Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
cr7.exe

Overview

General Information

Sample name:cr7.exe
Analysis ID:1462577
MD5:125ada51e044501a2a2947aaa6c17386
SHA1:c024b096862411b0e1fdc20e60268f7783c2694e
SHA256:44e5af0e50fc549a6c7d296168e6e7029f7d0135e46474bcbf4b08dcfbedd517
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Creates a process in suspended mode (likely to inject code)
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • cr7.exe (PID: 412 cmdline: "C:\Users\user\Desktop\cr7.exe" MD5: 125ADA51E044501A2A2947AAA6C17386)
    • conhost.exe (PID: 6976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • notepad.exe (PID: 1812 cmdline: "C:\Windows\System32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: cr7.exeReversingLabs: Detection: 54%
Source: cr7.exeJoe Sandbox ML: detected
Source: cr7.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\computer\source\repos\CMakeProject4\CMakeProject4\CMakeProject4\Debug\CMakeProject4.pdb source: cr7.exe
Source: Binary string: Z:\Zemana\Projects\AMSDKCore\Driver\zam64.pdb source: trevor.0.dr
Source: Binary string: ntdll.pdb source: cr7.exe, 00000000.00000002.2009465040.00000214363D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: cr7.exe, 00000000.00000002.2009465040.00000214363D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\computer\source\repos\CMakeProject4\CMakeProject4\CMakeProject4\Debug\CMakeProject4.pdbD source: cr7.exe
Source: trevor.0.drString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: trevor.0.drString found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: trevor.0.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: trevor.0.drString found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: trevor.0.drString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: trevor.0.drString found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: trevor.0.drString found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: trevor.0.drString found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: trevor.0.drString found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: trevor.0.drString found in binary or memory: http://s.symcd.com06
Source: trevor.0.drString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: trevor.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: trevor.0.drString found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: trevor.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: trevor.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: trevor.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: trevor.0.drString found in binary or memory: https://d.symcb.com/cps0%
Source: trevor.0.drString found in binary or memory: https://d.symcb.com/rpa0
Source: trevor.0.drString found in binary or memory: https://d.symcb.com/rpa0.
Source: cr7.exeString found in binary or memory: https://go.micr
Source: cr7.exeString found in binary or memory: https://go.microso
Source: trevor.0.drString found in binary or memory: https://www.globalsign.com/repository/0
Source: cr7.exeStatic PE information: invalid certificate
Source: cr7.exeStatic PE information: Resource name: RT_STRING type: 0421 Alliant compact executable not stripped
Source: cr7.exeStatic PE information: Resource name: RT_STRING type: PDP-11 executable not stripped
Source: cr7.exeStatic PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: cr7.exeBinary or memory string: OriginalFilename vs cr7.exe
Source: cr7.exe, 00000000.00000002.2009465040.000002143655C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs cr7.exe
Source: cr7.exe, 00000000.00000002.2009927179.00007FF7C81BB000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamesepWscSvc.exeZ vs cr7.exe
Source: cr7.exeBinary or memory string: OriginalFilenamesepWscSvc.exeZ vs cr7.exe
Source: trevor.0.drBinary string: \Device\B5A6B7C9-1E31-4E62-91CB-6078ED1E9A4F
Source: trevor.0.drBinary string: \Device\amsdk
Source: classification engineClassification label: mal52.winEXE@4/1@0/0
Source: C:\Users\user\Desktop\cr7.exeFile created: C:\Users\user\Desktop\trevorJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_03
Source: C:\Users\user\Desktop\cr7.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: cr7.exeReversingLabs: Detection: 54%
Source: unknownProcess created: C:\Users\user\Desktop\cr7.exe "C:\Users\user\Desktop\cr7.exe"
Source: C:\Users\user\Desktop\cr7.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cr7.exeProcess created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe"
Source: C:\Users\user\Desktop\cr7.exeProcess created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe"Jump to behavior
Source: C:\Users\user\Desktop\cr7.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\cr7.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\cr7.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\cr7.exeSection loaded: kernel.appcore.dllJump to behavior
Source: cr7.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: cr7.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: cr7.exeStatic file information: File size 5311624 > 1048576
Source: cr7.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x1a8600
Source: cr7.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x13a200
Source: cr7.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cr7.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cr7.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cr7.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cr7.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cr7.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: cr7.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: cr7.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\computer\source\repos\CMakeProject4\CMakeProject4\CMakeProject4\Debug\CMakeProject4.pdb source: cr7.exe
Source: Binary string: Z:\Zemana\Projects\AMSDKCore\Driver\zam64.pdb source: trevor.0.dr
Source: Binary string: ntdll.pdb source: cr7.exe, 00000000.00000002.2009465040.00000214363D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: cr7.exe, 00000000.00000002.2009465040.00000214363D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\computer\source\repos\CMakeProject4\CMakeProject4\CMakeProject4\Debug\CMakeProject4.pdbD source: cr7.exe
Source: cr7.exeStatic PE information: real checksum: 0x3a4402 should be: 0x513288
Source: cr7.exeStatic PE information: section name: .textbss
Source: cr7.exeStatic PE information: section name: .00cfg
Source: cr7.exeStatic PE information: section name: _RDATA
Source: trevor.0.drStatic PE information: section name: .hook
Source: C:\Users\user\Desktop\cr7.exeFile created: C:\Users\user\Desktop\trevorJump to dropped file
Source: C:\Users\user\Desktop\cr7.exeFile created: C:\Users\user\Desktop\trevorJump to dropped file
Source: C:\Users\user\Desktop\cr7.exeDropped PE file which has not been started: C:\Users\user\Desktop\trevorJump to dropped file
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: cr7.exeBinary or memory string: \system32\vboxmrxnp.dll
Source: cr7.exeBinary or memory string: \system32\drivers\vmmouse.sys
Source: cr7.exeBinary or memory string: \system32\drivers\VBoxMouse.sys
Source: cr7.exeBinary or memory string: \system32\drivers\VBoxSF.sys
Source: cr7.exeBinary or memory string: \ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\agent.pyw\system32\drivers\vmmouse.sys\system32\drivers\vmhgfs.sys\system32\drivers\VBoxMouse.sys\system32\drivers\VBoxGuest.sys\system32\drivers\VBoxSF.sys\system32\drivers\VBoxVideo.sys\system32\vboxdisp.dll\system32\vboxhook.dll\system32\vboxmrxnp.dll\system32\vboxogl.dll\system32\vboxoglarrayspu.dll\system32\vboxoglcrutil.dll\system32\vboxoglerrorspu.dll\system32\vboxoglfeedbackspu.dll\system32\vboxoglpackspu.dll\system32\vboxoglpassthroughspu.dll\system32\vboxservice.exe\system32\vboxtray.exe\system32\VBoxControl.exe%s%sMicrosoft Maintenance\Microsoft CorporationMicrosoft\SystemMaintenance\Maintenance.exeSYSTEMMicrosoft SecuritySecureDownload AgentInternetOpen %d
Source: cr7.exeBinary or memory string: \system32\vboxhook.dll
Source: cr7.exeBinary or memory string: \system32\vboxtray.exe
Source: cr7.exeBinary or memory string: \system32\drivers\vmhgfs.sys
Source: cr7.exeBinary or memory string: \system32\vboxservice.exe
Source: cr7.exeBinary or memory string: \system32\drivers\VBoxGuest.sys
Source: C:\Users\user\Desktop\cr7.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\cr7.exeProcess created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe"Jump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
DLL Side-Loading		11
Process Injection		11
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		11
Process Injection		LSASS Memory1
Process Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
DLL Side-Loading		Security Account Manager1
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1462577 Sample: cr7.exe Startdate: 25/06/2024 Architecture: WINDOWS Score: 52 15 Multi AV Scanner detection for submitted file 2->15 17 Machine Learning detection for sample 2->17 6 cr7.exe 2 2->6         started        process3 file4 13 C:\Users\user\Desktop\trevor, PE32+ 6->13 dropped 9 conhost.exe 6->9         started        11 notepad.exe 6->11         started        process5

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
cr7.exe54%ReversingLabsWin64.Trojan.Generic
cr7.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\Desktop\trevor4%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://go.microso0%Avira URL Cloudsafe
https://go.micr0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://go.microsocr7.exefalse
  • Avira URL Cloud: safe
unknown
https://go.micrcr7.exefalse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1462577
Start date and time:2024-06-25 18:42:07 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 2m 14s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:4
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:cr7.exe
Detection:MAL
Classification:mal52.winEXE@4/1@0/0
EGA Information:Failed
HCA Information:Failed
Cookbook Comments:
  • Found application associated with file extension: .exe
  • Stop behavior analysis, all processes terminated
  • Exclude process from analysis (whitelisted): dllhost.exe
  • Not all processes where analyzed, report is missing behavior information
  • VT rate limit hit for: cr7.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\Desktop\trevor

Download File
Process:C:\Users\user\Desktop\cr7.exe
File Type:PE32+ executable (native) x86-64, for MS Windows
Category:dropped
Size (bytes):226464
Entropy (8bit):6.395697443589292
Encrypted:false
SSDEEP:3072:ASf+tEO/xi9iS9TiNjBJ0eYY/sL5hVcvH6do6XFZHmOcACmAYrP1hQfUcl7P+:3fod49iXHSLyC6Umm1qRl7W
MD5:EB525D99A31EB4FFF09814E83593A494
SHA1:290D6376658CF0F8182DE0FAE40B503098FA09FD
SHA-256:6F55C148BB27C14408CF0F16F344ABCD63539174AC855E510A42D78CFAEC451C
SHA-512:385E4FE59D42B30C68767AA5A9590569F8B7C127448D4E28D52566400DDB7C56D1F515BC164507ADE94CC660DDEA18981CFC47CAE3502A59ED98EF0DAA6E15A6
Malicious:false
Antivirus:
  • Antivirus: ReversingLabs, Detection: 4%
Reputation:low
Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...........xL.....x^....`wp....`ww...........xX.....xH...........................\...........Rich...........................PE..d...9.\.........."......Z..........p..........@.............................@......B...........................................................<.... ..H.......P....(...L...0..p....D..8............................|..p............@...............................text...U........ .................. ..h.hook........0.......$.............. ....rdata..HK...@...L..................@..H.data....?.......j...z..............@....pdata..P...........................@..HPAGE....G........................... ..`INIT................................ ....rsrc...H.... ....... ..............@..B.reloc..4....0.......$..............@..B........................................................................................................

Static File Info

General

File type:PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):6.665367597866851
TrID:
  • Win64 Executable Console (202006/5) 92.65%
  • Win64 Executable (generic) (12005/4) 5.51%
  • Generic Win/DOS Executable (2004/3) 0.92%
  • DOS Executable Generic (2002/1) 0.92%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:cr7.exe
File size:5'311'624 bytes
MD5:125ada51e044501a2a2947aaa6c17386
SHA1:c024b096862411b0e1fdc20e60268f7783c2694e
SHA256:44e5af0e50fc549a6c7d296168e6e7029f7d0135e46474bcbf4b08dcfbedd517
SHA512:3ddc5a71b928ee6f4f39a913e1558c5b38a49f28c332cdff3e661842b3110a651670e80ed44117f7eae2d4e77aa70a389a15f0440c8c81d85d9084723d05b7d6
SSDEEP:98304:AiHinNgbHin8T3QOx8jQ9JjzDTjzYLhL2l:AiHi+bHi2NWKjzDTjzYLhg
TLSH:69362906A7FA5194F1FADB34A8723215BD367CA19B38D6CF1240794E0A30BE4DD79722
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`...`...`.......`.......`.......`.......`.......`.......`.......`.......`...`..x`.......`....\..`...`4..`.......`..Rich.`.

File Icon

Icon Hash:cacacacacaf8391b

Static PE Info

General

Entrypoint:0x1400cdcfa
Entrypoint Section:.text
Digitally signed:true
Imagebase:0x140000000
Subsystem:windows cui
Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:0x654258BA [Wed Nov 1 13:55:06 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:0
File Version Major:6
File Version Minor:0
Subsystem Version Major:6
Subsystem Version Minor:0
Import Hash:2547ce29f895e0732d955b0596cfe16e

Authenticode Signature

Signature Valid:false
Signature Issuer:CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:The digital signature of the object did not verify
Error Number:-2146869232
Not Before, Not After
  • 03/02/2023 01:05:33 01/02/2024 01:05:33
Subject Chain
  • CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:3
Thumbprint MD5:768751B1AA6FB8ACFD41E6633D102654
Thumbprint SHA-1:767F8AFD2E81DB55E3335B0BA24DE0791216E8F5
Thumbprint SHA-256:CD6A8C679312C385657E4AD554C76E105B6D598DFCD135D439598ADEB956AE00
Serial:3300000412F6D68F1BC165EC46000000000412
Instruction
jmp 00007F94DCD0A6D6h
jmp 00007F94DCCE5581h
jmp 00007F94DCE0E1CCh
jmp 00007F94DCCF5F67h
jmp 00007F94DCD66DA2h
jmp 00007F94DCD3910Dh
jmp 00007F94DCCB1D58h
jmp 00007F94DCDF3123h
jmp 00007F94DCD188CEh
jmp 00007F94DCC944B9h
jmp 00007F94DCD96E94h
jmp 00007F94DCCA1EAFh
jmp 00007F94DCD7DDEAh
jmp 00007F94DCD67DD5h
jmp 00007F94DCCC1B20h
jmp 00007F94DCD1871Bh
jmp 00007F94DCD2DFA6h
jmp 00007F94DCD44721h
jmp 00007F94DCD8630Ch
jmp 00007F94DCD0DDC6h
jmp 00007F94DCCFAFC2h
jmp 00007F94DCC8CE2Dh
jmp 00007F94DCE087F8h
jmp 00007F94DCD646A3h
jmp 00007F94DCD355EEh
jmp 00007F94DCCD4FC9h
jmp 00007F94DCC9E63Ah
jmp 00007F94DCDCD32Fh
jmp 00007F94DCCD4D8Ah
jmp 00007F94DCD02315h
jmp 00007F94DCC925C0h
jmp 00007F94DCDBCABBh
jmp 00007F94DCCEAE36h
jmp 00007F94DCD4C2B1h
jmp 00007F94DCE015FCh
jmp 00007F94DCDCCF27h
jmp 00007F94DCCDE8B2h
jmp 00007F94DCE03F5Dh
jmp 00007F94DCD0DCBFh
jmp 00007F94DCDBEAE3h
NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IMPORT0x327a380xc8.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x32c0000x13a081.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x3120000x12ae0.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY0x3982000x178a88
IMAGE_DIRECTORY_ENTRY_BASERELOC0x4670000x1238.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x2ae1800x38.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2ae0000x140.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x3270000xa38.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.textbss0x10000xc80570x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text0xca0000x1a84dc0x1a860042e50b5945251505407c4ca5a1dd8a45False0.23153937315905743data5.130986011281998IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata0x2730000x550d80x5520049f7ad2780537ce3c9fc0db939cd4074False0.19390429974302498data3.851949594355534IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data0x2c90000x487310x454000d98f75775fe39a8179488e693739ca9False0.3674554377256318data5.895241799798162IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata0x3120000x149e80x14a004f35b0a802a1beed044274da2fccf03dFalse0.4544152462121212data5.417287297134212IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata0x3270000x25ad0x260053b5712a9fac28de1f92dcc741220483False0.24814967105263158Intel amd64 COFF executable, not stripped, 50 sections, symbol offset=0x3287de, optional header size 347663.725830659680929IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg0x32a0000x1750x20094ec3197a9dd5d013c218eb58e57401dFalse0.0703125data0.5028476853987845IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA0x32b0000x29f0x40031d59d2fe5afebd739b9b1de9d0637ddFalse0.203125data1.8696838148199955IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc0x32c0000x13a0810x13a200d1f49b35b938dc869584998f18851188False0.24048463614206128data5.772109568031221IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0x4670000x38c50x3a008f2124bd7027905aba6d98fd36381d8aFalse0.1509967672413793data2.4689674816360894IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
NameRVASizeTypeLanguageCountryZLIB Complexity
KILLER_ULTRA0x330f640x374a0dataEnglishUnited States0.4504557015684612
RT_BITMAP0x3684040x1b38Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mArabicSaudi Arabia0.46426521239954077
RT_BITMAP0x369f3c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mChineseTaiwan0.4626006904487917
RT_BITMAP0x36ba640x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mCzechCzech Republic0.4626006904487917
RT_BITMAP0x36d58c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mDanishDenmark0.4626006904487917
RT_BITMAP0x36f0b40x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mGermanGermany0.4626006904487917
RT_BITMAP0x370bdc0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mGreekGreece0.4626006904487917
RT_BITMAP0x3727040x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mEnglishUnited States0.4626006904487917
RT_BITMAP0x37422c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mFinnishFinland0.4626006904487917
RT_BITMAP0x375d540x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mFrenchFrance0.4626006904487917
RT_BITMAP0x37787c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mHebrewIsrael0.4626006904487917
RT_BITMAP0x3793a40x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mHungarianHungary0.4626006904487917
RT_BITMAP0x37aecc0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mItalianItaly0.4626006904487917
RT_BITMAP0x37c9f40x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mJapaneseJapan0.4626006904487917
RT_BITMAP0x37e51c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mKoreanNorth Korea0.4626006904487917
RT_BITMAP0x37e51c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mKoreanSouth Korea0.4626006904487917
RT_BITMAP0x3800440x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mDutchNetherlands0.4626006904487917
RT_BITMAP0x381b6c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mNorwegianNorway0.4626006904487917
RT_BITMAP0x3836940x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mPolishPoland0.4626006904487917
RT_BITMAP0x3851bc0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mPortugueseBrazil0.4626006904487917
RT_BITMAP0x386ce40x1b48Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mRussianRussia0.4667812142038946
RT_BITMAP0x38882c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mSwedishSweden0.4626006904487917
RT_BITMAP0x38a3540x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mTurkishTurkey0.4626006904487917
RT_BITMAP0x38be7c0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mChineseChina0.4626006904487917
RT_BITMAP0x38d9a40x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/mPortuguesePortugal0.4626006904487917
RT_BITMAP0x38f4cc0x1b28Device independent bitmap graphic, 48 x 48 x 24, image size 6912, resolution 2834 x 2834 px/m0.4626006904487917
RT_ICON0x390ff40x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.33815028901734107
RT_ICON0x39155c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.46631205673758863
RT_DIALOG0x3919c40x1eadataArabicSaudi Arabia0.5530612244897959
RT_DIALOG0x391bb00x128dataChineseTaiwan0.6993243243243243
RT_DIALOG0x391cd80x1e8dataCzechCzech Republic0.569672131147541
RT_DIALOG0x391ec00x23adataDanishDenmark0.5263157894736842
RT_DIALOG0x3920fc0x1f2dataGermanGermany0.572289156626506
RT_DIALOG0x3922f00x222dataGreekGreece0.5494505494505495
RT_DIALOG0x3925140x1e4dataEnglishUnited States0.5516528925619835
RT_DIALOG0x3926f80x200dataFinnishFinland0.53125
RT_DIALOG0x3928f80x230dataFrenchFrance0.5178571428571429
RT_DIALOG0x392b280x1d4dataHebrewIsrael0.5769230769230769
RT_DIALOG0x392cfc0x22adataHungarianHungary0.5216606498194946
RT_DIALOG0x392f280x236dataItalianItaly0.47703180212014135
RT_DIALOG0x3931600x158dataJapaneseJapan0.7267441860465116
RT_DIALOG0x3932b80x14edataKoreanNorth Korea0.6586826347305389
RT_DIALOG0x3932b80x14edataKoreanSouth Korea0.6586826347305389
RT_DIALOG0x3934080x27cdataDutchNetherlands0.46540880503144655
RT_DIALOG0x3936840x1fedataNorwegianNorway0.5490196078431373
RT_DIALOG0x3938840x240dataPolishPoland0.5173611111111112
RT_DIALOG0x393ac40x232dataPortugueseBrazil0.5355871886120996
RT_DIALOG0x393cf80x20edataRussianRussia0.5285171102661597
RT_DIALOG0x393f080x1e4dataSwedishSweden0.5681818181818182
RT_DIALOG0x3940ec0x21adataTurkishTurkey0.5669144981412639
RT_DIALOG0x3943080x126dataChineseChina0.717687074829932
RT_DIALOG0x3944300x228dataPortuguesePortugal0.5307971014492754
RT_DIALOG0x3946580x246data0.5120274914089347
RT_DIALOG0x3948a00x4c2dataArabicSaudi Arabia0.4269293924466338
RT_DIALOG0x394d640x27cdataChineseTaiwan0.5628930817610063
RT_DIALOG0x394fe00x53cdataCzechCzech Republic0.4044776119402985
RT_DIALOG0x39551c0x56cdataDanishDenmark0.38328530259365995
RT_DIALOG0x395a880x5d2dataGermanGermany0.37718120805369126
RT_DIALOG0x39605c0x5f6dataGreekGreece0.3951507208387942
RT_DIALOG0x3966540x4eadataEnglishUnited States0.38235294117647056
RT_DIALOG0x396b400x4b6dataFinnishFinland0.3814262023217247
RT_DIALOG0x396ff80x566dataFrenchFrance0.36396526772793053
RT_DIALOG0x3975600x476dataHebrewIsrael0.43695271453590195
RT_DIALOG0x3979d80x540dataHungarianHungary0.4099702380952381
RT_DIALOG0x397f180x582dataItalianItaly0.37375886524822693
RT_DIALOG0x39849c0x366dataJapaneseJapan0.5287356321839081
RT_DIALOG0x3988040x32edataKoreanNorth Korea0.5528255528255528
RT_DIALOG0x3988040x32edataKoreanSouth Korea0.5528255528255528
RT_DIALOG0x398b340x558dataDutchNetherlands0.3713450292397661
RT_DIALOG0x39908c0x4fedataNorwegianNorway0.3755868544600939
RT_DIALOG0x39958c0x55cdataPolishPoland0.39577259475218657
RT_DIALOG0x399ae80x560dataPortugueseBrazil0.3633720930232558
RT_DIALOG0x39a0480x538dataRussianRussia0.40194610778443113
RT_DIALOG0x39a5800x538dataSwedishSweden0.38997005988023953
RT_DIALOG0x39aab80x526dataTurkishTurkey0.3899848254931715
RT_DIALOG0x39afe00x296dataChineseChina0.5634441087613293
RT_DIALOG0x39b2780x54edataPortuguesePortugal0.3711340206185567
RT_DIALOG0x39b7c80x54cdata0.37168141592920356
RT_DIALOG0x39bd140x3dcdataArabicSaudi Arabia0.4493927125506073
RT_DIALOG0x39c0f00x206dataChineseTaiwan0.6795366795366795
RT_DIALOG0x39c2f80x4cedataCzechCzech Republic0.4195121951219512
RT_DIALOG0x39c7c80x4f6dataDanishDenmark0.38661417322834646
RT_DIALOG0x39ccc00x590dataGermanGermany0.3728932584269663
RT_DIALOG0x39d2500x4e0dataGreekGreece0.4423076923076923
RT_DIALOG0x39d7300x438dataEnglishUnited States0.42314814814814816
RT_DIALOG0x39db680x48cdataFinnishFinland0.3805841924398625
RT_DIALOG0x39dff40x4e6dataFrenchFrance0.39553429027113235
RT_DIALOG0x39e4dc0x3a6dataHebrewIsrael0.4539614561027837
RT_DIALOG0x39e8840x4fcdataHungarianHungary0.42398119122257055
RT_DIALOG0x39ed800x506dataItalianItaly0.37636080870917576
RT_DIALOG0x39f2880x2f2dataJapaneseJapan0.5848806366047745
RT_DIALOG0x39f57c0x2c8dataKoreanNorth Korea0.601123595505618
RT_DIALOG0x39f57c0x2c8dataKoreanSouth Korea0.601123595505618
RT_DIALOG0x39f8440x4b8dataDutchNetherlands0.396523178807947
RT_DIALOG0x39fcfc0x434dataNorwegianNorway0.41821561338289964
RT_DIALOG0x3a01300x560dataPolishPoland0.3873546511627907
RT_DIALOG0x3a06900x4a4dataPortugueseBrazil0.4166666666666667
RT_DIALOG0x3a0b340x486dataRussianRussia0.4119170984455959
RT_DIALOG0x3a0fbc0x46cdataSwedishSweden0.3992932862190813
RT_DIALOG0x3a14280x426dataTurkishTurkey0.4152542372881356
RT_DIALOG0x3a18500x1fcdataChineseChina0.6692913385826772
RT_DIALOG0x3a1a4c0x52cdataPortuguesePortugal0.38972809667673713
RT_DIALOG0x3a1f780x4d2data0.38168557536466774
RT_DIALOG0x3a244c0x198dataArabicSaudi Arabia0.5098039215686274
RT_DIALOG0x3a25e40x168dataChineseTaiwan0.49166666666666664
RT_DIALOG0x3a274c0x198dataCzechCzech Republic0.49754901960784315
RT_DIALOG0x3a28e40x1a8dataDanishDenmark0.49292452830188677
RT_DIALOG0x3a2a8c0x1d8dataGermanGermany0.4788135593220339
RT_DIALOG0x3a2c640x1d4dataGreekGreece0.5277777777777778
RT_DIALOG0x3a2e380x1a4dataEnglishUnited States0.47619047619047616
RT_DIALOG0x3a2fdc0x1acdataFinnishFinland0.49065420560747663
RT_DIALOG0x3a31880x1c4dataFrenchFrance0.4756637168141593
RT_DIALOG0x3a334c0x190dataHebrewIsrael0.525
RT_DIALOG0x3a34dc0x1b0dataHungarianHungary0.5092592592592593
RT_DIALOG0x3a368c0x1acdataItalianItaly0.4976635514018692
RT_DIALOG0x3a38380x184dataJapaneseJapan0.5257731958762887
RT_DIALOG0x3a39bc0x16cdataKoreanNorth Korea0.4835164835164835
RT_DIALOG0x3a39bc0x16cdataKoreanSouth Korea0.4835164835164835
RT_DIALOG0x3a3b280x1acdataDutchNetherlands0.48598130841121495
RT_DIALOG0x3a3cd40x19cdataNorwegianNorway0.49029126213592233
RT_DIALOG0x3a3e700x1bcdataPolishPoland0.5202702702702703
RT_DIALOG0x3a402c0x1acdataPortugueseBrazil0.4929906542056075
RT_DIALOG0x3a41d80x1b4dataRussianRussia0.4954128440366973
RT_DIALOG0x3a438c0x1a4dataSwedishSweden0.4857142857142857
RT_DIALOG0x3a45300x1a0dataTurkishTurkey0.49278846153846156
RT_DIALOG0x3a46d00x164dataChineseChina0.48314606741573035
RT_DIALOG0x3a48340x1b0dataPortuguesePortugal0.5092592592592593
RT_DIALOG0x3a49e40x1b4data0.46788990825688076
RT_DIALOG0x3a4b980x346dataArabicSaudi Arabia0.4737470167064439
RT_DIALOG0x3a4ee00x1a8dataChineseTaiwan0.7334905660377359
RT_DIALOG0x3a50880x3aadataCzechCzech Republic0.43816631130063965
RT_DIALOG0x3a54340x42edataDanishDenmark0.402803738317757
RT_DIALOG0x3a58640x48adataGermanGermany0.3795180722891566
RT_DIALOG0x3a5cf00x4b6dataGreekGreece0.42371475953565507
RT_DIALOG0x3a61a80x394dataEnglishUnited States0.4203056768558952
RT_DIALOG0x3a653c0x3ecdataFinnishFinland0.39641434262948205
RT_DIALOG0x3a69280x46adataFrenchFrance0.38495575221238937
RT_DIALOG0x3a6d940x2f6dataHebrewIsrael0.46965699208443273
RT_DIALOG0x3a708c0x422dataHungarianHungary0.4168241965973535
RT_DIALOG0x3a74b00x418dataItalianItaly0.3816793893129771
RT_DIALOG0x3a78c80x24cdataJapaneseJapan0.6258503401360545
RT_DIALOG0x3a7b140x21cdataKoreanNorth Korea0.6388888888888888
RT_DIALOG0x3a7b140x21cdataKoreanSouth Korea0.6388888888888888
RT_DIALOG0x3a7d300x452dataDutchNetherlands0.3860759493670886
RT_DIALOG0x3a81840x3aadataNorwegianNorway0.4147121535181237
RT_DIALOG0x3a85300x44edataPolishPoland0.4319419237749546
RT_DIALOG0x3a89800x3d4dataPortugueseBrazil0.42244897959183675
RT_DIALOG0x3a8d540x3d8dataRussianRussia0.42784552845528456
RT_DIALOG0x3a912c0x418dataSwedishSweden0.3816793893129771
RT_DIALOG0x3a95440x3ecdataTurkishTurkey0.4203187250996016
RT_DIALOG0x3a99300x194dataChineseChina0.7227722772277227
RT_DIALOG0x3a9ac40x416dataPortuguesePortugal0.4005736137667304
RT_DIALOG0x3a9edc0x426data0.384180790960452
RT_DIALOG0x3aa3040x3a0dataArabicSaudi Arabia0.44288793103448276
RT_DIALOG0x3aa6a40x20cdataChineseTaiwan0.7175572519083969
RT_DIALOG0x3aa8b00x426dataCzechCzech Republic0.4491525423728814
RT_DIALOG0x3aacd80x44adataDanishDenmark0.41530054644808745
RT_DIALOG0x3ab1240x448dataGermanGermany0.41058394160583944
RT_DIALOG0x3ab56c0x536dataGreekGreece0.4295352323838081
RT_DIALOG0x3abaa40x3fcdataEnglishUnited States0.43137254901960786
RT_DIALOG0x3abea00x50cdataFinnishFinland0.37306501547987614
RT_DIALOG0x3ac3ac0x4cadataFrenchFrance0.398858075040783
RT_DIALOG0x3ac8780x374dataHebrewIsrael0.4819004524886878
RT_DIALOG0x3acbec0x476dataHungarianHungary0.45271453590192645
RT_DIALOG0x3ad0640x448dataItalianItaly0.41514598540145986
RT_DIALOG0x3ad4ac0x2a4dataJapaneseJapan0.6301775147928994
RT_DIALOG0x3ad7500x262dataKoreanNorth Korea0.6524590163934426
RT_DIALOG0x3ad7500x262dataKoreanSouth Korea0.6524590163934426
RT_DIALOG0x3ad9b40x4c4dataDutchNetherlands0.38278688524590165
RT_DIALOG0x3ade780x3a2dataNorwegianNorway0.432258064516129
RT_DIALOG0x3ae21c0x478dataPolishPoland0.4458041958041958
RT_DIALOG0x3ae6940x43edataPortugueseBrazil0.429097605893186
RT_DIALOG0x3aead40x460dataRussianRussia0.4419642857142857
RT_DIALOG0x3aef340x41cdataSwedishSweden0.42490494296577946
RT_DIALOG0x3af3500x442dataTurkishTurkey0.43944954128440367
RT_DIALOG0x3af7940x1f2dataChineseChina0.714859437751004
RT_DIALOG0x3af9880x48edataPortuguesePortugal0.41080617495711835
RT_DIALOG0x3afe180x47edata0.4017391304347826
RT_DIALOG0x3b02980x210dataArabicSaudi Arabia0.5340909090909091
RT_DIALOG0x3b04a80x120dataChineseTaiwan0.7361111111111112
RT_DIALOG0x3b05c80x224dataCzechCzech Republic0.541970802919708
RT_DIALOG0x3b07ec0x264dataDanishDenmark0.5016339869281046
RT_DIALOG0x3b0a500x288dataGermanGermany0.48919753086419754
RT_DIALOG0x3b0cd80x294dataGreekGreece0.5257575757575758
RT_DIALOG0x3b0f6c0x26cdataEnglishUnited States0.47096774193548385
RT_DIALOG0x3b11d80x23cdataFinnishFinland0.4737762237762238
RT_DIALOG0x3b14140x2a8dataFrenchFrance0.47205882352941175
RT_DIALOG0x3b16bc0x1b4dataHebrewIsrael0.6032110091743119
RT_DIALOG0x3b18700x254dataHungarianHungary0.48825503355704697
RT_DIALOG0x3b1ac40x220dataItalianItaly0.5183823529411765
RT_DIALOG0x3b1ce40x168dataJapaneseJapan0.7166666666666667
RT_DIALOG0x3b1e4c0x158dataKoreanNorth Korea0.6918604651162791
RT_DIALOG0x3b1e4c0x158dataKoreanSouth Korea0.6918604651162791
RT_DIALOG0x3b1fa40x2a8dataDutchNetherlands0.47941176470588237
RT_DIALOG0x3b224c0x23cdataNorwegianNorway0.4982517482517482
RT_DIALOG0x3b24880x254dataPolishPoland0.5033557046979866
RT_DIALOG0x3b26dc0x294dataPortugueseBrazil0.45606060606060606
RT_DIALOG0x3b29700x214dataRussianRussia0.5469924812030075
RT_DIALOG0x3b2b840x268dataSwedishSweden0.4967532467532468
RT_DIALOG0x3b2dec0x26cdataTurkishTurkey0.49193548387096775
RT_DIALOG0x3b30580x114dataChineseChina0.7246376811594203
RT_DIALOG0x3b316c0x270dataPortuguesePortugal0.48717948717948717
RT_DIALOG0x3b33dc0x2a0data0.45535714285714285
RT_DIALOG0x3b367c0x464dataArabicSaudi Arabia0.4706405693950178
RT_DIALOG0x3b3ae00x300dataChineseTaiwan0.5755208333333334
RT_DIALOG0x3b3de00x4d8dataCzechCzech Republic0.4258064516129032
RT_DIALOG0x3b42b80x53cdataDanishDenmark0.41492537313432837
RT_DIALOG0x3b47f40x5c0dataGermanGermany0.40625
RT_DIALOG0x3b4db40x590dataGreekGreece0.4515449438202247
RT_DIALOG0x3b53440x470dataEnglishUnited States0.43661971830985913
RT_DIALOG0x3b57b40x4d8dataFinnishFinland0.43629032258064515
RT_DIALOG0x3b5c8c0x56cdataFrenchFrance0.41714697406340057
RT_DIALOG0x3b61f80x434dataHebrewIsrael0.4804832713754647
RT_DIALOG0x3b662c0x514dataHungarianHungary0.44769230769230767
RT_DIALOG0x3b6b400x5c0dataItalianItaly0.3960597826086957
RT_DIALOG0x3b71000x384dataJapaneseJapan0.5588888888888889
RT_DIALOG0x3b74840x36cdataKoreanNorth Korea0.5730593607305936
RT_DIALOG0x3b74840x36cdataKoreanSouth Korea0.5730593607305936
RT_DIALOG0x3b77f00x5e4dataDutchNetherlands0.393236074270557
RT_DIALOG0x3b7dd40x4e4dataNorwegianNorway0.4249201277955272
RT_DIALOG0x3b82b80x540dataPolishPoland0.4263392857142857
RT_DIALOG0x3b87f80x4dcdataPortugueseBrazil0.42443729903536975
RT_DIALOG0x3b8cd40x518dataRussianRussia0.4516871165644172
RT_DIALOG0x3b91ec0x500dataSwedishSweden0.4328125
RT_DIALOG0x3b96ec0x540dataTurkishTurkey0.42336309523809523
RT_DIALOG0x3b9c2c0x2fcdataChineseChina0.6007853403141361
RT_DIALOG0x3b9f280x4f8dataPortuguesePortugal0.4143081761006289
RT_DIALOG0x3ba4200x51cdata0.40214067278287463
RT_DIALOG0x3ba93c0x40cdataArabicSaudi Arabia0.4420849420849421
RT_DIALOG0x3bad480x270dataChineseTaiwan0.6378205128205128
RT_DIALOG0x3bafb80x48adataCzechCzech Republic0.4259896729776248
RT_DIALOG0x3bb4440x4a8dataDanishDenmark0.40268456375838924
RT_DIALOG0x3bb8ec0x51cdataGermanGermany0.386085626911315
RT_DIALOG0x3bbe080x52cdataGreekGreece0.43202416918429004
RT_DIALOG0x3bc3340x48cdataEnglishUnited States0.4106529209621993
RT_DIALOG0x3bc7c00x470dataFinnishFinland0.3970070422535211
RT_DIALOG0x3bcc300x510dataFrenchFrance0.3896604938271605
RT_DIALOG0x3bd1400x3a6dataHebrewIsrael0.4743040685224839
RT_DIALOG0x3bd4e80x4c0dataHungarianHungary0.42105263157894735
RT_DIALOG0x3bd9a80x49adataItalianItaly0.40237691001697795
RT_DIALOG0x3bde440x320dataJapaneseJapan0.58
RT_DIALOG0x3be1640x30edataKoreanNorth Korea0.5959079283887468
RT_DIALOG0x3be1640x30edataKoreanSouth Korea0.5959079283887468
RT_DIALOG0x3be4740x50adataDutchNetherlands0.3883720930232558
RT_DIALOG0x3be9800x484dataNorwegianNorway0.39792387543252594
RT_DIALOG0x3bee040x52cdataPolishPoland0.4078549848942598
RT_DIALOG0x3bf3300x49edataPortugueseBrazil0.4365482233502538
RT_DIALOG0x3bf7d00x4c2dataRussianRussia0.4376026272577997
RT_DIALOG0x3bfc940x4bcdataSwedishSweden0.39026402640264024
RT_DIALOG0x3c01500x4badataTurkishTurkey0.4033057851239669
RT_DIALOG0x3c060c0x264dataChineseChina0.6372549019607843
RT_DIALOG0x3c08700x4c0dataPortuguesePortugal0.39555921052631576
RT_DIALOG0x3c0d300x4a8data0.39429530201342283
RT_DIALOG0x3c11d80x1d6dataArabicSaudi Arabia0.6191489361702127
RT_DIALOG0x3c13b00x12cdataChineseTaiwan0.7966666666666666
RT_DIALOG0x3c14dc0x210dataCzechCzech Republic0.5757575757575758
RT_DIALOG0x3c16ec0x258dataDanishDenmark0.505
RT_DIALOG0x3c19440x240dataGermanGermany0.5347222222222222
RT_DIALOG0x3c1b840x244dataGreekGreece0.5982758620689655
RT_DIALOG0x3c1dc80x1dcdataEnglishUnited States0.5546218487394958
RT_DIALOG0x3c1fa40x200dataFinnishFinland0.541015625
RT_DIALOG0x3c21a40x21cdataFrenchFrance0.5407407407407407
RT_DIALOG0x3c23c00x1b2dataHebrewIsrael0.6336405529953917
RT_DIALOG0x3c25740x208dataHungarianHungary0.5711538461538461
RT_DIALOG0x3c277c0x214dataItalianItaly0.5451127819548872
RT_DIALOG0x3c29900x174dataJapaneseJapan0.7231182795698925
RT_DIALOG0x3c2b040x150dataKoreanNorth Korea0.7857142857142857
RT_DIALOG0x3c2b040x150dataKoreanSouth Korea0.7857142857142857
RT_DIALOG0x3c2c540x234dataDutchNetherlands0.5124113475177305
RT_DIALOG0x3c2e880x1e4dataNorwegianNorway0.5475206611570248
RT_DIALOG0x3c306c0x214dataPolishPoland0.5845864661654135
RT_DIALOG0x3c32800x244dataPortugueseBrazil0.5206896551724138
RT_DIALOG0x3c34c40x21cdataRussianRussia0.5814814814814815
RT_DIALOG0x3c36e00x228dataSwedishSweden0.532608695652174
RT_DIALOG0x3c39080x21edataTurkishTurkey0.5424354243542435
RT_DIALOG0x3c3b280x11cdataChineseChina0.778169014084507
RT_DIALOG0x3c3c440x20cdataPortuguesePortugal0.5458015267175572
RT_DIALOG0x3c3e500x24adata0.5187713310580204
RT_DIALOG0x3c409c0x376dataArabicSaudi Arabia0.5316027088036117
RT_DIALOG0x3c44140x248dataChineseTaiwan0.696917808219178
RT_DIALOG0x3c465c0x388dataCzechCzech Republic0.5353982300884956
RT_DIALOG0x3c49e40x390dataDanishDenmark0.48793859649122806
RT_DIALOG0x3c4d740x3d6dataGermanGermany0.47046843177189407
RT_DIALOG0x3c514c0x3f6dataGreekGreece0.5374753451676528
RT_DIALOG0x3c55440x398dataEnglishUnited States0.4891304347826087
RT_DIALOG0x3c58dc0x372dataFinnishFinland0.4965986394557823
RT_DIALOG0x3c5c500x3eedataFrenchFrance0.4870775347912525
RT_DIALOG0x3c60400x326dataHebrewIsrael0.5483870967741935
RT_DIALOG0x3c63680x3fadataHungarianHungary0.5049115913555993
RT_DIALOG0x3c67640x39edataItalianItaly0.49136069114470843
RT_DIALOG0x3c6b040x2bedataJapaneseJapan0.6410256410256411
RT_DIALOG0x3c6dc40x298dataKoreanNorth Korea0.6807228915662651
RT_DIALOG0x3c6dc40x298dataKoreanSouth Korea0.6807228915662651
RT_DIALOG0x3c705c0x412dataDutchNetherlands0.46641074856046066
RT_DIALOG0x3c74700x3c4dataNorwegianNorway0.47199170124481327
RT_DIALOG0x3c78340x3d8dataPolishPoland0.5091463414634146
RT_DIALOG0x3c7c0c0x3f0dataPortugueseBrazil0.49007936507936506
RT_DIALOG0x3c7ffc0x390dataRussianRussia0.5471491228070176
RT_DIALOG0x3c838c0x390dataSwedishSweden0.4956140350877193
RT_DIALOG0x3c871c0x3f2dataTurkishTurkey0.5
RT_DIALOG0x3c8b100x238dataChineseChina0.6813380281690141
RT_DIALOG0x3c8d480x3f4dataPortuguesePortugal0.4782608695652174
RT_DIALOG0x3c913c0x400data0.46875
RT_DIALOG0x3c953c0x1f2dataArabicSaudi Arabia0.6004016064257028
RT_DIALOG0x3c97300x144dataChineseTaiwan0.7376543209876543
RT_DIALOG0x3c98740x204dataCzechCzech Republic0.5891472868217055
RT_DIALOG0x3c9a780x224dataDanishDenmark0.551094890510949
RT_DIALOG0x3c9c9c0x206dataGermanGermany0.5347490347490348
RT_DIALOG0x3c9ea40x246dataGreekGreece0.5859106529209622
RT_DIALOG0x3ca0ec0x218dataEnglishUnited States0.5466417910447762
RT_DIALOG0x3ca3040x236dataFinnishFinland0.5265017667844523
RT_DIALOG0x3ca53c0x246dataFrenchFrance0.5395189003436426
RT_DIALOG0x3ca7840x1cedataHebrewIsrael0.6233766233766234
RT_DIALOG0x3ca9540x24adataHungarianHungary0.5580204778156996
RT_DIALOG0x3caba00x222dataItalianItaly0.5366300366300366
RT_DIALOG0x3cadc40x1aedataJapaneseJapan0.6953488372093023
RT_DIALOG0x3caf740x170dataKoreanNorth Korea0.7336956521739131
RT_DIALOG0x3caf740x170dataKoreanSouth Korea0.7336956521739131
RT_DIALOG0x3cb0e40x256dataDutchNetherlands0.520066889632107
RT_DIALOG0x3cb33c0x1f4dataNorwegianNorway0.564
RT_DIALOG0x3cb5300x218dataPolishPoland0.5671641791044776
RT_DIALOG0x3cb7480x24cdataPortugueseBrazil0.5357142857142857
RT_DIALOG0x3cb9940x1fcdataRussianRussia0.5885826771653543
RT_DIALOG0x3cbb900x1f8dataSwedishSweden0.5674603174603174
RT_DIALOG0x3cbd880x222dataTurkishTurkey0.5677655677655677
RT_DIALOG0x3cbfac0x148dataChineseChina0.7469512195121951
RT_DIALOG0x3cc0f40x264dataPortuguesePortugal0.5196078431372549
RT_DIALOG0x3cc3580x27cdata0.5141509433962265
RT_DIALOG0x3cc5d40x2f6dataArabicSaudi Arabia0.43535620052770446
RT_DIALOG0x3cc8cc0x15adataChineseTaiwan0.6907514450867052
RT_DIALOG0x3cca280x398dataCzechCzech Republic0.425
RT_DIALOG0x3ccdc00x31cdataDanishDenmark0.40954773869346733
RT_DIALOG0x3cd0dc0x35edataGermanGermany0.39211136890951276
RT_DIALOG0x3cd43c0x35adataGreekGreece0.4417249417249417
RT_DIALOG0x3cd7980x2d4dataEnglishUnited States0.4005524861878453
RT_DIALOG0x3cda6c0x32cdataFinnishFinland0.3977832512315271
RT_DIALOG0x3cdd980x392dataFrenchFrance0.37199124726477023
RT_DIALOG0x3ce12c0x274dataHebrewIsrael0.46496815286624205
RT_DIALOG0x3ce3a00x3f8dataHungarianHungary0.3937007874015748
RT_DIALOG0x3ce7980x376dataItalianItaly0.38487584650112866
RT_DIALOG0x3ceb100x228dataJapaneseJapan0.5742753623188406
RT_DIALOG0x3ced380x1eadataKoreanNorth Korea0.6081632653061224
RT_DIALOG0x3ced380x1eadataKoreanSouth Korea0.6081632653061224
RT_DIALOG0x3cef240x39cdataDutchNetherlands0.36796536796536794
RT_DIALOG0x3cf2c00x2d4dataNorwegianNorway0.4074585635359116
RT_DIALOG0x3cf5940x35edataPolishPoland0.38979118329466356
RT_DIALOG0x3cf8f40x34edataPortugueseBrazil0.39361702127659576
RT_DIALOG0x3cfc440x340dataRussianRussia0.4014423076923077
RT_DIALOG0x3cff840x284dataSwedishSweden0.4363354037267081
RT_DIALOG0x3d02080x338dataTurkishTurkey0.41262135922330095
RT_DIALOG0x3d05400x158dataChineseChina0.7151162790697675
RT_DIALOG0x3d06980x336dataPortuguesePortugal0.4002433090024331
RT_DIALOG0x3d09d00x360data0.3773148148148148
RT_DIALOG0x3d0d300xb8dataArabicSaudi Arabia0.717391304347826
RT_DIALOG0x3d0de80xa0dataChineseTaiwan0.71875
RT_DIALOG0x3d0e880xb0dataCzechCzech Republic0.6875
RT_DIALOG0x3d0f380xb0dataDanishDenmark0.6875
RT_DIALOG0x3d0fe80xb0dataGermanGermany0.6875
RT_DIALOG0x3d10980xb0dataGreekGreece0.6875
RT_DIALOG0x3d11480xb0dataEnglishUnited States0.6931818181818182
RT_DIALOG0x3d11f80xb0dataFinnishFinland0.6875
RT_DIALOG0x3d12a80xb0dataFrenchFrance0.6875
RT_DIALOG0x3d13580xb8dataHebrewIsrael0.717391304347826
RT_DIALOG0x3d14100xb0dataHungarianHungary0.6875
RT_DIALOG0x3d14c00xb0dataItalianItaly0.6875
RT_DIALOG0x3d15700xacdataJapaneseJapan0.6976744186046512
RT_DIALOG0x3d161c0x9cdataKoreanNorth Korea0.7115384615384616
RT_DIALOG0x3d161c0x9cdataKoreanSouth Korea0.7115384615384616
RT_DIALOG0x3d16b80xb0dataDutchNetherlands0.6875
RT_DIALOG0x3d17680xb0dataNorwegianNorway0.6875
RT_DIALOG0x3d18180xb0dataPolishPoland0.6875
RT_DIALOG0x3d18c80xb0dataPortugueseBrazil0.6875
RT_DIALOG0x3d19780xb0dataRussianRussia0.6988636363636364
RT_DIALOG0x3d1a280xb0dataSwedishSweden0.6875
RT_DIALOG0x3d1ad80xb8dataTurkishTurkey0.6739130434782609
RT_DIALOG0x3d1b900x9cdataChineseChina0.7051282051282052
RT_DIALOG0x3d1c2c0xb0dataPortuguesePortugal0.6875
RT_DIALOG0x3d1cdc0xbcdata0.6968085106382979
RT_STRING0x3d1d980x51cdataArabicSaudi Arabia0.4319571865443425
RT_STRING0x3d22b40x292dataChineseTaiwan0.7082066869300911
RT_STRING0x3d25480x61adataCzechCzech Republic0.40717029449423814
RT_STRING0x3d2b640x60adataDanishDenmark0.3745148771021992
RT_STRING0x3d31700x5d6dataGermanGermany0.3969210174029451
RT_STRING0x3d37480x638dataGreekGreece0.4214824120603015
RT_STRING0x3d3d800x506dataEnglishUnited States0.40279937791601866
RT_STRING0x3d42880x54edataFinnishFinland0.3807069219440353
RT_STRING0x3d47d80x5f8dataFrenchFrance0.35602094240837695
RT_STRING0x3d4dd00x49edataHebrewIsrael0.461082910321489
RT_STRING0x3d52700x522dataHungarianHungary0.4345509893455099
RT_STRING0x3d57940x57edataItalianItaly0.3940256045519203
RT_STRING0x3d5d140x3b6dataJapaneseJapan0.5947368421052631
RT_STRING0x3d60cc0x338dataKoreanNorth Korea0.6395631067961165
RT_STRING0x3d60cc0x338dataKoreanSouth Korea0.6395631067961165
RT_STRING0x3d64040x67cdataDutchNetherlands0.33674698795180724
RT_STRING0x3d6a800x53cdataNorwegianNorway0.3738805970149254
RT_STRING0x3d6fbc0x5e6dataPolishPoland0.40463576158940395
RT_STRING0x3d75a40x618dataPortugueseBrazil0.37243589743589745
RT_STRING0x3d7bbc0x5e4dataRussianRussia0.3879310344827586
RT_STRING0x3d81a00x5c2dataSwedishSweden0.3805970149253731
RT_STRING0x3d87640x5a8dataTurkishTurkey0.40124309392265195
RT_STRING0x3d8d0c0x284dataChineseChina0.7018633540372671
RT_STRING0x3d8f900x5d0dataPortuguesePortugal0.364247311827957
RT_STRING0x3d95600x604data0.3538961038961039
RT_STRING0x3d9b640x368edataArabicSaudi Arabia0.25590720320779037
RT_STRING0x3dd1f40x16bcdataChineseTaiwan0.5036082474226804
RT_STRING0x3de8b00x3e94dataCzechCzech Republic0.26897627965043697
RT_STRING0x3e27440x4004dataDanishDenmark0.23822309006590187
RT_STRING0x3e67480x4950dataGermanGermany0.2348678601875533
RT_STRING0x3eb0980x4c220421 Alliant compact executable not strippedGreekGreece0.24371472550025655
RT_STRING0x3efcbc0x3a08dataEnglishUnited States0.23673936456650513
RT_STRING0x3f36c40x3d72dataFinnishFinland0.24342021614748888
RT_STRING0x3f74380x4822PDP-11 old overlayFrenchFrance0.2312899382649193
RT_STRING0x3fbc5c0x2eeedataHebrewIsrael0.2714333277842517
RT_STRING0x3feb4c0x446ePDP-11 old overlayHungarianHungary0.251398561479621
RT_STRING0x402fbc0x4ee8dataItalianItaly0.21455445544554455
RT_STRING0x407ea40x22fedataJapaneseJapan0.36626479124804645
RT_STRING0x40a1a40x21e8dataKoreanNorth Korea0.3601382488479263
RT_STRING0x40a1a40x21e8dataKoreanSouth Korea0.3601382488479263
RT_STRING0x40c38c0x477edataDutchNetherlands0.22341820566058354
RT_STRING0x410b0c0x3edcdataNorwegianNorway0.2298036291324882
RT_STRING0x4149e80x48e6dataPolishPoland0.23550530489765298
RT_STRING0x4192d00x40b6dataPortugueseBrazil0.23856090788361706
RT_STRING0x41d3880x4a96dataRussianRussia0.23923745679270975
RT_STRING0x421e200x3ef0dataSwedishSweden0.23659384309831183
RT_STRING0x425d100x3ee0dataTurkishTurkey0.24204771371769385
RT_STRING0x429bf00x16c6dataChineseChina0.49845626072041166
RT_STRING0x42b2b80x4568PDP-11 executable not strippedPortuguesePortugal0.23007654209815398
RT_STRING0x42f8200x485aPDP-11 separate I&D executable not stripped0.22826908541194255
RT_STRING0x43407c0x5adataArabicSaudi Arabia0.6777777777777778
RT_STRING0x4340d80x44dataChineseTaiwan0.5
RT_STRING0x43411c0x5cdataCzechCzech Republic0.7391304347826086
RT_STRING0x4341780x5cdataDanishDenmark0.6847826086956522
RT_STRING0x4341d40x44dataGermanGermany0.6911764705882353
RT_STRING0x4342180x52dataGreekGreece0.6829268292682927
RT_STRING0x43426c0x50dataEnglishUnited States0.725
RT_STRING0x4342bc0x80dataFinnishFinland0.5859375
RT_STRING0x43433c0x5cdataFrenchFrance0.6956521739130435
RT_STRING0x4343980x54dataHebrewIsrael0.75
RT_STRING0x4343ec0x6cdataHungarianHungary0.6574074074074074
RT_STRING0x4344580x48dataItalianItaly0.7222222222222222
RT_STRING0x4344a00x44dataJapaneseJapan0.5
RT_STRING0x4344e40x38dataKoreanNorth Korea0.5892857142857143
RT_STRING0x4344e40x38dataKoreanSouth Korea0.5892857142857143
RT_STRING0x43451c0x44dataDutchNetherlands0.7058823529411765
RT_STRING0x4345600x5adataNorwegianNorway0.6888888888888889
RT_STRING0x4345bc0x38dataPolishPoland0.5357142857142857
RT_STRING0x4345f40x2cdataPortugueseBrazil0.6363636363636364
RT_STRING0x4346200x5cdataRussianRussia0.7282608695652174
RT_STRING0x43467c0x4edataSwedishSweden0.6923076923076923
RT_STRING0x4346cc0x50dataTurkishTurkey0.65
RT_STRING0x43471c0x38dataChineseChina0.5714285714285714
RT_STRING0x4347540x56dataPortuguesePortugal0.7325581395348837
RT_STRING0x4347ac0x4adata0.7162162162162162
RT_STRING0x4347f80x450dataArabicSaudi Arabia0.41938405797101447
RT_STRING0x434c480x1b8dataChineseTaiwan0.7886363636363637
RT_STRING0x434e000x3f8dataCzechCzech Republic0.45866141732283466
RT_STRING0x4351f80x410dataDanishDenmark0.4269230769230769
RT_STRING0x4356080x460dataGermanGermany0.43214285714285716
RT_STRING0x435a680x4b6dataGreekGreece0.43449419568822556
RT_STRING0x435f200x3d8dataEnglishUnited States0.42073170731707316
RT_STRING0x4362f80x45adataFinnishFinland0.4120287253141831
RT_STRING0x4367540x4fcdataFrenchFrance0.3981191222570533
RT_STRING0x436c500x358dataHebrewIsrael0.48130841121495327
RT_STRING0x436fa80x484dataHungarianHungary0.435121107266436
RT_STRING0x43742c0x3d2dataItalianItaly0.43558282208588955
RT_STRING0x4378000x240dataJapaneseJapan0.6475694444444444
RT_STRING0x437a400x23edataKoreanNorth Korea0.7195121951219512
RT_STRING0x437a400x23edataKoreanSouth Korea0.7195121951219512
RT_STRING0x437c800x4badataDutchNetherlands0.37107438016528926
RT_STRING0x43813c0x40edataNorwegianNorway0.42485549132947975
RT_STRING0x43854c0x452dataPolishPoland0.4168173598553345
RT_STRING0x4389a00x40adataPortugueseBrazil0.425531914893617
RT_STRING0x438dac0x470dataRussianRussia0.44014084507042256
RT_STRING0x43921c0x3acdataSwedishSweden0.4297872340425532
RT_STRING0x4395c80x476dataTurkishTurkey0.4264448336252189
RT_STRING0x439a400x19cdataChineseChina0.7936893203883495
RT_STRING0x439bdc0x41edataPortuguesePortugal0.41840607210626185
RT_STRING0x439ffc0x45cdata0.3951612903225806
RT_STRING0x43a4580x364dataArabicSaudi Arabia0.3675115207373272
RT_STRING0x43a7bc0x150dataChineseTaiwan0.6607142857142857
RT_STRING0x43a90c0x38edataCzechCzech Republic0.35824175824175825
RT_STRING0x43ac9c0x386dataDanishDenmark0.33813747228381374
RT_STRING0x43b0240x3b8dataGermanGermany0.32668067226890757
RT_STRING0x43b3dc0x3fedataGreekGreece0.3649706457925636
RT_STRING0x43b7dc0x348dataEnglishUnited States0.3261904761904762
RT_STRING0x43bb240x384dataFinnishFinland0.31666666666666665
RT_STRING0x43bea80x404dataFrenchFrance0.31712062256809337
RT_STRING0x43c2ac0x288AmigaOS bitmap font "\325\005\324\005\352\005\324\005,", fc_YSize 4294955013, 54789 elementsHebrewIsrael0.42746913580246915
RT_STRING0x43c5340x3c0dataHungarianHungary0.3572916666666667
RT_STRING0x43c8f40x36adataItalianItaly0.34553775743707094
RT_STRING0x43cc600x206dataJapaneseJapan0.5347490347490348
RT_STRING0x43ce680x192dataKoreanNorth Korea0.6766169154228856
RT_STRING0x43ce680x192dataKoreanSouth Korea0.6766169154228856
RT_STRING0x43cffc0x3d8dataDutchNetherlands0.29776422764227645
RT_STRING0x43d3d40x348dataNorwegianNorway0.3380952380952381
RT_STRING0x43d71c0x3f2dataPolishPoland0.33564356435643566
RT_STRING0x43db100x3b8dataPortugueseBrazil0.3224789915966387
RT_STRING0x43dec80x3bedataRussianRussia0.33820459290187893
RT_STRING0x43e2880x326dataSwedishSweden0.3610421836228288
RT_STRING0x43e5b00x3aedataTurkishTurkey0.3333333333333333
RT_STRING0x43e9600x146dataChineseChina0.696319018404908
RT_STRING0x43eaa80x38cdataPortuguesePortugal0.33480176211453744
RT_STRING0x43ee340x3f0data0.3115079365079365
RT_STRING0x43f2240xd0dataArabicSaudi Arabia0.4855769230769231
RT_STRING0x43f2f40x56dataChineseTaiwan0.6976744186046512
RT_STRING0x43f34c0xdedataCzechCzech Republic0.6036036036036037
RT_STRING0x43f42c0xe0dataDanishDenmark0.5357142857142857
RT_STRING0x43f50c0xfedataGermanGermany0.5118110236220472
RT_STRING0x43f60c0x112dataGreekGreece0.5036496350364964
RT_STRING0x43f7200xe6dataEnglishUnited States0.46956521739130436
RT_STRING0x43f8080xccdataFinnishFinland0.5392156862745098
RT_STRING0x43f8d40x120dataFrenchFrance0.4097222222222222
RT_STRING0x43f9f40xbedataHebrewIsrael0.5842105263157895
RT_STRING0x43fab40xf4dataHungarianHungary0.5081967213114754
RT_STRING0x43fba80x13adataItalianItaly0.4394904458598726
RT_STRING0x43fce40x8cdataJapaneseJapan0.6928571428571428
RT_STRING0x43fd700x82dataKoreanNorth Korea0.6384615384615384
RT_STRING0x43fd700x82dataKoreanSouth Korea0.6384615384615384
RT_STRING0x43fdf40xfedataDutchNetherlands0.484251968503937
RT_STRING0x43fef40xe8dataNorwegianNorway0.49137931034482757
RT_STRING0x43ffdc0x134dataPolishPoland0.4837662337662338
RT_STRING0x4401100x116dataPortugueseBrazil0.49280575539568344
RT_STRING0x4402280xf2dataRussianRussia0.5661157024793388
RT_STRING0x44031c0xb4dataSwedishSweden0.5888888888888889
RT_STRING0x4403d00x102dataTurkishTurkey0.49224806201550386
RT_STRING0x4404d40x5adataChineseChina0.7
RT_STRING0x4405300x128dataPortuguesePortugal0.4358108108108108
RT_STRING0x4406580x128data0.40878378378378377
RT_STRING0x4407800x124dataArabicSaudi Arabia0.565068493150685
RT_STRING0x4408a40x82dataChineseTaiwan0.7769230769230769
RT_STRING0x4409280x10edataCzechCzech Republic0.5703703703703704
RT_STRING0x440a380x108dataDanishDenmark0.49242424242424243
RT_STRING0x440b400xe6dataGermanGermany0.5652173913043478
RT_STRING0x440c280x168dataGreekGreece0.525
RT_STRING0x440d900x134dataEnglishUnited States0.4902597402597403
RT_STRING0x440ec40x142dataFinnishFinland0.515527950310559
RT_STRING0x4410080x178dataFrenchFrance0.449468085106383
RT_STRING0x4411800x114dataHebrewIsrael0.5833333333333334
RT_STRING0x4412940x11adataHungarianHungary0.5531914893617021
RT_STRING0x4413b00x10cdataItalianItaly0.5111940298507462
RT_STRING0x4414bc0xc6dataJapaneseJapan0.7373737373737373
RT_STRING0x4415840xaadataKoreanNorth Korea0.7529411764705882
RT_STRING0x4415840xaadataKoreanSouth Korea0.7529411764705882
RT_STRING0x4416300x172dataDutchNetherlands0.44324324324324327
RT_STRING0x4417a40x150dataNorwegianNorway0.46726190476190477
RT_STRING0x4418f40x188dataPolishPoland0.4489795918367347
RT_STRING0x441a7c0x14cdataPortugueseBrazil0.4819277108433735
RT_STRING0x441bc80x19edataRussianRussia0.5024154589371981
RT_STRING0x441d680x168dataSwedishSweden0.4777777777777778
RT_STRING0x441ed00x142dataTurkishTurkey0.531055900621118
RT_STRING0x4420140x80dataChineseChina0.765625
RT_STRING0x4420940x152dataPortuguesePortugal0.47928994082840237
RT_STRING0x4421e80x162data0.423728813559322
RT_STRING0x44234c0x32dataArabicSaudi Arabia0.68
RT_STRING0x4423800x28dataChineseTaiwan0.6
RT_STRING0x4423a80x40dataCzechCzech Republic0.6875
RT_STRING0x4423e80x40dataDanishDenmark0.640625
RT_STRING0x4424280x3edataGermanGermany0.6774193548387096
RT_STRING0x4424680x3adataGreekGreece0.7241379310344828
RT_STRING0x4424a40x32dataEnglishUnited States0.66
RT_STRING0x4424d80x3edataFinnishFinland0.6290322580645161
RT_STRING0x4425180x3cdataFrenchFrance0.65
RT_STRING0x4425540x32dataHebrewIsrael0.66
RT_STRING0x4425880x3cdataHungarianHungary0.65
RT_STRING0x4425c40x3edataItalianItaly0.6290322580645161
RT_STRING0x4426040x2edataJapaneseJapan0.6739130434782609
RT_STRING0x4426340x2adataKoreanNorth Korea0.6428571428571429
RT_STRING0x4426340x2adataKoreanSouth Korea0.6428571428571429
RT_STRING0x4426600x30dataDutchNetherlands0.6458333333333334
RT_STRING0x4426900x30dataNorwegianNorway0.625
RT_STRING0x4426c00x3cdataPolishPoland0.6333333333333333
RT_STRING0x4426fc0x3adataPortugueseBrazil0.6551724137931034
RT_STRING0x4427380x38dataRussianRussia0.6607142857142857
RT_STRING0x4427700x2cdataSwedishSweden0.6136363636363636
RT_STRING0x44279c0x36dataTurkishTurkey0.6111111111111112
RT_STRING0x4427d40x28dataChineseChina0.6
RT_STRING0x4427fc0x3edataPortuguesePortugal0.6612903225806451
RT_STRING0x44283c0x40data0.640625
RT_STRING0x44287c0x7aMatlab v4 mat-file (little endian) A\006-\0065\006 , numeric, rows 0, columns 0ArabicSaudi Arabia0.6557377049180327
RT_STRING0x4428f80x40Matlab v4 mat-file (little endian) ck(W\203c\317c\250`\204v\373\226f\201\010, numeric, rows 0, columns 0ChineseTaiwan0.6875
RT_STRING0x4429380x80Matlab v4 mat-file (little endian) P, numeric, rows 0, columns 0CzechCzech Republic0.6015625
RT_STRING0x4429b80x82Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0DanishDenmark0.676923076923077
RT_STRING0x442a3c0x9eMatlab v4 mat-file (little endian) C, numeric, rows 0, columns 0GermanGermany0.6139240506329114
RT_STRING0x442adc0x92Matlab v4 mat-file (little endian) \223\003\257\003\275\003\265\003\304\003\261\003\271\003 , numeric, rows 0, columns 0GreekGreece0.6575342465753424
RT_STRING0x442b700x76Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0EnglishUnited States0.6694915254237288
RT_STRING0x442be80x8aMatlab v4 mat-file (little endian) T, numeric, rows 0, columns 0FinnishFinland0.5942028985507246
RT_STRING0x442c740x88Matlab v4 mat-file (little endian) A, numeric, rows 0, columns 0FrenchFrance0.5808823529411765
RT_STRING0x442cfc0x68Matlab v4 mat-file (little endian) \341\005\325\005\350\005\347\005 , numeric, rows 0, columns 0HebrewIsrael0.75
RT_STRING0x442d640x8aMatlab v4 mat-file (little endian) K, numeric, rows 0, columns 0HungarianHungary0.6666666666666666
RT_STRING0x442df00x7aMatlab v4 mat-file (little endian) A, numeric, rows 0, columns 0ItalianItaly0.5901639344262295
RT_STRING0x442e6c0x56Matlab v4 mat-file (little endian) \2630\3630\3240\3450\3740\2770\3740n0\2710\2550\3430\3630-N\016, numeric, rows 0, columns 0JapaneseJapan0.7441860465116279
RT_STRING0x442ec40x44Matlab v4 mat-file (little endian) \364\316\350\3240\321 , numeric, rows 0, columns 0KoreanNorth Korea0.6911764705882353
RT_STRING0x442ec40x44Matlab v4 mat-file (little endian) \364\316\350\3240\321 , numeric, rows 0, columns 0KoreanSouth Korea0.6911764705882353
RT_STRING0x442f080x84Matlab v4 mat-file (little endian) C, numeric, rows 0, columns 0DutchNetherlands0.6742424242424242
RT_STRING0x442f8c0x74Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0NorwegianNorway0.6724137931034483
RT_STRING0x4430000x76Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0PolishPoland0.5677966101694916
RT_STRING0x4430780x8cMatlab v4 mat-file (little endian) E, numeric, rows 0, columns 0PortugueseBrazil0.6642857142857143
RT_STRING0x4431040x94dataRussianRussia0.5135135135135135
RT_STRING0x4431980x74Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 0SwedishSweden0.6810344827586207
RT_STRING0x44320c0x74Matlab v4 mat-file (little endian) B, numeric, rows 0, columns 0TurkishTurkey0.6206896551724138
RT_STRING0x4432800x42Matlab v4 mat-file (little endian) ck(Wkb\317c\250`\204v\241\213\227{:g\010, numeric, rows 0, columns 0ChineseChina0.7121212121212122
RT_STRING0x4432c40x82Matlab v4 mat-file (little endian) A, numeric, rows 0, columns 0PortuguesePortugal0.6230769230769231
RT_STRING0x4433480x7aMatlab v4 mat-file (little endian) A, numeric, rows 0, columns 00.5901639344262295
RT_STRING0x4433c40x2c4dataArabicSaudi Arabia0.3968926553672316
RT_STRING0x4436880x162dataChineseTaiwan0.6412429378531074
RT_STRING0x4437ec0x2eadataCzechCzech Republic0.3967828418230563
RT_STRING0x443ad80x37edataDanishDenmark0.348993288590604
RT_STRING0x443e580x3d8dataGermanGermany0.3648373983739837
RT_STRING0x4442300x3f0dataGreekGreece0.3551587301587302
RT_STRING0x4446200x392dataEnglishUnited States0.32166301969365424
RT_STRING0x4449b40x32cdataFinnishFinland0.3768472906403941
RT_STRING0x444ce00x3d0dataFrenchFrance0.32479508196721313
RT_STRING0x4450b00x276dataHebrewIsrael0.40634920634920635
RT_STRING0x4453280x30adataHungarianHungary0.3856041131105398
RT_STRING0x4456340x320dataItalianItaly0.39625
RT_STRING0x4459540x1e2dataJapaneseJapan0.5062240663900415
RT_STRING0x445b380x1a4dataKoreanNorth Korea0.6214285714285714
RT_STRING0x445b380x1a4dataKoreanSouth Korea0.6214285714285714
RT_STRING0x445cdc0x39adataDutchNetherlands0.3524945770065076
RT_STRING0x4460780x32adataNorwegianNorway0.3691358024691358
RT_STRING0x4463a40x3a0dataPolishPoland0.3642241379310345
RT_STRING0x4467440x3cedataPortugueseBrazil0.3182751540041068
RT_STRING0x446b140x36edataRussianRussia0.36104783599088835
RT_STRING0x446e840x384dataSwedishSweden0.37444444444444447
RT_STRING0x4472080x340dataTurkishTurkey0.3737980769230769
RT_STRING0x4475480x15edataChineseChina0.5971428571428572
RT_STRING0x4476a80x3b8dataPortuguesePortugal0.328781512605042
RT_STRING0x447a600x3f8data0.3228346456692913
RT_STRING0x447e580x4adataArabicSaudi Arabia0.6891891891891891
RT_STRING0x447ea40x30dataChineseTaiwan0.6666666666666666
RT_STRING0x447ed40x56dataCzechCzech Republic0.686046511627907
RT_STRING0x447f2c0x5cdataDanishDenmark0.6739130434782609
RT_STRING0x447f880x6edataGermanGermany0.7181818181818181
RT_STRING0x447ff80x50dataGreekGreece0.75
RT_STRING0x4480480x4adataEnglishUnited States0.6486486486486487
RT_STRING0x4480940x5edataFinnishFinland0.648936170212766
RT_STRING0x4480f40x58dataFrenchFrance0.6704545454545454
RT_STRING0x44814c0x4edataHebrewIsrael0.7307692307692307
RT_STRING0x44819c0x58dataHungarianHungary0.6590909090909091
RT_STRING0x4481f40x58dataItalianItaly0.6363636363636364
RT_STRING0x44824c0x3edataJapaneseJapan0.7419354838709677
RT_STRING0x44828c0x30dataKoreanNorth Korea0.6666666666666666
RT_STRING0x44828c0x30dataKoreanSouth Korea0.6666666666666666
RT_STRING0x4482bc0x54dataDutchNetherlands0.6428571428571429
RT_STRING0x4483100x52dataNorwegianNorway0.6829268292682927
RT_STRING0x4483640x52dataPolishPoland0.5975609756097561
RT_STRING0x4483b80x60dataPortugueseBrazil0.65625
RT_STRING0x4484180x5adataRussianRussia0.6666666666666666
RT_STRING0x4484740x62dataSwedishSweden0.673469387755102
RT_STRING0x4484d80x46dataTurkishTurkey0.6285714285714286
RT_STRING0x4485200x30dataChineseChina0.6666666666666666
RT_STRING0x4485500x64dataPortuguesePortugal0.65
RT_STRING0x4485b40x64data0.65
RT_STRING0x4486180xd2dataArabicSaudi Arabia0.4857142857142857
RT_STRING0x4486ec0x4edataChineseTaiwan0.6153846153846154
RT_STRING0x44873c0xdadataCzechCzech Republic0.4908256880733945
RT_STRING0x4488180xfadataDanishDenmark0.396
RT_STRING0x4489140xe6dataGermanGermany0.44782608695652176
RT_STRING0x4489fc0xd6dataGreekGreece0.5373831775700935
RT_STRING0x448ad40xb6dataEnglishUnited States0.47802197802197804
RT_STRING0x448b8c0xc8dataFinnishFinland0.495
RT_STRING0x448c540x110dataFrenchFrance0.39705882352941174
RT_STRING0x448d640xa0dataHebrewIsrael0.5125
RT_STRING0x448e040xf4dataHungarianHungary0.5122950819672131
RT_STRING0x448ef80xcedataItalianItaly0.45145631067961167
RT_STRING0x448fc80x9cdataJapaneseJapan0.5641025641025641
RT_STRING0x4490640x72dataKoreanNorth Korea0.7105263157894737
RT_STRING0x4490640x72dataKoreanSouth Korea0.7105263157894737
RT_STRING0x4490d80x106dataDutchNetherlands0.4083969465648855
RT_STRING0x4491e00xcadataNorwegianNorway0.4603960396039604
RT_STRING0x4492ac0xe6dataPolishPoland0.4391304347826087
RT_STRING0x4493940xf6dataPortugueseBrazil0.4065040650406504
RT_STRING0x44948c0xd8dataRussianRussia0.46296296296296297
RT_STRING0x4495640xc8dataSwedishSweden0.455
RT_STRING0x44962c0xc0dataTurkishTurkey0.4739583333333333
RT_STRING0x4496ec0x54dataChineseChina0.6190476190476191
RT_STRING0x4497400x114dataPortuguesePortugal0.4166666666666667
RT_STRING0x4498540xf6data0.4065040650406504
RT_STRING0x44994c0x50dataArabicSaudi Arabia0.6625
RT_STRING0x44999c0x30dataChineseTaiwan0.6666666666666666
RT_STRING0x4499cc0x60dataCzechCzech Republic0.75
RT_STRING0x449a2c0x6cdataDanishDenmark0.6111111111111112
RT_STRING0x449a980x4edataGermanGermany0.6538461538461539
RT_STRING0x449ae80x5adataGreekGreece0.7333333333333333
RT_STRING0x449b440x4cdataEnglishUnited States0.6973684210526315
RT_STRING0x449b900x6edataFinnishFinland0.6545454545454545
RT_STRING0x449c000x52dataFrenchFrance0.6463414634146342
RT_STRING0x449c540x42dataHebrewIsrael0.7424242424242424
RT_STRING0x449c980x5adataHungarianHungary0.7111111111111111
RT_STRING0x449cf40x4adataItalianItaly0.7027027027027027
RT_STRING0x449d400x4adataJapaneseJapan0.7702702702702703
RT_STRING0x449d8c0x3edataKoreanNorth Korea0.7741935483870968
RT_STRING0x449d8c0x3edataKoreanSouth Korea0.7741935483870968
RT_STRING0x449dcc0x60dataDutchNetherlands0.6770833333333334
RT_STRING0x449e2c0x46dataNorwegianNorway0.6428571428571429
RT_STRING0x449e740x4cdataPolishPoland0.6973684210526315
RT_STRING0x449ec00x4adataPortugueseBrazil0.6351351351351351
RT_STRING0x449f0c0x5cdataRussianRussia0.7391304347826086
RT_STRING0x449f680x3adataSwedishSweden0.6551724137931034
RT_STRING0x449fa40x56dataTurkishTurkey0.6976744186046512
RT_STRING0x449ffc0x3cdataChineseChina0.75
RT_STRING0x44a0380x4adataPortuguesePortugal0.6486486486486487
RT_STRING0x44a0840x42data0.6515151515151515
RT_STRING0x44a0c80x36Matlab v4 mat-file (little endian) F\006*\006'\006&\006,\006 , numeric, rows 0, columns 0ArabicSaudi Arabia0.6851851851851852
RT_STRING0x44a1000x28Matlab v4 mat-file (little endian) \203c\317cP}\234g, numeric, rows 0, columns 0ChineseTaiwan0.6
RT_STRING0x44a1280x4aMatlab v4 mat-file (little endian) V, numeric, rows 0, columns 0CzechCzech Republic0.6756756756756757
RT_STRING0x44a1740x3cMatlab v4 mat-file (little endian) S, numeric, rows 0, columns 0DanishDenmark0.6333333333333333
RT_STRING0x44a1b00x4cMatlab v4 mat-file (little endian) \334, numeric, rows 0, columns 0GermanGermany0.6447368421052632
RT_STRING0x44a1fc0x48Matlab v4 mat-file (little endian) \221\003\300\003\277\003\304\003\265\003\273\003\255\003\303\003\274\003\261\003\304\003\261\003 , numeric, rows 0, columns 0GreekGreece0.7638888888888888
RT_STRING0x44a2440x38Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0EnglishUnited States0.6785714285714286
RT_STRING0x44a27c0x44Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0FinnishFinland0.6470588235294118
RT_STRING0x44a2c00x4cMatlab v4 mat-file (little endian) R, numeric, rows 0, columns 0FrenchFrance0.6842105263157895
RT_STRING0x44a30c0x3aMatlab v4 mat-file (little endian) \352\005\325\005\346\005\320\005\325\005\352\005 , numeric, rows 0, columns 0HebrewIsrael0.7068965517241379
RT_STRING0x44a3480x46Matlab v4 mat-file (little endian) K, numeric, rows 0, columns 0HungarianHungary0.6
RT_STRING0x44a3900x42Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0ItalianItaly0.6212121212121212
RT_STRING0x44a3d40x2cMatlab v4 mat-file (little endian) \2710\2550\3430\3630P}\234g, numeric, rows 0, columns 0JapaneseJapan0.6363636363636364
RT_STRING0x44a4000x2aMatlab v4 mat-file (little endian) \200\254\254\300 , numeric, rows 0, columns 0KoreanNorth Korea0.6190476190476191
RT_STRING0x44a4000x2aMatlab v4 mat-file (little endian) \200\254\254\300 , numeric, rows 0, columns 0KoreanSouth Korea0.6190476190476191
RT_STRING0x44a42c0x56Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0DutchNetherlands0.6744186046511628
RT_STRING0x44a4840x3cMatlab v4 mat-file (little endian) S, numeric, rows 0, columns 0NorwegianNorway0.6333333333333333
RT_STRING0x44a4c00x42Matlab v4 mat-file (little endian) W, numeric, rows 0, columns 0PolishPoland0.6060606060606061
RT_STRING0x44a5040x46Matlab v4 mat-file (little endian) R, numeric, rows 0, columns 0PortugueseBrazil0.6428571428571429
RT_STRING0x44a54c0x46Matlab v4 mat-file (little endian) \0045\0047\004C\004;\004L\004B\0040\004B\004K\004 , numeric, rows 0, columns 0RussianRussia0.7285714285714285
RT_STRING0x44a5940x36Matlab v4 mat-file (little endian) S, numeric, rows 0, columns 0SwedishSweden0.6666666666666666
RT_STRING0x44a5cc0x40Matlab v4 mat-file (little endian) T, numeric, rows 0, columns 0TurkishTurkey0.640625
RT_STRING0x44a60c0x28Matlab v4 mat-file (little endian) kb\317c\323~\234g, numeric, rows 0, columns 0ChineseChina0.6
RT_STRING0x44a6340x4aMatlab v4 mat-file (little endian) R, numeric, rows 0, columns 0PortuguesePortugal0.6756756756756757
RT_STRING0x44a6800x4eMatlab v4 mat-file (little endian) R, numeric, rows 0, columns 00.6538461538461539
RT_STRING0x44a6d00xa9edataArabicSaudi Arabia0.14164827078734363
RT_STRING0x44b1700x54edataChineseTaiwan0.21502209131075112
RT_STRING0x44b6c00xb66dataCzechCzech Republic0.135709389993146
RT_STRING0x44c2280xd90dataDanishDenmark0.12269585253456221
RT_STRING0x44cfb80xd9adataGermanGermany0.12492820218265364
RT_STRING0x44dd540xf20dataGreekGreece0.12164256198347108
RT_STRING0x44ec740xb94dataEnglishUnited States0.12213225371120108
RT_STRING0x44f8080xb5adataFinnishFinland0.12216104611149346
RT_STRING0x4503640xd6edataFrenchFrance0.12361838278068644
RT_STRING0x4510d40x9dedataHebrewIsrael0.14489311163895488
RT_STRING0x451ab40xbdcdataHungarianHungary0.13142292490118576
RT_STRING0x4526900xbc2dataItalianItaly0.13156146179401992
RT_STRING0x4532540x738dataJapaneseJapan0.19101731601731603
RT_STRING0x45398c0x6fcdataKoreanNorth Korea0.20246085011185683
RT_STRING0x45398c0x6fcdataKoreanSouth Korea0.20246085011185683
RT_STRING0x4540880xc60dataDutchNetherlands0.1268939393939394
RT_STRING0x454ce80xbc6dataNorwegianNorway0.12508294625082947
RT_STRING0x4558b00xcbedataPolishPoland0.13059472716125076
RT_STRING0x4565700xbfadataPortugueseBrazil0.13209393346379647
RT_STRING0x45716c0xcc8dataRussianRussia0.1311124694376528
RT_STRING0x457e340xb9cdataSwedishSweden0.12516823687752354
RT_STRING0x4589d00xcacdataTurkishTurkey0.11991368680641183
RT_STRING0x45967c0x520dataChineseChina0.2149390243902439
RT_STRING0x459b9c0xc50dataPortuguesePortugal0.12277918781725888
RT_STRING0x45a7ec0xbf8data0.12859007832898173
RT_STRING0x45b3e40x372dataArabicSaudi Arabia0.34467120181405897
RT_STRING0x45b7580x136dataChineseTaiwan0.6548387096774193
RT_STRING0x45b8900x3a6dataCzechCzech Republic0.3222698072805139
RT_STRING0x45bc380x4a6dataDanishDenmark0.3042016806722689
RT_STRING0x45c0e00x4dedataGermanGermany0.3097913322632424
RT_STRING0x45c5c00x4badataGreekGreece0.3074380165289256
RT_STRING0x45ca7c0x376dataEnglishUnited States0.3126410835214447
RT_STRING0x45cdf40x3b4dataFinnishFinland0.310126582278481
RT_STRING0x45d1a80x488dataFrenchFrance0.30431034482758623
RT_STRING0x45d6300x2d4dataHebrewIsrael0.3674033149171271
RT_STRING0x45d9040x3f0dataHungarianHungary0.32837301587301587
RT_STRING0x45dcf40x402dataItalianItaly0.3060428849902534
RT_STRING0x45e0f80x216dataJapaneseJapan0.49250936329588013
RT_STRING0x45e3100x1dcdataKoreanNorth Korea0.5777310924369747
RT_STRING0x45e3100x1dcdataKoreanSouth Korea0.5777310924369747
RT_STRING0x45e4ec0x4cadataDutchNetherlands0.2814029363784666
RT_STRING0x45e9b80x3a2dataNorwegianNorway0.3053763440860215
RT_STRING0x45ed5c0x458dataPolishPoland0.32823741007194246
RT_STRING0x45f1b40x498dataPortugueseBrazil0.2857142857142857
RT_STRING0x45f64c0x468dataRussianRussia0.31117021276595747
RT_STRING0x45fab40x3fadataSwedishSweden0.3055009823182711
RT_STRING0x45feb00x412dataTurkishTurkey0.2927063339731286
RT_STRING0x4602c40x11cdataChineseChina0.6408450704225352
RT_STRING0x4603e00x414dataPortuguesePortugal0.2883141762452107
RT_STRING0x4607f40x4b6data0.2752902155887231
RT_STRING0x460cac0x1beMatlab v4 mat-file (little endian) (\006E\006'\006 , numeric, rows 0, columns 0ArabicSaudi Arabia0.49551569506726456
RT_STRING0x460e6c0xd6dataChineseTaiwan0.8504672897196262
RT_STRING0x460f440x224Matlab v4 mat-file (little endian) \341, numeric, rows 0, columns 0CzechCzech Republic0.5218978102189781
RT_STRING0x4611680x270Matlab v4 mat-file (little endian) \370, numeric, rows 0, columns 0DanishDenmark0.42788461538461536
RT_STRING0x4613d80x27cMatlab v4 mat-file (little endian) i, numeric, rows 0, columns 0GermanGermany0.4308176100628931
RT_STRING0x4616540x27eMatlab v4 mat-file (little endian) \261\003 , numeric, rows 0, columns 0GreekGreece0.5031347962382445
RT_STRING0x4618d40x21cMatlab v4 mat-file (little endian) h, numeric, rows 0, columns 0EnglishUnited States0.4425925925925926
RT_STRING0x461af00x20eMatlab v4 mat-file (little endian) a, numeric, rows 0, columns 0FinnishFinland0.4296577946768061
RT_STRING0x461d000x270Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0FrenchFrance0.4375
RT_STRING0x461f700x1aeMatlab v4 mat-file (little endian) \331\005\352\005\333\005\337\005 , numeric, rows 0, columns 0HebrewIsrael0.5372093023255814
RT_STRING0x4621200x28eMatlab v4 mat-file (little endian) , numeric, rows 0, columns 0HungarianHungary0.47553516819571867
RT_STRING0x4623b00x244Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0ItalianItaly0.45689655172413796
RT_STRING0x4625f40x140Matlab v4 mat-file (little endian) n0\3250\2410\2440\3530o0\0010\252`\017an0B0\2130\2750\3250\3100\2460\2470\2420k0\037a\323gW0f0D0\2130\357S\375\200'`L0B0\2120~0Y0\0020\3250\2410\2440\3530k0d0D0f0\037u\020bU0\2140_0, numeric, rows 0, columns 0JapaneseJapan0.7875
RT_STRING0x4627340x136Matlab v4 mat-file (little endian) L\307 , numeric, rows 0, columns 0KoreanNorth Korea0.7870967741935484
RT_STRING0x4627340x136Matlab v4 mat-file (little endian) L\307 , numeric, rows 0, columns 0KoreanSouth Korea0.7870967741935484
RT_STRING0x46286c0x26cMatlab v4 mat-file (little endian) e, numeric, rows 0, columns 0DutchNetherlands0.4064516129032258
RT_STRING0x462ad80x208Matlab v4 mat-file (little endian) \370, numeric, rows 0, columns 0NorwegianNorway0.4519230769230769
RT_STRING0x462ce00x268Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0PolishPoland0.461038961038961
RT_STRING0x462f480x260Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0PortugueseBrazil0.43585526315789475
RT_STRING0x4631a80x22eMatlab v4 mat-file (little endian) ;\0045\0044\004C\004N\004I\0048\0045\004 , numeric, rows 0, columns 0RussianRussia0.489247311827957
RT_STRING0x4633d80x24eMatlab v4 mat-file (little endian) \366, numeric, rows 0, columns 0SwedishSweden0.43898305084745765
RT_STRING0x4636280x23cMatlab v4 mat-file (little endian) _\001a, numeric, rows 0, columns 0TurkishTurkey0.4825174825174825
RT_STRING0x4638640xc2dataChineseChina0.8711340206185567
RT_STRING0x4639280x25aMatlab v4 mat-file (little endian) s, numeric, rows 0, columns 0PortuguesePortugal0.42857142857142855
RT_STRING0x463b840x254Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 00.4312080536912752
RT_STRING0x463dd80x11cdataArabicSaudi Arabia0.545774647887324
RT_STRING0x463ef40x6cdataChineseTaiwan0.8425925925925926
RT_STRING0x463f600x158dataCzechCzech Republic0.5494186046511628
RT_STRING0x4640b80x15edataDanishDenmark0.5228571428571429
RT_STRING0x4642180x18cdataGermanGermany0.5050505050505051
RT_STRING0x4643a40x1a4dataGreekGreece0.5333333333333333
RT_STRING0x4645480x13cdataEnglishUnited States0.5253164556962026
RT_STRING0x4646840x16cdataFinnishFinland0.489010989010989
RT_STRING0x4647f00x1b4dataFrenchFrance0.49311926605504586
RT_STRING0x4649a40xf6dataHebrewIsrael0.5813008130081301
RT_STRING0x464a9c0x18adataHungarianHungary0.5203045685279187
RT_STRING0x464c280x166dataItalianItaly0.5111731843575419
RT_STRING0x464d900xb8dataJapaneseJapan0.7880434782608695
RT_STRING0x464e480xbedataKoreanNorth Korea0.8263157894736842
RT_STRING0x464e480xbedataKoreanSouth Korea0.8263157894736842
RT_STRING0x464f080x18edataDutchNetherlands0.4623115577889447
RT_STRING0x4650980x150dataNorwegianNorway0.5178571428571429
RT_STRING0x4651e80x162dataPolishPoland0.5508474576271186
RT_STRING0x46534c0x170dataPortugueseBrazil0.5054347826086957
RT_STRING0x4654bc0x14adataRussianRussia0.5515151515151515
RT_STRING0x4656080xfadataSwedishSweden0.556
RT_STRING0x4657040x15cdataTurkishTurkey0.5373563218390804
RT_STRING0x4658600x76dataChineseChina0.8813559322033898
RT_STRING0x4658d80x17edataPortuguesePortugal0.5026178010471204
RT_STRING0x465a580x154data0.5058823529411764
RT_GROUP_ICON0x465bac0x22dataEnglishUnited States0.9705882352941176
RT_VERSION0x465bd00x334dataEnglishUnited States0.4695121951219512
RT_MANIFEST0x465f040x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727
DLLImport
USER32.dllFindWindowW, EnumThreadWindows, ShowWindow
SHELL32.dllSHGetFolderPathW, SHFileOperationW, CommandLineToArgvW
ole32.dllCoInitializeEx, CoUninitialize, CoInitializeSecurity, CoCreateInstance
OLEAUT32.dllGetErrorInfo, VariantChangeType, SetErrorInfo, SysAllocString, SysFreeString, VariantClear, VariantInit, CreateErrorInfo
ADVAPI32.dllLookupAccountSidA, StartServiceW, StartServiceA, QueryServiceStatus, OpenServiceW, OpenServiceA, OpenSCManagerW, DeleteService, CreateServiceW, CreateServiceA, ControlService, CloseServiceHandle, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptDecrypt, CryptDestroyKey, CryptDeriveKey, OpenProcessToken, DuplicateTokenEx, GetTokenInformation, CryptAcquireContextW, CreateProcessWithTokenW, CryptReleaseContext
WININET.dllInternetOpenW, InternetCloseHandle, InternetOpenUrlW, InternetReadFile
WINHTTP.dllWinHttpOpen, WinHttpCloseHandle, WinHttpConnect, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpOpenRequest, WinHttpQueryDataAvailable, WinHttpReadData
KERNEL32.dllSetConsoleCtrlHandler, SetStdHandle, GetConsoleOutputCP, GetConsoleMode, GetExitCodeProcess, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, ReadConsoleW, GetFileAttributesExW, GetTempPathW, FlsAlloc, FlsGetValue, SetEndOfFile, FlsSetValue, FlsFree, MultiByteToWideChar, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, GetTimeZoneInformation, ReadFile, FlushFileBuffers, SetFilePointerEx, GetFileSizeEx, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, CreateDirectoryW, CreateFileW, DeleteFileW, FindFirstFileA, FindFirstFileW, GetFileAttributesA, GetFullPathNameW, GetFullPathNameA, SetFileAttributesW, WriteFile, CloseHandle, GetLastError, HeapAlloc, GetProcessHeap, DeviceIoControl, WaitForSingleObject, Sleep, GetCurrentProcess, GetCurrentProcessId, ExitProcess, TerminateProcess, CreateThread, ExitThread, CreateProcessA, CreateProcessW, OpenProcess, GetTickCount, GetSystemDirectoryW, GetWindowsDirectoryA, VirtualAlloc, VirtualProtect, ReadProcessMemory, GetModuleFileNameW, GetModuleHandleA, GetProcAddress, LoadResource, LockResource, SizeofResource, FindResourceW, LoadLibraryA, LocalAlloc, LocalFree, lstrcatW, lstrlenW, CopyFileW, WriteConsoleW, WideCharToMultiByte, FreeConsole, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, K32GetModuleInformation, FormatMessageA, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, GetLocaleInfoEx, EncodePointer, DecodePointer, LCMapStringEx, CompareStringEx, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, IsDebuggerPresent, RaiseException, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetStartupInfoW, GetModuleHandleW, HeapFree, VirtualQuery, FreeLibrary, OutputDebugStringW, GetFileType, HeapQueryInformation, HeapReAlloc, GetCurrentThread, LCMapStringW, CompareStringW, GetTimeFormatW, InterlockedPushEntrySList, InterlockedFlushSList, LoadLibraryExW, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, HeapSize, HeapValidate, GetSystemInfo, GetModuleHandleExW, GetStdHandle, GetCommandLineA, GetCommandLineW, GetDateFormatW
ntdll.dllRtlPcToFileHeader, RtlUnwindEx, RtlUnwind

Possible Origin

Language of compilation systemCountry where language is spokenMap
EnglishUnited States
ArabicSaudi Arabia
ChineseTaiwan
CzechCzech Republic
DanishDenmark
GermanGermany
GreekGreece
FinnishFinland
FrenchFrance
HebrewIsrael
HungarianHungary
ItalianItaly
JapaneseJapan
KoreanNorth Korea
KoreanSouth Korea
DutchNetherlands
NorwegianNorway
PolishPoland
PortugueseBrazil
RussianRussia
SwedishSweden
TurkishTurkey
ChineseChina
PortuguesePortugal

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

0510s020406080100

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:12:42:54
Start date:25/06/2024
Path:C:\Users\user\Desktop\cr7.exe
Wow64 process (32bit):false
Commandline:"C:\Users\user\Desktop\cr7.exe"
Imagebase:0x7ff7c7e90000
File size:5'311'624 bytes
MD5 hash:125ADA51E044501A2A2947AAA6C17386
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Has exited:true
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Process Activities

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities


General

Target ID:1
Start time:12:42:54
Start date:25/06/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

General

Target ID:3
Start time:12:42:54
Start date:25/06/2024
Path:C:\Windows\System32\notepad.exe
Wow64 process (32bit):false
Commandline:"C:\Windows\System32\notepad.exe"
Imagebase:0x7ff7144b0000
File size:201'216 bytes
MD5 hash:27F71B12CB585541885A31BE22F61C83
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:moderate
Has exited:true

Disassembly

⊘No disassembly