# UTF-8 Byte Order Marker; see http://unicode.org/faq/utf_bom.html
# bulk_extractor-Version: 1.3b7 ($Rev: 10075 $)
# Filename: drives/nps-2009-ubnist1/ubnist1.gen3.raw
# Feature-Recorder: winpe
# Feature-File-Version: 1.1
4225536	1f9d402ae5a8135a9b0f1413636e5520	<PE><FileHeader Machine="IMAGE_FILE_MACHINE_I386" NumberOfSections="5" TimeDateStamp="1198530269" PointerToSymbolTable="0" NumberOfSymbols="0" SizeOfOptionalHeader="224"><Characteristics><IMAGE_FILE_RELOCS_STRIPPED /><IMAGE_FILE_EXECUTABLE_IMAGE /><IMAGE_FILE_LINE_NUMS_STRIPPED /><IMAGE_FILE_LOCAL_SYMS_STRIPPED /><IMAGE_FILE_32BIT_MACHINE /></Characteristics></FileHeader><OptionalHeaderStandard Magic="PE32" MajorLinkerVersion="6" MinorLinkerVersion="0" SizeOfCode="23552" SizeOfInitializedData="164864" SizeOfUninitializedData="1024" AddressOfEntryPoint="0x30ed" BaseOfCode="0x1000" /><OptionalHeaderWindows ImageBase="0x400000" SectionAlignment="1000" FileAlignment="200" MajorOperatingSystemVersion="4" MinorOperatingSystemVersion="0" MajorImageVersion="0" MinorImageVersion="0" MajorSubsystemVersion="4" MinorSubsystemVersion="0" Win32VersionValue="0" SizeOfImage="4b000" SizeOfHeaders="400" CheckSum="0x0" SubSystem="" SizeOfStackReserve="100000" SizeOfStackCommit="1000" SizeOfHeapReserve="100000" SizeOfHeapCommit="1000" LoaderFlags="0" NumberOfRvaAndSizes="10"><DllCharacteristics></DllCharacteristics></OptionalHeaderWindows><Sections><SectionHeader Name=".text" VirtualSize="5b30" VirtualAddress="1000" SizeOfRawData="5c00" PointerToRawData="400" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_CODE /><IMAGE_SCN_MEM_EXECUTE /><IMAGE_SCN_MEM_READ /></Characteristics></SectionHeader><SectionHeader Name=".rdata" VirtualSize="129c" VirtualAddress="7000" SizeOfRawData="1400" PointerToRawData="6000" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_INITIALIZED_DATA /><IMAGE_SCN_MEM_READ /></Characteristics></SectionHeader><SectionHeader Name=".data" VirtualSize="25cb8" VirtualAddress="9000" SizeOfRawData="400" PointerToRawData="7400" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_INITIALIZED_DATA /><IMAGE_SCN_MEM_READ /><IMAGE_SCN_MEM_WRITE /></Characteristics></SectionHeader><SectionHeader Name=".ndata" VirtualSize="14000" VirtualAddress="2f000" SizeOfRawData="0" PointerToRawData="0" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_UNINITIALIZED_DATA /><IMAGE_SCN_MEM_READ /><IMAGE_SCN_MEM_WRITE /></Characteristics></SectionHeader><SectionHeader Name=".rsrc" VirtualSize="7888" VirtualAddress="43000" SizeOfRawData="7a00" PointerToRawData="7800" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_INITIALIZED_DATA /><IMAGE_SCN_MEM_READ /></Characteristics></SectionHeader></Sections><dlls><dll>USER32.dll\x00\x00\x0E\x02SelectObject\x00\x00<\x02Se</dll><dll>ADVAPI32.dll\x00\x008\x00ImageList_Destro</dll><dll>COMCTL32.dll\x00\x00\x10\x00CoCreateInstance</dll><dll>ole32.dll\x00\x0A\x00VerQueryValueA\x00\x00\x00\x00Ge</dll><dll>VERSION.dll\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00</dll></dlls></PE>
4426240	4a62f165afc92d963a77049416f24179	<PE><FileHeader Machine="IMAGE_FILE_MACHINE_I386" NumberOfSections="4" TimeDateStamp="1196930152" PointerToSymbolTable="0" NumberOfSymbols="0" SizeOfOptionalHeader="224"><Characteristics><IMAGE_FILE_RELOCS_STRIPPED /><IMAGE_FILE_EXECUTABLE_IMAGE /><IMAGE_FILE_LINE_NUMS_STRIPPED /><IMAGE_FILE_LOCAL_SYMS_STRIPPED /><IMAGE_FILE_32BIT_MACHINE /></Characteristics></FileHeader><OptionalHeaderStandard Magic="PE32" MajorLinkerVersion="6" MinorLinkerVersion="0" SizeOfCode="94208" SizeOfInitializedData="43008" SizeOfUninitializedData="0" AddressOfEntryPoint="0x11fe4" BaseOfCode="0x1000" /><OptionalHeaderWindows ImageBase="0x400000" SectionAlignment="1000" FileAlignment="200" MajorOperatingSystemVersion="4" MinorOperatingSystemVersion="0" MajorImageVersion="0" MinorImageVersion="0" MajorSubsystemVersion="4" MinorSubsystemVersion="0" Win32VersionValue="0" SizeOfImage="24000" SizeOfHeaders="400" CheckSum="0x0" SubSystem="" SizeOfStackReserve="100000" SizeOfStackCommit="1000" SizeOfHeapReserve="100000" SizeOfHeapCommit="1000" LoaderFlags="0" NumberOfRvaAndSizes="10"><DllCharacteristics></DllCharacteristics></OptionalHeaderWindows><Sections><SectionHeader Name=".text" VirtualSize="16f5e" VirtualAddress="1000" SizeOfRawData="17000" PointerToRawData="400" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_CODE /><IMAGE_SCN_MEM_EXECUTE /><IMAGE_SCN_MEM_READ /></Characteristics></SectionHeader><SectionHeader Name=".rdata" VirtualSize="4132" VirtualAddress="18000" SizeOfRawData="4200" PointerToRawData="17400" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_INITIALIZED_DATA /><IMAGE_SCN_MEM_READ /></Characteristics></SectionHeader><SectionHeader Name=".data" VirtualSize="5948" VirtualAddress="1d000" SizeOfRawData="3200" PointerToRawData="1b600" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_INITIALIZED_DATA /><IMAGE_SCN_MEM_READ /><IMAGE_SCN_MEM_WRITE /></Characteristics></SectionHeader><SectionHeader Name=".rsrc" VirtualSize="a60" VirtualAddress="23000" SizeOfRawData="c00" PointerToRawData="1e800" PointerToRelocations="0" PointerToLinenumbers="0" ><Characteristics><IMAGE_SCN_CNT_INITIALIZED_DATA /><IMAGE_SCN_MEM_READ /></Characteristics></SectionHeader></Sections><dlls><dll>USER32.dll\x00\x00OLEAUT32.dll\x00\x00\x09\x01Shel</dll><dll>OLEAUT32.dll\x00\x00\x09\x01ShellExecuteExA\x00</dll><dll>KERNEL32.dll\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00</dll></dlls></PE>