Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
23bGlBtTiX.exe

Overview

General Information

Sample name:23bGlBtTiX.exe
renamed because original name is a hash value
Original sample name:ca6e33cf72e210e9b8faaa354de8b2382fc5e2a163d9172802011f68983fccb0.exe
Analysis ID:1446918
MD5:4e14611a07ab337ac271117a19c3181e
SHA1:b1e420c460b8dd3d8fbcd5e1f0a14da833d6c05e
SHA256:ca6e33cf72e210e9b8faaa354de8b2382fc5e2a163d9172802011f68983fccb0
Tags:exe
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sample uses string decryption to hide its real strings
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • 23bGlBtTiX.exe (PID: 6760 cmdline: "C:\Users\user\Desktop\23bGlBtTiX.exe" MD5: 4E14611A07AB337AC271117A19C3181E)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
23bGlBtTiX.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000000.1679030875.000001DAD1FDB000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
      00000000.00000002.2990307355.000001DAD60C1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
            Process Memory Space: 23bGlBtTiX.exe PID: 6760JoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.0.23bGlBtTiX.exe.1dad1fc2b43.2.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                0.0.23bGlBtTiX.exe.1dad3f14529.4.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                  0.0.23bGlBtTiX.exe.1dad3f42f2d.3.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                    0.0.23bGlBtTiX.exe.1dad3ee8325.6.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      ⊘No Snort rule has matched

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Sample uses string decryption to hide its real strings
                      Source: 23bGlBtTiX.exeString decryptor: n%p
                      Source: 23bGlBtTiX.exeString decryptor: =O-
                      Source: 23bGlBtTiX.exeString decryptor: 8?^
                      Source: 23bGlBtTiX.exeString decryptor: <BW
                      Source: 23bGlBtTiX.exeString decryptor: ws|
                      Source: 23bGlBtTiX.exeString decryptor: w!:
                      Source: 23bGlBtTiX.exeString decryptor: |No
                      Source: 23bGlBtTiX.exeString decryptor: B&'
                      Source: 23bGlBtTiX.exeString decryptor: z`7
                      Source: 23bGlBtTiX.exeString decryptor: +u
                      Source: 23bGlBtTiX.exeString decryptor: =O-
                      Source: 23bGlBtTiX.exeString decryptor: =O-
                      Source: 23bGlBtTiX.exeString decryptor: dL- _,
                      Source: 23bGlBtTiX.exeString decryptor: dL-
                      Source: 23bGlBtTiX.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdbSHA256{ source: 23bGlBtTiX.exe, 00000000.00000002.3113392926.000001DAEE980000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988027071.000001DAD4740000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: /_/src/MahApps.Metro.SimpleChildWindow/obj/Release/net47/MahApps.Metro.SimpleChildWindow.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: RayCarrot.RCP.Metro.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/src/MahApps.Metro/obj/Release/net47/MahApps.Metro.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: D:\Users\RibShark\Documents\Projects\rayman3-input-fix\Release\dinput8.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3113630486.000001DAEE9A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: C:\Dev\RayCarrot\RCP_Metro\RayCarrot.RCP.Metro\src\RayCarrot.RCP.Uninstaller\obj\Release\RayCarrot.RCP.Uninstaller.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: RayCarrot.RCP.Metro.pdbMPDB source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: D:\Paulo\Projetos\WPF-AutoComplete-TextBox\AutoCompleteTextBox\AutoCompleteTextBox\obj\Release\net472\AutoCompleteTextBox.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3124879805.000001DAEEEB0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988975888.000001DAD6065000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: D:\a\Magick.Native\Magick.Native\src\Magick.Native\bin\ReleaseQ8\x64\Magick.Native-Q8-x64.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF3635000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD3689000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.2988185158.000001DAD4760000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdbSHA256;@ source: 23bGlBtTiX.exe, 00000000.00000002.3113630486.000001DAEE9A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/NLog/obj/Release/net46/NLog.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: /_/src/NLog/obj/Release/net46/NLog.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: D:\a\Magick.Native\Magick.Native\src\Magick.Native\bin\ReleaseQ8\x64\Magick.Native-Q8-x64.pdb' source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF3635000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD3689000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.2988027071.000001DAD4740000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3113392926.000001DAEE980000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2987761781.000001DAD46A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/ControlzEx/obj/Release/net462/ControlzEx.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988245314.000001DAD4770000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: dinput.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256: source: 23bGlBtTiX.exe, 00000000.00000002.2987761781.000001DAD46A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988185158.000001DAD4760000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: D:\Paulo\Projetos\WPF-AutoComplete-TextBox\AutoCompleteTextBox\AutoCompleteTextBox\obj\Release\net472\AutoCompleteTextBox.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.3124879805.000001DAEEEB0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988975888.000001DAD6065000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: D:\a\_work\1\s\src\Microsoft.Xaml.Behaviors\obj\Release\net462\Microsoft.Xaml.Behaviors.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3125044472.000001DAEEEC0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6FFE000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE7026000.00000004.00000800.00020000.00000000.sdmp
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/mods/rrr/RRR_Patched_GOG.zipVhttps://raym.app/rcp/featured_gb_mods.jsoncnhttps://github.com/RayCarrot/Rayman-Control-Panel-MetroFhttps://www.youtube.com/c/RayCarrot:https://twitter.com/RayCarrot@mailto:RayCarrotMaster@gmail.comhhttps://steamcommunity.com/groups/RaymanControlPanel equals www.twitter.com (Twitter)
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/mods/rrr/RRR_Patched_GOG.zipVhttps://raym.app/rcp/featured_gb_mods.jsoncnhttps://github.com/RayCarrot/Rayman-Control-Panel-MetroFhttps://www.youtube.com/c/RayCarrot:https://twitter.com/RayCarrot@mailto:RayCarrotMaster@gmail.comhhttps://steamcommunity.com/groups/RaymanControlPanel equals www.youtube.com (Youtube)
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF359F000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD35F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://.css
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF359F000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD35F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://.jpg
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0K
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.Buttons.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.ComboBox.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.ListBox.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.Scrollbars.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.Shared.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.TabControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.TextBlock.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Styles/Controls.TextBox.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorCanvas.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorCanvas.xaml0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorComponentSlider.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorEyeDropper.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorPalette.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorPicker.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ContentControlEx.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/Dialogs/BaseMetroDialog.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/HamburgerMenu.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/HamburgerMenuTemplate.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/HotKeyBox.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/MetroContentControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/MetroHeader.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/MetroProgressBar.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/MetroTabControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/MetroTabItem.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/MetroWindow.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/NumericUpDown.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/Pivot.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ProgressRing.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/RangeSlider.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/SplitButton.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/SplitView.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/Thumb.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/Tile.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/ToggleSwitch.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/TransitioningContentControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/WindowButtonCommands.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/Themes/WindowCommands.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.blue.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.cyan.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.emerald.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.green.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.green.xaml0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.indigo.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.lime.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.magenta.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.olive.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.orange.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.purple.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.red.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.sienna.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.steel.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.taupe.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.teal.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.violet.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.yellow.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.cyan.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.emerald.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.green.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.indigo.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.magenta.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.mauve.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.pink.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.red.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.sienna.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.steel.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.taupe.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.teal.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.violet.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/MahApps.Metro;component/styles/themes/light.yellow.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Styles/Controls.ListBox.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ColorPicker/ColorCanvas.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ColorPicker/ColorComponentSlider.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ColorPicker/ColorEyeDropper.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ColorPicker/ColorPalette.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ColorPicker/ColorPicker.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ContentControlEx.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/Dialogs/BaseMetroDialog.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/HamburgerMenu.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/HamburgerMenuTemplate.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/HotKeyBox.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/MetroAnimatedTabControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/MetroContentControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/MetroHeader.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/MetroProgressBar.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/MetroTabControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/MetroTabItem.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/MetroWindow.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/NumericUpDown.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/Pivot.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ProgressRing.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/RangeSlider.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/SplitButton.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/SplitView.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/Thumb.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/Tile.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/ToggleSwitch.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/TransitioningContentControl.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/WindowButtonCommands.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/Themes/WindowCommands.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/controls.listbox.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/controls.listbox.baml0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.blue.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.cyan.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.emerald.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.green.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.indigo.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.lime.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.magenta.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.olive.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.orange.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.purple.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.red.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.sienna.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.steel.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.taupe.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.teal.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.violet.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/dark.yellow.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.cyan.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.emerald.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.green.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.indigo.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.magenta.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.mauve.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.pink.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.red.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.sienna.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.steel.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.taupe.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.teal.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.violet.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/styles/themes/light.yellow.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/colorpicker/colorcanvas.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/colorpicker/colorcomponentslider.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/colorpicker/coloreyedropper.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/colorpicker/colorpalette.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/colorpicker/colorpicker.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/contentcontrolex.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/dialogs/basemetrodialog.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/hamburgermenu.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/hamburgermenutemplate.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/hotkeybox.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/metroanimatedtabcontrol.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/metrocontentcontrol.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/metroheader.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/metroprogressbar.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/metrotabcontrol.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/metrotabitem.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/metrowindow.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/numericupdown.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/pivot.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/progressring.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/rangeslider.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/splitbutton.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/splitview.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/thumb.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/tile.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/toggleswitch.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/transitioningcontentcontrol.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/windowbuttoncommands.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/bar/themes/windowcommands.baml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.blue.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.blue.xaml0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.cyan.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.emerald.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.green.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.indigo.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.lime.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.magenta.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.olive.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.orange.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.purple.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.red.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.sienna.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.steel.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.taupe.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.teal.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.violet.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/dark.yellow.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.cyan.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.emerald.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.green.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.indigo.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.magenta.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.mauve.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.pink.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.red.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.sienna.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.steel.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.taupe.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.teal.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.violet.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://foo/styles/themes/light.yellow.xaml
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF359F000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD35F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://html4/loose.dtd
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF30A9000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD30FD000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://medical.nema.org/.
                      Source: 23bGlBtTiX.exeString found in binary or memory: http://metro.mahapps.com/winfx/xaml/controls
                      Source: 23bGlBtTiX.exeString found in binary or memory: http://metro.mahapps.com/winfx/xaml/iconpacks
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6EEC000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6B3D000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://metro.mahapps.com/winfx/xaml/shared
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6EEC000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://metro.mahapps.com/winfx/xaml/simplechildwindow
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nlog-project.org/dummynamespace/
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0K
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: 23bGlBtTiX.exeString found in binary or memory: http://wpfcontrols.com/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD317E000.00000002.00000001.01000000.00000003.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF312A000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF312A000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.libpng.org/
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF312A000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.libpng.org/pub/mng/
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF30A9000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD30FD000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.smtpe.org
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://aka.ms/toolkit/dotnet
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3246833523.00007FFDF37F3000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://efg2.com/Lab/Library/ImageProcessing/DHALF.TXT
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3246833523.00007FFDF37F3000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://fho-emden.de/~hoffmann/hilb010101.pdf
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamebanana.com/apiv11/Game/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamebanana.com/apiv11/Mod/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamebanana.com/apiv11/Mod/Multi?_csvRowIds=
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamebanana.com/mods/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/RaymanGardenPlus/622289
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/Rayman_ReDesigner/539216
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/Rayman_ReDesigner/539216dhttps://gamejolt.com/games/dreamersboundary/5075
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/Rayman_The_Dark_Magicians_Reign_of_terror/237701
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/Rayman_The_Dark_Magicians_Reign_of_terror/237701YRayman
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/dreamersboundary/507525GRayman
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/globoxmoment/428585
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/globoxmoment/428585#Globox
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/rayman_bowling_2/532563
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/rayman_bowling_2/532563)Rayman
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://gamejolt.com/games/raymanredemption/340532
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/CommunityToolkit/dotnet
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/ControlzEx/ControlzEx
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/ControlzEx/ControlzEx0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988975888.000001DAD5FF2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/MahApps/MahAp
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/MahApps/MahApps.Metro.git
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/MahApps/MahApps.Metro0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/NLog/NLog.git
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://github.com/RayCarrot/RayCarrot.RCP.Metro/wiki/Mod-LoaderCConverting
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113392926.000001DAEE980000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/AsyncEx
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113392926.000001DAEE980000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/AsyncEx5
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113630486.000001DAEE9A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/Deque
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113630486.000001DAEE9A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/Deque2
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988245314.000001DAD4770000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988245314.000001DAD4770000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988185158.000001DAD4760000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988027071.000001DAD4740000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2987761781.000001DAD46A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/runtime
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3125044472.000001DAEEEC0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6FFE000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE7026000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/XamlBehaviorsWpf
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/punker76/MahApps.Metro.SimpleChildWindow
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/punker76/MahApps.Metro.SimpleChildWindow.git
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://github.com/punker76/MahApps.Metro.SimpleChildWindow.gitT
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD3218000.00000002.00000001.01000000.00000003.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF31C3000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://gitlab.gnome.org/GNOME/glib/issues/new
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD3218000.00000002.00000001.01000000.00000003.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF31C3000.00000002.00000001.01000000.00000006.sdmpString found in binary or memory: https://gitlab.gnome.org/GNOME/glib/issues/newD:
                      Source: magick.native-q8-x64.dll.0.drString found in binary or memory: https://imagemagick.org
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3246833523.00007FFDF37F3000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://imagemagick.org/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://imagemagick.org/0
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF3005000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD2BA7000.00000002.00000001.01000000.00000003.sdmp, magick.native-q8-x64.dll.0.drString found in binary or memory: https://imagemagick.orgsoftwareThumb::Image::WidthThumb::Image::HeightThumb::Document::Pages
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nlog-project.org/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/maps/2https://raym.app/maps_r1/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/maps/?mode=
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/maps_r1/?mode=
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/ray1editor/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/RCP_Metro_Manifest.json
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/Xhttps://raym.app/rcp/RCP_Metro_Manifest.json
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/featured_gb_mods.jsoncILoading
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/news.json
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/news.jsonLhttps://raym.app/rcp/resources/12.0.0/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_1.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_2.zip7Rayman3_Demo_20021210_Win32
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_3.zip7Rayman3_Demo_20030108_Win32
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_4.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_5.zip7Rayman3_Demo_20030129_Win32
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/RRR_Demo.zip3RaymanRavingRabbids_Win32
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_1_Demo_1.zip7Rayman1_Demo_19960215_MsDos
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_1_Demo_2.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_1_Demo_3.zip7Rayman1_Demo_19951207_MsDos
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_2_Demo_1.zip)BinData
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_2_Demo_2.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_Gold_Demo.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_Gold_Demo.zip~https://raym.app/rcp/resources/12.0
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/demos/Rayman_M_Demo.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/games/PrintStudio1.zipyhttps://raym.app/rcp/resources/12.0.0/g
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/games/RavingRabbidsActivityCenter.zipORaymanRavingRabbids_Demo
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/games/RavingRabbidsActivityCenter.ziprhttps://raym.app/rcp/res
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/games/Ray1Minigames.zip7Rayman2_Demo_19990818_Win32
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/mods/rrr/RRR_Patched_GOG.zip)Invalid
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/mods/rrr/RRR_Patched_GOG.zipVhttps://raym.app/rcp/featured_gb_
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/mods/rrr/RRR_Patched_Steam.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/Vhttps://raym.app/rcp/resources/12.0.0/mods/Xhttps:/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/CompleteOST.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/CompleteOST.zip/Replacing
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/IncompleteOST.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/TPLS.zipIThe
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/CLIENT.EXE
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/RAYRUN.EXE
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/STARTUP.EXE
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/al/MAPPER.EXE
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/fr/MAPPER.EXE
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/us/MAPPER.EXE
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/ro/Updater.zip
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://raym.app/rcp/resources/12.0.0/utilities/ro/Updater.zip1RaymanOriginspc_1.02.exe-Downloading
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://steamcommunity.com/groups/RaymanControlPanel
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://steamcommunity.com/groups/RaymanControlPanel/discussions/0/1812044473314212117/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://store.steampowered.com/app/?https://steamcommunity.com/app/%steam://rungameid/
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://store.ubisoft.com/game?pid=
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.gog.com/game/rayman_2_the_great_escape
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.gog.com/game/rayman_3_hoodlum_havoc
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.gog.com/game/rayman_forever3GameDisplay_PurchaseUplay
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.gog.com/game/rayman_origins
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.gog.com/game/rayman_raving_rabbids
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.google.com/s2/favicons?domain=-Getting
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/NLog.Web.AspNetCore
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: DirectInput8Create called.memstr_109c4676-8
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: ARegisterRawInputDevicesmemstr_4ca13a1f-5
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B899BA00_2_00007FFD9B899BA0
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B897E490_2_00007FFD9B897E49
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B8905480_2_00007FFD9B890548
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B89BAA10_2_00007FFD9B89BAA1
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B89C7E00_2_00007FFD9B89C7E0
                      Source: 23bGlBtTiX.exeStatic PE information: No import functions for PE file found
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameControlzEx.dll6 vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMahApps.Metro.dll< vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMahApps.Metro.dll< vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: _originalFileName vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNLog.dll8 vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameControlzEx.dll6 vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988185158.000001DAD4760000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Bcl.AsyncInterfaces.dll@ vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3246833523.00007FFDF37F3000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenameMagick.Native< vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: _originalFileName vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNLog.dll8 vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRayCarrot.RCP.Updater.exe^ vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRayCarrot.RCP.Uninstaller.exeT vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDInput.dllj% vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3125044472.000001DAEEEC0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Xaml.Behaviors.dllR vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988027071.000001DAD4740000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Extensions.DependencyInjection.dll@ vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameMagick.Native< vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRayCarrot.RCP.Metro.resources.dllL vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6FFE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Xaml.Behaviors.dllR vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113630486.000001DAEE9A0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNito.Collections.Deque.dllN vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113392926.000001DAEE980000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameNito.AsyncEx.Coordination.dllT vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3124879805.000001DAEEEB0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameAutoCompleteTextBox.dllH vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Extensions.DependencyInjection.dll@ vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: _originalFileName vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNLog.dll8 vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000000.1711444485.000001DAD4306000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRayCarrot.RCP.Metro.exeJ vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMahApps.Metro.dll< vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988245314.000001DAD4770000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameSystem.Threading.Tasks.Extensions.dllT vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2987761781.000001DAD46A0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Extensions.DependencyInjection.Abstractions.dll@ vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCommunityToolkit.Mvvm.dllN vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMahApps.Metro.SimpleChildWindow.dll` vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.2988975888.000001DAD6065000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAutoCompleteTextBox.dllH vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE7026000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMicrosoft.Xaml.Behaviors.dllR vs 23bGlBtTiX.exe
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameControlzEx.dll6 vs 23bGlBtTiX.exe
                      Source: classification engineClassification label: mal48.evad.winEXE@1/1@0/0
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeMutant created: NULL
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeMutant created: \Sessions\1\BaseNamedObjects\Costura0356CB2390ED0D212B1CEB25ED194726
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeMutant created: \Sessions\1\BaseNamedObjects\Global\b2de6d50-e70b-47c4-bef0-471de28816d0
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeFile created: C:\Users\user\AppData\Local\Temp\CosturaJump to behavior
                      Source: 23bGlBtTiX.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: 23bGlBtTiX.exeStatic file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: 23bGlBtTiX.exeString found in binary or memory: Binstaller/installergifs/astro.gif
                      Source: 23bGlBtTiX.exeString found in binary or memory: @installer/installergifs/cask.gif+
                      Source: 23bGlBtTiX.exeString found in binary or memory: Binstaller/installergifs/chase.gifL
                      Source: 23bGlBtTiX.exeString found in binary or memory: @installer/installergifs/glob.gif
                      Source: 23bGlBtTiX.exeString found in binary or memory: Binstaller/installergifs/rodeo.gifj
                      Source: 23bGlBtTiX.exeString found in binary or memory: Pui/controls/loadinghost/loadinghost.baml.
                      Source: 23bGlBtTiX.exeString found in binary or memory: Nui/dialogs/addgames/addgamesdialog.baml7
                      Source: 23bGlBtTiX.exeString found in binary or memory: Xui/dialogs/addgames/addgamesgamecontrol.baml8
                      Source: 23bGlBtTiX.exeString found in binary or memory: lui/dialogs/gameclientssetup/addgameclientscontrol.baml9
                      Source: 23bGlBtTiX.exeString found in binary or memory: (UI/Controls/LoadingHost/LoadingHost.xaml?
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeFile read: C:\Users\user\Desktop\23bGlBtTiX.exe:Zone.IdentifierJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: mscoree.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: version.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: urlmon.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: srvcli.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: netutils.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: dnsapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: iphlpapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: dwrite.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: msvcp140_clr0400.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: propsys.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: windowscodecs.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: dwmapi.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: d3d9.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: d3d10warp.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: wtsapi32.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: winsta.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: powrprof.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: umpdc.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: dataexchange.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: d3d11.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: dcomp.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: dxgi.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: twinapi.appcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: resourcepolicyclient.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: dxcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: textshaping.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: textinputframework.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: coreuicomponents.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: coremessaging.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: ntmarta.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: msctfui.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: uiautomationcore.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeSection loaded: d3dcompiler_47.dllJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                      Source: 23bGlBtTiX.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: 23bGlBtTiX.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                      Source: 23bGlBtTiX.exeStatic file information: File size 51514368 > 1048576
                      Source: 23bGlBtTiX.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x30f2800
                      Source: 23bGlBtTiX.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: 23bGlBtTiX.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdbSHA256{ source: 23bGlBtTiX.exe, 00000000.00000002.3113392926.000001DAEE980000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988027071.000001DAD4740000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: /_/src/MahApps.Metro.SimpleChildWindow/obj/Release/net47/MahApps.Metro.SimpleChildWindow.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: RayCarrot.RCP.Metro.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/src/MahApps.Metro/obj/Release/net47/MahApps.Metro.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6820000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3114651832.000001DAEEA30000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: D:\Users\RibShark\Documents\Projects\rayman3-input-fix\Release\dinput8.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3113630486.000001DAEE9A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: C:\Dev\RayCarrot\RCP_Metro\RayCarrot.RCP.Metro\src\RayCarrot.RCP.Uninstaller\obj\Release\RayCarrot.RCP.Uninstaller.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: RayCarrot.RCP.Metro.pdbMPDB source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: D:\Paulo\Projetos\WPF-AutoComplete-TextBox\AutoCompleteTextBox\AutoCompleteTextBox\obj\Release\net472\AutoCompleteTextBox.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3124879805.000001DAEEEB0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988975888.000001DAD6065000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: D:\a\Magick.Native\Magick.Native\src\Magick.Native\bin\ReleaseQ8\x64\Magick.Native-Q8-x64.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF3635000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD3689000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.2988185158.000001DAD4760000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdbSHA256;@ source: 23bGlBtTiX.exe, 00000000.00000002.3113630486.000001DAEE9A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/NLog/obj/Release/net46/NLog.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: /_/src/NLog/obj/Release/net46/NLog.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: D:\a\Magick.Native\Magick.Native\src\Magick.Native\bin\ReleaseQ8\x64\Magick.Native-Q8-x64.pdb' source: 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF3635000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD3689000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.2988027071.000001DAD4740000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmp
                      Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3113392926.000001DAEE980000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2987761781.000001DAD46A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/ControlzEx/obj/Release/net462/ControlzEx.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988245314.000001DAD4770000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/src/CommunityToolkit.Mvvm/obj/Release/netstandard2.0/CommunityToolkit.Mvvm.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988422510.000001DAD4930000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: dinput.pdb source: 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD21A7000.00000002.00000001.01000000.00000003.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256: source: 23bGlBtTiX.exe, 00000000.00000002.2987761781.000001DAD46A0000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: 23bGlBtTiX.exe, 00000000.00000002.2988185158.000001DAD4760000.00000004.08000000.00040000.00000000.sdmp
                      Source: Binary string: D:\Paulo\Projetos\WPF-AutoComplete-TextBox\AutoCompleteTextBox\AutoCompleteTextBox\obj\Release\net472\AutoCompleteTextBox.pdbSHA256 source: 23bGlBtTiX.exe, 00000000.00000002.3124879805.000001DAEEEB0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.2988975888.000001DAD6065000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: D:\a\_work\1\s\src\Microsoft.Xaml.Behaviors\obj\Release\net462\Microsoft.Xaml.Behaviors.pdb source: 23bGlBtTiX.exe, 00000000.00000002.3125044472.000001DAEEEC0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6FFE000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE7026000.00000004.00000800.00020000.00000000.sdmp

                      Data Obfuscation

                      barindex
                      Yara detected Costura Assembly Loader
                      Source: Yara matchFile source: 23bGlBtTiX.exe, type: SAMPLE
                      Source: Yara matchFile source: 0.0.23bGlBtTiX.exe.1dad1fc2b43.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.0.23bGlBtTiX.exe.1dad3f14529.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.0.23bGlBtTiX.exe.1dad3f42f2d.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.0.23bGlBtTiX.exe.1dad3ee8325.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000000.1679030875.000001DAD1FDB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.2990307355.000001DAD60C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: 23bGlBtTiX.exe PID: 6760, type: MEMORYSTR
                      Source: 23bGlBtTiX.exeStatic PE information: 0x818D346F [Tue Nov 16 10:07:43 2038 UTC]
                      Source: magick.native-q8-x64.dll.0.drStatic PE information: section name: _RDATA
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B77D2A5 pushad ; iretd 0_2_00007FFD9B77D2A6
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B8A4BF7 push FFFFFFE8h; ret 0_2_00007FFD9B8A4BF9
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B897A78 pushad ; retf 0_2_00007FFD9B897C5D
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeCode function: 0_2_00007FFD9B897C5E push eax; retf 0_2_00007FFD9B897C6D
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeFile created: C:\Users\user\AppData\Local\Temp\Costura\0356CB2390ED0D212B1CEB25ED194726\64\magick.native-q8-x64.dllJump to dropped file
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeMemory allocated: 1DAD4660000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeMemory allocated: 1DAEE0C0000 memory reserve | memory write watchJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Costura\0356CB2390ED0D212B1CEB25ED194726\64\magick.native-q8-x64.dllJump to dropped file
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeMemory allocated: page read and write | page guardJump to behavior
                      Source: 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6351000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3113747204.000001DAEE9E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWndhwndthis
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Users\user\Desktop\23bGlBtTiX.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationClient.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\23bGlBtTiX.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Mitre Att&ck Matrix

                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                      Command and Scripting Interpreter                      		1
                      DLL Side-Loading                      		1
                      Process Injection                      		1
                      Virtualization/Sandbox Evasion                      		21
                      Input Capture                      		1
                      Virtualization/Sandbox Evasion                      		Remote Services21
                      Input Capture                      		1
                      Encrypted Channel                      		Exfiltration Over Other Network MediumAbuse Accessibility Features
                      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                      DLL Side-Loading                      		1
                      Disable or Modify Tools                      		LSASS Memory1
                      Process Discovery                      		Remote Desktop Protocol1
                      Archive Collected Data                      		Junk DataExfiltration Over BluetoothNetwork Denial of Service
                      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
                      Process Injection                      		Security Account Manager12
                      System Information Discovery                      		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                      Timestomp                      		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                      DLL Side-Loading                      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                      Obfuscated Files or Information                      		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      23bGlBtTiX.exe0%ReversingLabs

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Local\Temp\Costura\0356CB2390ED0D212B1CEB25ED194726\64\magick.native-q8-x64.dll0%ReversingLabs

                      Unpacked PE Files

                      ⊘No Antivirus matches

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
                      http://foo/Themes/ColorPicker/ColorPalette.xaml0%Avira URL Cloudsafe
                      https://nlog-project.org/0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/WindowButtonCommands.xaml0%Avira URL Cloudsafe
                      http://foo/styles/themes/light.emerald.xaml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.blue.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/SplitButton.xaml0%Avira URL Cloudsafe
                      http://foo/bar/themes/splitview.baml0%Avira URL Cloudsafe
                      http://foo/bar/styles/controls.listbox.baml00%Avira URL Cloudsafe
                      http://foo/styles/themes/light.indigo.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/demos/Rayman_2_Demo_2.zip0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorPalette.xaml0%Avira URL Cloudsafe
                      https://steamcommunity.com/groups/RaymanControlPanel/discussions/0/1812044473314212117/0%Avira URL Cloudsafe
                      http://foo/styles/themes/light.mauve.xaml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/light.violet.xaml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/Pivot.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/TransitioningContentControl.xaml0%Avira URL Cloudsafe
                      http://foo/bar/themes/contentcontrolex.baml0%Avira URL Cloudsafe
                      http://foo/styles/themes/dark.violet.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/CLIENT.EXE0%Avira URL Cloudsafe
                      https://www.gog.com/game/rayman_3_hoodlum_havoc0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/light.mauve.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/utilities/Vhttps://raym.app/rcp/resources/12.0.0/mods/Xhttps:/0%Avira URL Cloudsafe
                      http://foo/styles/themes/light.sienna.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/ToggleSwitch.xaml0%Avira URL Cloudsafe
                      http://foo/bar/themes/numericupdown.baml0%Avira URL Cloudsafe
                      http://foo/bar/themes/hamburgermenutemplate.baml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/light.sienna.baml0%Avira URL Cloudsafe
                      http://foo/styles/themes/light.green.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/games/PrintStudio1.zipyhttps://raym.app/rcp/resources/12.0.0/g0%Avira URL Cloudsafe
                      http://foo/styles/themes/dark.teal.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/utilities/r1/CompleteOST.zip0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/Dialogs/BaseMetroDialog.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/Dialogs/BaseMetroDialog.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/MetroTabControl.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/ProgressRing.xaml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/dark.purple.baml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/dark.violet.baml0%Avira URL Cloudsafe
                      http://foo/styles/themes/light.magenta.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_1.zip0%Avira URL Cloudsafe
                      https://gamejolt.com/games/globoxmoment/428585#Globox0%Avira URL Cloudsafe
                      https://github.com/punker76/MahApps.Metro.SimpleChildWindow.git0%Avira URL Cloudsafe
                      http://foo/Themes/SplitView.xaml0%Avira URL Cloudsafe
                      https://gamejolt.com/games/rayman_bowling_2/5325630%Avira URL Cloudsafe
                      http://foo/bar/themes/pivot.baml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/light.taupe.baml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/utilities/ro/Updater.zip1RaymanOriginspc_1.02.exe-Downloading0%Avira URL Cloudsafe
                      http://foo/bar/themes/tile.baml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/dark.magenta.baml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/mods/rrr/RRR_Patched_Steam.zip0%Avira URL Cloudsafe
                      https://gamebanana.com/apiv11/Mod/Multi?_csvRowIds=0%Avira URL Cloudsafe
                      http://foo/bar/themes/colorpicker/colorpicker.baml0%Avira URL Cloudsafe
                      https://www.gog.com/game/rayman_2_the_great_escape0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/dark.taupe.baml0%Avira URL Cloudsafe
                      https://raym.app/maps/2https://raym.app/maps_r1/0%Avira URL Cloudsafe
                      http://foo/styles/themes/dark.purple.xaml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/light.indigo.baml0%Avira URL Cloudsafe
                      http://foo/bar/themes/metrowindow.baml0%Avira URL Cloudsafe
                      https://www.nuget.org/packages/NLog.Web.AspNetCore0%Avira URL Cloudsafe
                      http://foo/styles/themes/dark.yellow.xaml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.emerald.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/HotKeyBox.xaml0%Avira URL Cloudsafe
                      http://foo/bar/themes/hamburgermenu.baml0%Avira URL Cloudsafe
                      http://foo/Themes/HamburgerMenuTemplate.xaml0%Avira URL Cloudsafe
                      https://gitlab.gnome.org/GNOME/glib/issues/new0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/demos/Rayman_M_Demo.zip0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/dark.emerald.baml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/ContentControlEx.xaml0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_4.zip0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/games/RavingRabbidsActivityCenter.zipORaymanRavingRabbids_Demo0%Avira URL Cloudsafe
                      https://gamejolt.com/games/Rayman_ReDesigner/5392160%Avira URL Cloudsafe
                      http://foo/styles/themes/light.teal.xaml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Styles/Controls.Scrollbars.xaml0%Avira URL Cloudsafe
                      https://github.com/microsoft/XamlBehaviorsWpf0%Avira URL Cloudsafe
                      https://imagemagick.orgsoftwareThumb::Image::WidthThumb::Image::HeightThumb::Document::Pages0%Avira URL Cloudsafe
                      http://foo/styles/themes/light.cyan.xaml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/light.mauve.baml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Styles/Controls.Shared.xaml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/dark.olive.baml0%Avira URL Cloudsafe
                      http://foo/bar/styles/themes/light.pink.baml0%Avira URL Cloudsafe
                      https://gamejolt.com/games/Rayman_The_Dark_Magicians_Reign_of_terror/237701YRayman0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/us/MAPPER.EXE0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/demos/Rayman_1_Demo_2.zip0%Avira URL Cloudsafe
                      http://foo/styles/themes/light.red.xaml0%Avira URL Cloudsafe
                      http://html4/loose.dtd0%Avira URL Cloudsafe
                      https://imagemagick.org/00%Avira URL Cloudsafe
                      http://foo/Themes/MetroWindow.xaml0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/ToggleSwitch.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/MetroHeader.xaml0%Avira URL Cloudsafe
                      https://efg2.com/Lab/Library/ImageProcessing/DHALF.TXT0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/games/RavingRabbidsActivityCenter.ziprhttps://raym.app/rcp/res0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.lime.xaml0%Avira URL Cloudsafe
                      http://foo/Themes/RangeSlider.xaml0%Avira URL Cloudsafe
                      http://metro.mahapps.com/winfx/xaml/iconpacks0%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/MetroWindow.xaml0%Avira URL Cloudsafe
                      http://.css0%Avira URL Cloudsafe
                      https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_3.zip7Rayman3_Demo_20030108_Win320%Avira URL Cloudsafe
                      http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorEyeDropper.xaml0%Avira URL Cloudsafe
                      https://store.steampowered.com/app/?https://steamcommunity.com/app/%steam://rungameid/0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      ⊘No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://foo/Themes/ColorPicker/ColorPalette.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/splitview.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.blue.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.emerald.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/demos/Rayman_2_Demo_2.zip23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/WindowButtonCommands.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/controls.listbox.baml023bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.indigo.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://nlog-project.org/23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/SplitButton.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorPalette.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://steamcommunity.com/groups/RaymanControlPanel/discussions/0/1812044473314212117/23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/TransitioningContentControl.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.mauve.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/light.violet.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/CLIENT.EXE23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/contentcontrolex.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/dark.violet.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/Pivot.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://www.gog.com/game/rayman_3_hoodlum_havoc23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/light.mauve.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/utilities/Vhttps://raym.app/rcp/resources/12.0.0/mods/Xhttps:/23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.sienna.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/hamburgermenutemplate.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/games/PrintStudio1.zipyhttps://raym.app/rcp/resources/12.0.0/g23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/numericupdown.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.green.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/ToggleSwitch.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/light.sienna.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/dark.teal.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/utilities/r1/CompleteOST.zip23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/Dialogs/BaseMetroDialog.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/Dialogs/BaseMetroDialog.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/dark.violet.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/MetroTabControl.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/dark.purple.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/ProgressRing.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.magenta.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_1.zip23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://gamejolt.com/games/globoxmoment/428585#Globox23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://github.com/punker76/MahApps.Metro.SimpleChildWindow.git23bGlBtTiX.exe, 00000000.00000002.3124632455.000001DAEEE90000.00000004.08000000.00040000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/SplitView.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://gamejolt.com/games/rayman_bowling_2/53256323bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/light.taupe.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/pivot.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/tile.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/mods/rrr/RRR_Patched_Steam.zip23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/utilities/ro/Updater.zip1RaymanOriginspc_1.02.exe-Downloading23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/dark.magenta.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://gamebanana.com/apiv11/Mod/Multi?_csvRowIds=23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://www.gog.com/game/rayman_2_the_great_escape23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/maps/2https://raym.app/maps_r1/23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/metrowindow.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/dark.taupe.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/dark.purple.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/colorpicker/colorpicker.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://www.nuget.org/packages/NLog.Web.AspNetCore23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6DE4000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3110914267.000001DAEE890000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE60C8000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/light.indigo.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/dark.yellow.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.emerald.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/HotKeyBox.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/themes/hamburgermenu.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://gitlab.gnome.org/GNOME/glib/issues/new23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD3218000.00000002.00000001.01000000.00000003.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF31C3000.00000002.00000001.01000000.00000006.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/demos/Rayman_M_Demo.zip23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_4.zip23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/games/RavingRabbidsActivityCenter.zipORaymanRavingRabbids_Demo23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/HamburgerMenuTemplate.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/ContentControlEx.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/dark.emerald.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://gamejolt.com/games/Rayman_ReDesigner/53921623bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.teal.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Styles/Controls.Scrollbars.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://github.com/microsoft/XamlBehaviorsWpf23bGlBtTiX.exe, 00000000.00000002.3125044472.000001DAEEEC0000.00000004.08000000.00040000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE6FFE000.00000004.00000800.00020000.00000000.sdmp, 23bGlBtTiX.exe, 00000000.00000002.3058157758.000001DAE7026000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://imagemagick.orgsoftwareThumb::Image::WidthThumb::Image::HeightThumb::Document::Pages23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF3005000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD2BA7000.00000002.00000001.01000000.00000003.sdmp, magick.native-q8-x64.dll.0.drfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/light.mauve.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.cyan.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/dark.olive.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/bar/styles/themes/light.pink.baml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Styles/Controls.Shared.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://gamejolt.com/games/Rayman_The_Dark_Magicians_Reign_of_terror/237701YRayman23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/demos/Rayman_1_Demo_2.zip23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/utilities/r1/raykit/us/MAPPER.EXE23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/styles/themes/light.red.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://imagemagick.org/023bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://html4/loose.dtd23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF359F000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD35F3000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/ToggleSwitch.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://efg2.com/Lab/Library/ImageProcessing/DHALF.TXT23bGlBtTiX.exe, 00000000.00000002.3246833523.00007FFDF37F3000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/MetroWindow.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/MetroHeader.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/games/RavingRabbidsActivityCenter.ziprhttps://raym.app/rcp/res23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/styles/themes/dark.lime.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6B09000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://foo/Themes/RangeSlider.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://metro.mahapps.com/winfx/xaml/iconpacks23bGlBtTiX.exefalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://raym.app/rcp/resources/12.0.0/demos/R3_Demo_3.zip7Rayman3_Demo_20030108_Win3223bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://.css23bGlBtTiX.exe, 00000000.00000002.3214981273.00007FFDF359F000.00000002.00000001.01000000.00000006.sdmp, 23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD35F3000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://store.steampowered.com/app/?https://steamcommunity.com/app/%steam://rungameid/23bGlBtTiX.exe, 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/ColorPicker/ColorEyeDropper.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://defaultcontainer/MahApps.Metro;component/Themes/MetroWindow.xaml23bGlBtTiX.exe, 00000000.00000002.2990307355.000001DAD6109000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      ⊘No contacted IP infos

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1446918
                      Start date and time:2024-05-24 01:03:12 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 8m 9s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:6
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:23bGlBtTiX.exe
                      renamed because original name is a hash value
                      Original Sample Name:ca6e33cf72e210e9b8faaa354de8b2382fc5e2a163d9172802011f68983fccb0.exe
                      Detection:MAL
                      Classification:mal48.evad.winEXE@1/1@0/0
                      EGA Information:
                      • Successful, ratio: 100%
                      HCA Information:
                      • Successful, ratio: 54%
                      • Number of executed functions: 14
                      • Number of non-executed functions: 2
                      Cookbook Comments:
                      • Found application associated with file extension: .exe

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                      • VT rate limit hit for: 23bGlBtTiX.exe

                      Simulations

                      Behavior and APIs

                      ⊘No simulations

                      Joe Sandbox View / Context

                      IPs

                      ⊘No context

                      Domains

                      ⊘No context

                      ASNs

                      ⊘No context

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\Local\Temp\Costura\0356CB2390ED0D212B1CEB25ED194726\64\magick.native-q8-x64.dll

                      Download File
                      Process:C:\Users\user\Desktop\23bGlBtTiX.exe
                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                      Category:dropped
                      Size (bytes):23137624
                      Entropy (8bit):6.57670120569104
                      Encrypted:false
                      SSDEEP:393216:uHOhioP3FFY0cOFqklODLpnZI4OSQH5dZCfBf1N:d1HK
                      MD5:6CAC0019D5F953791E171E57EA8F4E7C
                      SHA1:3EE0AE90971A319BEE12B9BBE6D7587B7C8F923B
                      SHA-256:33D66978194CBF759E262A32B83F62E0E7185483824555998B3A9994D2E8B619
                      SHA-512:7A0C5805DDEF633E522EBB64772C62FB74F7BF35275AB3635FF3B6D0BA55C1CB5F6CB269B5A1ABFA5DA748EA82BCC71225F0BC6EF8B074BB8CBB0C450E8F5324
                      Malicious:false
                      Antivirus:
                      • Antivirus: ReversingLabs, Detection: 0%
                      Reputation:low
                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........M...#...#...#... ...#...&.K.#......#...&..#...'...#... ...#...'...#... ...#...#...#...'.j.#...&..#..."...#..."...#...*...#...#...#......#.......#...!...#.Rich..#.........................PE..d...`.oe.........." ...%.:..........,.)......................................@g.....&.a...`.........................................p5O.|b...O.......d.0z...0\.4f....`.X7...0f.P....vB.T....................wB.(...puB.@............P...............................text....9.......:.................. ..`.rdata...pr..P...rr..>..............@..@.data...H]....O..<....O.............@....pdata..4f...0\..h....U.............@..@_RDATA..0.....d......T^.............@..@.rsrc...0z....d..|...X^.............@..@.reloc..P....0f......._.............@..B........................................................................................................................................

                      Static File Info

                      General

                      File type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                      Entropy (8bit):7.394807966041646
                      TrID:
                      • Win64 Executable GUI Net Framework (217006/5) 49.88%
                      • Win64 Executable GUI (202006/5) 46.43%
                      • Win64 Executable (generic) (12005/4) 2.76%
                      • Generic Win/DOS Executable (2004/3) 0.46%
                      • DOS Executable Generic (2002/1) 0.46%
                      File name:23bGlBtTiX.exe
                      File size:51'514'368 bytes
                      MD5:4e14611a07ab337ac271117a19c3181e
                      SHA1:b1e420c460b8dd3d8fbcd5e1f0a14da833d6c05e
                      SHA256:ca6e33cf72e210e9b8faaa354de8b2382fc5e2a163d9172802011f68983fccb0
                      SHA512:6dfeafc0e260bd1d081ac6a3422f2c0d35d88c173391acab097eb672fddb5ee1b8366aee713c6dacea50b6f7714a4158142a729b981fffb1fe1efa2f26890110
                      SSDEEP:393216:LwZs2PWABsKi/W8Bs/md6sJZRbfnA3yt1lpoixFHOhioP3FFY0cOFqklODLpnZIl:MZGdO8BsOMsVICNpu1HKNLy70goW41
                      TLSH:A7B7E101B3E404E9E1B7C534DA766613EB71B89A077187EF269485ED2F27BD0293B312
                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...o4............"...0..(............... ....@...... .......................`............`...@......@............... .....

                      File Icon

                      Icon Hash:8f2d317127b2cacc

                      Static PE Info

                      General

                      Entrypoint:0x400000
                      Entrypoint Section:
                      Digitally signed:false
                      Imagebase:0x400000
                      Subsystem:windows gui
                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Time Stamp:0x818D346F [Tue Nov 16 10:07:43 2038 UTC]
                      TLS Callbacks:
                      CLR (.Net) Version:v4.0.30319
                      OS Version Major:4
                      OS Version Minor:0
                      File Version Major:4
                      File Version Minor:0
                      Subsystem Version Major:4
                      Subsystem Version Minor:0
                      Import Hash:

                      Entrypoint Preview

                      Instruction
                      dec ebp
                      pop edx
                      nop
                      add byte ptr [ebx], al
                      add byte ptr [eax], al
                      add byte ptr [eax+eax], al
                      add byte ptr [eax], al

                      Data Directories

                      NameVirtual AddressVirtual Size Is in Section
                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x30f60000x2e0f0.rsrc
                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                      IMAGE_DIRECTORY_ENTRY_DEBUG0x30648c40x54.text
                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20000x48.text
                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                      Sections

                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                      .text0x20000x30f27880x30f280043659fe9169faa25ba3305ea011a82b7unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      .rsrc0x30f60000x2e0f00x2e2001e36ebd4dbe4034fd6feb8a3990dc3e5False0.7380430640243902data6.864365166574471IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                      Resources

                      NameRVASizeTypeLanguageCountryZLIB Complexity
                      RT_ICON0x30f61a00x15359PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.998353918939141
                      RT_ICON0x310b50c0x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 5904 x 5904 px/m0.4873417721518987
                      RT_ICON0x311bd440x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5904 x 5904 px/m0.5686112423240435
                      RT_ICON0x311ff7c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 5904 x 5904 px/m0.5997925311203319
                      RT_ICON0x31225340x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 5904 x 5904 px/m0.650328330206379
                      RT_ICON0x31235ec0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 5904 x 5904 px/m0.7606382978723404
                      RT_GROUP_ICON0x3123a640x5aTarga image data - Map 32 x 21337 x 1 +10.7777777777777778
                      RT_VERSION0x3123ad00x41edata0.4222011385199241
                      RT_MANIFEST0x3123f000x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                      Network Behavior

                      ⊘No network behavior found

                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      System Behavior

                      General

                      Target ID:0
                      Start time:19:04:04
                      Start date:23/05/2024
                      Path:C:\Users\user\Desktop\23bGlBtTiX.exe
                      Wow64 process (32bit):false
                      Commandline:"C:\Users\user\Desktop\23bGlBtTiX.exe"
                      Imagebase:0x1dad1210000
                      File size:51'514'368 bytes
                      MD5 hash:4E14611A07AB337AC271117A19C3181E
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1679030875.000001DAD1FDB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2990307355.000001DAD60C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1679030875.000001DAD41D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1679030875.000001DAD37D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                      Reputation:low
                      Has exited:false

                      Disassembly

                      Reset < >

                        Execution Graph

                        Execution Coverage:12.1%
                        Dynamic/Decrypted Code Coverage:100%
                        Signature Coverage:0%
                        Total number of Nodes:7
                        Total number of Limit Nodes:0
                        execution_graph 17518 7ffd9b89236a 17519 7ffd9b892320 17518->17519 17519->17518 17520 7ffd9b8923ec SetErrorMode 17519->17520 17521 7ffd9b892423 17520->17521 17522 7ffd9b89244c 17523 7ffd9b892455 LoadLibraryW 17522->17523 17525 7ffd9b892514 17523->17525

                        Executed Functions

                        Function 00007FFD9B899BA0 Relevance: 1.9, Strings: 1, Instructions: 673COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 155 7ffd9b899ba0-7ffd9b89ed27 157 7ffd9b89ed36-7ffd9b89ed66 155->157 158 7ffd9b89ed29-7ffd9b89ed35 155->158 163 7ffd9b89ed68-7ffd9b89ed6f 157->163 164 7ffd9b89ed70-7ffd9b89ed73 157->164 158->157 162 7ffd9b89ed7f-7ffd9b89eda5 158->162 165 7ffd9b89eda7-7ffd9b89edee 162->165 166 7ffd9b89edef-7ffd9b89ee33 call 7ffd9b899f38 162->166 163->164 165->166 171 7ffd9b89f246-7ffd9b89f24f 166->171 172 7ffd9b89ee39-7ffd9b89ee3d 166->172 178 7ffd9b89f292-7ffd9b89f29a 171->178 174 7ffd9b89ef94-7ffd9b89efa4 172->174 175 7ffd9b89ee43-7ffd9b89ee47 172->175 176 7ffd9b89efa6-7ffd9b89efb1 174->176 177 7ffd9b89effa-7ffd9b89f01d 174->177 179 7ffd9b89eefa 175->179 180 7ffd9b89ee4d-7ffd9b89ee62 175->180 187 7ffd9b89efe8-7ffd9b89eff8 176->187 188 7ffd9b89efb3-7ffd9b89efbe 176->188 184 7ffd9b89f0c2-7ffd9b89f0ce 177->184 185 7ffd9b89f023-7ffd9b89f081 call 7ffd9b896d00 177->185 193 7ffd9b89f29b-7ffd9b89f2ac 178->193 186 7ffd9b89eefc 179->186 190 7ffd9b89ee68-7ffd9b89ee7c 180->190 191 7ffd9b89eeff-7ffd9b89ef0d 180->191 209 7ffd9b89f1fa-7ffd9b89f222 184->209 210 7ffd9b89f0d4-7ffd9b89f0e8 184->210 207 7ffd9b89f0b2-7ffd9b89f0bc 185->207 224 7ffd9b89f083 185->224 186->191 187->177 192 7ffd9b89efc0-7ffd9b89efc8 188->192 201 7ffd9b89ee7e-7ffd9b89ee80 190->201 202 7ffd9b89eeed-7ffd9b89eef5 190->202 196 7ffd9b89ef0e-7ffd9b89ef19 191->196 192->178 197 7ffd9b89efce 192->197 198 7ffd9b89f37d-7ffd9b89f394 193->198 199 7ffd9b89f2b2-7ffd9b89f2d1 193->199 204 7ffd9b89ef1a-7ffd9b89ef33 call 7ffd9b896d00 196->204 205 7ffd9b89efcf-7ffd9b89efd7 197->205 206 7ffd9b89f39a-7ffd9b89f3ca 198->206 198->207 217 7ffd9b89f2e0-7ffd9b89f32e 199->217 218 7ffd9b89f2d3-7ffd9b89f2de 199->218 201->186 213 7ffd9b89ee82 201->213 212 7ffd9b89f3f5-7ffd9b89f415 call 7ffd9b89f416 202->212 236 7ffd9b89ef38-7ffd9b89ef4f 204->236 237 7ffd9b89efd8-7ffd9b89efdd 205->237 248 7ffd9b89f12d-7ffd9b89f158 206->248 249 7ffd9b89f3d0-7ffd9b89f3ea 206->249 207->184 207->185 209->171 219 7ffd9b89f0ea-7ffd9b89f0ec 210->219 220 7ffd9b89f159-7ffd9b89f164 call 7ffd9b899bc0 210->220 222 7ffd9b89eec9-7ffd9b89eed1 213->222 223 7ffd9b89ee84-7ffd9b89ee87 213->223 217->198 262 7ffd9b89f330-7ffd9b89f37b 217->262 218->217 229 7ffd9b89f168-7ffd9b89f16f call 7ffd9b899bd0 219->229 230 7ffd9b89f0ee-7ffd9b89f0f5 219->230 220->229 238 7ffd9b89eed5-7ffd9b89eed6 222->238 233 7ffd9b89eef8 223->233 234 7ffd9b89ee89-7ffd9b89ee8e 223->234 235 7ffd9b89f084-7ffd9b89f08f 224->235 250 7ffd9b89f171-7ffd9b89f175 229->250 230->250 251 7ffd9b89f0f7-7ffd9b89f0fb 230->251 233->179 234->238 253 7ffd9b89ee90-7ffd9b89ee92 234->253 235->193 264 7ffd9b89f095-7ffd9b89f0b0 235->264 236->192 255 7ffd9b89ef51-7ffd9b89ef53 236->255 244 7ffd9b89efde-7ffd9b89efe7 237->244 245 7ffd9b89eedc-7ffd9b89eee9 call 7ffd9b89d0d0 238->245 244->187 266 7ffd9b89eeeb 245->266 248->220 258 7ffd9b89f3ec 249->258 259 7ffd9b89f3f1-7ffd9b89f3f3 249->259 260 7ffd9b89f177-7ffd9b89f1b5 250->260 251->260 261 7ffd9b89f0fd 251->261 253->196 263 7ffd9b89ee94-7ffd9b89ee99 253->263 255->205 265 7ffd9b89ef55 255->265 258->207 259->206 282 7ffd9b89f1b7-7ffd9b89f1e8 260->282 283 7ffd9b89f1ea-7ffd9b89f1f4 260->283 261->235 267 7ffd9b89f0ff 261->267 262->198 263->204 269 7ffd9b89ee9b 263->269 264->207 265->245 270 7ffd9b89ef57-7ffd9b89ef5c 265->270 266->202 267->248 269->222 270->237 274 7ffd9b89ef5e-7ffd9b89ef62 270->274 274->244 275 7ffd9b89ef64 274->275 275->266 276 7ffd9b89ef66 275->276 276->174 282->283 283->209
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.3140749467.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b890000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID: 6M_H
                        • API String ID: 0-3378704075
                        • Opcode ID: a22540c615d33b5e15bfe8da8895c2f059efef3d3261ba6ca00d2c6ab0490ad7
                        • Instruction ID: b2c8b825f9cff0846de29f05b9de865d66d893ad655ae2dfee4fe4853cc52d86
                        • Opcode Fuzzy Hash: a22540c615d33b5e15bfe8da8895c2f059efef3d3261ba6ca00d2c6ab0490ad7
                        • Instruction Fuzzy Hash: E522F330B19A4D8FEBA8DB5CC8656B87BE1EF58310F1141BAD04DC76A2DE34BD468B41
                        Function 00007FFD9B890548 Relevance: 1.7, Strings: 1, Instructions: 456COMMON
                        Download Yara Rule

                        Control-flow Graph

                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.3140749467.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b890000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID: _
                        • API String ID: 0-701932520
                        • Opcode ID: 039b2e2f2daede70b2b5586f189ccd335b781e0239ecc27f2d2e1d4261629726
                        • Instruction ID: 53b417aaf4937689643dd665673cb60604d13c7c0fd8cb296174709d632e2147
                        • Opcode Fuzzy Hash: 039b2e2f2daede70b2b5586f189ccd335b781e0239ecc27f2d2e1d4261629726
                        • Instruction Fuzzy Hash: 08D12763B1F6EA8FE722577D98B50E53BA0EF5666070A40B7C0C5CB0A3E9156906CBC1
                        Function 00007FFD9B897E49 Relevance: 1.5, Strings: 1, Instructions: 287COMMON
                        Download Yara Rule

                        Control-flow Graph

                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.3140749467.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b890000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID: I
                        • API String ID: 0-1966777607
                        • Opcode ID: dd8f109b2b234a49044a3cc86f602a0bfd341ee60e73230093ab1ce2178027ec
                        • Instruction ID: 98c2f2e4eb70ef63eb1f301ff62ffa99380e799646936bf5e0dcbc4af3f498bd
                        • Opcode Fuzzy Hash: dd8f109b2b234a49044a3cc86f602a0bfd341ee60e73230093ab1ce2178027ec
                        • Instruction Fuzzy Hash: 12815A61B0EA8E0BEF29DB6858264B97FC2EF99754B0902BDD449D71A2DD2469038380
                        Function 00007FFD9B89244C Relevance: 1.6, APIs: 1, Instructions: 128libraryCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 766 7ffd9b89244c-7ffd9b892453 767 7ffd9b892455-7ffd9b89245d 766->767 768 7ffd9b89245e-7ffd9b8924ce 766->768 767->768 772 7ffd9b8924d8-7ffd9b892512 LoadLibraryW 768->772 773 7ffd9b8924d0-7ffd9b8924d5 768->773 774 7ffd9b89251a-7ffd9b892542 772->774 775 7ffd9b892514 772->775 773->772 775->774
                        APIs
                        Memory Dump Source
                        • Source File: 00000000.00000002.3140749467.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b890000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID: LibraryLoad
                        • String ID:
                        • API String ID: 1029625771-0
                        • Opcode ID: a7b99e8bc02880469e8d0b8fb8e84264114b86a5e60251e294aa83ab333bb332
                        • Instruction ID: 60fca6292bf02bb7986dd25f8461e5bda05aa15ca4a57a0b58485da1b8b56698
                        • Opcode Fuzzy Hash: a7b99e8bc02880469e8d0b8fb8e84264114b86a5e60251e294aa83ab333bb332
                        • Instruction Fuzzy Hash: 8631F531A0CB484FDB2DDF989855AF97BF0EF5A311F04426FD04AD3692DB74A8068791
                        Function 00007FFD9B89236A Relevance: 1.6, APIs: 1, Instructions: 112COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 777 7ffd9b89236a 778 7ffd9b89236f-7ffd9b89237a 777->778 780 7ffd9b89237c-7ffd9b8923e4 778->780 781 7ffd9b892320-7ffd9b892323 778->781 786 7ffd9b8923ec-7ffd9b892421 SetErrorMode 780->786 781->777 787 7ffd9b892429-7ffd9b892445 786->787 788 7ffd9b892423 786->788 788->787
                        APIs
                        Memory Dump Source
                        • Source File: 00000000.00000002.3140749467.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b890000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID: ErrorMode
                        • String ID:
                        • API String ID: 2340568224-0
                        • Opcode ID: 993b45fce80faa7726045fce68e698a184e053bfde93ad5aab6c8e2cded4267b
                        • Instruction ID: 40f4c872d6b1bfd884937e4cabb6ca2a805c64384c918b6ff7ca722e35ab3852
                        • Opcode Fuzzy Hash: 993b45fce80faa7726045fce68e698a184e053bfde93ad5aab6c8e2cded4267b
                        • Instruction Fuzzy Hash: 61312431A0DA4C9FEB1DDF9988456E8BBE0FF59310F00416FC059C32A2DB75A806CB81
                        Function 00007FFD9B77E330 Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.3139865579.00007FFD9B77D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B77D000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b77d000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID: sk;
                        • API String ID: 0-1256885303
                        • Opcode ID: 206e5b94f8591b755d66267cfed0b2861549e268e8216f333139d482d3deff26
                        • Instruction ID: f32ff191e6c4c4869bc28218bdb11073cabc6235025fe2571a000aeca4415d38
                        • Opcode Fuzzy Hash: 206e5b94f8591b755d66267cfed0b2861549e268e8216f333139d482d3deff26
                        • Instruction Fuzzy Hash: F641177150EBC44FE7568B3998959623FF0EF47320B1606EFD088CB1B3D665A846C7A2
                        Function 00007FFD9BBA1D1D Relevance: .7, Instructions: 742COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 931700a536a4549b1eed8ff797d90b3025152105fb0e756be771876349837e11
                        • Instruction ID: 2480b9bd2022bdb8ab53e66bb95ca0e8ac96640bacc54d4f1d84ef03bcb807fc
                        • Opcode Fuzzy Hash: 931700a536a4549b1eed8ff797d90b3025152105fb0e756be771876349837e11
                        • Instruction Fuzzy Hash: 08423831E0E78A4EE7B99A9488615BD3BD1FF95308F05057ED48DC75E3ED186A0AC382
                        Function 00007FFD9BBA0ED0 Relevance: .4, Instructions: 421COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 71a997bdc1be989949e00ea7e06f7d556b9403227f532afc60fda094ce930ecc
                        • Instruction ID: e76afcb70866bddbff4fb62ee4ef79f15afd260147f9b08756d76abfc91f8457
                        • Opcode Fuzzy Hash: 71a997bdc1be989949e00ea7e06f7d556b9403227f532afc60fda094ce930ecc
                        • Instruction Fuzzy Hash: 86C1D335F0EA4E0FEBA8EB688422AB973D1FF45714F45017DD45EC31E2DE29A9028781
                        Function 00007FFD9BBA1EE9 Relevance: .4, Instructions: 405COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: bbd8dd318fcd74d23a65d06cb91a8b305c7de4056a906acd118677889e619032
                        • Instruction ID: 1e1232f6a54856341cc575f075a4f54d8022747063fe4bc84a5d21502a942f25
                        • Opcode Fuzzy Hash: bbd8dd318fcd74d23a65d06cb91a8b305c7de4056a906acd118677889e619032
                        • Instruction Fuzzy Hash: 6CD10A71E0E78A4FEB769B9488615B93BE1FF55308F0505BED44CC74E3FA189A0A8781
                        Function 00007FFD9BBA14E9 Relevance: .1, Instructions: 146COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 9c0c7f2fafac0ee7903fa8b322528604375e760a196dbcb0f6cdb60d7d7b6884
                        • Instruction ID: 3e47d44dc77b43473c54859d3e32bebc1e334ed1bca249cd71e084e6526ef35a
                        • Opcode Fuzzy Hash: 9c0c7f2fafac0ee7903fa8b322528604375e760a196dbcb0f6cdb60d7d7b6884
                        • Instruction Fuzzy Hash: 28418710B19E594FEBD5A77C44322B827D2EF8E744B5A41F9E44DC72E7DD18AE014381
                        Function 00007FFD9BBA0060 Relevance: .1, Instructions: 133COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f1809f4d892a60576acf4a54f0cf3a65f63cc1a6f9f7a707d4f629ffa863c354
                        • Instruction ID: 03a3f4dba45beaf835f36c4dcf6c3c31711fe70534100bac2ea9436acfed690b
                        • Opcode Fuzzy Hash: f1809f4d892a60576acf4a54f0cf3a65f63cc1a6f9f7a707d4f629ffa863c354
                        • Instruction Fuzzy Hash: EE416A71E08A4C8FDB98DF98D855BE9BBF1FB99310F00416ED00ED7291DA74A985CB81
                        Function 00007FFD9BBA16DD Relevance: .1, Instructions: 108COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 64043b8c86e72122e4297242d57b5ff792bcddb0a23d4d76d47e27e35f03caa3
                        • Instruction ID: 93036c065fefe230ec15a073c9da5406054504494f306b71d45c2bfd44c9ec0d
                        • Opcode Fuzzy Hash: 64043b8c86e72122e4297242d57b5ff792bcddb0a23d4d76d47e27e35f03caa3
                        • Instruction Fuzzy Hash: 31310430B1DA894FD799DB388864A6577E1FF9A308B1541BAD04ECB2D6CD28BC45C301
                        Function 00007FFD9BBA12A6 Relevance: .0, Instructions: 37COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: aafae4134b863b75d0e127533bc473390690cb2728af933b2f25ab319ae9cf40
                        • Instruction ID: cd65dbcbc9d451c39c854bf209266b824bcf954c6d087d03ace3d5942b806a95
                        • Opcode Fuzzy Hash: aafae4134b863b75d0e127533bc473390690cb2728af933b2f25ab319ae9cf40
                        • Instruction Fuzzy Hash: 5FF0375094FBC60FE71353B50C2A6957F919E131A8F4E02EAD494CA1F3E88D959AC362
                        Function 00007FFD9BBA12E0 Relevance: .0, Instructions: 10COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3153702589.00007FFD9BBA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBA0000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9bba0000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 7382dbad28d9deb0cc71bafbefa37d1d59dbc58eebe4f386af4a05a4a0a6b000
                        • Instruction ID: 3fc61935c5a4b9369705b46d238f3d7cf66ce59d5f9d5e488c405ae14022cfcc
                        • Opcode Fuzzy Hash: 7382dbad28d9deb0cc71bafbefa37d1d59dbc58eebe4f386af4a05a4a0a6b000
                        • Instruction Fuzzy Hash: CDB09244E17D1F00E96C32A609720B62080AF4A259FC60279A808C40D6E80CD6ED81A2

                        Non-executed Functions

                        Function 00007FFD9B89BAA1 Relevance: 2.8, Strings: 2, Instructions: 309COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.3140749467.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b890000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID: gfff$gfff
                        • API String ID: 0-3084402119
                        • Opcode ID: 533a0b2ef962eaf6c9903d32da585e128168e4e418f3551fb5ff7a2031f1994c
                        • Instruction ID: ff9dbfaa6d94f7d91f19fc4b47d59167c3c645c4dac955cb59861100ffe475ce
                        • Opcode Fuzzy Hash: 533a0b2ef962eaf6c9903d32da585e128168e4e418f3551fb5ff7a2031f1994c
                        • Instruction Fuzzy Hash: 08910430B1D7494FD758DB18985267ABBD5FF89704F11417DE48BC72A6CE28F8428782
                        Function 00007FFD9B89C7E0 Relevance: .5, Instructions: 527COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000000.00000002.3140749467.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_7ffd9b890000_23bGlBtTiX.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: e58cf145dfbc96966c6b1edc565a66af54e270c8547f8fc6b32eb3a030282ed6
                        • Instruction ID: 69fa57a4fc7eed529c3173620a6fe8b92c16bea5f54e1c8aff89f8258e9b5cfe
                        • Opcode Fuzzy Hash: e58cf145dfbc96966c6b1edc565a66af54e270c8547f8fc6b32eb3a030282ed6
                        • Instruction Fuzzy Hash: 74F14A71B1EB894FEB6DDB6888265797FD1EF5A310F0505BED489C71A3ED24A8028342