bb30da352
SHA1 6fa3539df2e7931ae378b66d42e0b7a43f3d77d6
SHA256 330cfd63f7e5180877650b0c435ee91eea751b6fb4519ed4232f003480d13823
SHA3 badef4e3e61063233be7496b4a4b3d43c080ee15107a5b86affc1ef79590286b
VirtualSize 0x10d08
VirtualAddress 0x58a000
SizeOfRawData 0x10e00
PointerToRawData 0x579000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.45546

Imports

PccWFWMo_64x.dll ?WFW_Uninitialize@@YAHXZ
?WFW_RemovePort@@YAHJHPEB_W@Z
?WFW_Initialize@@YAHXZ
VERSION.dll VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
GetFileVersionInfoSizeA
ADVAPI32.dll RegEnumKeyExW
ImpersonateLoggedOnUser
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
AllocateAndInitializeSid
EqualSid
FreeSid
GetTokenInformation
RegDeleteValueA
RegDeleteKeyValueA
CloseServiceHandle
OpenSCManagerA
RegDeleteKeyA
RegDeleteKeyExA
RegEnumKeyExA
RegOpenKeyExW
RegQueryValueExW
OpenServiceA
DeleteService
QueryServiceStatus
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenSCManagerW
OpenServiceW
StartServiceW
ControlService
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGetHashParam
RevertToSelf
RegDeleteKeyW
DuplicateTokenEx
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
ChangeServiceConfigW
ChangeServiceConfig2W
RegEnumValueA
RegQueryValueA
RegEnumKeyA
ConvertStringSidToSidW
SetFileSecurityW
InitializeAcl
GetAce
AddAccessAllowedAce
RegEnumValueW
RegDeleteKeyExW
RegOpenCurrentUser
CRYPT32.dll CryptMsgGetParam
CryptMsgControl
CertFreeCertificateContext
CryptQueryObject
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetNameStringW
CertDeleteCertificateFromStore
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CryptMsgClose
CryptUnprotectData
WININET.dll InternetReadFile
InternetOpenA
InternetQueryOptionA
InternetSetOptionA
HttpOpenRequestA
InternetCloseHandle
HttpAddRequestHeadersA
HttpSendRequestA
InternetConnectA
HttpQueryInfoA
PSAPI.DLL GetModuleFileNameExW
SHLWAPI.dll PathRemoveFileSpecA
PathUnquoteSpacesA
PathFindExtensionW
PathCanonicalizeA
PathCanonicalizeW
PathFileExistsA
PathFileExistsW
PathIsDirectoryEmptyA
PathRemoveBackslashA
PathRemoveFileSpecW
PathStripToRootA
PathAddBackslashW
SHDeleteKeyW
StrFormatKBSizeA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA
PathUnquoteSpacesW
PathAddBackslashA
PathFindFileNameW
PathAppendA
PathAppendW
OfcPIPC_64x.dll OIPC_SendData
OIPC_Init
OIPC_DeInit
OIPC_FreeCommand
OIPC_CmdDataCopy
OIPC_CreateCommand
KERNEL32.dll GetPrivateProfileSectionA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetEnvironmentVariableW
GlobalUnlock
GlobalHandle
GlobalLock
GetVersion
GetPrivateProfileIntA
GetUserDefaultLangID
GetSystemDefaultLangID
ReleaseMutex
CreateMutexW
GetStdHandle
CreateNamedPipeW
WaitForMultipleObjectsEx
GetLocalTime
GetComputerNameW
ResetEvent
MoveFileW
MoveFileExW
GetSystemTimeAsFileTime
GetFileInformationByHandle
GetCurrentThread
SetThreadPriority
GetACP
GetDateFormatW
GetTimeFormatW
FormatMessageW
GlobalSize
MulDiv
OutputDebugStringA
FreeResource
GetModuleHandleExW
FindResourceA
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
GlobalDeleteAtom
CompareStringA
GlobalAddAtomA
InitializeCriticalSectionAndSpinCount
EncodePointer
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
LocalReAlloc
GlobalFlags
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
FlushFileBuffers
GetFullPathNameA
LockFile
SetEndOfFile
UnlockFile
VirtualProtect
GetOEMCP
GetCPInfo
SetErrorMode
GetFileAttributesExA
VerSetConditionMask
VerifyVersionInfoA
FindResourceExW
GetProfileIntA
SearchPathA
GetUserDefaultLCID
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetVolumeInformationA
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindFirstFileExA
EnumSystemLocalesW
IsValidLocale
GetConsoleCP
ExitProcess
SetStdHandle
HeapQueryInformation
VirtualQuery
VirtualAlloc
GetSystemInfo
FreeLibraryAndExitThread
ExitThread
ReadConsoleW
GetConsoleMode
PeekNamedPipe
GetFileType
GetCommandLineW
RtlPcToFileHeader
RtlUnwindEx
GetStringTypeExW
LCMapStringW
CompareStringW
SwitchToThread
QueryPerformanceFrequency
AreFileApisANSI
GetFileAttributesExW
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
GetStringTypeW
CreateFileMappingA
GetThreadTimes
Process32NextW
Process32FirstW
LoadLibraryExW
GetCurrentThreadId
GetPrivateProfileSectionW
GetPrivateProfileIntW
lstrlenW
CreateFileMappingW
DuplicateHandle
CreateDirectoryW
GetDriveTypeW
LocalAlloc
CreateProcessW
GetExitCodeProcess
SetFilePointer
GetFileSize
FindNextFileW
FindFirstFileW
GetFullPathNameW
RemoveDirectoryW
ExpandEnvironmentStringsW
GetTickCount
CopyFileW
GetFileAttributesW
GetOverlappedResult
SleepEx
CreateMailslotW
OutputDebugStringW
GetModuleHandleW
GetFileTime
FileTimeToLocalFileTime
InitializeSListHead
SetFilePointerEx
GetFileSizeEx
DeleteFileW
ReadFile
GetLogicalDriveStringsW
QueryDosDeviceW
CreateFileW
DeviceIoControl
GetVersionExW
SetLastError
GetSystemDirectoryW
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
DecodePointer
MoveFileA
QueryDosDeviceA
GetPrivateProfileStringW
GetPrivateProfileStringA
OpenFileMappingA
lstrlenA
lstrcpyA
lstrcpynA
lstrcmpiA
lstrcmpA
LoadLibraryW
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFile
GetWindowsDirectoryW
ResumeThread
SuspendThread
TerminateThread
CreateThread
TerminateProcess
WaitForMultipleObjects
CreateEventW
GetTempFileNameA
GetTempPathW
SetFileAttributesA
RemoveDirectoryA
GetTempFileNameW
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryW
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
MoveFileExA
CopyFileA
WritePrivateProfileStringA
GetStartupInfoA
OpenMutexA
WinExec
GlobalFree
GlobalAlloc
LoadLibraryA
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetVersionExA
OpenProcess
CreateProcessA
GetCurrentProcessId
GetCurrentProcess
OpenEventA
CreateMutexA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetDiskFreeSpaceExA
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
SetCurrentDirectoryA
ExpandEnvironmentStringsA
GetCommandLineA
CreateEventA
WaitForSingleObject
SetEvent
GetLogicalDriveStringsA
FormatMessageA
LocalFree
GetWindowsDirectoryA
Sleep
GetLastError
CloseHandle
GetTempPathA
WriteFile
GetFileAttributesA
GetDriveTypeA
CreateFileA
CreateDirectoryA
SetNamedPipeHandleState
WaitNamedPipeW
VerifyVersionInfoW
GetVolumeNameForVolumeMountPointW
RtlUnwind
CreateActCtxW
SETUPAPI.dll InstallHinfSectionW
USER32.dll IsZoomed
DrawFrameControl
DrawEdge
DrawStateA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetParent
SetWindowRgn
SetClassLongPtrA
EnumDisplayMonitors
SetLayeredWindowAttributes
NotifyWinEvent
LoadCursorW
InvertRect
HideCaret
EnableScrollBar
GetIconInfo
DrawIconEx
LoadImageA
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
GetMenuDefaultItem
CreatePopupMenu
MapDialogRect
GetAsyncKeyState
GetMenuItemInfoA
DestroyMenu
LoadImageW
TrackMouseEvent
IntersectRect
InflateRect
CharUpperA
DestroyIcon
InvalidateRect
DeleteMenu
SystemParametersInfoA
CopyImage
RealChildWindowFromPoint
LoadCursorA
GetSysColorBrush
GetSystemMetrics
MapVirtualKeyA
GetKeyNameTextA
IsDialogMessageA
SetWindowTextA
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
InsertMenuItemA
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageA
WaitMessage
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
CopyAcceleratorTableA
SetRect
GetSystemMenu
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
RegisterClipboardFormatA
CharUpperBuffA
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcA
TranslateMDISysAccel
SetCursorPos
SubtractRect
PostMessageA
FindWindowA
LoadStringW
wsprintfA
MessageBoxA
LoadStringA
OpenInputDesktop
OpenWindowStationA
CloseWindowStation
SetProcessWindowStation
SendMessageA
BringWindowToTop
SetTimer
KillTimer
EnableWindow
GetClientRect
GetWindowRect
MessageBeep
EnumWindows
GetClassNameA
GetWindowThreadProcessId
LoadBitmapA
LoadIconW
DdeInitializeA
DdeUninitialize
DdeConnect
DdeDisconnect
DdeClientTransaction
DdeCreateDataHandle
DdeCreateStringHandleA
DdeFreeStringHandle
UnregisterClassA
wsprintfW
GetDC
ReleaseDC
GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExA
CallNextHookEx
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
RemoveMenu
UnhookWindowsHookEx
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
GetParent
LoadBitmapW
LoadMenuW
CopyIcon
FrameRect
LockWindowUpdate
DrawIcon
IsWindow
DestroyWindow
CreateMenu
GetWindowRgn
DestroyCursor
CheckDlgButton
MoveWindow
ShowWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconA
GetWindow
GetTopWindow
GetClassLongPtrA
GetClassLongA
SetWindowLongPtrA
GetWindowLongPtrA
SetWindowLongA
PtInRect
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
SetForegroundWindow
GetForegroundWindow
UpdateWindow
DefMDIChildProcA
CreateDialogIndirectParamA
EndDialog
GetDlgItem
GetNextDlgTabItem
IsWindowEnabled
SetActiveWindow
GetWindowLongA
GetDesktopWindow
PostQuitMessage
ShowOwnedPopups
BeginDeferWindowPos
SetCursor
GetLastActivePopup
DrawTextA
DrawTextExA
GrayStringA
TabbedTextOutA
GetWindowDC
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
TrackPopupMenu
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
IsIconic
EndDeferWindowPos
GetSysColor
FillRect
SendDlgItemMessageA
SetRectEmpty
OffsetRect
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
IsMenu
IsChild
SetWindowPos
GetWindowPlacement
SetWindowPlacement
DeferWindowPos
GDI32.dll Polygon
Polyline
CreateRoundRectRgn
LPtoDP
EnumFontFamiliesExA
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
CreateEllipticRgn
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceA
MoveToEx
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
CreatePolygonRgn
SetBkMode
SetBkColor
BitBlt
CreateCompatibleDC
CreateSolidBrush
DeleteObject
PatBlt
SelectObject
GetObjectA
GetDeviceCaps
CopyMetaFileA
CreateDCA
CreateBitmap
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
DeleteDC
Escape
ExcludeClipRect
GetClipBox
GetObjectType
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
DPtoLP
SetRectRgn
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
CombineRgn
GetTextMetricsA
GetTextExtentPoint32A
CreateFontIndirectA
CreateRectRgnIndirect
ScaleWindowExtEx
GetViewportExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
GetTextColor
SetWindowExtEx
SetViewportOrgEx
RestoreDC
SaveDC
Ellipse
SetViewportExtEx
ExtTextOutA
SelectClipRgn
ExtSelectClipRgn
ExtFloodFill
SelectPalette
GetPixel
GetStockObject
TextOutA
MSIMG32.dll TransparentBlt
AlphaBlend
WINSPOOL.DRV ClosePrinter
DocumentPropertiesA
OpenPrinterA
SHELL32.dll SHGetFolderPathW
SHGetFileInfoA
SHGetFolderPathA
SHCreateDirectoryExW
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteA
SHBrowseForFolderA
DragQueryFileA
DragFinish
SHAppBarMessage
ShellExecuteExW
UxTheme.dll IsAppThemed
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
ole32.dll ReleaseStgMedium
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoInitializeEx
CLSIDFromProgID
CoCreateInstance
CoCreateGuid
CoUninitialize
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoDisconnectObject
CreateStreamOnHGlobal
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoInitialize
OleLockRunning
OleDuplicateData
OLEAUT32.dll #9
#150
#4
#12
#161
#7
#184
#185
#8
#10
#114
#6
#2
gdiplus.dll GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipGetImagePaletteSize
GdiplusShutdown
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromStream
GdipGetImageWidth
OLEACC.dll AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
IMM32.dll ImmReleaseContext
ImmGetOpenStatus
ImmGetContext
WINMM.dll PlaySoundA
WINTRUST.dll CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData
VSAPI64.dll #305
#289
#316
TmListenShare_64x.dll rtSetRegistryKeyValue2W
rtGetRegistryKeyValueW
rtSetRegistryKeyValueW
GetFileVersionBuildA
FlowControl_64x.dll FlowEnabled
msi.dll #103
#125
#17
#8
#205
sqlite3.dll sqlite3_mprintf
sqlite3_free
sqlite3_open16
sqlite3_errmsg
sqlite3_prepare16_v2
sqlite3_bind_int
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_column_name
sqlite3_step
sqlite3_column_int
sqlite3_column_text16
sqlite3_column_type
sqlite3_finalize
sqlite3_reset
sqlite3_next_stmt
sqlite3_busy_timeout
sqlite3_close
sqlite3_column_count
sqlite3_changes
dbghelp.dll ImageNtHeader

Delayed Imports

18

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.02695
MD5 cab67e9ca149fb79ab4473998412b951
SHA1 2e793d35537bfb5d3f042ed0626d3b119d50519a
SHA256 fbeb3be87e80cb8e1d2af3d8140796c1bb80c6c7056f60897088ff9e355c3867
SHA3 0e72f5537421764effb2ed98e536358bb7e86eed7b0936e606e8d45559685684

19

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0xb4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.74274
MD5 9fa8a914823ac7e5370652146901f4f1
SHA1 eb3224109abb341b6e464d2606fdbed1a7160bc6
SHA256 f64ccc0582bc7c66af8b40049e485e8e241335261ec95ace909293ba50b2e4a3
SHA3 bb348af06514e27cd1fa21ad524dfd037edcd3b36ef4cc6ab24c4a8ec38995ff

20

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.34038
MD5 d78a341fa7444ba9ccb74ad0c943d0ac
SHA1 a3fdcb001587c47b72f06441087455e8027baca1
SHA256 652988945185cf5d604d9b48de66288d82d8ed0acdd134398e90d002d2d9fc72
SHA3 2ddf8193c735adcec9a83d3a9032dc70796778b1d0c967a43789f1a6bb3da15f

21

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.34004
MD5 07618c451f53db89991c3fb7c567a568
SHA1 0d5cd2bb85bb88024b832f68bdbadd1e69938138
SHA256 0b0e16c38a3d5a85566e67b1d9a7e720e4dee27e163b06099d3d7dfa5dbed9ee
SHA3 f4d98de638008ce348a7ef0cb3feb13207cf5b3eaea4f1ee1d71b3a22397fba4

22

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.51649
MD5 9936fbf67a1d9f755c37852015d09527
SHA1 426016ba6a10cc2634ab7357e4223793c51aa304
SHA256 368f9cb089d206a8b61251f0c85eeda97ee08a56b33be8579246e964d3af6169
SHA3 6bdb1e7d667efe7812e162384a6341edec73311ee7dfcb122adf0cc0f08e7a8f

23

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.45401
MD5 ffacff1dbee315221fd131e951d8e151
SHA1 d2eb9800a1f60d3ea7225fec706d809cf477885b
SHA256 6440c3a38dcfb81d45bc6be31b776fdae116dd7a2933b407b67132f6cfa0e6eb
SHA3 dbe125dd582d83c13a62c87798c900fdc43d97b581935e320c14f9cc761a3868

24

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.34864
MD5 fa681900dd51c997aa67a2c5a4704099
SHA1 b48ebfd25835cb260b5e4f8e7085ea3da102c48a
SHA256 9882a8462ce9de3cc9a5d0ca48c8c4f7ca97f1f846f0c10e6655e33c9734b152
SHA3 157fb750ffc808227ced340c81ed1c1c1e15b05dd0e831678b871515870e0a8b

25

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.34505
MD5 0a12283479aa8a8677dd27bb0f584a34
SHA1 63679153c4d14fc591d1286cc98ff5044a5b589d
SHA256 322e92d75b3fec9e16b81466f4cf111d298b80812d5b238f4ee032c025a02050
SHA3 d6fc5e08b9d51b2cc80c1a2a34ca495e28edd0ca1bc65f317958b773c675de7e

26

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.34864
MD5 d0293b6f84ea96f2662fa2f8e2fd44de
SHA1 240ad776d40208f067dda60701affa3d162cb3bb
SHA256 8db6df648274a0fc3d28430367216e1c17c364ca613066cbb0e133637e92ba62
SHA3 d92c1c2bfba803073152e14d6846474d13ccef3f04aa8670540389efa7c7d995

27

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.31114
MD5 49ca9d25ceb458297ddf84fff64c8d55
SHA1 fbd6d992b7e2a59c9e24372ea8d30a5dcdbd46f9
SHA256 f9c81ce9b4176b305c554a15f0ca2b98b11be76c1f13ef22169999aa07e9612f
SHA3 03f7002b636940864ef7d399ba60fb8de3f455da32f311ee39cdf6602c5d348b

28

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33609
MD5 27fc5529ad790189bbf410c7e3a70fb7
SHA1 ea2456c9b26f884a7f7abb051f460ec98cb9451c
SHA256 601635482a9b1864ea0c61ce0282c5c9fe1d014aa95dbb4f60770f1c2b6df3da
SHA3 24ab306744896452b2a7f7055c97671ab0aad3965342b3d0cead7a6cb640238d

29

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.81313
MD5 858a63dc597812b0885e8a8f9689227c
SHA1 0a816cd0e6f10038f43bde278eb613f1c7281b33
SHA256 2bf742d2beb4c56dd6eb68347dd8ee28da85bed9e6d165b36c6edb91da01d5d6
SHA3 6974d714fd124f0de87b6f088039e52bcf3123b5e6ae24c7c61864b70b894963

30

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.81491
MD5 ff43eaab521694d0356618a92cd83b55
SHA1 f1ed8d456a5a3d87d1a8349e992c99e22bf3624e
SHA256 cfc4ff9e46fbb61f61b68f36adc6593b137233d1cbaa50fe37e5653f0cb20396
SHA3 7069692bfbe0c043b33390a40f8033c3d0aa3092c3b1ca1b01fc899dc760ec48

31

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.10016
MD5 4bfaa5ad112338fc90bf84b1ba21859d
SHA1 f175fb276720b4f98bc75dd3edc8c53ed563bdf4
SHA256 c4a6e3a7a346baecb09a0c49268eb44f388382a7866a4e912b53d48fa3b34c26
SHA3 eb1f5efadebebc4b756ef49661343ee08641f53184ad8ee83e33d6665028a00d

32

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.97052
MD5 654a61b5fd300aaf86c52a3c48035005
SHA1 e16bdc1b4309abd682e2d0b52aaf370a77ad6a86
SHA256 f273e554605a89aa0994c9d42bc2569be3db5b19b2900dacb30f3218ed1174a0
SHA3 50582dc2bd6d1a2632564b2d3c6fdc1877e401924754069bc2dfccf3e2896340

33

Type RT_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x134
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.22699
MD5 b6946159ef4680b2b03d58bdf3dc83f6
SHA1 b949690a6e071a1fe43cb83a15d5104d1fa9fe0d
SHA256 ebaf4bcc0f0d7ca9a3458ea52520d2dd10811069241940b9b2e79ac1a4c3ca5c
SHA3 4b1152fe0fd4581cc8716682bff8f14d7c903ab6b5414d52876bd37fc58eb0c5

30994

Type RT_BITMAP
Language English - United States
Codepage Latin 1 / Western European
Size 0xb8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.23666
MD5 8cf65be17e506ff24c2177078f88b56e
SHA1 3e397dc7597caeb844df0ea760b64231c8ce3dbf
SHA256 e7c0005285d1ab59732d5f99f77a9bdd6342b01cf44437ebd7a07611a227e272
SHA3 7da4c7aab356574679f0f9107740f01647864c846c04f699deef67577fd6aded
Preview

30996

Type RT_BITMAP
Language English - United States
Codepage Latin 1 / Western European
Size 0x144
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.87621
MD5 5a9c81cdbf480cf01daa71ba0e233c5f
SHA1 28e04c01584654e1974347d1baa462b2784e9c47
SHA256 abdf36bde89a26349f5741c17c235dacea88d441d8662ba16a598dc50c3c4864
SHA3 99dec83590ac444359a5a6f8924dae5615d93f4df527e10a8a61319ce3a5beaf
Preview

1

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0xc828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.47561
MD5 4b6995335d5faac3c801d39170a17a58
SHA1 90edeed106ac2b7d26d67f87d07a91e9fc0a52f2
SHA256 5b8d7a32961f3441f2aee37d77cbae296024e7593048f7773c588abb621bf93f
SHA3 c3d2e27958a0aa693415f730834ed40fc44f956f9d2a66c34bfa4180369dc9be

2

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x4048
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.49751
MD5 f1eb5abb3bd952695c304d37acfbf507
SHA1 7abf2afdf2f8db4a458c91caa7cfc6af9af98dd1
SHA256 044910fe71d04de04a1679f1f65f80cbbb215674ceac25e320895e334dcbf4f2
SHA3 b944ce65784b2a8aff40c61bced944ca2653a1ac16fbaee8a0cececae56b5eb3

3

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x2c38
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.23916
MD5 ba6af1cfcd842ef8aa374b1147ad4827
SHA1 d30a51d5188e14739af312844abc8c33f5876ee2
SHA256 19b989aa1199f2a517df7a00e9548fea0c609bcfeb13cbfc42260b8be254b82d
SHA3 805d0d70f337278c1be32f312cf42bf344606b9b46d18f75d2524160fb22376c

4

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x1ca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.80773
MD5 da0bc5bfd3444e01229c10750d187233
SHA1 ff9da4ad6d3faf8a48c3fad004f4ab81e1669e52
SHA256 25ce1d4825e08c87534d15c7e7218cbe877818ba5bbfcb8711483740a782fee5
SHA3 3930e66806891b95f71716600ef4b772d1168a6026ad8926faee6b3049ecf500

5

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0xca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.61096
MD5 1d60a93c9f43542e5e6f5953d1d78edb
SHA1 f1c0db09989da7bc4977426bb037fc813a58fc63
SHA256 5bcc209f860ab3dc5f0630ffc72dba94819307a2054967aa23fb15b85ee9bdd1
SHA3 71ba7a4bc842c28dacd27f0f6cc8d1a02d4805235fd94e2d9caf41d6f752d753

6

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x748
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.93477
MD5 3e11c25181cea8cfa25e070c2ff619f5
SHA1 1ea1779bcfc1063c9a6ee2de70eba186b8beb910
SHA256 2c040616ea6a30122d166736281052f94773e4a61059459722141416619beefe
SHA3 de8361a7140cdc1e64da7092a9701f05c85400622319cc3fb7710771562aa538

7

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x528
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.83889
MD5 6f90084f36aef694adce381b89c45a3c
SHA1 c670bdf24a51946e3d835a6f4d080b019852042f
SHA256 8a097eae6b839d9d971c25c09206a729142e255282969dd64820732bffbc188f
SHA3 48a913f3ae1196c5bc505aca688f017f7939de29c226c7bc7f3c96c93b3d99b7

8

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x368
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.52909
MD5 f8ed6ecd3c9eb2af875595f664e81698
SHA1 abc26513a282dc21d7104d5ddec41e6d44128414
SHA256 216af332ea380ed0da483b1c3570247a4966f3720ee3ea966a17790c3e224ec2
SHA3 e3d592ff93274eabe719fbd28e69b0d04f1af8db355ac9a454919bc02ceff6f3

9

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.18014
MD5 35a1b6d50face7a1c4759b1e31423779
SHA1 73fde2d5db21cce17298b33b23bdaed36037363d
SHA256 094d239ae9aec9f0a1429512a412532e88b6cea4864998c38e224792e7b99ab2
SHA3 4e36079dcd587a0c07f5c48e70397e6dcf7779c8c22ec5b7158398bb33e2303b

10

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.35298
MD5 46d1fb642f7580ee7c0c51d9e1273293
SHA1 a813783661e5b4e83213edaddbf9fb0d85b6aa2f
SHA256 255a257c623f1f48c3efe33d899996dfa02046003deb525f44a7933bec9636b4
SHA3 89c32ec24baddf36373071238ce8d6de538eaa1fe9bb9ad80f1be99efa4c28e4

11

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x5488
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.59281
MD5 39ec180f2fc37888ca658dd40e863d16
SHA1 c5d423a6843904c4769e0354b5c165e6cee0abb1
SHA256 b4dbed4866d8dc034034f8479ca214eb6923d2107944bf0de4c8c5fa4ae56927
SHA3 28634be61a893300af528db8005e4ab8d49b3c9e0cabfdd2de12773616e1deda

12

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x3a48
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.54223
MD5 13676305b92312f646d5a21f5c5f9826
SHA1 8d31f9faeecb0fb91e8cbdb616c32ba0ae1cd17a
SHA256 f86fd4cd9324eaf58cf58eebd7e55b1c40b4cd9454000a4e11f1b1cb411da96c
SHA3 b0288c1430a2e16eebdd3a7cc8577d6612044055427be74d5461433c7e13e96f

13

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.79256
MD5 69676f725c8e3a9ec38e7b33d9666f51
SHA1 8f0c0311737b5ae805bba0586651db582532782d
SHA256 86d2de0288affd2938518485b54d648e63f8ab8a5da35421e079b2e6e4307015
SHA3 02314bc58d77cc54c757336d8e0860f206024cb313872189b99aae6e8239faa3

14

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73655
MD5 7aba1efcfc88288da7988a4bcc8875d0
SHA1 c47b120aa1a34792deaaf188721acc668f16e01e
SHA256 704bf05e8a391d80c1a4b1d93143a7fd5e733b240ca193f1fce976e9ca420686
SHA3 11d7fc8b3509b622b8e04b9a7f1355d75113a90ed68b26656a3ffc5f56c18588

15

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.02713
MD5 21176fac7642b46f09c16855fdea3096
SHA1 48ca0e48d73972c67eac91165fdf12fd5922b3cd
SHA256 ae3f9dabbeac0316da66b1a5b966ccda7e81b8d2f0c39f90d6c750594e21a375
SHA3 c566d93290e3a1cd65f5cf41cd603831f1a86c5575c1f7dd0fa40e8cc6d9f15b

16

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x6b8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.96066
MD5 e5584ce484be108636bc0ec6c2043acc
SHA1 506c7649f21995e106b2a67026df6b3cbb4304f3
SHA256 779ebb61d1931e0a270fbba5118c83302866bae9ce30ce3cff7959080f467dd3
SHA3 93d229e015a319fd894077a7c4458d320506a59e157336648265e90df35b19ef

17

Type RT_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.76091
MD5 79650cc7359bb5c68be8f8583f17db7d
SHA1 a0423d8bf161c3230b5bd7374ffea8156e938346
SHA256 a08301accd993c669d2ffbca47e59671027f68fae4a3338430f989eb919c2b5e
SHA3 863bd540baab0717e771f53767d0b16224e17b3deeabeb9ce6f802fdbc504e80

30721

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0xe8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.06676
MD5 ad7b15160c8bf80910606d417f40fef5
SHA1 9752acb8e012635c4356f7f2a20191d656b53faf
SHA256 6e113fd8e9f3156ae68251c6076beb9b59fe29e589d06398e7019802521f69d3
SHA3 50c74f1eeba91cb4ecc237c0b18cd2f6c0e2b6064e8d13ce1a779160c03b5d48

30734

Type RT_DIALOG
Language English - United States
Codepage Latin 1 / Western European
Size 0x34
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.41669
MD5 72723d63b211c60717138184c1675b66
SHA1 ecd2be6587bb32a080e51b5c3f3a816e8b637c85
SHA256 4cf716efaf68e0cb2ec45ec55d291050b5712b05653cae68edbb999f803d2a98
SHA3 6031fa1100e39d04c89ed42890fe9833adb0503fe1857940533b7356aec9d306

9 (#2)

Type RT_STRING
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x54
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.19619
MD5 d6604a44479a4e39e0bcb0ca2d6d3a5b
SHA1 b87c08822177d35a1f97a8b859513af17eabdf6f
SHA256 bb78c8927fedaec269dcc2867d5bb65e29c26a786123f472a8bb57ba9c0137c5
SHA3 87ff153f139b056a152a41053bc820a2956493f0390af1df8a9a18a519d8421e

10 (#2)

Type RT_STRING
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x36
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.38476
MD5 9405e8adfb2090ee959d385f382c1c9a
SHA1 9675a8f4d640dec5fe44a7bede8a96a48522d0b8
SHA256 e2c4b62f8120bf17e5f8218d774db26e0b6b6265276d0a4ccc08c5e8819abc12
SHA3 017b407ffa947558bb6071877d2f9b1a7a05c71838c6ec92241ef73c34270425

3841

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x82
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.81705
MD5 8bb814f43734537868736a6df5dcc012
SHA1 3ae7a8f8678bc2aed76f745960730097032389b6
SHA256 d91dc4e26fd86def5ee907c72f32457bea07d21fa618012245f641d08501548d
SHA3 73fabbc3aad03738eda288b6d45b076e7f94f1ff8de37df5ac4d6e7dc7a48f98

3842

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x2a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 0.960953
MD5 0131ce1c2237957b6926d5097b0af63d
SHA1 2ce37b98065cc4de92e99eb0777e0e1159102068
SHA256 05e0d5787611ed4f643733e3e6e62d00f426422b5d3e443ceebac22e9d294bc4
SHA3 9ee7bcb02f48332a4fac72465297312ef9c765b03edf2ab24a4b3de0840bda6c

3843

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x184
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.08634
MD5 58655591099de216feb4cc512012d318
SHA1 4001db00e1535b26b506e6d033e9759351ae6874
SHA256 9665348f07508c6c2a568fc90ec4c04736668adc3521e311a4c7659973d92313
SHA3 296c00546a67204c06806ff85a9e3e065559b2b85b22fec4166afc19cad4b6f9

3857

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x4ee
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.27024
MD5 8bb8d06e4cc7bf37b4af2a26f3a1d813
SHA1 a17d97834a5141a7094de1d27224e2b14b94b498
SHA256 fcb87f4b1b4178dae839137498027a0cfdf4247d1b49e741b5015313a2cd6a2d
SHA3 1d35bf4d5121f58b146895c17013001a95be7563b0a5f0267afa8c442c8bb300

3858

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x264
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.11275
MD5 3dbecd982474b9072ecd4aefe7406857
SHA1 ee81b0d03aebe1cde90de59031771f416d29eef2
SHA256 eaa0b4fe4704e193dd2ed1f8de1cb20e1001034fdb30307ee44aa664966d4ffc
SHA3 9053da012393a18a8a9012e2ab17735c7c864f0463086c9439c3a74a37ed7ee7

3859

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x2da
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16694
MD5 9e3221160c33e15054ff236daf2263d7
SHA1 cf41e0cdd3377698f819c4ef95ab56de40c57a5a
SHA256 cffcd4956911b3d50eef378cb051e598baba0db48246b07780af03b01c67c64d
SHA3 663e17de8922b049f83fdeca37a68d626bb83566bc377d85be42c653707a2b74

3860

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x8a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.71087
MD5 5988b72b85cd1c121906b20e7526fdf2
SHA1 45efa4995e9c25a32e3f47a15b63a813cc6e8fc4
SHA256 35b5abb90316b4017d5531e031cbf15bae6e8dd46f6dd221701693a22a7795be
SHA3 afa115b83c9f9b2f16ce1e14424b4e2cf6216cbcee84835e0b5cec4a23510a93

3865

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0xac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.63903
MD5 5fbbd2a5f564e043553889eec9147920
SHA1 2ddafabdf2bf5b62090419f07f731c4d02f0d987
SHA256 1b8660b0c53b94f3e029de58e56d08c8097a080244e9dc65d4155a9b603820d8
SHA3 1a90cf149f1fc5cfa9cd3f82f9a079ec48c7f7ce76dc4be601e538ae5c052ab9

3866

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0xde
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.87807
MD5 a0838b75a6ffc345212d18178663bb7d
SHA1 a90a0eccdf4cc4c50f430195695a3b65adefe5e8
SHA256 31bff9afbf08a8869318cd946a1d73a4425afefc5693c6e06671bde1e86de1dc
SHA3 ad576d2bedb8e173fb207310f244bee3ad8c898a2101cb67da930fadf80ec7d0

3867

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x4a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.24671
MD5 7e0e2d984d6d743b4d90b04758507505
SHA1 bec6af6197b875caf3064c7e053b64044904c1bb
SHA256 2b5551644093e58a4af74928fb744bd735fa2ef5f99824e6918ff9f6a33a3803
SHA3 08f040ebd50cc1809f91378999331d0d19e7364612041db3805a0ff1d37050e5

3868

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.10695
MD5 cd11e247927c7360d3447bbb2e01d326
SHA1 0e6b76a1cf9824dac91fad3a346388589987cb9a
SHA256 e9212b16f2d3292d0b0eb67134a70778ff1b0aede4918831e5bdba3f950db2a7
SHA3 7a0a3e741ea89b752fca14451f1e9b9ac5600d99a7408d04c7835e30688f8fcf

3869

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x2c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.07875
MD5 4b18eed800e2806db8e0aacb95fd54f2
SHA1 8b09634f818d6823f6466717f3863cbb466d97c1
SHA256 0714c554acd308b38c3d6319f7e470f76a16d712f696545eacac2bdc725dfb95
SHA3 067dea0fda55e331beab407da1e0e79a9d71fe8a8d0c965384d459ce0a8d499a

3887

Type RT_STRING
Language English - United States
Codepage Latin 1 / Western European
Size 0x53e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.18003
MD5 c260fc0560cc8c7d1a979db82f172142
SHA1 0cf7de555da00d9160b2311a25c459da7de598f9
SHA256 a5e23c6071b4faf115605493d1fd2e238c1d915b412f869aa6a7a77726f56082
SHA3 b5f76ff984cfc414e534d6bcd71dce53168b5371571326279bbae2c616c0abfe

30977

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x22
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.25451
Detected Filetype Cursor file
MD5 dfdc01a062b80e61a53db5a3761e586b
SHA1 db99b6199898558cf83c1beb23be0040980c8746
SHA256 744b3daba424ceb5e8d7d49c70ed4a70c0ff221cbe5ff142cf793c9d85909197
SHA3 c3afa8907265772f94fd165f0601e374df3a57213780b6e7794dd2b2286cb13f
Preview

30998

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 eaf1b83c561a97555fc0cde38891a389
SHA1 29eca824a284b26bb760963ad84bce64799dc770
SHA256 b077d477d0775d0b86be9bedee8ec134bdc213d6941e9ae60adcf8bdd18623cc
SHA3 2f4c2fa13d5c6dda7479c65d1e74e7d1977e50560f25c62b466daad9e75722ae
Preview

30999

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 79bc23c45190436b2c51ff2941fa8720
SHA1 0a8234176fad8831709703a0a34337a08987a983
SHA256 b328fe22a904a2e7e1341a95dbf00e2fdffc9ab350bc64c5ee348d3007c2b479
SHA3 b897f30ec85dad865a74be84cd616e0066da486befd0983d87e2b6f5d66a6c6b
Preview

31000

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 2fbccba7b754792dfc2070456e66fbd7
SHA1 6017f22c993c7d724876e35e8c54e7c4603eafae
SHA256 60a0a8bc0169228c8af42c377d93a218ccc9712a17b76ef014f81e156a36c66f
SHA3 f1edf8c8df156e449682ec443c0a87232b94e17062148388949ba84b7eb55227
Preview

31001

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 459379b9418ad5b62b1bf409300acb32
SHA1 5363fc84172d6b624542a0b52edbbfe21e2443ae
SHA256 1085b7390dbd2b2006f85619521047c6ca58a8b274196eeed48e74ad8a1b746a
SHA3 2b8f3218d3da7e4ee463a712c6c3b8f5b58cc6799a84f5e582b6a40da38a2bfc
Preview

31002

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 975596b334c3811a6899d17dc1083c83
SHA1 77adb688a202706cd60619067d29413db049e2c3
SHA256 749de8c6268f233434feebbff1f5f5539d32cb07e993e3683224a191a035362e
SHA3 f71229575da7bdbcc657ce7b3d0ea4a9395a2a1c748478c6d01ff7cc47ba620c
Preview

31003

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 690a20e696fc4e33ffb377a8ef54fb97
SHA1 972159605fa069921dbdee9b7a35879e6f1928a6
SHA256 6c2ef97bca5cdc6aa6de65b1f1ae8328bcb3494a16025eee870231d991e2cd56
SHA3 fd9d56519b5bf976a4ae748fe0c51dcd47ac27ce6a7c271fa2bbb3e00f473b22
Preview

31004

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 b17264d20faaa8ae0bcfffd2a28b5821
SHA1 cc3a0c683d3a70e81de9bd8dca7c7da25df1ec9a
SHA256 04fe4c49379fb61d65560745031cf797d5234fbc2886e1ee5245141e3f71cdba
SHA3 b9748f87bc9a8bad6f25bd2088709ce4bf07c044674cd302e3cc76e3bc878a83
Preview

31005

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 1e219dd609ce399df95ba7af59ef113f
SHA1 436a16dd20d5e3ec42342a4d005a664cd227f517
SHA256 8f51832638675f16ec5f251ab59251b3f85d84e5129025d44c45b3191b331c58
SHA3 9e44adcf523bb484f416a99197d947211027feae6b6665b457883e548218befd
Preview

31006

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 79ae5478465a9feb537afcca01f560d8
SHA1 48a70a0e9667e0f1726a2bac4c971616e1980c1a
SHA256 90b143ec83ef48639ea48969a1d0850aa14b573b48dadef87e4230e42bdb5971
SHA3 db5dc137de891f95ecec33bb5ab37284a6b6e93c595a6892970111442b14c483
Preview

31007

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 d3d02cf14dbfe1523c1ef143cea3eb85
SHA1 af4b9b5a7c69ac8682ec367b7873e0ddbc5acf40
SHA256 a9453e1af624a62f80defdca32aacf5bb0e031e40db0bcaba38707b209354914
SHA3 71fc8dced4a4b7c0d8aee098303fa90f4832bb4092bf96393fbb47d267e2ea5b
Preview

31008

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 c8872a05e76e0ef00f1eae141c9035b7
SHA1 dd2072409381c136906a4ec3e7a313d469061703
SHA256 6963da9b0f501c836ec1faa3291509c14f590e21c9dab60334935b82bf96ed2c
SHA3 f0a5677f68149eadaf661d29b05e710554d8701e3eb134487273b48b45995b69
Preview

31009

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 a8e3d308634fed8be67e2407a0a5baf7
SHA1 573f5ca20167e20eb7e8d2fcba8ddda418fc4f55
SHA256 24bcf1184228f7899773ec8556b32250ddfe39b85fd4262886a2c7812f867e53
SHA3 1205719114281d8e4f7d38768e99d60dc728e005067fb30665fb453880e1ddbd
Preview

31010

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.91924
Detected Filetype Cursor file
MD5 4634b24e3e8ba5549e36c8ce0da4db72
SHA1 6f933990cefa2e67147e6d3b9132f74281bfa183
SHA256 1dfd89b18fd53004c4a6f623c36e459408b4788b4619d38b42e75c2847e2ed72
SHA3 c56c27c633699841e29005512e7c7fb0560eca864520aa59d859c1edc02d9c3f
Preview

31011

Type RT_GROUP_CURSOR
Language English - United States
Codepage Latin 1 / Western European
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.01924
Detected Filetype Cursor file
MD5 ed8179c5f20ff874be1bd0098af76eca
SHA1 7aa6b6ba529c2710c7bea69fb18a2067852ef987
SHA256 64e17430676e2113178247a5c0d792ae704d00899cb60c56156fc7d9bf824b99
SHA3 37e8817122ee0379e2458e8b55132d062482ae553cf88b45725908a67012b190
Preview

128

Type RT_GROUP_ICON
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0xf4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.23973
Detected Filetype Icon file
MD5 61070fd174e78a61905df2b212ebb132
SHA1 3a80e80ea9d675f783a5d0974ad3897f222869d9
SHA256 32052753ee9ef26107e5e72934d77155ebd23429135b4512e78dea1bc845fc64
SHA3 cad5399c8a62d97c7330329dc1dbf1d1f9c8f284d01524ebd0d78c02980293a8

1 (#2)

Type RT_VERSION
Language Chinese - Taiwan
Codepage Latin 1 / Western European
Size 0x538
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.45032
MD5 79744695a0ca122232fc8c51a7f50044
SHA1 38a7bc80f3f7fae15ed88ffbc43fcfbc8f2f5dde
SHA256 4c4d7cbbb19723ac59437ebcbfe8e891b769522576398d2f1f1fb90f022ae686
SHA3 872be4d72f0a1b733c6b64d25d163f4720043711489b353dd4df934ce09dcf7e

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x521
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.2169
MD5 3946ab8f95daa4065516d8595211745a
SHA1 7f66c167980cc4a07ef319643b996d5f41a218cc
SHA256 b53fd1dc5363b118539f3f304d8ac46e04b37a2ba3d52a2831a70798a7c3abdc
SHA3 8d09783a592a1398ade36abee4a02ff021b724e437062421121994996e3972e5

String Table contents

Apex One Outlook Mail Scan
Scanning...
Open
Save As
All Files (*.*)
Untitled
an unnamed file
&Hide
No error message is available.
Attempted an unsupported operation.
A required resource was unavailable.
Out of memory.
An unknown error has occurred.
Encountered an improper argument.
Incorrect filename.
Failed to open document.
Failed to save document.
Save changes to %1?
Failed to create empty document.
The file is too large to open.
Could not start print job.
Failed to launch help.
Internal application error.
Command failed.
Insufficient memory to perform operation.
System registry entries have been removed and the INI file (if any) was deleted.
Not all of the system registry entries (or INI file) were removed.
This program requires the file %Ts, which was not found on this system.
This program is linked to the missing export %Ts in the file %Ts. This machine may have an incompatible version of %Ts.
Enter an integer.
Enter a number.
Enter an integer between %1 and %2.
Enter a number between %1 and %2.
Enter no more than %1 characters.
Select a button.
Enter an integer between 0 and 255.
Enter a positive integer.
Enter a date and/or time.
Enter a currency.
Enter a GUID.
Enter a time.
Enter a date.
Unexpected file format.
%1
Cannot find this file.
Verify that the correct path and file name are given.
Destination disk drive is full.
Unable to read from %1, it is opened by someone else.
Unable to write to %1, it is read-only or opened by someone else.
Encountered an unexpected error while reading %1.
Encountered an unexpected error while writing %1.
%1: %2
Continue running script?
Dispatch exception: %1
Unable to read write-only property.
Unable to write read-only property.
Unable to load mail system support.
Mail system DLL is invalid.
Send Mail failed to send message.
No error occurred.
An unknown error occurred while accessing %1.
%1 was not found.
%1 contains an incorrect path.
Could not open %1 because there are too many open files.
Access to %1 was denied.
An incorrect file handle was associated with %1.
Could not remove %1 because it is the current directory.
Could not create %1 because the directory is full.
Seek failed on %1
Encountered a hardware I/O error while accessing %1.
Encountered a sharing violation while accessing %1.
Encountered a locking violation while accessing %1.
Disk full while accessing %1.
Attempted to access %1 past its end.
No error occurred.
An unknown error occurred while accessing %1.
Attempted to write to the reading %1.
Attempted to access %1 past its end.
Attempted to read from the writing %1.
%1 has a bad format.
%1 contained an unexpected object.
%1 contains an incorrect schema.
pixels
Uncheck
Check
Mixed
One or more auto-saved documents were found.
These are more recently saved than the currently open documents and contain changes that were made before the application closed.
Do you want to recover these auto-saved documents?
Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.
Recover the auto-saved documents
Open the auto-saved versions instead of the explicitly saved versions
Don't recover the auto-saved documents
Use the last explicitly saved versions of the documents
%Ts [Recovered]

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 14.0.0.3048
ProductVersion 14.0.0.3048
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName Trend Micro Inc.
CoverageBuild NO
CompileOption Release
BuildType Rel
FileDescription Trend Micro Common Client Uninstallation Service
FileVersion (#2) 14.0.0.3048
InternalName Common Client NT uninstaller
LegalCopyright Copyright (C) 2019 Trend Micro Incorporated. All rights reserved.
LegalTrademarks Copyright (C) Trend Micro Inc.
OriginalFilename webntrmv.EXE
PrivateBuild Build 3048 - 6/5/2019
ProductName Trend Micro OfficeScan (common client)
ProductVersion (#2) 14.0
SpecialBuild 3048
Resource LangID Chinese - Taiwan

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2019-Jun-05 08:23:04
Version 0.0
SizeofData 106
AddressOfRawData 0x469bd4
PointerToRawData 0x4683d4
Referenced File D:\OSCE-Common-MAIN_1.0\src\Setup\NTClientUninstaller\NTRmv\x64\Release\NTRmv.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2019-Jun-05 08:23:04
Version 0.0
SizeofData 20
AddressOfRawData 0x469c40
PointerToRawData 0x468440

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2019-Jun-05 08:23:04
Version 0.0
SizeofData 1004
AddressOfRawData 0x469c54
PointerToRawData 0x468454

TLS Callbacks

StartAddressOfRawData 0x14046a060
EndAddressOfRawData 0x14046a068
AddressOfIndex 0x1404df8f0
AddressOfCallbacks 0x14035b410
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x100
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x1404cb958

RICH Header

XOR Key 0xb615daff
Unmarked objects 0
ASM objects (VS2017 v15.?.? build 25203) 23
C++ objects (VS2017 v15.?.? build 25203) 257
C++ objects (VS2015 build 23026) 4
199 (41118) 14
136 (VS2008 SP1 build 30729) 1
C objects (VS2008 SP1 build 30729) 10
C++ objects (VS2008 SP1 build 30729) 1
C objects (VS 2015/2017 runtime 26706) 38
ASM objects (VS 2015/2017 runtime 26706) 10
C++ objects (VS2017 v15.6.6 compiler 26131) 8
Imports (VS2017 v15.8.1 compiler 26726) 8
135 (VS2008 SP1 build 30729) 3
C++ objects (VS2015 UPD3.1 build 24215) 51
C objects (VS2015 UPD3.1 build 24215) 26
C objects (VS2017 v15.?.? build 25203) 26
C++ objects (VS2015 UPD3 build 24210) 2
C++ objects (VS2012 build 50727 / VS2005 build 50727) 7
Imports (VS2008 SP1 build 30729) 52
Imports (VS2012 build 50727 / VS2005 build 50727) 7
Total imports 1192
C++ objects (VS 2015/2017 runtime 26706) 445
C++ objects (VS2017 v15.8.1 compiler 26726) 151
Resource objects (VS2017 v15.8.1 compiler 26726) 1
151 1
Linker (VS2017 v15.8.1 compiler 26726) 1

Errors

<-- -->