Edit tour

Windows Analysis Report
TRxHlAc5qV.msi

Overview

General Information

Sample name:TRxHlAc5qV.msi
renamed because original name is a hash value
Original sample name:6251d8f0af660e1e92506d6cea15fd9a7d332a669a6e1b3cf47914b45267b16d.msi
Analysis ID:1670991
MD5:be1c1078180ef9b833853be5a1ef73f8
SHA1:4095649239030e10fc6ee6692362e112336a6cc5
SHA256:6251d8f0af660e1e92506d6cea15fd9a7d332a669a6e1b3cf47914b45267b16d
Tags:biblegummzmsiuser-JAMESWT_WT
Infos:

Detection

LummaC Stealer
Score:72
Range:0 - 100
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Sample uses string decryption to hide its real strings
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • msiexec.exe (PID: 6644 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\TRxHlAc5qV.msi" MD5: E5DA170027542E25EDE42FC54C929077)
  • msiexec.exe (PID: 6040 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • Audacity.exe (PID: 7136 cmdline: "C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe" MD5: 9488F51D9BB30C6DC834A5B16DE79507)
  • cleanup
{
  "C2 url": [
    "econusi.digital/nwmb",
    "jawdedmirror.run/ewqd",
    "changeaie.top/geps",
    "lonfgshadow.live/xawi",
    "liftally.top/xasj",
    "nighetwhisper.top/lekd",
    "salaccgfa.top/gsooz",
    "zestmodp.top/zeda",
    "owlflright.digital/qopy"
  ],
  "Build id": "c6f6999caf2921e79959420ebe8ada32"
}
SourceRuleDescriptionAuthorStrings
00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
    00000003.00000003.1871596638.000000000BBB7000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
      00000003.00000003.1871519233.000000000BD09000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
        00000003.00000003.1871596638.000000000BC4F000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
          00000003.00000003.1869722097.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
            Click to see the 14 entries
            No Sigma rule has matched
            No Suricata rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: LummaC {"C2 url": ["econusi.digital/nwmb", "jawdedmirror.run/ewqd", "changeaie.top/geps", "lonfgshadow.live/xawi", "liftally.top/xasj", "nighetwhisper.top/lekd", "salaccgfa.top/gsooz", "zestmodp.top/zeda", "owlflright.digital/qopy"], "Build id": "c6f6999caf2921e79959420ebe8ada32"}
            Source: TRxHlAc5qV.msiReversingLabs: Detection: 13%
            Source: TRxHlAc5qV.msiVirustotal: Detection: 15%Perma Link
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: econusi.digital/nwmb
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: jawdedmirror.run/ewqd
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: changeaie.top/geps
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: lonfgshadow.live/xawi
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: liftally.top/xasj
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: nighetwhisper.top/lekd
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: salaccgfa.top/gsooz
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: zestmodp.top/zeda
            Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmpString decryptor: owlflright.digital/qopy
            Source: Audacity.exe, 00000003.00000002.2340945642.000000006A11A000.00000002.00000001.01000000.0000005B.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_2b47d8c2-f
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\License Agreement.txtJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\License Agreement.txtJump to behavior
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-registries.pdb source: Audacity.exe, 00000003.00000002.2348495989.000000006ABC3000.00000002.00000001.01000000.0000003F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-stretching-sequence.pdb source: Audacity.exe, 00000003.00000002.2352326349.000000006AE71000.00000002.00000001.01000000.00000031.sdmp, lib-stretching-sequence.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-builtin-effects.pdb source: Audacity.exe, 00000003.00000002.2362081920.000000006C5A0000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_html_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2358648263.000000006BE65000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-network-manager.pdb source: Audacity.exe, 00000003.00000002.2355436706.000000006B1E7000.00000002.00000001.01000000.00000025.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-io.pdb source: Audacity.exe, 00000003.00000002.2353901250.000000006B056000.00000002.00000001.01000000.0000002A.sdmp, lib-audio-io.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ladspa.pdb%%"" source: Audacity.exe, 00000003.00000002.2362951447.000000006F801000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-init.pdb source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-channel.pdb!! " source: Audacity.exe, 00000003.00000002.2349719148.000000006ACA9000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-numeric-formats.pdb source: Audacity.exe, 00000003.00000002.2349056918.000000006AC43000.00000002.00000001.01000000.0000003C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-concurrency.pdb source: Audacity.exe, 00000003.00000002.2341121317.000000006A147000.00000002.00000001.01000000.0000005A.sdmp, lib-concurrency.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track-selection.pdb$$!" source: Audacity.exe, 00000003.00000002.2349515048.000000006AC88000.00000002.00000001.01000000.0000003B.sdmp, lib-track-selection.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\porta9bd3205496548\b\build\RelWithDebInfo\portaudio_x86.pdb source: Audacity.exe, 00000003.00000002.2343800500.000000006A4AD000.00000002.00000001.01000000.0000004E.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-lv2.pdbEE"" source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-shuttlegui.pdb!! " source: Audacity.exe, 00000003.00000002.2360083931.000000006C120000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-viewport.pdb source: Audacity.exe, 00000003.00000002.2357004512.000000006B423000.00000002.00000001.01000000.0000001C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-strings.pdb$$ source: Audacity.exe, 00000003.00000002.2344332410.000000006A584000.00000002.00000001.01000000.0000004C.sdmp, lib-strings.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-math.pdb source: Audacity.exe, 00000003.00000002.2346624020.000000006AA19000.00000002.00000001.01000000.00000046.sdmp, lib-math.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-snapping.pdb source: Audacity.exe, 00000003.00000002.2350545642.000000006AD49000.00000002.00000001.01000000.00000037.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sample-track.pdb source: Audacity.exe, 00000003.00000002.2351796824.000000006ADE7000.00000002.00000001.01000000.00000033.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-uuid.pdb source: Audacity.exe, 00000003.00000002.2355653671.000000006B23B000.00000002.00000001.01000000.00000024.sdmp, lib-uuid.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-crashpad-configurer.pdb source: Audacity.exe, 00000003.00000002.2360879394.000000006C30F000.00000002.00000001.01000000.00000012.sdmp, lib-crashpad-configurer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sqlite-helpers.pdb&& source: Audacity.exe, 00000003.00000002.2341687838.000000006A230000.00000002.00000001.01000000.00000057.sdmp, lib-sqlite-helpers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-dynamic-range-processor.pdb source: Audacity.exe, 00000003.00000002.2356792962.000000006B3F4000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-rate.pdb source: Audacity.exe, 00000003.00000002.2348888470.000000006AC0C000.00000002.00000001.01000000.0000003D.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-note-track.pdb,,# source: Audacity.exe, 00000003.00000002.2354329585.000000006B0A2000.00000002.00000001.01000000.00000029.sdmp, lib-note-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-wrappers.pdb++ source: Audacity.exe, 00000003.00000002.2359830854.000000006C07B000.00000002.00000001.01000000.00000016.sdmp, lib-wx-wrappers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-mixer.pdb source: Audacity.exe, 00000003.00000002.2351533065.000000006ADCC000.00000002.00000001.01000000.00000034.sdmp, lib-mixer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-tags.pdb source: Audacity.exe, 00000003.00000002.2356314514.000000006B31E000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-string-utils.pdb$$ source: Audacity.exe, 00000003.00000002.2348057306.000000006AB6A000.00000002.00000001.01000000.00000041.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-history.pdb!! source: Audacity.exe, 00000003.00000002.2349969885.000000006ACCE000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-exceptions.pdb source: Audacity.exe, 00000003.00000002.2347561218.000000006AAE9000.00000002.00000001.01000000.00000043.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-module-manager.pdb source: Audacity.exe, 00000003.00000002.2353185542.000000006AFC2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\mpg1275c4e863dbd77\b\build\src\libmpg123\RelWithDebInfo\mpg123.pdb11 source: mpg123.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-graphics.pdb source: Audacity.exe, 00000003.00000002.2360280830.000000006C169000.00000002.00000001.01000000.00000014.sdmp, lib-graphics.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-strings.pdb source: Audacity.exe, 00000003.00000002.2344332410.000000006A584000.00000002.00000001.01000000.0000004C.sdmp, lib-strings.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-network-manager.pdb++! source: Audacity.exe, 00000003.00000002.2355436706.000000006B1E7000.00000002.00000001.01000000.00000025.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project.pdb source: Audacity.exe, 00000003.00000002.2348704325.000000006ABE3000.00000002.00000001.01000000.0000003E.sdmp, lib-project.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track.pdb source: Audacity.exe, 00000003.00000002.2350249428.000000006AD07000.00000002.00000001.01000000.00000038.sdmp, lib-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-paint.pdb$$ source: Audacity.exe, 00000003.00000002.2363588282.000000006F954000.00000002.00000001.01000000.00000008.sdmp, lib-wave-track-paint.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-track.pdb!! source: Audacity.exe, 00000003.00000002.2355241506.000000006B18D000.00000002.00000001.01000000.0000002D.sdmp, lib-time-track.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libcu20da0308c42af\b\build\lib\RelWithDebInfo\libcurl.pdb source: Audacity.exe, 00000003.00000002.2340945642.000000006A11A000.00000002.00000001.01000000.0000005B.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-effects.pdb source: Audacity.exe, 00000003.00000002.2354821538.000000006B12F000.00000002.00000001.01000000.00000027.sdmp, lib-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ipc.pdb!! source: Audacity.exe, 00000003.00000002.2340566792.000000006A079000.00000002.00000001.01000000.0000005E.sdmp, lib-ipc.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-exceptions.pdb!! source: Audacity.exe, 00000003.00000002.2347561218.000000006AAE9000.00000002.00000001.01000000.00000043.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-lv2.pdb source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_core_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2357878241.000000006BB1B000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme.pdb source: Audacity.exe, 00000003.00000002.2359638952.000000006C02B000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\flac012542216f3f1\b\build\objs\RelWithDebInfo\FLAC.pdb33 source: Audacity.exe, 00000003.00000002.2338296484.0000000069E90000.00000002.00000001.01000000.00000063.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preferences.pdb##!" source: Audacity.exe, 00000003.00000002.2346346654.000000006A9BD000.00000002.00000001.01000000.00000047.sdmp, lib-preferences.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-realtime-effects.pdb))&" source: Audacity.exe, 00000003.00000002.2353499147.000000006B00D000.00000002.00000001.01000000.0000002B.sdmp, lib-realtime-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-rate.pdb!! source: Audacity.exe, 00000003.00000002.2348888470.000000006AC0C000.00000002.00000001.01000000.0000003D.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libsn58ad79f46d772\b\build\RelWithDebInfo\sndfile.pdbpp source: Audacity.exe, 00000003.00000002.2344077880.000000006A545000.00000002.00000001.01000000.0000004D.sdmp, sndfile.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-file-formats.pdb source: Audacity.exe, 00000003.00000002.2355831691.000000006B258000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audacity-application-logic.pdb source: Audacity.exe, 00000003.00000002.2363281289.000000006F90B000.00000002.00000001.01000000.0000000B.sdmp, lib-audacity-application-logic.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-label-track.pdb$$!" source: Audacity.exe, 00000003.00000002.2355104199.000000006B166000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: Audacity.exe, 00000003.00000002.2343553874.000000006A421000.00000020.00000001.01000000.0000004F.sdmp, msvcp140.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\zlib30c3fe3af5135\b\build\RelWithDebInfo\zlib1.pdb$$ source: Audacity.exe, 00000003.00000002.2340247491.000000006A032000.00000002.00000001.01000000.00000060.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\vorbiec0e21cc0b84d\b\build\lib\RelWithDebInfo\vorbis.pdb++ source: Audacity.exe, 00000003.00000002.2338488979.0000000069F73000.00000002.00000001.01000000.00000062.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-fft.pdb))" source: Audacity.exe, 00000003.00000002.2342811887.000000006A38B000.00000002.00000001.01000000.00000052.sdmp, lib-fft.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libjp412eaa9bc058c\b\build\RelWithDebInfo\jpeg8.pdb,KK source: Audacity.exe, 00000003.00000002.2341986733.000000006A2E3000.00000002.00000001.01000000.00000056.sdmp, jpeg8.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-components.pdb## source: Audacity.exe, 00000003.00000002.2345677721.000000006A94D000.00000002.00000001.01000000.00000049.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-shuttlegui.pdb source: Audacity.exe, 00000003.00000002.2360083931.000000006C120000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme.pdb))%" source: Audacity.exe, 00000003.00000002.2359638952.000000006C02B000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-files.pdb(( " source: Audacity.exe, 00000003.00000002.2347833006.000000006AB15000.00000002.00000001.01000000.00000042.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track.pdb--#" source: Audacity.exe, 00000003.00000002.2352567062.000000006AF07000.00000002.00000001.01000000.00000030.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-frequency-selection.pdb!! source: Audacity.exe, 00000003.00000002.2350862316.000000006AD73000.00000002.00000001.01000000.00000036.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-dynamic-range-processor.pdb)) source: Audacity.exe, 00000003.00000002.2356792962.000000006B3F4000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-mixer.pdb..$" source: Audacity.exe, 00000003.00000002.2351533065.000000006ADCC000.00000002.00000001.01000000.00000034.sdmp, lib-mixer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-devices.pdb//$ source: Audacity.exe, 00000003.00000002.2347266804.000000006AAC3000.00000002.00000001.01000000.00000044.sdmp, lib-audio-devices.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-snapping.pdb&& " source: Audacity.exe, 00000003.00000002.2350545642.000000006AD49000.00000002.00000001.01000000.00000037.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-stretching-sequence.pdb++!" source: Audacity.exe, 00000003.00000002.2352326349.000000006AE71000.00000002.00000001.01000000.00000031.sdmp, lib-stretching-sequence.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-command-parameters.pdb source: Audacity.exe, 00000003.00000002.2354546103.000000006B0C9000.00000002.00000001.01000000.00000028.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\mpg1275c4e863dbd77\b\build\src\libmpg123\RelWithDebInfo\mpg123.pdb source: mpg123.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\zlib30c3fe3af5135\b\build\RelWithDebInfo\zlib1.pdb source: Audacity.exe, 00000003.00000002.2340247491.000000006A032000.00000002.00000001.01000000.00000060.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Audacity.exe, 00000003.00000002.2343553874.000000006A421000.00000020.00000001.01000000.0000004F.sdmp, msvcp140.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-and-pitch.pdb source: Audacity.exe, 00000003.00000002.2352021982.000000006AE43000.00000002.00000001.01000000.00000032.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-paint.pdb source: Audacity.exe, 00000003.00000002.2363588282.000000006F954000.00000002.00000001.01000000.00000008.sdmp, lib-wave-track-paint.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-registries.pdb source: Audacity.exe, 00000003.00000002.2348495989.000000006ABC3000.00000002.00000001.01000000.0000003F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-url-schemes.pdb source: Audacity.exe, 00000003.00000002.2361034269.000000006C33B000.00000002.00000001.01000000.00000011.sdmp, lib-url-schemes.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-files.pdb source: Audacity.exe, 00000003.00000002.2347833006.000000006AB15000.00000002.00000001.01000000.00000042.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-import-export.pdb source: Audacity.exe, 00000003.00000002.2356526735.000000006B385000.00000002.00000001.01000000.00000020.sdmp, lib-import-export.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-wrappers.pdb source: Audacity.exe, 00000003.00000002.2359830854.000000006C07B000.00000002.00000001.01000000.00000016.sdmp, lib-wx-wrappers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-transactions.pdb source: Audacity.exe, 00000003.00000002.2341528377.000000006A208000.00000002.00000001.01000000.00000058.sdmp, lib-transactions.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-numeric-formats.pdb++ source: Audacity.exe, 00000003.00000002.2349056918.000000006AC43000.00000002.00000001.01000000.0000003C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ipc.pdb source: Audacity.exe, 00000003.00000002.2340566792.000000006A079000.00000002.00000001.01000000.0000005E.sdmp, lib-ipc.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-settings.pdb source: Audacity.exe, 00000003.00000002.2352813323.000000006AF52000.00000002.00000001.01000000.0000002F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-playable-track.pdb source: Audacity.exe, 00000003.00000002.2351235266.000000006AD9B000.00000002.00000001.01000000.00000035.sdmp, lib-playable-track.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libjp412eaa9bc058c\b\build\RelWithDebInfo\jpeg8.pdb source: Audacity.exe, 00000003.00000002.2341986733.000000006A2E3000.00000002.00000001.01000000.00000056.sdmp, jpeg8.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-math.pdb88" source: Audacity.exe, 00000003.00000002.2346624020.000000006AA19000.00000002.00000001.01000000.00000046.sdmp, lib-math.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-channel.pdb source: Audacity.exe, 00000003.00000002.2349719148.000000006ACA9000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preference-pages.pdb source: Audacity.exe, 00000003.00000002.2363431639.000000006F92D000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preference-pages.pdb"" " source: Audacity.exe, 00000003.00000002.2363431639.000000006F92D000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-playable-track.pdb source: Audacity.exe, 00000003.00000002.2351235266.000000006AD9B000.00000002.00000001.01000000.00000035.sdmp, lib-playable-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ladspa.pdb source: Audacity.exe, 00000003.00000002.2362951447.000000006F801000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-components.pdb source: Audacity.exe, 00000003.00000002.2345677721.000000006A94D000.00000002.00000001.01000000.00000049.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-track.pdb source: Audacity.exe, 00000003.00000002.2355241506.000000006B18D000.00000002.00000001.01000000.0000002D.sdmp, lib-time-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sentry-reporting.pdb source: Audacity.exe, 00000003.00000002.2343195176.000000006A3E4000.00000002.00000001.01000000.00000051.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdbGCTL source: Audacity.exe, 00000003.00000002.2340830838.000000006A0A1000.00000020.00000001.01000000.0000005C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project.pdb## " source: Audacity.exe, 00000003.00000002.2348704325.000000006ABE3000.00000002.00000001.01000000.0000003E.sdmp, lib-project.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\vorbiec0e21cc0b84d\b\build\lib\RelWithDebInfo\vorbis.pdb source: Audacity.exe, 00000003.00000002.2338488979.0000000069F73000.00000002.00000001.01000000.00000062.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-frequency-selection.pdb source: Audacity.exe, 00000003.00000002.2350862316.000000006AD73000.00000002.00000001.01000000.00000036.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-music-information-retrieval.pdb source: Audacity.exe, 00000003.00000002.2362401570.000000006C66A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-fft.pdb source: Audacity.exe, 00000003.00000002.2342811887.000000006A38B000.00000002.00000001.01000000.00000052.sdmp, lib-fft.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-music-information-retrieval.pdb&& source: Audacity.exe, 00000003.00000002.2362401570.000000006C66A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-note-track.pdb source: Audacity.exe, 00000003.00000002.2354329585.000000006B0A2000.00000002.00000001.01000000.00000029.sdmp, lib-note-track.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxbase313u_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2344932745.000000006A825000.00000002.00000001.01000000.0000004B.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst.pdb(($" source: Audacity.exe, 00000003.00000002.2361800646.000000006C4C1000.00000002.00000001.01000000.0000000D.sdmp, lib-vst.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-utility.pdb source: Audacity.exe, 00000003.00000002.2345386531.000000006A930000.00000002.00000001.01000000.0000004A.sdmp, lib-utility.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\expat121c5d15c95f6\b\build\RelWithDebInfo\libexpat.pdb source: Audacity.exe, 00000003.00000002.2340378908.000000006A062000.00000002.00000001.01000000.0000005F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-realtime-effects.pdb source: Audacity.exe, 00000003.00000002.2353499147.000000006B00D000.00000002.00000001.01000000.0000002B.sdmp, lib-realtime-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\Audacity.pdb source: Audacity.exe, 00000003.00000000.1179442064.0000000000ABB000.00000002.00000001.01000000.00000003.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-label-track.pdb source: Audacity.exe, 00000003.00000002.2355104199.000000006B166000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-utility.pdb// source: Audacity.exe, 00000003.00000002.2345386531.000000006A930000.00000002.00000001.01000000.0000004A.sdmp, lib-utility.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-url-schemes.pdb!! source: Audacity.exe, 00000003.00000002.2361034269.000000006C33B000.00000002.00000001.01000000.00000011.sdmp, lib-url-schemes.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\oggb5849dbc1a267\b\build\RelWithDebInfo\ogg.pdb source: Audacity.exe, 00000003.00000002.2338128861.0000000069E37000.00000002.00000001.01000000.00000064.sdmp, ogg.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-basic-ui.pdb source: Audacity.exe, 00000003.00000002.2345944323.000000006A969000.00000002.00000001.01000000.00000048.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-module-manager.pdb++"" source: Audacity.exe, 00000003.00000002.2353185542.000000006AFC2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-graph.pdb## source: Audacity.exe, 00000003.00000002.2340710356.000000006A098000.00000002.00000001.01000000.0000005D.sdmp, lib-audio-graph.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-xml.pdb## source: Audacity.exe, 00000003.00000002.2348293921.000000006AB98000.00000002.00000001.01000000.00000040.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-io.pdb22%" source: Audacity.exe, 00000003.00000002.2353901250.000000006B056000.00000002.00000001.01000000.0000002A.sdmp, lib-audio-io.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-fft.pdb source: Audacity.exe, 00000003.00000002.2364019722.000000006FD16000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-screen-geometry.pdb source: Audacity.exe, 00000003.00000002.2346889198.000000006AA77000.00000002.00000001.01000000.00000045.sdmp, lib-screen-geometry.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libpn63be0cf5e3973\b\build\RelWithDebInfo\libpng16.pdb%% source: Audacity.exe, 00000003.00000002.2342318040.000000006A31A000.00000002.00000001.01000000.00000055.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sentry-reporting.pdb%%" source: Audacity.exe, 00000003.00000002.2343195176.000000006A3E4000.00000002.00000001.01000000.00000051.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libpn63be0cf5e3973\b\build\RelWithDebInfo\libpng16.pdb source: Audacity.exe, 00000003.00000002.2342318040.000000006A31A000.00000002.00000001.01000000.00000055.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme-resources.pdb source: Audacity.exe, 00000003.00000002.2362784435.000000006C875000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\porta9bd3205496548\b\build\RelWithDebInfo\portaudio_x86.pdb,, source: Audacity.exe, 00000003.00000002.2343800500.000000006A4AD000.00000002.00000001.01000000.0000004E.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdb source: Audacity.exe, 00000003.00000002.2340830838.000000006A0A1000.00000020.00000001.01000000.0000005C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxbase313u_xml_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2342590051.000000006A35F000.00000002.00000001.01000000.00000053.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Audacity.exe, 00000003.00000002.2343386576.000000006A401000.00000020.00000001.01000000.00000050.sdmp, vcruntime140.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-builtin-effects.pdbbb$" source: Audacity.exe, 00000003.00000002.2362081920.000000006C5A0000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\opuse6c2b3d3b8a4d\b\build\RelWithDebInfo\opus.pdb source: Audacity.exe, 00000003.00000002.2337964387.0000000069E0F000.00000002.00000001.01000000.00000065.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-xml.pdb source: Audacity.exe, 00000003.00000002.2348293921.000000006AB98000.00000002.00000001.01000000.00000040.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track-selection.pdb source: Audacity.exe, 00000003.00000002.2349515048.000000006AC88000.00000002.00000001.01000000.0000003B.sdmp, lib-track-selection.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\flac012542216f3f1\b\build\objs\RelWithDebInfo\FLAC.pdb source: Audacity.exe, 00000003.00000002.2338296484.0000000069E90000.00000002.00000001.01000000.00000063.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-import-export.pdb33$ source: Audacity.exe, 00000003.00000002.2356526735.000000006B385000.00000002.00000001.01000000.00000020.sdmp, lib-import-export.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-file-io.pdb**$" source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\sqlite.pdb source: Audacity.exe, 00000003.00000002.2341336526.000000006A1DF000.00000002.00000001.01000000.00000059.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track.pdb source: Audacity.exe, 00000003.00000002.2352567062.000000006AF07000.00000002.00000001.01000000.00000030.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preferences.pdb source: Audacity.exe, 00000003.00000002.2346346654.000000006A9BD000.00000002.00000001.01000000.00000047.sdmp, lib-preferences.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-settings.pdb##!" source: Audacity.exe, 00000003.00000002.2352813323.000000006AF52000.00000002.00000001.01000000.0000002F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-devices.pdb source: Audacity.exe, 00000003.00000002.2347266804.000000006AAC3000.00000002.00000001.01000000.00000044.sdmp, lib-audio-devices.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_html_vc_custom.pdb;; " source: Audacity.exe, 00000003.00000002.2358648263.000000006BE65000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-history.pdb source: Audacity.exe, 00000003.00000002.2349969885.000000006ACCE000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_qa_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2359400925.000000006BFA8000.00000002.00000001.01000000.00000018.sdmp, wxmsw313u_qa_vc_custom.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_aui_vc_custom.pdb)) source: Audacity.exe, 00000003.00000002.2359084604.000000006BF31000.00000002.00000001.01000000.00000019.sdmp, wxmsw313u_aui_vc_custom.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-menus.pdb source: Audacity.exe, 00000003.00000002.2357198512.000000006B465000.00000002.00000001.01000000.0000001B.sdmp, lib-menus.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-menus.pdb&& " source: Audacity.exe, 00000003.00000002.2357198512.000000006B465000.00000002.00000001.01000000.0000001B.sdmp, lib-menus.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sqlite-helpers.pdb source: Audacity.exe, 00000003.00000002.2341687838.000000006A230000.00000002.00000001.01000000.00000057.sdmp, lib-sqlite-helpers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme-resources.pdb"" source: Audacity.exe, 00000003.00000002.2362784435.000000006C875000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst.pdb source: Audacity.exe, 00000003.00000002.2361800646.000000006C4C1000.00000002.00000001.01000000.0000000D.sdmp, lib-vst.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-and-pitch.pdb++! source: Audacity.exe, 00000003.00000002.2352021982.000000006AE43000.00000002.00000001.01000000.00000032.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-string-utils.pdb source: Audacity.exe, 00000003.00000002.2348057306.000000006AB6A000.00000002.00000001.01000000.00000041.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-init.pdb33"" source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-crashpad-configurer.pdbKK source: Audacity.exe, 00000003.00000002.2360879394.000000006C30F000.00000002.00000001.01000000.00000012.sdmp, lib-crashpad-configurer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-file-io.pdb source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libsn58ad79f46d772\b\build\RelWithDebInfo\sndfile.pdb source: Audacity.exe, 00000003.00000002.2344077880.000000006A545000.00000002.00000001.01000000.0000004D.sdmp, sndfile.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-effects.pdb,,!" source: Audacity.exe, 00000003.00000002.2354821538.000000006B12F000.00000002.00000001.01000000.00000027.sdmp, lib-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst3.pdb source: Audacity.exe, 00000003.00000002.2361297853.000000006C3C3000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst3.pdb==+ source: Audacity.exe, 00000003.00000002.2361297853.000000006C3C3000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_aui_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2359084604.000000006BF31000.00000002.00000001.01000000.00000019.sdmp, wxmsw313u_aui_vc_custom.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-graph.pdb source: Audacity.exe, 00000003.00000002.2340710356.000000006A098000.00000002.00000001.01000000.0000005D.sdmp, lib-audio-graph.dll.2.dr
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: Audacity.exe, 00000003.00000002.2343386576.000000006A401000.00000020.00000001.01000000.00000050.sdmp, vcruntime140.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-nyquist-effects.pdb source: Audacity.exe, 00000003.00000002.2360594729.000000006C273000.00000002.00000001.01000000.00000013.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\vorbiec0e21cc0b84d\b\build\lib\RelWithDebInfo\vorbisenc.pdb source: Audacity.exe, 00000003.00000002.2339500080.000000006A017000.00000002.00000001.01000000.00000061.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track.pdb&& " source: Audacity.exe, 00000003.00000002.2350249428.000000006AD07000.00000002.00000001.01000000.00000038.sdmp, lib-track.dll.2.dr
            Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: c:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior

            Networking

            barindex
            Source: Malware configuration extractorURLs: econusi.digital/nwmb
            Source: Malware configuration extractorURLs: jawdedmirror.run/ewqd
            Source: Malware configuration extractorURLs: changeaie.top/geps
            Source: Malware configuration extractorURLs: lonfgshadow.live/xawi
            Source: Malware configuration extractorURLs: liftally.top/xasj
            Source: Malware configuration extractorURLs: nighetwhisper.top/lekd
            Source: Malware configuration extractorURLs: salaccgfa.top/gsooz
            Source: Malware configuration extractorURLs: zestmodp.top/zeda
            Source: Malware configuration extractorURLs: owlflright.digital/qopy
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drString found in binary or memory: http://audacity.sourceforge.net/xml/audacityproject-1.3.0.dtd
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drString found in binary or memory: http://audacity.sourceforge.net/xml/xmlnsversionaudacityversionDELETE
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
            Source: Release Notes.txt.2.drString found in binary or memory: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2007.htm
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://drobilla.net/ns/lilv#dyn-manifest
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://drobilla.net/ns/lilv#filter-lang
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://drobilla.net/ns/lilv#lv2-path
            Source: Audacity.exe, 00000003.00000002.2357878241.000000006B972000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://jimmac.musichall.cz
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://kxstudio.sf.net/ns/lv2ext/external-ui#Host
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://kxstudio.sf.net/ns/lv2ext/external-ui#Widget
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://kxstudio.sf.net/ns/lv2ext/external-ui#WidgetP
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lame.sourceforge.net/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lexvo.org/id/iso639-3/
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007992000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://ll-plugins.nongnu.org/lv2/namespace#MathConstantPlugin
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007992000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://ll-plugins.nongnu.org/lv2/namespace#MathFunctionPlugin
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#AtomPort
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#AtomPorthttp://lv2plug.in/ns/ext/buf-size#maxBlockLengthhttp://lv2plug
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/atom#AtomPortl
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Blank
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Blankhttp://lv2plug.in/ns/ext/atom#Boolhttp://lv2plug.in/ns/ext/atom#C
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Bool
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Chunk
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/atom#ChunkP
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Double
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/atom#DoubleJ
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Event
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Eventhttp://lv2plug.in/ns/ext/atom#frameTimehttp://lv2plug.in/ns/ext/a
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Float
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Int
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/atom#IntD
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Literal
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/atom#Literalf
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Long
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/atom#Long~
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Object
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Path
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Property
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Resource
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Sequence
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/atom#Sequence$
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#String
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Tuple
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#URI
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#URID
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#Vector
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#atomhttp://lv2plug.in/ns/ext/presets#psethttp://lv2plug.in/ns/ext/stat
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#beatTime
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#childType
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#childType%2XFailed
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#eventTransfer
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#frameTime
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/atom#supports
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#boundedBlockLength
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#fixedBlockLength
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#maxBlockLength
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#maxBlockLengthx
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#minBlockLength
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#minBlockLengthh
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#minBlockLengthi
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#nominalBlockLength
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#nominalBlockLengthy
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/buf-size#sequenceSize
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/data-access
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/dynmanifest#DynManifest
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/dynmanifest#DynManifestS
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/event#supportsEvent
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/event#supportsEventlilv_port_get_valuelilv_port_get_name%s():
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/instance-access
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/log#Error
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/log#Note
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/log#Trace
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/log#TraceZ.
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/log#Warning
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/log#log
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/midi#MidiEvent
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/options#interface
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/options#interfacehttp://lv2plug.in/ns/ext/state#interfaceParametersvector
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/options#options
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/options#optionsLV2InstanceFeaturesList::CheckOptionsD:
            Source: Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/options#requiredOption
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/options#supportedOption
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/parameters#sampleRate
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-groups#group
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-props#causesArtifacts
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-props#expensive
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/port-props#expensiveS
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-props#logarithmic
            Source: Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/port-props#logarithmicW
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-props#notAutomatic
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-props#notOnGUI
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/port-props#notOnGUIZ
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-props#rangeSteps
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/port-props#rangeStepsi
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/port-props#trigger
            Source: Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/port-props#triggerT
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/presets#
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/presets#Preset
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/presets#value
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/resize-port#minimumSize
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/resize-port#minimumSizeY
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/state#
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/state#interface
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/state#makePath
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/state#mapPath
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathhttp://lv2plug.in/ns/lv
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathlilv_state_new_from_ins
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/state#state
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/state#statelilv_state_new_from_world%s():
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/time#Position
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/time#frame
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/ext/time#frame6
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/time#speed
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/uri-map
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/urid#map
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/urid#unmap
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/worker#interface
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/ext/worker#schedule
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#CocoaUI
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#Gtk3UI
            Source: Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#Gtk3UI?
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#GtkUI
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#GtkUIhttp://lv2plug.in/ns/extensions/ui#Qt4UIhttp://lv2plug.in/ns
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#Qt4UI
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#Qt5UI
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#WindowsUI
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#WindowsUIhttp://kxstudio.sf.net/ns/lv2ext/external-ui#Widgethttp:
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#X11UI
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#binary
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#external
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#externalN
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#fixedSize
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#idleInterface
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#makeResident
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#noUserResize
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#noUserResizehttp://lv2plug.in/ns/extensions/ui#fixedSizehttp://lv
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#parent
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#portMap
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#portMaphttp://lv2plug.in/ns/extensions/ui#portSubscribehttp://lv2
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#portSubscribe
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#resize
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#resizehttp://lv2plug.in/ns/ext/data-accesshttp://kxstudio.sf.net/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#showInterface
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/ui#touch
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/ui#ui
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2331511865.000000000111E000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/extensions/units#unit
            Source: Audacity.exe, 00000003.00000002.2331511865.000000000111E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/extensions/units#unitk
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#AudioPort
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#CVPort
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#ControlPort
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#InputPort
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#InstrumentPlugin
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#InstrumentPlugin&-
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#MIDIPlugin
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#OutputPort
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#OutputPortlilv_plugin_has_extension_data%s():
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#Plugin
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#Specification
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#Specificationj/
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#appliesTo
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#binary
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#control
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#default
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#default%
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#designation
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#enumeration
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#extensionData
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#extensionDatah
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#index
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#integer
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007992000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#latency
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#maximum
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#maximumr
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#microVersion
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#minimum
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#minimumx
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#minorVersion
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#name
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#optionalFeature
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#port
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#portProperty
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#project
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#projecthttp://usefulinc.com/ns/doap#maintainerhttp://xmlns.com/foaf/0.1
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#prototype
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#reportsLatency
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#reportsLatencyr
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#requiredFeature
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#sampleRate
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#scalePoint
            Source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#scalePointLANGCPOSIXlilv_get_lang%s():
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#scalePointUnknown
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#symbol
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lv2plug.in/ns/lv2core#symbolV
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://lv2plug.in/ns/lv2core#toggled
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://ocsp.digicert.com0A
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://ocsp.digicert.com0C
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://ocsp.digicert.com0X
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: http://ocsp.sectigo.com0
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://sbsms.sourceforge.net/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://usefulinc.com/ns/doap#
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://usefulinc.com/ns/doap#doaphttp://xmlns.com/foaf/0.1/foafhttp://lv2plug.in/ns/lv2core#lv2http:
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://usefulinc.com/ns/doap#maintainer
            Source: Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://usefulinc.com/ns/doap#name
            Source: Audacity.exe, 00000003.00000002.2357878241.000000006B972000.00000002.00000001.01000000.0000001E.sdmpString found in binary or memory: http://www.gimp.orgg
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.mega-nerd.com/libsndfile/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.portaudio.com/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.portmedia.sourceforge.net/portmidi/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.twolame.org/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://www.vamp-plugins.org/
            Source: Release Notes.txt.2.drString found in binary or memory: http://www.weonlydo.com/SFTP/Help/wodSFTPLib~wodSFTP~FIPS.html
            Source: Audacity.exe, 00000003.00000002.2340270336.000000006A03C000.00000002.00000001.01000000.00000060.sdmpString found in binary or memory: http://www.zlib.net/D
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://xmlns.com/foaf/0.1/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://xmlns.com/foaf/0.1/homepage
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://xmlns.com/foaf/0.1/mbox
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drString found in binary or memory: http://xmlns.com/foaf/0.1/name
            Source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://Audacity_SupportQuick_Helpquick_helphttp%.._
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://api.audio.com/analytics/audacity-uuid/opt-out
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://audacityteam.org/3.7.0-video
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://audacityteam.org/audacitypromo
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://audacityteam.org/download/openvino
            Source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://audacityteam.org/errors
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://audacityteam.org/errors#missing-plugins
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://audacityteam.org/errors#missing-pluginsLearn
            Source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://audacityteam.org/errorshere%sWould
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://audio.com/audacity/auth/sign-in?mtm_campaign=audacitydesktop&mtm_content=app_launch_popup
            Source: Audacity.exe, 00000003.00000002.2341017372.000000006A133000.00000002.00000001.01000000.0000005B.sdmpString found in binary or memory: https://curl.se/V
            Source: Audacity.exe, 00000003.00000002.2340945642.000000006A11A000.00000002.00000001.01000000.0000005B.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
            Source: Audacity.exe, 00000003.00000002.2341017372.000000006A133000.00000002.00000001.01000000.0000005B.sdmpString found in binary or memory: https://curl.se/docs/copyright.htmlD
            Source: Audacity.exe, 00000003.00000002.2340945642.000000006A11A000.00000002.00000001.01000000.0000005B.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
            Source: Audacity.exe, 00000003.00000002.2340945642.000000006A11A000.00000002.00000001.01000000.0000005B.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://forum.audacityteam.org/
            Source: Audacity.exe, 00000003.00000002.2352567062.000000006AF07000.00000002.00000001.01000000.00000030.sdmpString found in binary or memory: https://forum.audacityteam.org/.
            Source: Audacity.exe, 00000003.00000002.2347561218.000000006AAE9000.00000002.00000001.01000000.00000043.sdmpString found in binary or memory: https://forum.audacityteam.org/.(argtype
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://forum.audacityteam.org/Visit
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://github.com/audacity/audacity/commit/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://github.com/audacity/audacity/commit/Commit
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://github.com/audacity/audacity/releases
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://libexpat.github.io/
            Source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://manual.audacityteam.org/man/faq_opening_and_saving_files.html#fromcd
            Source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://manual.audacityteam.org/man/playing_and_recording.html#midi
            Source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://manual.audacityteam.org/man/unzipping_the_manual.html
            Source: lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drString found in binary or memory: https://sectigo.com/CPS0
            Source: Audacity.exe, 00000003.00000002.2332117015.0000000003379000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2330512703.0000000000924000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731d
            Source: Audacity.exe, 00000003.00000002.2330512703.0000000000924000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731d--crashre
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://sourceforge.net/p/portmedia/wiki/portsmf/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://sourceforge.net/p/soxr/wiki/Home/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://support.audacityteam.org/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://support.audacityteam.org/View
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://support.audacityteam.org/additional-resources/changelog
            Source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://support.audacityteam.org/basics/installing-ffmpeg
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://updates.audacityteam.org/feed/latest.xml
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://updates.audacityteam.org/feed/latest.xml?audacity-instance-id=&user_id=https://api.audio.com
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://wiki.audacityteam.org/wiki/EQCurvesDownloadEQDefaultCurves.xmlEQBackup.xml
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/
            Source: Audacity.exe, 00000003.00000002.2332117015.0000000003379000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://www.audacityteam.org/desktop-privacy-notice/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drString found in binary or memory: https://www.audacityteam.org/desktop-privacy-notice/our
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/mh-effectmenu
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/mh-effectmenuhttps://audacityteam.org/download/openvinoRepeat
            Source: Audacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/mh-pluginmanager
            Source: Audacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/mh-pluginmanagerwxWeakRef
            Source: Audacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/mh-rtepanel
            Source: Audacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/mh-rtepanelAnalyze%s
            Source: Audacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/realtime-video
            Source: Audacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.audacityteam.org/realtime-videoWatch
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.cs.cmu.edu/~music/nyquist/
            Source: Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.musehub.com/app/ace-studio?utm_source=au-app&utm_medium=ace-studio&utm_campaign=au-app-w
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://www.surina.net/soundtouch/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://wxwidgets.org/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://xiph.org/flac/
            Source: Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: https://xiph.org/vorbis/
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\684c70.msiJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{269E0548-9833-4152-BFAE-78ADA6691E16}Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI577C.tmpJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\684c72.msiJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\684c72.msiJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\684c72.msiJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSI577C.tmpJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\684c70.msiJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03C4418C3_2_03C4418C
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03E3272C3_2_03E3272C
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_69B2272C3_2_69B2272C
            Source: libexpat.dll.2.drStatic PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
            Source: classification engineClassification label: mal72.troj.winMSI@5/141@0/0
            Source: wodKeys.pdf.2.drInitial sample: http://www.weonlydo.com/index.asp?forum=1
            Source: wodKeys.pdf.2.drInitial sample: mailto:sales@weonlydo.com
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PublicKeyData.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-Generate.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Enumerations.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-Load.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PublicKey.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PublicKeyLoad.html
            Source: wodKeys.pdf.2.drInitial sample: http://www.worldtimeserver.com/time.asp?locationid=HR
            Source: wodKeys.pdf.2.drInitial sample: http://www.worldtimeserver.com/time.asp?locationid=hr
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-FingerPrintData.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-FromXmlString.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-BubbleBabble.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PublicKeySave.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-Properties.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PublicKeyOpenSSH.html
            Source: wodKeys.pdf.2.drInitial sample: mailto:general@weonlydo.com
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PublicKeyRSA1.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-Save.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys.html
            Source: wodKeys.pdf.2.drInitial sample: mailto:techsupport@weonlydo.com
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-ToXmlString.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PublicKeySSH.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-BitCount.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-Version.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Enumerations-SSHKeyTypes.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-Methods.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-FingerPrint.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PrivateKey.html
            Source: wodKeys.pdf.2.drInitial sample: file:///C:/devHelp/www/export/pdf/wodKeys-Keys-PrivateKeyData.html
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\CML5838.tmpJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeMutant created: NULL
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeMutant created: \Sessions\1\BaseNamedObjects\55401706
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeMutant created: \Sessions\1\BaseNamedObjects\audacity-lock-user
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\TEMP\~DFB97040BBDB49D8D6.TMPJump to behavior
            Source: C:\Windows\System32\msiexec.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT blockid FROM sampleblocks;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT ROWID FROM main.project WHERE id = 1;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT summary64k FROM sampleblocks WHERE blockid = ?1;
            Source: Audacity.exe, 00000003.00000002.2341336526.000000006A1DF000.00000002.00000001.01000000.00000059.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT ROWID FROM main.autosave WHERE id = 1;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT samples FROM sampleblocks WHERE blockid = ?1;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT COUNT(1) FROM main.project;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT Count(*) FROM project;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT Count(*) FROM sqlite_master WHERE type='table';
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: INSERT INTO %s.%s(id, dict, doc) VALUES(1, ?1, ?2) ON CONFLICT(id) DO UPDATE SET dict = ?1, doc = ?2;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT sampleformat, summin, summax, sumrms, length(samples) FROM sampleblocks WHERE blockid = ?1;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: INSERT INTO sampleblocks (sampleformat, summin, summax, sumrms, summary256, summary64k, samples) VALUES(?1,?2,?3,?4,?5,?6,?7);
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT ROWID FROM %s.%s WHERE id = 1;
            Source: Audacity.exe, 00000003.00000002.2341336526.000000006A1DF000.00000002.00000001.01000000.00000059.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT Count(*) FROM sampleblocks;
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007AFA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT * FROM AntiVirusProduct;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: INSERT INTO outbound.sampleblocks SELECT * FROM main.sampleblocks WHERE blockid = ?;
            Source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.drBinary or memory string: SELECT summary256 FROM sampleblocks WHERE blockid = ?1;
            Source: TRxHlAc5qV.msiStatic file information: TRID: Microsoft Windows Installer (60509/1) 88.31%
            Source: TRxHlAc5qV.msiReversingLabs: Detection: 13%
            Source: TRxHlAc5qV.msiVirustotal: Detection: 15%
            Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\TRxHlAc5qV.msi"
            Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe "C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe"
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe "C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe"Jump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: cryptnet.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: webio.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-theme-resources.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wx-init.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track-paint.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-music-information-retrieval.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preference-pages.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-audacity-application-logic.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-builtin-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-vst.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-lv2.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-ladspa.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-vst3.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-url-schemes.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-crashpad-configurer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-nyquist-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-graphics.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-shuttlegui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wx-wrappers.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-theme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_qa_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_aui_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_html_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-menus.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-viewport.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track-fft.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-dynamic-range-processor.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-import-export.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-tags.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-file-formats.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-file-io.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-uuid.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-network-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-label-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-command-parameters.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-note-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-audio-io.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-realtime-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: portmidi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track-settings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-stretching-sequence.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-and-pitch.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-sample-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-mixer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-playable-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-frequency-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-snapping.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-history.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-channel.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-numeric-formats.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-rate.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-string-utils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-audio-devices.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-screen-geometry.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-fft.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-math.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: sndfile.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: portaudio_x86.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-theme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-shuttlegui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wx-wrappers.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-sentry-reporting.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-theme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_html_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-string-utils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-graphics.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-mixer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-screen-geometry.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-fft.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-shuttlegui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wx-wrappers.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-menus.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-viewport.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-frequency-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-rate.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-history.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-dynamic-range-processor.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track-fft.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-label-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-note-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-fft.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-frequency-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-command-parameters.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-numeric-formats.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-realtime-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-mixer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-math.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-channel.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-string-utils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-label-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-note-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track-settings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-mixer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-frequency-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-rate.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-math.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: portaudio_x86.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: sndfile.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-command-parameters.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wx-wrappers.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-theme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-theme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_xml_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: iu3.0.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxmsw313u_core_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-history.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-playable-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-frequency-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-snapping.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-channel.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-history.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-screen-geometry.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-fft.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-mixer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-math.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: sndfile.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-playable-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-frequency-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-stretching-sequence.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-mixer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-rate.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-components.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: oleacc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: jpeg8.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: libpng16.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msimg32.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-history.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-sentry-reporting.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-sqlite-helpers.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project-history.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-transactions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-registries.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-files.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-math.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: sqlite.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-string-utils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140_codecvt_ids.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: sndfile.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-string-utils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-concurrency.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-exceptions.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: libcurl.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-stretching-sequence.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-time-frequency-selection.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-channel.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-project.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-xml.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-preferences.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-basic-ui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-strings.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: wxbase313u_vc_custom.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-utility.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: msvcp140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: vcruntime140.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-command-parameters.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-realtime-effects.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-wave-track.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-module-manager.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-stretching-sequence.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-mixer.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-audio-graph.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeSection loaded: lib-track-selection.dllJump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: TRxHlAc5qV.msiStatic file information: File size 19652608 > 1048576
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-registries.pdb source: Audacity.exe, 00000003.00000002.2348495989.000000006ABC3000.00000002.00000001.01000000.0000003F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-stretching-sequence.pdb source: Audacity.exe, 00000003.00000002.2352326349.000000006AE71000.00000002.00000001.01000000.00000031.sdmp, lib-stretching-sequence.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-builtin-effects.pdb source: Audacity.exe, 00000003.00000002.2362081920.000000006C5A0000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_html_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2358648263.000000006BE65000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-network-manager.pdb source: Audacity.exe, 00000003.00000002.2355436706.000000006B1E7000.00000002.00000001.01000000.00000025.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-io.pdb source: Audacity.exe, 00000003.00000002.2353901250.000000006B056000.00000002.00000001.01000000.0000002A.sdmp, lib-audio-io.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ladspa.pdb%%"" source: Audacity.exe, 00000003.00000002.2362951447.000000006F801000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-init.pdb source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-channel.pdb!! " source: Audacity.exe, 00000003.00000002.2349719148.000000006ACA9000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-numeric-formats.pdb source: Audacity.exe, 00000003.00000002.2349056918.000000006AC43000.00000002.00000001.01000000.0000003C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-concurrency.pdb source: Audacity.exe, 00000003.00000002.2341121317.000000006A147000.00000002.00000001.01000000.0000005A.sdmp, lib-concurrency.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track-selection.pdb$$!" source: Audacity.exe, 00000003.00000002.2349515048.000000006AC88000.00000002.00000001.01000000.0000003B.sdmp, lib-track-selection.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\porta9bd3205496548\b\build\RelWithDebInfo\portaudio_x86.pdb source: Audacity.exe, 00000003.00000002.2343800500.000000006A4AD000.00000002.00000001.01000000.0000004E.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-lv2.pdbEE"" source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-shuttlegui.pdb!! " source: Audacity.exe, 00000003.00000002.2360083931.000000006C120000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-viewport.pdb source: Audacity.exe, 00000003.00000002.2357004512.000000006B423000.00000002.00000001.01000000.0000001C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-strings.pdb$$ source: Audacity.exe, 00000003.00000002.2344332410.000000006A584000.00000002.00000001.01000000.0000004C.sdmp, lib-strings.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-math.pdb source: Audacity.exe, 00000003.00000002.2346624020.000000006AA19000.00000002.00000001.01000000.00000046.sdmp, lib-math.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-snapping.pdb source: Audacity.exe, 00000003.00000002.2350545642.000000006AD49000.00000002.00000001.01000000.00000037.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sample-track.pdb source: Audacity.exe, 00000003.00000002.2351796824.000000006ADE7000.00000002.00000001.01000000.00000033.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-uuid.pdb source: Audacity.exe, 00000003.00000002.2355653671.000000006B23B000.00000002.00000001.01000000.00000024.sdmp, lib-uuid.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-crashpad-configurer.pdb source: Audacity.exe, 00000003.00000002.2360879394.000000006C30F000.00000002.00000001.01000000.00000012.sdmp, lib-crashpad-configurer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sqlite-helpers.pdb&& source: Audacity.exe, 00000003.00000002.2341687838.000000006A230000.00000002.00000001.01000000.00000057.sdmp, lib-sqlite-helpers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-dynamic-range-processor.pdb source: Audacity.exe, 00000003.00000002.2356792962.000000006B3F4000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-rate.pdb source: Audacity.exe, 00000003.00000002.2348888470.000000006AC0C000.00000002.00000001.01000000.0000003D.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-note-track.pdb,,# source: Audacity.exe, 00000003.00000002.2354329585.000000006B0A2000.00000002.00000001.01000000.00000029.sdmp, lib-note-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-wrappers.pdb++ source: Audacity.exe, 00000003.00000002.2359830854.000000006C07B000.00000002.00000001.01000000.00000016.sdmp, lib-wx-wrappers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-mixer.pdb source: Audacity.exe, 00000003.00000002.2351533065.000000006ADCC000.00000002.00000001.01000000.00000034.sdmp, lib-mixer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-tags.pdb source: Audacity.exe, 00000003.00000002.2356314514.000000006B31E000.00000002.00000001.01000000.00000021.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-string-utils.pdb$$ source: Audacity.exe, 00000003.00000002.2348057306.000000006AB6A000.00000002.00000001.01000000.00000041.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-history.pdb!! source: Audacity.exe, 00000003.00000002.2349969885.000000006ACCE000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-exceptions.pdb source: Audacity.exe, 00000003.00000002.2347561218.000000006AAE9000.00000002.00000001.01000000.00000043.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-module-manager.pdb source: Audacity.exe, 00000003.00000002.2353185542.000000006AFC2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\mpg1275c4e863dbd77\b\build\src\libmpg123\RelWithDebInfo\mpg123.pdb11 source: mpg123.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-graphics.pdb source: Audacity.exe, 00000003.00000002.2360280830.000000006C169000.00000002.00000001.01000000.00000014.sdmp, lib-graphics.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-strings.pdb source: Audacity.exe, 00000003.00000002.2344332410.000000006A584000.00000002.00000001.01000000.0000004C.sdmp, lib-strings.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-network-manager.pdb++! source: Audacity.exe, 00000003.00000002.2355436706.000000006B1E7000.00000002.00000001.01000000.00000025.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project.pdb source: Audacity.exe, 00000003.00000002.2348704325.000000006ABE3000.00000002.00000001.01000000.0000003E.sdmp, lib-project.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track.pdb source: Audacity.exe, 00000003.00000002.2350249428.000000006AD07000.00000002.00000001.01000000.00000038.sdmp, lib-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-paint.pdb$$ source: Audacity.exe, 00000003.00000002.2363588282.000000006F954000.00000002.00000001.01000000.00000008.sdmp, lib-wave-track-paint.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-track.pdb!! source: Audacity.exe, 00000003.00000002.2355241506.000000006B18D000.00000002.00000001.01000000.0000002D.sdmp, lib-time-track.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libcu20da0308c42af\b\build\lib\RelWithDebInfo\libcurl.pdb source: Audacity.exe, 00000003.00000002.2340945642.000000006A11A000.00000002.00000001.01000000.0000005B.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-effects.pdb source: Audacity.exe, 00000003.00000002.2354821538.000000006B12F000.00000002.00000001.01000000.00000027.sdmp, lib-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ipc.pdb!! source: Audacity.exe, 00000003.00000002.2340566792.000000006A079000.00000002.00000001.01000000.0000005E.sdmp, lib-ipc.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-exceptions.pdb!! source: Audacity.exe, 00000003.00000002.2347561218.000000006AAE9000.00000002.00000001.01000000.00000043.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-lv2.pdb source: Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_core_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2357878241.000000006BB1B000.00000002.00000001.01000000.0000001E.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme.pdb source: Audacity.exe, 00000003.00000002.2359638952.000000006C02B000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\flac012542216f3f1\b\build\objs\RelWithDebInfo\FLAC.pdb33 source: Audacity.exe, 00000003.00000002.2338296484.0000000069E90000.00000002.00000001.01000000.00000063.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preferences.pdb##!" source: Audacity.exe, 00000003.00000002.2346346654.000000006A9BD000.00000002.00000001.01000000.00000047.sdmp, lib-preferences.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-realtime-effects.pdb))&" source: Audacity.exe, 00000003.00000002.2353499147.000000006B00D000.00000002.00000001.01000000.0000002B.sdmp, lib-realtime-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-rate.pdb!! source: Audacity.exe, 00000003.00000002.2348888470.000000006AC0C000.00000002.00000001.01000000.0000003D.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libsn58ad79f46d772\b\build\RelWithDebInfo\sndfile.pdbpp source: Audacity.exe, 00000003.00000002.2344077880.000000006A545000.00000002.00000001.01000000.0000004D.sdmp, sndfile.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-file-formats.pdb source: Audacity.exe, 00000003.00000002.2355831691.000000006B258000.00000002.00000001.01000000.00000023.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audacity-application-logic.pdb source: Audacity.exe, 00000003.00000002.2363281289.000000006F90B000.00000002.00000001.01000000.0000000B.sdmp, lib-audacity-application-logic.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-label-track.pdb$$!" source: Audacity.exe, 00000003.00000002.2355104199.000000006B166000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdbGCTL source: Audacity.exe, 00000003.00000002.2343553874.000000006A421000.00000020.00000001.01000000.0000004F.sdmp, msvcp140.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\zlib30c3fe3af5135\b\build\RelWithDebInfo\zlib1.pdb$$ source: Audacity.exe, 00000003.00000002.2340247491.000000006A032000.00000002.00000001.01000000.00000060.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\vorbiec0e21cc0b84d\b\build\lib\RelWithDebInfo\vorbis.pdb++ source: Audacity.exe, 00000003.00000002.2338488979.0000000069F73000.00000002.00000001.01000000.00000062.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-fft.pdb))" source: Audacity.exe, 00000003.00000002.2342811887.000000006A38B000.00000002.00000001.01000000.00000052.sdmp, lib-fft.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libjp412eaa9bc058c\b\build\RelWithDebInfo\jpeg8.pdb,KK source: Audacity.exe, 00000003.00000002.2341986733.000000006A2E3000.00000002.00000001.01000000.00000056.sdmp, jpeg8.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-components.pdb## source: Audacity.exe, 00000003.00000002.2345677721.000000006A94D000.00000002.00000001.01000000.00000049.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-shuttlegui.pdb source: Audacity.exe, 00000003.00000002.2360083931.000000006C120000.00000002.00000001.01000000.00000015.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme.pdb))%" source: Audacity.exe, 00000003.00000002.2359638952.000000006C02B000.00000002.00000001.01000000.00000017.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-files.pdb(( " source: Audacity.exe, 00000003.00000002.2347833006.000000006AB15000.00000002.00000001.01000000.00000042.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track.pdb--#" source: Audacity.exe, 00000003.00000002.2352567062.000000006AF07000.00000002.00000001.01000000.00000030.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-frequency-selection.pdb!! source: Audacity.exe, 00000003.00000002.2350862316.000000006AD73000.00000002.00000001.01000000.00000036.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-dynamic-range-processor.pdb)) source: Audacity.exe, 00000003.00000002.2356792962.000000006B3F4000.00000002.00000001.01000000.0000001F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-mixer.pdb..$" source: Audacity.exe, 00000003.00000002.2351533065.000000006ADCC000.00000002.00000001.01000000.00000034.sdmp, lib-mixer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-devices.pdb//$ source: Audacity.exe, 00000003.00000002.2347266804.000000006AAC3000.00000002.00000001.01000000.00000044.sdmp, lib-audio-devices.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-snapping.pdb&& " source: Audacity.exe, 00000003.00000002.2350545642.000000006AD49000.00000002.00000001.01000000.00000037.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-stretching-sequence.pdb++!" source: Audacity.exe, 00000003.00000002.2352326349.000000006AE71000.00000002.00000001.01000000.00000031.sdmp, lib-stretching-sequence.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-command-parameters.pdb source: Audacity.exe, 00000003.00000002.2354546103.000000006B0C9000.00000002.00000001.01000000.00000028.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\mpg1275c4e863dbd77\b\build\src\libmpg123\RelWithDebInfo\mpg123.pdb source: mpg123.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\zlib30c3fe3af5135\b\build\RelWithDebInfo\zlib1.pdb source: Audacity.exe, 00000003.00000002.2340247491.000000006A032000.00000002.00000001.01000000.00000060.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Audacity.exe, 00000003.00000002.2343553874.000000006A421000.00000020.00000001.01000000.0000004F.sdmp, msvcp140.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-and-pitch.pdb source: Audacity.exe, 00000003.00000002.2352021982.000000006AE43000.00000002.00000001.01000000.00000032.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-paint.pdb source: Audacity.exe, 00000003.00000002.2363588282.000000006F954000.00000002.00000001.01000000.00000008.sdmp, lib-wave-track-paint.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-registries.pdb source: Audacity.exe, 00000003.00000002.2348495989.000000006ABC3000.00000002.00000001.01000000.0000003F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-url-schemes.pdb source: Audacity.exe, 00000003.00000002.2361034269.000000006C33B000.00000002.00000001.01000000.00000011.sdmp, lib-url-schemes.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-files.pdb source: Audacity.exe, 00000003.00000002.2347833006.000000006AB15000.00000002.00000001.01000000.00000042.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-import-export.pdb source: Audacity.exe, 00000003.00000002.2356526735.000000006B385000.00000002.00000001.01000000.00000020.sdmp, lib-import-export.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-wrappers.pdb source: Audacity.exe, 00000003.00000002.2359830854.000000006C07B000.00000002.00000001.01000000.00000016.sdmp, lib-wx-wrappers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-transactions.pdb source: Audacity.exe, 00000003.00000002.2341528377.000000006A208000.00000002.00000001.01000000.00000058.sdmp, lib-transactions.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-numeric-formats.pdb++ source: Audacity.exe, 00000003.00000002.2349056918.000000006AC43000.00000002.00000001.01000000.0000003C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ipc.pdb source: Audacity.exe, 00000003.00000002.2340566792.000000006A079000.00000002.00000001.01000000.0000005E.sdmp, lib-ipc.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-settings.pdb source: Audacity.exe, 00000003.00000002.2352813323.000000006AF52000.00000002.00000001.01000000.0000002F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-playable-track.pdb source: Audacity.exe, 00000003.00000002.2351235266.000000006AD9B000.00000002.00000001.01000000.00000035.sdmp, lib-playable-track.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libjp412eaa9bc058c\b\build\RelWithDebInfo\jpeg8.pdb source: Audacity.exe, 00000003.00000002.2341986733.000000006A2E3000.00000002.00000001.01000000.00000056.sdmp, jpeg8.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-math.pdb88" source: Audacity.exe, 00000003.00000002.2346624020.000000006AA19000.00000002.00000001.01000000.00000046.sdmp, lib-math.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-channel.pdb source: Audacity.exe, 00000003.00000002.2349719148.000000006ACA9000.00000002.00000001.01000000.0000003A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preference-pages.pdb source: Audacity.exe, 00000003.00000002.2363431639.000000006F92D000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preference-pages.pdb"" " source: Audacity.exe, 00000003.00000002.2363431639.000000006F92D000.00000002.00000001.01000000.0000000A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-playable-track.pdb source: Audacity.exe, 00000003.00000002.2351235266.000000006AD9B000.00000002.00000001.01000000.00000035.sdmp, lib-playable-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-ladspa.pdb source: Audacity.exe, 00000003.00000002.2362951447.000000006F801000.00000002.00000001.01000000.0000000F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-components.pdb source: Audacity.exe, 00000003.00000002.2345677721.000000006A94D000.00000002.00000001.01000000.00000049.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-track.pdb source: Audacity.exe, 00000003.00000002.2355241506.000000006B18D000.00000002.00000001.01000000.0000002D.sdmp, lib-time-track.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sentry-reporting.pdb source: Audacity.exe, 00000003.00000002.2343195176.000000006A3E4000.00000002.00000001.01000000.00000051.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdbGCTL source: Audacity.exe, 00000003.00000002.2340830838.000000006A0A1000.00000020.00000001.01000000.0000005C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project.pdb## " source: Audacity.exe, 00000003.00000002.2348704325.000000006ABE3000.00000002.00000001.01000000.0000003E.sdmp, lib-project.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\vorbiec0e21cc0b84d\b\build\lib\RelWithDebInfo\vorbis.pdb source: Audacity.exe, 00000003.00000002.2338488979.0000000069F73000.00000002.00000001.01000000.00000062.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-frequency-selection.pdb source: Audacity.exe, 00000003.00000002.2350862316.000000006AD73000.00000002.00000001.01000000.00000036.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-music-information-retrieval.pdb source: Audacity.exe, 00000003.00000002.2362401570.000000006C66A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-fft.pdb source: Audacity.exe, 00000003.00000002.2342811887.000000006A38B000.00000002.00000001.01000000.00000052.sdmp, lib-fft.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-music-information-retrieval.pdb&& source: Audacity.exe, 00000003.00000002.2362401570.000000006C66A000.00000002.00000001.01000000.00000009.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-note-track.pdb source: Audacity.exe, 00000003.00000002.2354329585.000000006B0A2000.00000002.00000001.01000000.00000029.sdmp, lib-note-track.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxbase313u_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2344932745.000000006A825000.00000002.00000001.01000000.0000004B.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst.pdb(($" source: Audacity.exe, 00000003.00000002.2361800646.000000006C4C1000.00000002.00000001.01000000.0000000D.sdmp, lib-vst.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-utility.pdb source: Audacity.exe, 00000003.00000002.2345386531.000000006A930000.00000002.00000001.01000000.0000004A.sdmp, lib-utility.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\expat121c5d15c95f6\b\build\RelWithDebInfo\libexpat.pdb source: Audacity.exe, 00000003.00000002.2340378908.000000006A062000.00000002.00000001.01000000.0000005F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-realtime-effects.pdb source: Audacity.exe, 00000003.00000002.2353499147.000000006B00D000.00000002.00000001.01000000.0000002B.sdmp, lib-realtime-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\Audacity.pdb source: Audacity.exe, 00000003.00000000.1179442064.0000000000ABB000.00000002.00000001.01000000.00000003.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-label-track.pdb source: Audacity.exe, 00000003.00000002.2355104199.000000006B166000.00000002.00000001.01000000.00000026.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-utility.pdb// source: Audacity.exe, 00000003.00000002.2345386531.000000006A930000.00000002.00000001.01000000.0000004A.sdmp, lib-utility.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-url-schemes.pdb!! source: Audacity.exe, 00000003.00000002.2361034269.000000006C33B000.00000002.00000001.01000000.00000011.sdmp, lib-url-schemes.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\oggb5849dbc1a267\b\build\RelWithDebInfo\ogg.pdb source: Audacity.exe, 00000003.00000002.2338128861.0000000069E37000.00000002.00000001.01000000.00000064.sdmp, ogg.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-basic-ui.pdb source: Audacity.exe, 00000003.00000002.2345944323.000000006A969000.00000002.00000001.01000000.00000048.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-module-manager.pdb++"" source: Audacity.exe, 00000003.00000002.2353185542.000000006AFC2000.00000002.00000001.01000000.0000002C.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-graph.pdb## source: Audacity.exe, 00000003.00000002.2340710356.000000006A098000.00000002.00000001.01000000.0000005D.sdmp, lib-audio-graph.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-xml.pdb## source: Audacity.exe, 00000003.00000002.2348293921.000000006AB98000.00000002.00000001.01000000.00000040.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-io.pdb22%" source: Audacity.exe, 00000003.00000002.2353901250.000000006B056000.00000002.00000001.01000000.0000002A.sdmp, lib-audio-io.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-fft.pdb source: Audacity.exe, 00000003.00000002.2364019722.000000006FD16000.00000002.00000001.01000000.0000001D.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-screen-geometry.pdb source: Audacity.exe, 00000003.00000002.2346889198.000000006AA77000.00000002.00000001.01000000.00000045.sdmp, lib-screen-geometry.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libpn63be0cf5e3973\b\build\RelWithDebInfo\libpng16.pdb%% source: Audacity.exe, 00000003.00000002.2342318040.000000006A31A000.00000002.00000001.01000000.00000055.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sentry-reporting.pdb%%" source: Audacity.exe, 00000003.00000002.2343195176.000000006A3E4000.00000002.00000001.01000000.00000051.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libpn63be0cf5e3973\b\build\RelWithDebInfo\libpng16.pdb source: Audacity.exe, 00000003.00000002.2342318040.000000006A31A000.00000002.00000001.01000000.00000055.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme-resources.pdb source: Audacity.exe, 00000003.00000002.2362784435.000000006C875000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\porta9bd3205496548\b\build\RelWithDebInfo\portaudio_x86.pdb,, source: Audacity.exe, 00000003.00000002.2343800500.000000006A4AD000.00000002.00000001.01000000.0000004E.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\msvcp140_codecvt_ids.i386.pdb source: Audacity.exe, 00000003.00000002.2340830838.000000006A0A1000.00000020.00000001.01000000.0000005C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxbase313u_xml_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2342590051.000000006A35F000.00000002.00000001.01000000.00000053.sdmp
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Audacity.exe, 00000003.00000002.2343386576.000000006A401000.00000020.00000001.01000000.00000050.sdmp, vcruntime140.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-builtin-effects.pdbbb$" source: Audacity.exe, 00000003.00000002.2362081920.000000006C5A0000.00000002.00000001.01000000.0000000C.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\opuse6c2b3d3b8a4d\b\build\RelWithDebInfo\opus.pdb source: Audacity.exe, 00000003.00000002.2337964387.0000000069E0F000.00000002.00000001.01000000.00000065.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-xml.pdb source: Audacity.exe, 00000003.00000002.2348293921.000000006AB98000.00000002.00000001.01000000.00000040.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track-selection.pdb source: Audacity.exe, 00000003.00000002.2349515048.000000006AC88000.00000002.00000001.01000000.0000003B.sdmp, lib-track-selection.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\flac012542216f3f1\b\build\objs\RelWithDebInfo\FLAC.pdb source: Audacity.exe, 00000003.00000002.2338296484.0000000069E90000.00000002.00000001.01000000.00000063.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-import-export.pdb33$ source: Audacity.exe, 00000003.00000002.2356526735.000000006B385000.00000002.00000001.01000000.00000020.sdmp, lib-import-export.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-file-io.pdb**$" source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\sqlite.pdb source: Audacity.exe, 00000003.00000002.2341336526.000000006A1DF000.00000002.00000001.01000000.00000059.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track.pdb source: Audacity.exe, 00000003.00000002.2352567062.000000006AF07000.00000002.00000001.01000000.00000030.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-preferences.pdb source: Audacity.exe, 00000003.00000002.2346346654.000000006A9BD000.00000002.00000001.01000000.00000047.sdmp, lib-preferences.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wave-track-settings.pdb##!" source: Audacity.exe, 00000003.00000002.2352813323.000000006AF52000.00000002.00000001.01000000.0000002F.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-devices.pdb source: Audacity.exe, 00000003.00000002.2347266804.000000006AAC3000.00000002.00000001.01000000.00000044.sdmp, lib-audio-devices.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_html_vc_custom.pdb;; " source: Audacity.exe, 00000003.00000002.2358648263.000000006BE65000.00000002.00000001.01000000.0000001A.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-history.pdb source: Audacity.exe, 00000003.00000002.2349969885.000000006ACCE000.00000002.00000001.01000000.00000039.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_qa_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2359400925.000000006BFA8000.00000002.00000001.01000000.00000018.sdmp, wxmsw313u_qa_vc_custom.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_aui_vc_custom.pdb)) source: Audacity.exe, 00000003.00000002.2359084604.000000006BF31000.00000002.00000001.01000000.00000019.sdmp, wxmsw313u_aui_vc_custom.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-menus.pdb source: Audacity.exe, 00000003.00000002.2357198512.000000006B465000.00000002.00000001.01000000.0000001B.sdmp, lib-menus.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-menus.pdb&& " source: Audacity.exe, 00000003.00000002.2357198512.000000006B465000.00000002.00000001.01000000.0000001B.sdmp, lib-menus.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-sqlite-helpers.pdb source: Audacity.exe, 00000003.00000002.2341687838.000000006A230000.00000002.00000001.01000000.00000057.sdmp, lib-sqlite-helpers.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-theme-resources.pdb"" source: Audacity.exe, 00000003.00000002.2362784435.000000006C875000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst.pdb source: Audacity.exe, 00000003.00000002.2361800646.000000006C4C1000.00000002.00000001.01000000.0000000D.sdmp, lib-vst.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-time-and-pitch.pdb++! source: Audacity.exe, 00000003.00000002.2352021982.000000006AE43000.00000002.00000001.01000000.00000032.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-string-utils.pdb source: Audacity.exe, 00000003.00000002.2348057306.000000006AB6A000.00000002.00000001.01000000.00000041.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-wx-init.pdb33"" source: Audacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-crashpad-configurer.pdbKK source: Audacity.exe, 00000003.00000002.2360879394.000000006C30F000.00000002.00000001.01000000.00000012.sdmp, lib-crashpad-configurer.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-project-file-io.pdb source: Audacity.exe, 00000003.00000002.2356102014.000000006B2D7000.00000002.00000001.01000000.00000022.sdmp, lib-project-file-io.dll.2.dr
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\libsn58ad79f46d772\b\build\RelWithDebInfo\sndfile.pdb source: Audacity.exe, 00000003.00000002.2344077880.000000006A545000.00000002.00000001.01000000.0000004D.sdmp, sndfile.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-effects.pdb,,!" source: Audacity.exe, 00000003.00000002.2354821538.000000006B12F000.00000002.00000001.01000000.00000027.sdmp, lib-effects.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst3.pdb source: Audacity.exe, 00000003.00000002.2361297853.000000006C3C3000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-vst3.pdb==+ source: Audacity.exe, 00000003.00000002.2361297853.000000006C3C3000.00000002.00000001.01000000.00000010.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\wxwid514be78435ae6\b\build\lib\vc_dll\wxmsw313u_aui_vc_custom.pdb source: Audacity.exe, 00000003.00000002.2359084604.000000006BF31000.00000002.00000001.01000000.00000019.sdmp, wxmsw313u_aui_vc_custom.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-audio-graph.pdb source: Audacity.exe, 00000003.00000002.2340710356.000000006A098000.00000002.00000001.01000000.0000005D.sdmp, lib-audio-graph.dll.2.dr
            Source: Binary string: D:\a\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdbGCTL source: Audacity.exe, 00000003.00000002.2343386576.000000006A401000.00000020.00000001.01000000.00000050.sdmp, vcruntime140.dll.2.dr
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-nyquist-effects.pdb source: Audacity.exe, 00000003.00000002.2360594729.000000006C273000.00000002.00000001.01000000.00000013.sdmp
            Source: Binary string: D:\a\conan-recipes\conan-recipes\.conan_utils\conan\p\b\vorbiec0e21cc0b84d\b\build\lib\RelWithDebInfo\vorbisenc.pdb source: Audacity.exe, 00000003.00000002.2339500080.000000006A017000.00000002.00000001.01000000.00000061.sdmp
            Source: Binary string: D:\a\audacity\audacity\.build.x32\RelWithDebInfo\lib-track.pdb&& " source: Audacity.exe, 00000003.00000002.2350249428.000000006AD07000.00000002.00000001.01000000.00000038.sdmp, lib-track.dll.2.dr
            Source: vcruntime140.dll.2.drStatic PE information: 0x6D121D62 [Mon Dec 27 10:35:14 2027 UTC]
            Source: wxmsw313u_aui_vc_custom.dll.2.drStatic PE information: real checksum: 0xd6580 should be: 0xd5b6c
            Source: IU3.0.dll.2.drStatic PE information: real checksum: 0x0 should be: 0x237ca
            Source: management_ext.dll.2.drStatic PE information: real checksum: 0x0 should be: 0x1e4b22
            Source: libservice-gpu.dll.2.drStatic PE information: real checksum: 0x0 should be: 0xd6c7
            Source: lib-ffmpeg-support.dll.2.drStatic PE information: section name: .00cfg
            Source: sqlite.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-sentry-reporting.dll.2.drStatic PE information: section name: .00cfg
            Source: libmp3lame.dll.2.drStatic PE information: section name: .00cfg
            Source: sndfile.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-wx-wrappers.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-menus.dll.2.drStatic PE information: section name: .00cfg
            Source: vorbis.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-audio-devices.dll.2.drStatic PE information: section name: .00cfg
            Source: wxmsw313u_aui_vc_custom.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-string-utils.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-lv2.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-preferences.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-project-file-io.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-screen-geometry.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-audio-graph.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-sqlite-helpers.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-wave-track-fft.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-vst.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-realtime-effects.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-module-manager.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-viewport.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-time-and-pitch.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-shuttlegui.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-tags.dll.2.drStatic PE information: section name: .00cfg
            Source: ogg.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-ladspa.dll.2.drStatic PE information: section name: .00cfg
            Source: opus.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-url-schemes.dll.2.drStatic PE information: section name: .00cfg
            Source: Audacity.exe.2.drStatic PE information: section name: .00cfg
            Source: lib-dynamic-range-processor.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-files.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-xml.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-note-track.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-components.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-ipc.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-theme.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-track-selection.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-fft.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-strings.dll.2.drStatic PE information: section name: .00cfg
            Source: libexpat.dll.2.drStatic PE information: section name: .00cfg
            Source: wxmsw313u_core_vc_custom.dll.2.drStatic PE information: section name: minATL
            Source: wxmsw313u_core_vc_custom.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-graphics.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-wave-track-paint.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-exceptions.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-transactions.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-registries.dll.2.drStatic PE information: section name: .00cfg
            Source: zlib1.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-channel.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-theme-resources.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-uuid.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-math.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-music-information-retrieval.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-concurrency.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-wave-track-settings.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-track.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-project-history.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-vst3.dll.2.drStatic PE information: section name: .00cfg
            Source: portmidi.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-stretching-sequence.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-numeric-formats.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-audio-io.dll.2.drStatic PE information: section name: .00cfg
            Source: libcurl.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-label-track.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-wave-track.dll.2.drStatic PE information: section name: .00cfg
            Source: vorbisenc.dll.2.drStatic PE information: section name: .00cfg
            Source: portaudio_x86.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-preference-pages.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-builtin-effects.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-command-parameters.dll.2.drStatic PE information: section name: .00cfg
            Source: mpg123.dll.2.drStatic PE information: section name: .rodata
            Source: mpg123.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-utility.dll.2.drStatic PE information: section name: .00cfg
            Source: wxmsw313u_qa_vc_custom.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-audacity-application-logic.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-project.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-playable-track.dll.2.drStatic PE information: section name: .00cfg
            Source: libpng16.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-nyquist-effects.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-nyquist-effects.dll.2.drStatic PE information: section name: _RDATA
            Source: lib-time-frequency-selection.dll.2.drStatic PE information: section name: .00cfg
            Source: wxbase313u_xml_vc_custom.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-file-formats.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-crashpad-configurer.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-basic-ui.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-sample-track.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-effects.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-mixer.dll.2.drStatic PE information: section name: .00cfg
            Source: jpeg8.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-time-track.dll.2.drStatic PE information: section name: .00cfg
            Source: wxmsw313u_html_vc_custom.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-project-rate.dll.2.drStatic PE information: section name: .00cfg
            Source: FLAC.dll.2.drStatic PE information: section name: _RDATA
            Source: FLAC.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-snapping.dll.2.drStatic PE information: section name: .00cfg
            Source: management_ext.dll.2.drStatic PE information: section name: .fptable
            Source: lib-wx-init.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-network-manager.dll.2.drStatic PE information: section name: .00cfg
            Source: lib-import-export.dll.2.drStatic PE information: section name: .00cfg
            Source: wxbase313u_vc_custom.dll.2.drStatic PE information: section name: .00cfg
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\management_ext.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-ffmpeg-support.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-label-track.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\libpng16.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\libmp3lame.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-files.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-wave-track.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\libcurl.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\jpeg8.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-mixer.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140_1.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-builtin-effects.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-numeric-formats.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-transactions.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\portaudio_x86.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-time-and-pitch.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audio-devices.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-effects.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-music-information-retrieval.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audio-graph.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-preferences.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140_atomic_wait.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\opus.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\wxmsw313u_core_vc_custom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\sqlite.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-wx-wrappers.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project-history.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-command-parameters.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-screen-geometry.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\FLAC.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-wx-init.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-vst.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-track-selection.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-track.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-utility.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-graphics.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-theme.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\wxbase313u_xml_vc_custom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140_codecvt_ids.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\concrt140.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\portmidi.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\vcruntime140.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project-file-io.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-theme-resources.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-module-manager.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-time-track.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-xml.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-nyquist-effects.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-time-frequency-selection.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-viewport.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-registries.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-exceptions.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-wave-track-settings.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-snapping.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-url-schemes.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-realtime-effects.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audacity-application-logic.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-wave-track-fft.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\vorbisenc.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-strings.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project-rate.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\IU3.0.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-wave-track-paint.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-sqlite-helpers.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-import-export.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140_2.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\vorbis.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\ucrtbase.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-fft.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-preference-pages.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\mpg123.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\wxmsw313u_aui_vc_custom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\ogg.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\sndfile.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-sentry-reporting.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-file-formats.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-vst3.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-concurrency.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-crashpad-configurer.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-string-utils.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-playable-track.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-components.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-note-track.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\wxmsw313u_html_vc_custom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\wxmsw313u_qa_vc_custom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-math.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-ipc.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\libservice-gpu.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\libexpat.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-basic-ui.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-uuid.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-lv2.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\vccorlib140.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-stretching-sequence.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-channel.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-dynamic-range-processor.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-shuttlegui.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-sample-track.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\zlib1.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\wxbase313u_vc_custom.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-tags.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audio-io.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-network-manager.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-menus.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-ladspa.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\License Agreement.txtJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Programs\Directory Converter\License Agreement.txtJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeMemory allocated: 3B20000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeMemory allocated: 3E80000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeMemory allocated: 3B20000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeWindow / User API: threadDelayed 809Jump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeWindow / User API: threadDelayed 1344Jump to behavior
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\vccorlib140.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140_1.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\lib-ffmpeg-support.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\mpg123.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140_atomic_wait.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\libmp3lame.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\msvcp140_2.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Directory Converter\concrt140.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeAPI coverage: 2.5 %
            Source: C:\Windows\System32\msiexec.exe TID: 6996Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe TID: 6028Thread sleep time: -67200s >= -30000sJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007AFA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllom(ExpandoButtonWrapper)" class="ImageAlignmentWrapper" layout="verticalflowlayout(false,2,0)" layoutpos="left" active="inactive">
            Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03C43F94 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_03C43F94
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe "C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe"Jump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03C444D7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_03C444D7
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03C43F94 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_03C43F94
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03E32530 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_03E32530
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03E32A77 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_03E32A77
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_69B22A77 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_69B22A77
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_69B22530 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_69B22530
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeMemory allocated: page read and write | page guardJump to behavior
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007ABE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: program manager*lesL
            Source: Audacity.exe, 00000003.00000003.1183998538.00000000064D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [Shell_TrayWnd32d
            Source: Audacity.exe, 00000003.00000003.1183998538.00000000064D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerboxocr.exe)nWindowClass.0
            Source: Audacity.exe, 00000003.00000003.1183998538.00000000064D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [Progmank Window ClasstopShellWindowss.0;
            Source: Audacity.exe, 00000003.00000002.2333822729.0000000007ABE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager*ass
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Directory Converter\IU3.0.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Directory Converter\libservice-gpu.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeCode function: 3_2_03C43BDF GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,3_2_03C43BDF
            Source: C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871596638.000000000BBB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871519233.000000000BD09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871596638.000000000BC4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869722097.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869929994.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1868298021.000000000BB02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1868246669.000000000BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1872738664.000000000BCB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869449978.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.2335776606.000000000BBB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1870257236.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871559397.000000000BCB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1870257236.000000000BBBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1872645698.000000000BDBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871596638.000000000BB71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869365554.000000000BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.2335776606.000000000BC4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1870775606.000000000BD09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871596638.000000000BBB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871519233.000000000BD09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871596638.000000000BC4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869722097.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869929994.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1868298021.000000000BB02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1868246669.000000000BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1872738664.000000000BCB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869449978.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.2335776606.000000000BBB7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1870257236.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871559397.000000000BCB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1870257236.000000000BBBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1872645698.000000000BDBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1871596638.000000000BB71000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1869365554.000000000BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000002.2335776606.000000000BC4F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000003.00000003.1870775606.000000000BD09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure1
            Spearphishing Link
            Windows Management Instrumentation1
            DLL Side-Loading
            2
            Process Injection
            11
            Masquerading
            OS Credential Dumping1
            System Time Discovery
            Remote Services11
            Archive Collected Data
            1
            Encrypted Channel
            Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomains1
            Replication Through Removable Media
            Scheduled Task/JobBoot or Logon Initialization Scripts1
            DLL Side-Loading
            2
            Virtualization/Sandbox Evasion
            LSASS Memory11
            Security Software Discovery
            Remote Desktop ProtocolData from Removable Media1
            Application Layer Protocol
            Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)11
            Disable or Modify Tools
            Security Account Manager2
            Virtualization/Sandbox Evasion
            SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
            Process Injection
            NTDS2
            Process Discovery
            Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Timestomp
            LSA Secrets1
            Application Window Discovery
            SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            DLL Side-Loading
            Cached Domain Credentials11
            Peripheral Device Discovery
            VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            File Deletion
            DCSync14
            System Information Discovery
            Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1670991 Sample: TRxHlAc5qV.msi Startdate: 22/04/2025 Architecture: WINDOWS Score: 72 21 Found malware configuration 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 Yara detected LummaC Stealer 2->25 27 2 other signatures 2->27 6 msiexec.exe 191 149 2->6         started        9 msiexec.exe 3 2->9         started        process3 file4 13 C:\Users\user\AppData\Local\...\zlib1.dll, PE32 6->13 dropped 15 C:\Users\user\...\wxmsw313u_qa_vc_custom.dll, PE32 6->15 dropped 17 C:\Users\...\wxmsw313u_html_vc_custom.dll, PE32 6->17 dropped 19 105 other files (none is malicious) 6->19 dropped 11 Audacity.exe 19 6->11         started        process5

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            TRxHlAc5qV.msi14%ReversingLabsWin32.Trojan.Generic
            TRxHlAc5qV.msi15%VirustotalBrowse
            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\FLAC.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\IU3.0.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\concrt140.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\jpeg8.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audacity-application-logic.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audio-devices.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audio-graph.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-audio-io.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-basic-ui.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-builtin-effects.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-channel.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-command-parameters.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-components.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-concurrency.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-crashpad-configurer.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-dynamic-range-processor.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-effects.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-exceptions.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-ffmpeg-support.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-fft.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-file-formats.dll3%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-files.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-graphics.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-import-export.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-ipc.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-label-track.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-ladspa.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-lv2.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-math.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-menus.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-mixer.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-module-manager.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-music-information-retrieval.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-network-manager.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-note-track.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-numeric-formats.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-nyquist-effects.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-playable-track.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-preference-pages.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-preferences.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project-file-io.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project-history.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project-rate.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-project.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-realtime-effects.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-registries.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-sample-track.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-screen-geometry.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-sentry-reporting.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-shuttlegui.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-snapping.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-sqlite-helpers.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-stretching-sequence.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-string-utils.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-strings.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-tags.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-theme-resources.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Programs\Directory Converter\lib-theme.dll0%ReversingLabs
            No Antivirus matches
            No Antivirus matches
            SourceDetectionScannerLabelLink
            http://lv2plug.in/ns/ext/atom#DoubleJ0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#noUserResize0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/port-props#logarithmicW0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#project0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/presets#0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#scalePointLANGCPOSIXlilv_get_lang%s():0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/log#Note0%Avira URL Cloudsafe
            http://lame.sourceforge.net/0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/state#makePath0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#X11UI0%Avira URL Cloudsafe
            https://www.musehub.com/app/ace-studio?utm_source=au-app&utm_medium=ace-studio&utm_campaign=au-app-w0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/log#Warning0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#InstrumentPlugin0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#externalN0%Avira URL Cloudsafe
            http://www.portmedia.sourceforge.net/portmidi/0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/buf-size#minBlockLengthi0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/buf-size#minBlockLengthh0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/atom#Double0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/port-props#notOnGUI0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#portMaphttp://lv2plug.in/ns/extensions/ui#portSubscribehttp://lv20%Avira URL Cloudsafe
            http://kxstudio.sf.net/ns/lv2ext/external-ui#WidgetP0%Avira URL Cloudsafe
            http://xmlns.com/foaf/0.1/homepage0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#projecthttp://usefulinc.com/ns/doap#maintainerhttp://xmlns.com/foaf/0.10%Avira URL Cloudsafe
            https://www.surina.net/soundtouch/0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/atom#Property0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/dynmanifest#DynManifest0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#GtkUI0%Avira URL Cloudsafe
            https://manual.audacityteam.org/man/unzipping_the_manual.html0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#external0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/units#unitk0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/atom#URID0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/options#optionsLV2InstanceFeaturesList::CheckOptionsD:0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/atom#Int0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathlilv_state_new_from_ins0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#Qt4UI0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/log#TraceZ.0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/parameters#sampleRate0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/atom#String0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/port-props#notAutomatic0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/options#interfacehttp://lv2plug.in/ns/ext/state#interfaceParametersvector0%Avira URL Cloudsafe
            http://www.twolame.org/0%Avira URL Cloudsafe
            https://manual.audacityteam.org/man/faq_opening_and_saving_files.html#fromcd0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#sampleRate0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/atom#Long0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#symbolV0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/time#speed0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/port-groups#group0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/instance-access0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/buf-size#minBlockLength0%Avira URL Cloudsafe
            https://support.audacityteam.org/additional-resources/changelog0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/event#supportsEventlilv_port_get_valuelilv_port_get_name%s():0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/worker#schedule0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/atom#Blankhttp://lv2plug.in/ns/ext/atom#Boolhttp://lv2plug.in/ns/ext/atom#C0%Avira URL Cloudsafe
            http://xmlns.com/foaf/0.1/0%Avira URL Cloudsafe
            http://kxstudio.sf.net/ns/lv2ext/external-ui#Host0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#Specificationj/0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/buf-size#nominalBlockLengthy0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/event#supportsEvent0%Avira URL Cloudsafe
            http://ll-plugins.nongnu.org/lv2/namespace#MathFunctionPlugin0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathhttp://lv2plug.in/ns/lv0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/dynmanifest#DynManifestS0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/log#log0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#noUserResizehttp://lv2plug.in/ns/extensions/ui#fixedSizehttp://lv0%Avira URL Cloudsafe
            http://lv2plug.in/ns/ext/port-props#rangeStepsi0%Avira URL Cloudsafe
            http://lv2plug.in/ns/extensions/ui#touch0%Avira URL Cloudsafe
            http://lv2plug.in/ns/lv2core#extensionDatah0%Avira URL Cloudsafe
            NameIPActiveMaliciousAntivirus DetectionReputation
            bg.microsoft.map.fastly.net
            199.232.214.172
            truefalse
              high
              NameMaliciousAntivirus DetectionReputation
              nighetwhisper.top/lekdfalse
                high
                changeaie.top/gepsfalse
                  high
                  jawdedmirror.run/ewqdfalse
                    high
                    NameSourceMaliciousAntivirus DetectionReputation
                    http://xmlns.com/foaf/0.1/nameAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                      high
                      http://lv2plug.in/ns/lv2core#projectAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                      • Avira URL Cloud: safe
                      unknown
                      http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drfalse
                        high
                        http://lv2plug.in/ns/ext/presets#Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://lv2plug.in/ns/ext/state#makePathAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://lv2plug.in/ns/ext/log#NoteAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://lv2plug.in/ns/lv2core#scalePointLANGCPOSIXlilv_get_lang%s():Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://lv2plug.in/ns/ext/port-props#logarithmicWAudacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://lame.sourceforge.net/Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://lv2plug.in/ns/lv2core#portPropertyAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                          high
                          http://lv2plug.in/ns/lv2core#requiredFeatureAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                            high
                            https://www.cs.cmu.edu/~music/nyquist/Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpfalse
                              high
                              https://forum.audacityteam.org/VisitAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                high
                                http://lv2plug.in/ns/extensions/ui#noUserResizeAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                • Avira URL Cloud: safe
                                unknown
                                https://audacityteam.org/audacitypromoAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                  high
                                  http://lv2plug.in/ns/ext/atom#DoubleJAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://lv2plug.in/ns/extensions/ui#X11UIAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://lv2plug.in/ns/ext/buf-size#minBlockLengthhAudacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  https://www.musehub.com/app/ace-studio?utm_source=au-app&utm_medium=ace-studio&utm_campaign=au-app-wAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://lv2plug.in/ns/ext/buf-size#minBlockLengthiAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.portmedia.sourceforge.net/portmidi/Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://lv2plug.in/ns/ext/atom#ChunkAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                    high
                                    http://lv2plug.in/ns/ext/atom#SequenceAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                      high
                                      http://lv2plug.in/ns/extensions/ui#externalNAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      http://lv2plug.in/ns/lv2core#InstrumentPluginAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                      • Avira URL Cloud: safe
                                      unknown
                                      https://api.audio.com/analytics/audacity-uuid/opt-outAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                        high
                                        http://lv2plug.in/ns/ext/atom#DoubleAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://lv2plug.in/ns/ext/log#WarningAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://lv2plug.in/ns/extensions/ui#portMaphttp://lv2plug.in/ns/extensions/ui#portSubscribehttp://lv2Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                        • Avira URL Cloud: safe
                                        unknown
                                        http://lv2plug.in/ns/ext/atom#AtomPortAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                          high
                                          http://lv2plug.in/ns/ext/port-props#notOnGUIAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                          • Avira URL Cloud: safe
                                          unknown
                                          https://updates.audacityteam.org/feed/latest.xml?audacity-instance-id=&user_id=https://api.audio.comAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                            high
                                            http://kxstudio.sf.net/ns/lv2ext/external-ui#WidgetPAudacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            http://lv2plug.in/ns/lv2core#maximumAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              high
                                              http://lv2plug.in/ns/ext/atom#PropertyAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              https://www.surina.net/soundtouch/Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://xmlns.com/foaf/0.1/homepageAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/lv2core#projecthttp://usefulinc.com/ns/doap#maintainerhttp://xmlns.com/foaf/0.1Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/dynmanifest#DynManifestAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/extensions/ui#externalAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              https://manual.audacityteam.org/man/unzipping_the_manual.htmlAudacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/extensions/ui#GtkUIAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/extensions/units#unitkAudacity.exe, 00000003.00000002.2331511865.000000000111E000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/options#optionsLV2InstanceFeaturesList::CheckOptionsD:Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/atom#URIDAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathlilv_state_new_from_insAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/atom#IntAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/log#TraceZ.Audacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/parameters#sampleRateAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/extensions/ui#Qt4UIAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/atom#StringAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                              • Avira URL Cloud: safe
                                              unknown
                                              http://lv2plug.in/ns/ext/buf-size#fixedBlockLengthAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                high
                                                https://www.audacityteam.org/mh-pluginmanagerAudacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpfalse
                                                  high
                                                  http://lv2plug.in/ns/ext/port-props#notAutomaticAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://lv2plug.in/ns/ext/options#interfacehttp://lv2plug.in/ns/ext/state#interfaceParametersvectorAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://www.twolame.org/Audacity.exe, 00000003.00000002.2330512703.00000000008F3000.00000002.00000001.01000000.00000003.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://manual.audacityteam.org/man/faq_opening_and_saving_files.html#fromcdAudacity.exe, 00000003.00000002.2363804728.000000006F9C4000.00000002.00000001.01000000.00000007.sdmp, lib-wx-init.dll.2.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://lv2plug.in/ns/lv2core#sampleRateAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://www.audacityteam.org/mh-rtepanelAnalyze%sAudacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpfalse
                                                    high
                                                    http://lv2plug.in/ns/lv2core#portAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                      high
                                                      http://lv2plug.in/ns/ext/atom#LongAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://lv2plug.in/ns/lv2core#symbolVAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://audacityteam.org/errors#missing-pluginsAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                        high
                                                        http://lv2plug.in/ns/ext/buf-size#minBlockLengthAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2333822729.0000000007A22000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                        • Avira URL Cloud: safe
                                                        unknown
                                                        http://lv2plug.in/ns/ext/time#speedAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                        • Avira URL Cloud: safe
                                                        unknown
                                                        https://www.audacityteam.org/mh-effectmenuAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                          high
                                                          http://www.zlib.net/DAudacity.exe, 00000003.00000002.2340270336.000000006A03C000.00000002.00000001.01000000.00000060.sdmpfalse
                                                            high
                                                            http://lv2plug.in/ns/lv2core#scalePointAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                              high
                                                              http://lv2plug.in/ns/ext/instance-accessAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              unknown
                                                              http://lv2plug.in/ns/lv2core#nameAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                high
                                                                http://lv2plug.in/ns/ext/port-groups#groupAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, Audacity.exe, 00000003.00000002.2332117015.0000000003428000.00000004.00000020.00020000.00000000.sdmp, lib-lv2.dll.2.drfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                https://support.audacityteam.org/additional-resources/changelogAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://lv2plug.in/ns/ext/event#supportsEventlilv_port_get_valuelilv_port_get_name%s():Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://lv2plug.in/ns/ext/worker#scheduleAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://lv2plug.in/ns/ext/atom#Blankhttp://lv2plug.in/ns/ext/atom#Boolhttp://lv2plug.in/ns/ext/atom#CAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                http://xmlns.com/foaf/0.1/Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                • Avira URL Cloud: safe
                                                                unknown
                                                                https://curl.se/VAudacity.exe, 00000003.00000002.2341017372.000000006A133000.00000002.00000001.01000000.0000005B.sdmpfalse
                                                                  high
                                                                  http://kxstudio.sf.net/ns/lv2ext/external-ui#HostAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  unknown
                                                                  http://lv2plug.in/ns/ext/buf-size#nominalBlockLengthyAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  unknown
                                                                  http://lv2plug.in/ns/lv2core#AudioPortAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                    high
                                                                    http://lv2plug.in/ns/lv2core#Specificationj/Audacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    unknown
                                                                    http://www.weonlydo.com/SFTP/Help/wodSFTPLib~wodSFTP~FIPS.htmlRelease Notes.txt.2.drfalse
                                                                      high
                                                                      http://lv2plug.in/ns/ext/event#supportsEventAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                      • Avira URL Cloud: safe
                                                                      unknown
                                                                      http://ocsp.sectigo.com0lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drfalse
                                                                        high
                                                                        http://ll-plugins.nongnu.org/lv2/namespace#MathFunctionPluginAudacity.exe, 00000003.00000002.2333822729.0000000007992000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                        • Avira URL Cloud: safe
                                                                        unknown
                                                                        http://lv2plug.in/ns/ext/log#logAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                        • Avira URL Cloud: safe
                                                                        unknown
                                                                        https://www.audacityteam.org/mh-rtepanelAudacity.exe, 00000003.00000002.2330512703.0000000000978000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                          high
                                                                          http://lv2plug.in/ns/ext/dynmanifest#DynManifestSAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          unknown
                                                                          http://lv2plug.in/ns/ext/state#mapPathhttp://lv2plug.in/ns/ext/state#makePathhttp://lv2plug.in/ns/lvAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          unknown
                                                                          https://github.com/audacity/audacity/releasesAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                            high
                                                                            http://lv2plug.in/ns/lv2core#OutputPortAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                              high
                                                                              http://lv2plug.in/ns/ext/port-props#rangeStepsiAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              unknown
                                                                              http://lv2plug.in/ns/extensions/ui#noUserResizehttp://lv2plug.in/ns/extensions/ui#fixedSizehttp://lvAudacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                              • Avira URL Cloud: safe
                                                                              unknown
                                                                              http://lv2plug.in/ns/lv2core#extensionDatahAudacity.exe, 00000003.00000002.2332117015.000000000343F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              unknown
                                                                              http://lv2plug.in/ns/extensions/ui#touchAudacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              unknown
                                                                              http://lv2plug.in/ns/lv2core#symbolAudacity.exe, 00000003.00000002.2333822729.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, Audacity.exe, 00000003.00000000.1179442064.0000000000A03000.00000002.00000001.01000000.00000003.sdmp, Audacity.exe, 00000003.00000002.2361572727.000000006C45C000.00000002.00000001.01000000.0000000E.sdmp, lib-lv2.dll.2.drfalse
                                                                                high
                                                                                http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#lib-vst.dll.2.dr, lib-effects.dll.2.dr, jpeg8.dll.2.dr, lib-transactions.dll.2.dr, lib-uuid.dll.2.dr, lib-import-export.dll.2.dr, lib-stretching-sequence.dll.2.dr, wxmsw313u_aui_vc_custom.dll.2.dr, lib-preferences.dll.2.dr, portmidi.dll.2.dr, lib-playable-track.dll.2.dr, sndfile.dll.2.dr, lib-strings.dll.2.dr, lib-url-schemes.dll.2.dr, lib-audacity-application-logic.dll.2.dr, lib-ipc.dll.2.dr, lib-wx-init.dll.2.dr, wxmsw313u_qa_vc_custom.dll.2.dr, lib-time-track.dll.2.dr, lib-utility.dll.2.dr, lib-wx-wrappers.dll.2.drfalse
                                                                                  high
                                                                                  No contacted IP infos
                                                                                  Joe Sandbox version:42.0.0 Malachite
                                                                                  Analysis ID:1670991
                                                                                  Start date and time:2025-04-22 13:28:33 +02:00
                                                                                  Joe Sandbox product:CloudBasic
                                                                                  Overall analysis duration:0h 8m 23s
                                                                                  Hypervisor based Inspection enabled:false
                                                                                  Report type:full
                                                                                  Cookbook file name:default.jbs
                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                  Number of analysed new started processes analysed:14
                                                                                  Number of new started drivers analysed:0
                                                                                  Number of existing processes analysed:0
                                                                                  Number of existing drivers analysed:0
                                                                                  Number of injected processes analysed:0
                                                                                  Technologies:
                                                                                  • HCA enabled
                                                                                  • EGA enabled
                                                                                  • AMSI enabled
                                                                                  Analysis Mode:default
                                                                                  Analysis stop reason:Timeout
                                                                                  Sample name:TRxHlAc5qV.msi
                                                                                  renamed because original name is a hash value
                                                                                  Original Sample Name:6251d8f0af660e1e92506d6cea15fd9a7d332a669a6e1b3cf47914b45267b16d.msi
                                                                                  Detection:MAL
                                                                                  Classification:mal72.troj.winMSI@5/141@0/0
                                                                                  EGA Information:
                                                                                  • Successful, ratio: 100%
                                                                                  HCA Information:Failed
                                                                                  Cookbook Comments:
                                                                                  • Found application associated with file extension: .msi
                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
                                                                                  • Excluded IPs from analysis (whitelisted): 199.232.214.172, 52.149.20.212, 184.29.183.29
                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                  TimeTypeDescription
                                                                                  07:29:31API Interceptor1x Sleep call for process: msiexec.exe modified
                                                                                  07:31:02API Interceptor816x Sleep call for process: Audacity.exe modified
                                                                                  No context
                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  bg.microsoft.map.fastly.netDayKovazvL.msiGet hashmaliciousLummaC StealerBrowse
                                                                                  • 199.232.214.172
                                                                                  Abelia_Danger_IMG53524554a.vbsGet hashmaliciousAsyncRAT, PureLog Stealer, zgRATBrowse
                                                                                  • 199.232.210.172
                                                                                  Medbase Employee.pdfGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                  • 199.232.210.172
                                                                                  ps-pulse-win-22.8r1-b31437-64bit-installer.msiGet hashmaliciousUnknownBrowse
                                                                                  • 199.232.210.172
                                                                                  SecuriteInfo.com.Win32.MalwareX-gen.26969.29469.exeGet hashmaliciousUnknownBrowse
                                                                                  • 199.232.210.172
                                                                                  SecuriteInfo.com.Win64.MalwareX-gen.15593.21621.exeGet hashmaliciousLockBit ransomwareBrowse
                                                                                  • 199.232.210.172
                                                                                  Quarantined Messages.zipGet hashmaliciousHTMLPhisherBrowse
                                                                                  • 199.232.214.172
                                                                                  zNaZhcgkj3.ps1Get hashmaliciousAsyncRAT, DcRatBrowse
                                                                                  • 199.232.210.172
                                                                                  5VPZNNjklZ.exeGet hashmaliciousAmadey, LockBit ransomware, LummaC Stealer, VidarBrowse
                                                                                  • 199.232.214.172
                                                                                  pixel.exeGet hashmaliciousAsyncRAT, DcRatBrowse
                                                                                  • 199.232.210.172
                                                                                  No context
                                                                                  No context
                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                  C:\Users\user\AppData\Local\Programs\Directory Converter\concrt140.dllVisualCppRedist_AIO_x86_x64.exeGet hashmaliciousUnknownBrowse
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:modified
                                                                                    Size (bytes):29675
                                                                                    Entropy (8bit):5.826448780713532
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:DFb6r3GTKZlyijhXTonr7g7p7g7pevT0Th:Dx6r3GTKZlyi1TonroqeTa
                                                                                    MD5:98DE637D2DA97A2E2B1886DBCD1BF2F8
                                                                                    SHA1:FD15349B324E3E51140505149A0F6EF4DC9F6773
                                                                                    SHA-256:A923DA36C6708B2CDAD988830A8DFAEC2384A8F7549BF3FE800720DA23A38726
                                                                                    SHA-512:D1A53784AF66765C90B388F8950C39FE8CA9211CB611DC54C2F2E8A5A7A1C242DA0B861C2EF782E91F3A3B2E815DECC8FADDBA5017923D0302AE7942FBDAA65D
                                                                                    Malicious:false
                                                                                    Reputation:low
                                                                                    Preview:...@IXOS.@.....@.;.Z.@.....@.....@.....@.....@.....@......&.{269E0548-9833-4152-BFAE-78ADA6691E16}..Directory Converter..TRxHlAc5qV.msi.@.....@.....@.....@........&.{C18396A7-35E7-4830-B61F-0C5FAC07CF20}.....@.....@.....@.....@.......@.....@.....@.......@......Directory Converter......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{6692B693-5A98-89D1-88D8-A7D6CC742A84}&.{269E0548-9833-4152-BFAE-78ADA6691E16}.@......&.{6D791EF7-BFC8-2113-A063-8C94B8C5C885}&.{269E0548-9833-4152-BFAE-78ADA6691E16}.@......&.{2A3552F7-DF7E-D0FB-6D75-E52E45E8BCFB}&.{269E0548-9833-4152-BFAE-78ADA6691E16}.@......&.{D1514EB2-E1C2-5D11-6C92-1585437D53CA}&.{269E0548-9833-4152-BFAE-78ADA6691E16}.@......&.{3DA015D0-0531-58DC-B22E-E7340B879661}&.{269E0548-9833-4152-BFAE-78ADA6691E16}.@......&.{4F1B00BA-BEC3-AC9C-5D53-C69EF4A0144A}&.{269E0548-9833-4152-BFAE-78ADA6691E16}.@......&.{D8555950-BE2E-647D-5FF0-F19CB4AA28E8}&.{2
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 73305 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                                    Category:dropped
                                                                                    Size (bytes):73305
                                                                                    Entropy (8bit):7.996028107841645
                                                                                    Encrypted:true
                                                                                    SSDEEP:1536:krha8mqJ7v3CeFMz/akys7nSTK7QMuK+C/Oh5:kAOFq+Mba9Ok7C/O/
                                                                                    MD5:83142242E97B8953C386F988AA694E4A
                                                                                    SHA1:833ED12FC15B356136DCDD27C61A50F59C5C7D50
                                                                                    SHA-256:D72761E1A334A754CE8250E3AF7EA4BF25301040929FD88CF9E50B4A9197D755
                                                                                    SHA-512:BB6DA177BD16D163F377D9B4C63F6D535804137887684C113CC2F643CEAB4F34338C06B5A29213C23D375E95D22EF417EAC928822DFB3688CE9E2DE9D5242D10
                                                                                    Malicious:false
                                                                                    Reputation:high, very likely benign file
                                                                                    Preview:MSCF....Y.......,...................I.................;Za. .authroot.stl.98.?.6..CK..<Tk......4..c... .Ec...U.d.d.E&I.DH*..M.KB."..rK.RQ*..}f..f...}..1....9...........$.8q..fa...7.o.1.0...bfsM4.........u..l..0..4.a.t....0.....6#....n. :... ....%.,CQ5uU..(.3.<7#.0..JN.$...=j|w..*.#.oU..Eq[..P..^..~.V...;..m...I|...l..@-W..=.QQ.._./.M.nZ..(.........`.$Z.9wW:W.]..8*E.......I.D{..n...K:.m..^.(.S.......c..s.y..<...2.%o.o.....H.B.R.....11.|!.(...........h.SZ........<...^....Z>.Pp?... .pT@p.#.&..........#VEV=.....p........y..."T=l.n..egf.w..X.Y..-G...........KQ.]...pM..[m..-6.wd:........T...:.P5Zs....c.oT`..F1#......EuD.......7....V ..-....!.N..%S...k...S. ...@.J..../..b!B.(=\../.l......`.\...q9..>4!b..8EH.....zdy.....#...X>%0w...i.,>c.z.g"p.S..2W.+mMs.....5Def.....#._D.4....>}...i...\.&`D.......z;..ZY.3.+t.`....z_.q'w.z.)..j3.+.co.s..:.........qK...{...E....uPO...#vs.XxH.B!..(t. 8k+.....G\..?..GF8....'..w.>.ms..\ve.nFN..W)....xi..u..5.f.l....
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:modified
                                                                                    Size (bytes):330
                                                                                    Entropy (8bit):3.287136292755414
                                                                                    Encrypted:false
                                                                                    SSDEEP:6:kKirmcQRnSN+SkQlPlEGYRMY9z+4KlDA3RUeqpGVuys1:KrmfZkPlE99SNxAhUeq8S
                                                                                    MD5:97E82D21789D57B3DAAB7A33EC53FB8A
                                                                                    SHA1:6D83A872377419D357FA97BB49432B0C80F12F63
                                                                                    SHA-256:0A81F07D35D34CAFC762E1357214768EE185E73B3E57ECBA0E3B4B0F0805A6FD
                                                                                    SHA-512:B5175F633F58CEA31B32154BD319599F8D99714BA047A2FA71B8E054FB5048E38DDF803E7CB329113CEF0A17D743B1AAF7D6823D8B1CBFB5FE58B736F0907E9F
                                                                                    Malicious:false
                                                                                    Reputation:low
                                                                                    Preview:p...... ........D...y...(....................................................... ..................(....c*.....Y...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".6.4.2.7.f.6.c.2.b.7.8.7.d.b.1.:.0."...
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):10525112
                                                                                    Entropy (8bit):6.013820914749141
                                                                                    Encrypted:false
                                                                                    SSDEEP:98304:trzdnm3W/6klywFoWJaQ2KmnNTgOJyLW9Qzd7Na1Ow/Jn34XeilGtFNcqKZMisv:trZnsk6klyejJaQgQzd5wNNYeiJrZI
                                                                                    MD5:9488F51D9BB30C6DC834A5B16DE79507
                                                                                    SHA1:877253B3512897733031FAF52B37B55D322A32B5
                                                                                    SHA-256:7677111340EEA8915DD609236FEBF14F9A4D4416A2A33FD11DAF505AB5BC7867
                                                                                    SHA-512:F30EC2B6D1EC7536ABC067AD2230E67611DD935111439E361EBD7D67EE535CE552FA45244F30657AFD3D9CD7E0FBA74EB41D069F9FD47D96DC3BB4598450103C
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Reputation:low
                                                                                    Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........5.`.Tw3.Tw3.Tw3.,.3.Tw3..3.Tw3..s2.Tw3..r2.Tw3..t2.Tw3..v2.Tw3.)v2.Tw3..v2.Tw3.&v2.Tw3..v2.Tw3.+r2.Tw3>.s2.Tw3>.v2ITw3.Tv3~Lw3>.r2NUw3>.w2.Tw3>.3.Tw3>.u2.Tw3Rich.Tw3................PE..L......g...............+..[...F.....a........0[...@......................................@.............................M...u.......................n...+......h%...Ss.8....................s......Rs.@............................................text.....[.......[................. ..`.rdata....(..0[...(...[.............@..@.data........0...|..................@....idata..+...........................@..@.tls.................x..............@....00cfg..............|..............@..@.rsrc................~..............@..@.reloc..@1.......2...<..............@..B........................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):338872
                                                                                    Entropy (8bit):6.136809885481085
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:qOe3xHpbl2bf+0lNDaLi+i8MxtlkZbG8Q8nB:qBbbyNmVi5TlQadAB
                                                                                    MD5:4566378820757BEC55C5B28692A7CB18
                                                                                    SHA1:6F15C08DEB05412C85D88166F7D3DCCF0BA59D0E
                                                                                    SHA-256:E15ED67E9DA662492A567BAA7675D3AAF33DC6D768A4863F573B880ED4CDEF53
                                                                                    SHA-512:600011943566FAE6D5A5982CF961D2C85C6D20EF6E2FF460C41599A5CA77996FC4F770DDA1EF95A480B4CA10FCCE803E3AC0985B76B6E9ED4F88FF5CD55221BD
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Reputation:low
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}p{09..c9..c9..c0i.c+..c.o.b;..c.o.c;..c.o.b5..c.o.b3..c.o.b+..c.a.b:..c9..cm..c-n.b$..c-n.b8..c-n.c8..c-n.b8..cRich9..c........................PE..L...@.d...........!...$.....................................................P......dT....@..........................W..bG..h........ ..<................+...0..t....I..8............................H..@...............h............................text...;........................... ..`.rdata.............................@..@.data...............................@....idata..*...........................@..@_RDATA...7.......8..................@..@.00cfg..............................@..@.rsrc...<.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):93696
                                                                                    Entropy (8bit):5.7638773759587085
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:MqXoTUX6YDmvbdogBSouwIfSTVYIw7dmQQ4PcldIM6tPRKLmuAK6TtR1VhvHG+to:/XAUX6YD2dogBSouwIfSTVYIw7oQQ4Pw
                                                                                    MD5:4D8A2048957E22DD223286806772B179
                                                                                    SHA1:09FF9B08C5C7674B605B430F739E7E7C0B1025CD
                                                                                    SHA-256:DD94A417398E749EC63395AF31B4749421FC37EC4259DA8CD068D3C9FC5198FE
                                                                                    SHA-512:112BB08D749BE9B46DAB459B25CEA7C2ED0837F758AF81432C3F897B43A977C5318B18234F1758657B5D0F870BAE41CE9E880922DCC16BBEFDCA9AA70AD32405
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Reputation:low
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2..va..va..va...a..va...a..va.Yu`..va.Yr`..vaPXw`..va.Ys`..va.Yw`..va.^w`..va..wa..vaPXs`..vaPXv`..vaPX.a..vaPXt`..vaRich..va........................PE..L......g...........!...+.L...........[.......`............................................@.........................0$..H...x$.......@..TH..............................................................@............`..D............b..H............text....K.......L.................. ..`.rdata.......`.......P..............@..@.data...T....0......................@....rsrc...TH...@...J... ..............@..@.reloc...............j..............@..B................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Non-ISO extended-ASCII text, with very long lines (734), with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):6985
                                                                                    Entropy (8bit):4.764771932538675
                                                                                    Encrypted:false
                                                                                    SSDEEP:96:/ThHYVyQqhwV+z4txYcW5zXSo77Z1cc43ZoYZM7FGKFeRpnpUEDKpVOkjmH8oPxd:/Thrw0z4duTSo77Z5woYZMR1FKay8oz
                                                                                    MD5:006A2461EC1D8D3B72D8852698D18447
                                                                                    SHA1:5B9D29FB5F2DC2554F79BFB2063A134977B801E9
                                                                                    SHA-256:1E8860F3DD2DE4B64BFCE6CB2C44D256EA82322553DDAB4F215BEE89F5B00350
                                                                                    SHA-512:9486AEF746604B97BB99A239BA35C1D98C1DA6D0FB9A11DB50F2A8488081303374F963042196AD1AF96E8627C2FD240B60CDCD063DE7FE7DFDF142EAF8C71193
                                                                                    Malicious:false
                                                                                    Reputation:low
                                                                                    Preview:WeOnlyDo! SOFTWARE LICENSE AGREEMENT....This is a legal agreement between you (either an individual or an entity) and WeOnlyDo! Software ("WeOnlyDo!"). By installing the enclosed software, you are agreeing to be bound by the terms of this Agreement. If you do not agree to the terms of this Agreement, promptly return the software and the accompanying items to the place you obtained them for a full refund. If you need to return the software, you must prepay shipping and either insure the package or assume all risk of loss or damage in transit.....WeOnlyDo! LICENSE..1. GRANT OF LICENSE TO USE. The WeOnlyDo! Software product that accompanies this license is referred to herein as "SOFTWARE." WeOnlyDo! Software ("WeOnlyDo") grants to you as an individual, a personal, non-exclusive license to make and use the SOFTWARE for the sole purpose of designing, developing, and testing your software product(s). WeOnlyDo! Software grants to you the limited right to use only one copy of the Software on a
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz
                                                                                    Category:dropped
                                                                                    Size (bytes):3075244
                                                                                    Entropy (8bit):7.895441997515991
                                                                                    Encrypted:false
                                                                                    SSDEEP:49152:0Of953zGsnD0OinKs2iZsrW9HlcYZ+6IUU0288fR6WmfOkZ/112ik+/dPW7pURAI:0OHpD0OE0iOrWYYZ+62bfR6WmfOkDg+R
                                                                                    MD5:4042DE84259D9D5E64D3C427C79CE31E
                                                                                    SHA1:08671D072E64B304224C1FD588AA08042DE0F325
                                                                                    SHA-256:096A889AF519AA6A3DE3C8D9204ED48CC5B65BDE60F73093327703F991F9172B
                                                                                    SHA-512:FED1601AF7EDA722FD74A24C34E77ABAC8E9F50237926482CB7343D008321A84458052D0575B6EC8AC545046DCF6D4D57A9F65046B1109972617E29880A61F5F
                                                                                    Malicious:false
                                                                                    Reputation:low
                                                                                    Preview:RIFF....WAVEfmt ........D....X........fact.....u..data......:.&.......B.P.^...T.....,.......L.......2...2.D...n...........*.......>.....p.l.n........"N.T....$."......(..(./.#..d.. .4.A4A.-x.0 .6.N.P46J!. $'.4.=.?.@H8.#..... .).'.%.#......@...........0..<................T.N.~.p...v..b...D....x....X......D.t...j.v.@.l.....h.....D.p.j..;.h....|l\P.D.L.W~T>GV/..0..p..|...j.h......F.QhE.+..v.~...:.0......<.b.R......X...*....F.........8....~.n.....h...z.(.L........F.h.v.T.(.............x..............b... ...p.........|.....b".).*@(x.....h.....d....".%f....*X*."H.....&../.;.>x<.0.(2(./.A.QX[.T.C.D$T&Z.Z.R.F.A.KpR<R.O.<z........".#.#:". ......... ...r.......|.Z.....p.........~...........F.X.~.p.r....". j.....<.........H0.8.F$D.,L........$.4.H.V.[.U.J.J.T._.qDy.|.."}.n.k.t.~....\|.ovg.h.w..........................................N{.q.q.@.../....h....... .v...........|.....:...........B..B..\.(.Z.l....@...t..z...>....6.J...T.p......4..".....x...b........>.....
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):371117
                                                                                    Entropy (8bit):7.998543939751016
                                                                                    Encrypted:true
                                                                                    SSDEEP:6144:LV0ZclkXEl8Gljoe5Fg8ybdWPD7qaY+7AuKOuzLoTgFZWTp19D9Xc87v/y:LTk48Ghoefg8yhWL7qaY+7GwoZYZd/y
                                                                                    MD5:E7E5FFCB4E5D817F7503BB90894FB5EE
                                                                                    SHA1:557AF483A44CD948CF82716F89E8F97016B07E32
                                                                                    SHA-256:DFAFC6752602BEC01329F33481C4B39F68F0C136E5F4450A788B4570EDB4208C
                                                                                    SHA-512:C9AABE72B93AC056D89C93A8BF3AD1698C0BB0F5878E7C5E6B6806E3898C9CF6DF58D028799A2964FDEB025D6DBB9DF8203D4B742D3CFEB91FAACBA0D76696F3
                                                                                    Malicious:false
                                                                                    Reputation:low
                                                                                    Preview:!K.....G.?W..A......................................1012546698.?=<>5! #u@HKHL[X.IN,.QPRRUT.SYXZR]\_jutruv}~BIHKKMLO.tpss}twvLMOJLKOHd`cbddgf.mkjllon.........u............................_........................]....................... ..............................................................9::9;78.=3255769.>:==7>! JLQAUHHD%*-,..QP.WUTV^YX[nmhkhwttMEDGGIHK.HLOOypsr........m|.~``cb.agfn`kjmPon.............h...................................................................d................V......................q.7.H.c.k.u.r.{.t.^.w.g.~.o....1%325.169:.:=<.>Q Q"J$@&[(J*@,K.0P'R4TrV.X.Z.\0^/@&B1D.F=H*J>L$Nipsrutwv.}{z}|.~aycbe|gfi.njmmen.............................................8.............................................k..........................|w "{ oos|nhmin{d8zg2v..........102.547.A.Z...}_.D....A..N.....k.`aafcg7.m.jj..kv^CBE\GFI.NJMMmNqp'>'..1/..7<;.$*,., \.P."2.XY.................................................................K...........
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):19207
                                                                                    Entropy (8bit):5.101148542964513
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:jyfVW7XUkCkVLKbhofo3O+OIWNHalVBcuRomR5ir91i:juVW7h2Wf2OvHqFRLQLi
                                                                                    MD5:AF5624AE852A836A8D2CFB88D760BD83
                                                                                    SHA1:CD8DE982C28E93CA2616FC7A6A53E4CDD9929307
                                                                                    SHA-256:8905E0835078740E15691290F6B0935AD82388BA7EAD0E1E8CB052F1B068972F
                                                                                    SHA-512:7425C83444BB0229E2C7EDD15C687EF382418FEF16E39A5A0341583F8D5B330E8E7F4321EBE7D483527FED402576E212052E912C1E0DDAE91D46599905E41856
                                                                                    Malicious:false
                                                                                    Preview:wodSFTP ActiveX Component and COM object ..----------------------------------------......4.0.0 November 30, 2024..* Switched to using OpenSSL3. ..* There are changes in FIPS mode, please review before upgrading if you are using FIPS.....3.9.2 January 15, 2024..* Fix for Terrapin attacks (CVE-2023-48795) using strict KEX mode....3.9.1 February 14, 2022..* Support for ssh-ed25519....3.9.0 September 6, 2020..* Binaries now compiled in VS2019..* OpenSSL updated to 1.0.2u....3.8.8 August 30, 2019..* Fixed aes-cbc ciphers ....3.8.7 May 14, 2019..* Fix in 'no encryption algorithms' error even there is a match....3.8.6 March 15, 2019..* Fix in initial KEXINIT packet that was not blindly sent - caused some...servers to "freeze" connection waiting for it to arrive....3.8.5 January 15, 2018..* Updated OpenSSL to 1.0.2n....3.8.4 May 24, 2017..* Fix in 'Server signature does not match' when connecting to 'Reflection for Secure IT' server....3.8.3 November 30, 2016..* New HMAC algorithms ...hmac-sha
                                                                                    Process:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):371200
                                                                                    Entropy (8bit):7.998547589776705
                                                                                    Encrypted:true
                                                                                    SSDEEP:6144:dV0ZclkXEl8Gljoe5Fg8ybdWPD7qaY+7AuKOuzLoTgFZWTp19D9Xc87v/1:dTk48Ghoefg8yhWL7qaY+7GwoZYZd/1
                                                                                    MD5:8E40F2EE1B06F61F5D768554A4ED2DA1
                                                                                    SHA1:B904CFB8477FB3A3948C27E633CADCD3F255E63B
                                                                                    SHA-256:67C2E386DCE44CFBD379CDDB43100C5518F36A23DE7FECF8890AA8A1334C6F0A
                                                                                    SHA-512:BC149CDD02EEF3B0DF161937578F94402916688BBD76C3CE3A06215B5BC5552BE24D170DC2DDECD143C68078F1BFDF195AD03E661A01E8ABFAFF9B54B7472905
                                                                                    Malicious:false
                                                                                    Preview:.......}x.+..!^.....................................1012546698.?=<>5! #u@HKHL[X.IN,.QPRRUT.SYXZR]\_jutruv}~BIHKKMLO.tpss}twvLMOJLKOHd`cbddgf.mkjllon.........u............................_........................]....................... ..............................................................9::9;78.=3255769.>:==7>! JLQAUHHD%*-,..QP.WUTV^YX[nmhkhwttMEDGGIHK.HLOOypsr........m|.~``cb.agfn`kjmPon.............h...................................................................d................V......................q.7.H.c.k.u.r.{.t.^.w.g.~.o....1%325.169:.:=<.>Q Q"J$@&[(J*@,K.0P'R4TrV.X.Z.\0^/@&B1D.F=H*J>L$Nipsrutwv.}{z}|.~aycbe|gfi.njmmen.............................................8.............................................k..........................|w "{ oos|nhmin{d8zg2v..........102.547.A.Z...}_.D....A..N.....k.`aafcg7.m.jj..kv^CBE\GFI.NJMMmNqp'>'..1/..7<;.$*,., \.P."2.XY.................................................................K...........
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):259672
                                                                                    Entropy (8bit):6.704368184984171
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:NSRa45/SAWtw+z7Xk8zqyGLx//5uIlOz1nKipU3CQv20kyd0eXXE12z/V2st96:r+F2GeIlOz1n2UkhXX1zl36
                                                                                    MD5:53DE7153D033D6989FDA00406C09C79F
                                                                                    SHA1:9E8600097F088292969A1D65E972D3B8663944D8
                                                                                    SHA-256:FB55B1A8EA941F614DDA3490AEEDBC1A17A3C1071A065F98923B2120DDB9B240
                                                                                    SHA-512:847C428B1344A6A020BA3C7727FAAF046C5D4ED76A2A4C3D4612A05B65AA9511F68284830659004A70947F8A36543BCCA2623E2DC98B1C91E302A0D20E1E95BF
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Joe Sandbox View:
                                                                                    • Filename: VisualCppRedist_AIO_x86_x64.exe, Detection: malicious, Browse
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._z.1).1).1)..0(.1)...).1).>0(.1).0)Y.1).>2(.1).>5(.1).>4(..1).>1(.1).>.).1).>3(.1)Rich.1)........................PE..L....D>?.........."!...*.....x......`........@.......................................F....@A.............................K..............................XP.......+..0<..T...........................p;..@............................................text...|-.......................... ..`.data....4...@...2...2..............@....idata..R............d..............@..@.rsrc................v..............@..@.reloc...+.......,...z..............@..B........................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):701368
                                                                                    Entropy (8bit):5.482889224435232
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:paV4hNP6YLdfvYoPD2dKQIgurJTFERhlpv7s64qZ9c6LkLhMiOU1L8nh:pauhJ6YLdfpBguteQ64qZ9cFLiU1LAh
                                                                                    MD5:31B8CACCDCEE3CCB4DD1132F7C9D0116
                                                                                    SHA1:AD4E211554FDA3A98D242B137D7D059451734155
                                                                                    SHA-256:546409DE89D21A386DC7A1A119FC5EC2103AA6973BDACDBBB32E85F2B2827965
                                                                                    SHA-512:1CC41AB729E5A387DFD4A8D9E9C66E04764BE6B2FB25FD93CED0BB136065AA1B89F539F30EEEDE395563F42F9B7A8AD3FD38BFFD42584164FC3B537FBE0E18CA
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Q..R...R...R.......R.P.S...R.P.W...R.P.V...R.P.Q...R...S...R...S...R...V...R...R...R...R...R.......R.......R...P...R.Rich..R.........PE..L....d...........!...$.<...L...............P.......................................M....@..........................C.......q..........L................+...........4..8....................:.......3..@............p...............................text....:.......<.................. ..`.rdata..0....P.......@..............@..@.data........`.......F..............@....idata.......p.......H..............@..@.tls.................R..............@....00cfg...............V..............@..@.rsrc...L............X..............@..@.reloc.."%.......&...b..............@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):85432
                                                                                    Entropy (8bit):5.363425624827085
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:L1zKT+Pss8ti194wivGXtytyGzwD8nmkEsp:L1M+PE26wiutytyGzU8nNp
                                                                                    MD5:31B93BE7275E0517998D019B65A856D1
                                                                                    SHA1:ADAA1E165DD7EE38EA18CFF6FE6EB7D5CE2F3219
                                                                                    SHA-256:5183B34F2460FC785C4282592EB1C0B68501F2902A9BC91CD7483E8C1F255B8D
                                                                                    SHA-512:90D0A1EDCF898AF0242D69F8E54B026C961EDB20C5986E7457D7DD2E89C22F9C3A80C3058719570EF8BFCD5D3CCEF47D1E5FFA382D1D39980C075CBC49279FD7
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$..GEeCGEeCGEeCN=.CCEeCV.fBFEeCV.aBMEeCV.`BSEeCV.dBCEeC.7dBEEeC..dBXEeCGEdC*EeC..`BFEeC..eBFEeC..CFEeC..gBFEeCRichGEeC........................PE..L......g...........!...+.....................................................p.......y....@.................................`........P..<............"...+...`..4...@...8...........................X...@...............`............................text.............................. ..`.rdata..n8.......:..................@..@.data...H...........................@....idata..(#.......$..................@..@.00cfg.......@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):349624
                                                                                    Entropy (8bit):5.817681859302845
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:5LqcR0KsUwh2RIiJ/wAd3b8CDAtCt5I/qRdNOjyCW76P5ISVRaCWaO1V8n9:5WcROnsta/qbNOjyCWO5PXpGVA9
                                                                                    MD5:E524F61544CA54C05110C1BE287FAE18
                                                                                    SHA1:B0B07AAB042DF07AA717FD6CD3AF0EFEAE532B09
                                                                                    SHA-256:9334DA137271D362C47D9B05328470D891B8701201974EC32E10D2DA5AED25FF
                                                                                    SHA-512:181B6BF99FADC7F015F53A4DD3ED5A8807A6D5466C2963004BC6558D54926B84F938847A9AD07ED7EC1AD17CA8B110E98535351169A7EB1BADA88F97F73106ED
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........qeS.............h..............................................~b......~b......tm......U...............U.......U.......U.......U.......U.......Rich............................PE..L......g...........!...+.....................0............................................@.............................t.......@....@..<............*...+...P... ......8...............................@............................................text............................... ..`.rdata.......0......................@..@.data...............................@....idata...".......$..................@..@.00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc...%...P...&..................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):58808
                                                                                    Entropy (8bit):5.200159326680361
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:gQw/DrqWwYPXm+5Bew79j1IB8nmkEsBYqj:XwvZNPwg9j1IB8nNm6
                                                                                    MD5:6545A5B7E2159D8EF001F663425027D2
                                                                                    SHA1:CC9622FD4DE963EEB464289074E60FD8F50C2A07
                                                                                    SHA-256:C53F8767047EEB86B6DD13411FCB6D3CBE210A1118A8AE581EFE0E3AECBD1D88
                                                                                    SHA-512:83241133AC4B5E6B2185BF9270AACE6A632A4875BAF89B44420E8443B9FE3E316F6C5A9BE3B4639CD89C37EA94994BF4D2047AB01DF8202AB1EF29C49F73C516
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./...k.Uk.Uk.Ub.1Uo.UzW.Tj.UzW.Ta.UzW.T..UzW.Tn.U...Ti.Uk.UA.U.V.Tn.U.V.Tj.U.V]Uj.U.V.Tj.URichk.U........PE..L......g...........!...+.p...J.......................................................O....@.............................m.......x.......<................+..............8...............................@............................................text....n.......p.................. ..`.rdata...&.......(...t..............@..@.data...............................@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..K...........................@..B................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):241592
                                                                                    Entropy (8bit):5.610078597802337
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:GTPKTzC/TZGnBa18DhxqU3NT2na5xyQ58nE:GMzUTZwawhxqU3NT2a5xP58nE
                                                                                    MD5:462813BF163B89F1BFFE3187C4DE684E
                                                                                    SHA1:32770A6DC32533FF38AB51F733974B523501D09B
                                                                                    SHA-256:0031B635D16586DA9F6A1AC300F56EB2BE24B64E793DC0F2327207AEB72CC080
                                                                                    SHA-512:EB621F028891DE318ABE5521991ED024E3C40843E50575DADC3324B667FF3994CDEF89DC1D5E17F1A2CD088CA56CE1FD7D31B72CCB69447E0DF4B48D3293AD04
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........F..F..F..O...H..Wb}.G..Wb..N..Wb..L..Wb..]..Wb..B....G....@....D..c..@..c..Y..F..T..c..@..c..G..c..G..c..G..RichF..........................PE..L...P..g...........!...+.P...4...............`.......................................=....@..............................F...9..D.......<................+...........{..8...................L........z..@............0...............................text....N.......P.................. ..`.rdata..F....`.......T..............@..@.data....!..........................@....idata...I...0...J..................@..@.tls.................\..............@....00cfg...............`..............@..@.rsrc...<............b..............@..@.reloc...............h..............@..B................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):61368
                                                                                    Entropy (8bit):4.688587883094886
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:QgKNQcuN5UQs8PgzzUUt84brmBlDT8nmkEs1uq:QgKNQtN5UwgzzUUt8YrmBlDT8nN7
                                                                                    MD5:3514B384C29BF405E12457F6EEF740C8
                                                                                    SHA1:FB3BB29077CD4F6F345877312E7FF1D6FCBE6D95
                                                                                    SHA-256:936BCFBFE374A7E516908729D32CB96D72E9F8ADFFF2553224A293F29FF7C8C4
                                                                                    SHA-512:04B7BA397900AD1351E1742A1A25FBD6C2BDCCFD367B621C00D1454314B5D9107A664B20813073E4E320DF6A7A5632C63312624F6F8E29D7CBD4E359782AAD54
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....x...x...x.......x.......x.......x.......x.......x.......x.......x...x..0x.......x.......x....r..x.......x..Rich.x..................PE..L......g...........!...+.z...J...........................................................@.............................................<................+..........P...8...........................h...@............................................text....y.......z.................. ..`.rdata...%.......&...~..............@..@.data...h...........................@....idata..>...........................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):1210808
                                                                                    Entropy (8bit):5.988994212882912
                                                                                    Encrypted:false
                                                                                    SSDEEP:24576:yC3dIFiDWmLRMeSzXwB2AdZCUkFvpUFYDGt//E33No3y0oMCZK0cXloVU5VtuTkg:ZCgZ2aGF0ZvCj5R
                                                                                    MD5:28494C7C373D092650F0B9D367050D23
                                                                                    SHA1:1FAFB730E0BF4EB5DB5328FE72766FACC2C5E840
                                                                                    SHA-256:A1C6D797B44F18A2FD85541BF74576F3AF5A7884EE40489B5D0C27DE7C54226C
                                                                                    SHA-512:FEE88E1F29B56C419B8278717CED82875283D170C53B186DE44F5CC67C81CA55EC7A6C63B6F6CB8DA49520E11D4732DE4DB839350ACAC023DA342FD01718FE88
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.a.M.2.M.2.M.2.5D2.M.2...3.M.2...3.M.2...3.M.2...3.M.2r?.3.M.2Y..3.M.2.M.2.O.2Y..3.M.2Y..3.M.2Y.(2.M.2Y..3.M.2Rich.M.2........................PE..L......g...........!...+.....b......|>..............................................".....@..........................F...K..............<............N...+..............8...............................@............................................text............................... ..`.rdata..X...........................@..@.data....Z.......\...~..............@....idata..7...........................@..@.tls.................t..............@....00cfg...............x..............@..@.rsrc...<............z..............@..@.reloc..............................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):73144
                                                                                    Entropy (8bit):5.101312754997741
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:injuZWvDmHg2e8z8NrHZFJA7wta8nmkEsp:sqZWCHbe8z8NrHZU7wk8nNp
                                                                                    MD5:BD1FD4FEFBDB974B4B634AC56D4E077E
                                                                                    SHA1:4CA08966B72A5F391EE9C53086DF7EBD175C3409
                                                                                    SHA-256:DBE915DF05274F06D3CD1C3E14CF81BF3E9B86083DEFC0DE383BDD6284A49D7D
                                                                                    SHA-512:8723C3B68A801E3E06C645C3C0F6D70668F54D6E9D717D1428C4ABAD92FFE1618A62F1EA113F014DDE1B8930BDF4AC3A2D8D75833B52FA730DD44744A09F394F
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~Z..4...4...4..g....4...7...4...0...4...1...4...5...4.Um5...4...5...4.~.1...4.~.4...4.~....4.~.6...4.Rich..4.........PE..L......g...........!...+.~...v......\........................................@............@.............................{+......x.... ..<................+...0......`...8...........................x...@............................................text....|.......~.................. ..`.rdata..{K.......L..................@..@.data... ...........................@....idata..............................@..@.tls................................@....00cfg..............................@..@.rsrc...<.... ......................@..@.reloc..U....0......................@..B........................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):70584
                                                                                    Entropy (8bit):5.371544827904238
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:xDipVTin1fVO3d+aJSHl+vJ1nsnJ3v1P9fi20piEgvLkWvy3PsvBdj8nmkEsD3O:WVTin1fVO3d+aJcvBp8nND3O
                                                                                    MD5:41D5CC12BB94009123AC89DBEC767B27
                                                                                    SHA1:DE7A3EE336A2C18EF0E7DEFFB3A02F1105AC6738
                                                                                    SHA-256:B9111F78FF5AF8814D02F3A4F58DAB5C6E6797A888CE2DAA0C78298C3E1C2032
                                                                                    SHA-512:116A3485998E2CCD6EE4ED1A1DD73E98397677E411649D0373F16DAE46EBFF90FB3DA85AFFBA97CEBEF845FBB9D33A4410E75869F0F6C4DB759A04A6A0B5EFCA
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K-Y..L7..L7..L7..4...L7...6..L7...4..L7...3..L7...2..L7..>6..L7...6..L7..L6.BL7...2..L7...7..L7......L7...5..L7.Rich.L7.........PE..L......g...........!...+.~...j...... ........................................0......>P....@.........................0...................<................+... ..8......8...............................@............................................text....|.......~.................. ..`.rdata..J;.......<..................@..@.data...............................@....idata..[...........................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):106424
                                                                                    Entropy (8bit):5.314711013603366
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:cCz157tEk1EZWvdgyQYPPxZ+w4UuUVVj65QuZqMhbWDAoyRuQK8nmkEsU7:B5h+kC4vdgZsPxsByGQuVvoyRuQK8nNw
                                                                                    MD5:57AD970B45965AF77EE2F58442EFFE13
                                                                                    SHA1:7D7D582522A520D20816F4A80A9CED68BE85232E
                                                                                    SHA-256:DFEE312DADDA46359D03FC60541BA99DB325C3DB58328AF518AAA330667C1AC3
                                                                                    SHA-512:4DBC5FBB6CA0C7AE7B7C876EA9C497B8D712090ABCE397833FCAF3F0B595A97511E9AD4233323374B3DA82B0FDB9426B7EC4379EABF263089962784449E41792
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.8&a.Vua.Vua.Vuh..ug.Vup2Wtc.Vup2Utc.Vup2Rtk.Vup2Stu.Vu..Wtc.Vu.3Wtd.Vua.Wu.Vu.3Std.Vu.3Vt`.Vu.3.u`.Vu.3Tt`.VuRicha.Vu................PE..L......g...........!...+.................................................................@..............................:...S..........<............t...+......|.......8...............................@............P...............................text............................... ..`.rdata...n.......p..................@..@.data...`....@.......0..............@....idata.......P... ...8..............@..@.tls.........p.......X..............@....00cfg...............\..............@..@.rsrc...<............^..............@..@.reloc...............d..............@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):50616
                                                                                    Entropy (8bit):5.060180131619896
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:ph8wclNh2BixYmJR6Ha2rlNaCsKY1Ae5bFsw1zfvhpwK6QNynss2m/8E9VFzSJIy:TY6lNTVe3jzu8nmkEslr
                                                                                    MD5:0506726CA1B217782560BE8275AB149A
                                                                                    SHA1:51311F30FA1DEA0AA68C18C06595D949FD0319D0
                                                                                    SHA-256:892BB10A6DBF5F8088C3DEEE5F23D0DD5651CC362F55103C7D85B3264DD9EA39
                                                                                    SHA-512:95FA45FB87B4E2C04C62686BA91C81D8617C801D959453D45FED78934DE1988DB158B81B1CA5ECD1DA279D1D3AE26B1543DEED4185D44E13FAD843BBBFB637A4
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k..A/.t./.t./.t.&...+.t.>\w...t.>\p.%.t.>\q.<.t.>\u.*.t...u.-.t./.u...t..]q...t..]t...t..]....t..]v...t.Rich/.t.........PE..L...s..g...........!...+.V...D...............p............................................@.....................................x.......<................+...........y..8............................x..@............................................text...,T.......V.................. ..`.rdata..Z ...p..."...Z..............@..@.data...(............|..............@....idata..V...........................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):406968
                                                                                    Entropy (8bit):5.97823186669772
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:qYKqfy3fZ2ycx7AOZynWDYQcua4ItmpA5:qYK8u2ycx7AOZynWDha4ItmA5
                                                                                    MD5:79700F4841083DF506FF82A4D40267CF
                                                                                    SHA1:2A5A80FF7A5CB83A49CCE4AD688A93E689CF74EB
                                                                                    SHA-256:C67362FEA6CA6BDF5852BC9A9938E593FBC256A31FE055C59B7A6B9DAD9936B5
                                                                                    SHA-512:8F8A78BD84486337F12826B37C56BA973AB0CAE0AD5F34425F8544D6EB2BDBB03C4D3C8D2FA7ECD455F0B24E0497C0109A274C7AECA8BC4C8350E8448D735286
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y+.9.J.j.J.j.J.j.2Fj.J.j...k.J.j...k.J.j...k.J.j...k.J.j.8.k.J.j.J.j.J.j.5.k.J.j.5.k7J.j...k.J.j...k.J.j..*j.J.j...k.J.jRich.J.j........PE..L...y..g...........!...+.....................................................p.......h....@..........................................0..<................+...@..........8...............................@............................................text............................... ..`.rdata..............................@..@.data...............................@....idata...&.......(..................@..@.tls................................@....00cfg....... ......................@..@.rsrc...<....0......................@..@.reloc..."...@...$..................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):345016
                                                                                    Entropy (8bit):5.814509054908954
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:DDZRozcDRIiJ/nXd7CTGY41E9XMYWP9sOoyvWWL7ltv6ZPTZ+rXI8nB:DVIcf298YWlsOoyvW6l5O1+bIAB
                                                                                    MD5:1B51B530E85662BE14659C4C17D061C6
                                                                                    SHA1:3C16F3ADCEDE4E68C17A5A6CB4ACF40C7CF18174
                                                                                    SHA-256:0E2F82D75D527852C2261A39FC1BDA0F8AAC247FE1EC4B2BB63399989D015B28
                                                                                    SHA-512:68CB6DD692E4D6CADC572FD9EE486D12973A396D0BE796A60A880724A32E68FA9C1B281363C8CE593F3605D809E8D8095B2EEA2A807A45BA27C76BC4A3BD7391
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........DT...T...T...].g.\...EV..Q...EV..^...EV..B...EV..P.......V....W..Q...T........W..]....W..U....W..U....W..U...RichT...................PE..L......g...........!...+.*...................@...............................`......I.....@.............................M... ........0..<................+...@..h......8..............................@............... ............................text...!(.......*.................. ..`.rdata..-....@......................@..@.data...............................@....idata..............................@..@.00cfg....... ......................@..@.rsrc...<....0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):447416
                                                                                    Entropy (8bit):5.870176027050916
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:wPlCD1xRIiJ/BqdEPHOhdy1VD6Xe/3MOQyUWAAiU4mLXQxcYaHh18nd:wPAsQVuXevMOQyUW2U4EgGJAd
                                                                                    MD5:D80B75A59A5A8AC966BE6EB7705457DC
                                                                                    SHA1:06E7C8CF1829BD4D985C24B5D27666FBED1AEEFF
                                                                                    SHA-256:C4A186BAE9FA47BA829F428DD1E2239FF2D7408F665F438488BB6C7959A9DFF2
                                                                                    SHA-512:C0EB9DF5C139228DEA5FCA445BE22D2560A00D04BA26C6344AA9F8139530DBBDCF7665D5D6A118805C50634C01E13D09938B4CEEAAAEF0F8D7A18C8988B314E7
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........q."."."..."."...#."...#."...#..."...#."?..#."...#.."."."...#."...#."..z"."...#."Rich."........PE..L......g...........!...+............u................................................|....@.........................0....O...9..0.......<................+.......*..hB..8....................G.......A..@............0...............................text..._........................... ..`.rdata..............................@..@.data....9.......4..................@....idata...Z...0...\..................@..@.tls.................j..............@....00cfg...............n..............@..@.rsrc...<............p..............@..@.reloc...0.......2...v..............@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):70584
                                                                                    Entropy (8bit):5.327475647675308
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:LguaSupK9bWEZLfus2c8Y1c0Y6vPV8nmkEse:Lu5pK9bWEZLfuvcnc0YgN8nNe
                                                                                    MD5:A2760F4BFC66C04D112D377FEDE932CE
                                                                                    SHA1:89F3BE80FAB48F577D3A013FC400769106A87E02
                                                                                    SHA-256:A28AB356C261D87CD6BD256F0A4AD9F5051D5307DFE07339E3FD725EAFA3B097
                                                                                    SHA-512:62F80512C7F03754302C39807B7238657709830E1BC3B7EAB0B54B284EA38C40085E2A0498419641950D71B3CC142D2DB99E61E0C7219E543BF072E8B1342C4E
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IZ...;w..;w..;w..C...;w...t..;w...s..;w...r..;w...v..;w..Iv..;w...v..;w..;v.X;w...r..;w...w..;w......;w...u..;w.Rich.;w.................PE..L......g...........!...+.....j......p........................................0......{.....@.........................@...................<................+... .........8...............................@............................................text............................... ..`.rdata...1.......2..................@..@.data...@...........................@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..J.... ......................@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):400312
                                                                                    Entropy (8bit):5.387382194723816
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:HRVtSiQH3qcceoSw+iOW0dTqw2MZE2QUUnFOCLiYSm2VvMvZLxDbHSGjurICUIQ5:jtSV36rSYOW0N7IuQAy
                                                                                    MD5:198F803DE09A244C0FC15C10B996A33D
                                                                                    SHA1:989BEA71EF00C63DCE67895DF3E01343D1F768BA
                                                                                    SHA-256:AEED57E5F6FB51772FDF94F58A6CB509A8C2913A4347D49D70E619D0E89CC37E
                                                                                    SHA-512:B41A7C62C29E18C1BF3B240606767E1D213A66CBAE8DF8E638A57691666973D009FD95B85587AA31BDC1B90B85338095DAD19AA228AD66620E3DC9A6A03F6110
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z]3D;3`D;3`D;3`MC.`L;3`U.0aG;3`U.7aN;3`U.6aR;3`U.2a@;3`.I2aF;3`..2aC;3`D;2`7;3`..6am;3`..3aE;3`...`E;3`..1aE;3`RichD;3`........PE..L...i..g...........!...+.^...........3.......p...............................@............@..........................'...*.............<................+.......8......8.......................... ...@............................................text....].......^.................. ..`.rdata.......p.......b..............@..@.data....H...`...D...F..............@....idata..............................@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc..h?.......@..................@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):156600
                                                                                    Entropy (8bit):5.55997949185798
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:JgHK3f3l6btPn15WMzG5WBZoS/zDyyukHwkDyqaMx3pzsOmExL3yaTE8npK9:iHK0n15RzD1/N3yaTE8npA
                                                                                    MD5:2D44F360B9CDFEEF5CE4927AD746611F
                                                                                    SHA1:14C3D26D65224B9D04401A0B068DB36278461118
                                                                                    SHA-256:03A08B3BED723086D227A74AEEBE6795CE31CA3BF18967BFF1645364A85EEFB9
                                                                                    SHA-512:5087DB9F8747762A6AEBA51CF78E4927F52D4F228442CE85256FE5856470FB42D576C338D34CC8D10F0E0C8C2F5A5C31D5BDAD1A3C970D69B570F87A83821D4C
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............A.A.A..0A.A.(.@.A.(.@.A.(.@...A.(.@.A4.@.A.).@.A.A...A.).@.A.).@.A.).@.A.)\A.A.).@.ARich.A................PE..L......g...........!...+..................................................................@..............................7...3.......p..<............8...+..............8...............................@............0...............................text............................... ..`.rdata...j.......l..................@..@.data...h.... ......................@....idata..[....0......................@..@.tls.........P......................@....00cfg.......`......."..............@..@.rsrc...<....p.......$..............@..@.reloc..+............*..............@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):58808
                                                                                    Entropy (8bit):5.239201539416184
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:0+EK4FF1l8KNZZ8NluG13vFBTAOe+gC+Q/LsKZXga4W5SBSo99/ZiomjrbfwkIiC:0+T3tlge4kSBFJsomjHhIo8nmkEsbPR
                                                                                    MD5:D59875075805C063F56E167C02CB3482
                                                                                    SHA1:C86D0DD817311AFFB43F044BA30189CD81FFA194
                                                                                    SHA-256:CF55D0CCE1F1C8304D9B2B21EA114BFC1AF69BE7602BCC5D2C381AEFD95BD22E
                                                                                    SHA-512:6E0463541C5CA5A757F4A302D2FC34503D9385BE1FD012ADFD986C1AA8F897AABE939E5E10E9559E5B30429E0CD4866B6F618E06A6B7A07FE1313D531B616469
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 3%
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........7?.Yl.Yl.Yl...l.Yl.;Xm.Yl.;.l.Yl.;Zm.Yl.;]m.Yl.;\m..Yl>.Xm.Yl.:Xm.Yl.=Xm.Yl.Xl..Yl.:\m.Yl.:Ym.Yl.:.l.Yl.:[m.YlRich.Yl........................PE..L......g...........!...+.f...T............................................................@.............................................<................+..........8...8...........................P...@............................................text....e.......f.................. ..`.rdata...%.......&...j..............@..@.data...............................@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):151992
                                                                                    Entropy (8bit):5.395123425357425
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:D0d0RXG/q4ld2Qw04TiTPkgjrtYqlhuGlXK/k/u6j8nNg:WGiogjyotXK/k/u6j8nG
                                                                                    MD5:6539DFA76A56A09DA1DE38B0D47CDF2A
                                                                                    SHA1:0F0BE775F1EECB615C14B451D9F83459A7CD2620
                                                                                    SHA-256:3C3581F44ED757CFA673EF6E6EB08D14A6F0EFA43DC725D1666083D00845DF10
                                                                                    SHA-512:01E2E29528BE32A21CC4CE8904603B36BB8973490063E15E165E60D600A13E1408031CD638E49E1061359933FA663C9DACFAE5B37FFA22CD03AACC6EDB13AE59
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#qx.#qx.#qx.*..%qx.2.|.)qx.2.}.5qx.2.{.'qx.2.y.'qx...y.!qx...y..qx.#qy.'px...}.+qx...x."qx....."qx...z."qx.Rich#qx.........PE..L......g...........!...+.4...................P......................................i.....@.........................`................P..<............&...+...`.......i..8....................m......(h..@............................................text...N2.......4.................. ..`.rdata..np...P...r...8..............@..@.data...............................@....idata..d<.......>..................@..@.tls.........0......................@....00cfg.......@......................@..@.rsrc...<....P......................@..@.reloc..0....`......................@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):65976
                                                                                    Entropy (8bit):4.900855900939065
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:+Iab8/LPp/W10TTTvCBZ2XKA7EhzzQVl2Flgj5opFxau4DxCWb0mspwK6QNynss9:kA+EW4DVIw8nmkEsmj
                                                                                    MD5:CA75CF3621AE4FFC3C95AC835E1E5AB0
                                                                                    SHA1:A44B4328D72B86B3B9A596EAFE7CF6FD62721A72
                                                                                    SHA-256:ECAD6F0AD83F147E0E69B46208B4EA739EC91C0A19477A15BFDA33649BFD8B84
                                                                                    SHA-512:FC7D3ECAD511705CFDD3DDE4069C8E2E5288709143E0FB75786D502610C8A2F5D876013AFD719AA37027CD428C50DB878018DF5360F1CA2F62C41F4315F96D09
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S.j...j...j.......j......j......j......j......j.......j../...j...j...j../...j../...j../.q..j../...j..Rich.j..................PE..L......g...........!...+.t...f...............................................0.......1....@............................................<................+... ..........8...................L...........@............................................text...<r.......t.................. ..`.rdata...,...........x..............@..@.data...p...........................@....idata..............................@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc..;.... ......................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):477112
                                                                                    Entropy (8bit):5.854132404599163
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:Pfxc63M9uXk4OeyRWiLUQuJFpRYJ8AqAFA0HhA7AQAU5FfQm+DdAnBmhAr9sI3VW:PZccM9uXk4OeyRWzYJ8AqAFA0HhA7AQ2
                                                                                    MD5:63587E3B8CFEC67EA2E79F676D1F217B
                                                                                    SHA1:E93A693EDC9CEE881E8E7B334BCD228D7416153E
                                                                                    SHA-256:D50931A77A62978BF5736D62073CC56F9C3A9588D4D87CC9F695284FD6BA890E
                                                                                    SHA-512:FEF6F0AD929F1EA1BECC181B8E72020CD183F1E73DD3FC78E3B34056F536EA78D586D185172A8C6614E82C1527471DA067FF4E2DF1AC3726662FB72EE8947C28
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q.f.0.5.0.5.0.5.H#5.0.5..4.0.5..4.0.5..4.0.5..4.0.5.B.4.0.5.4.0.5+..4.0.5.0.5.1.5+..4.0.5+..4.0.5+.O5.0.5+..4.0.5Rich.0.5........................PE..L......g...........!...+.>..........r .......P...............................p......7.....@..............................Q..H...0.... ..<................+...0..........8..............................@...............H............................text...J<.......>.................. ..`.rdata.......P.......B..............@..@.data....5...p...0...`..............@....idata...H.......J..................@..@.tls................................@....00cfg..............................@..@.rsrc...<.... ......................@..@.reloc..H5...0...6..................@..B........................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):61368
                                                                                    Entropy (8bit):5.16920634776332
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:tDbMiMPamafTxrrRRDwqymTve3FUNiPdDq9GVhF47mppRui4ZFRUlF6ONFVKRbzR:ZbKe5x9yKFIfF05vZMEzPOv8nmkEsvn
                                                                                    MD5:5788BDBDA585E0C5B6944416A11ABE61
                                                                                    SHA1:5F7E478654A9C07DEC538C0FCD3ACC454034A1FB
                                                                                    SHA-256:24FD7D575CA923D078456E158FE746D6B8AA54B6768619959C88F614C3C99CB9
                                                                                    SHA-512:ABA374DA55E3ED740A7EA6D8BB1DBE085D2601B87A66DEFE0601F3B499169AFF191E403B8094CFBEB0390DAE3F32875FC87CA0368CADA5C6E840E5CF73FC306C
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<N.wR..wR..wR......wR...S..wR...Q..wR...V..wR...W..wR...S..wR..wS..wR.;.W..wR.;.R..wR.;...wR.;.P..wR.Rich.wR.................PE..L...~..g...........!...+.v...N......M...............................................*L....@.............................?...P...........<................+..............8...........................(...@...............P............................text....t.......v.................. ..`.rdata..O'.......(...z..............@..@.data...............................@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..E...........................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):153016
                                                                                    Entropy (8bit):5.4756066970469295
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:Gas377uz2TQHGw67H1Iwg4GkeofbKFY7ijpJ6IFg4rtTfis4268nN8p:GaETmrbkeofbKFmEX6IFg4rtT4f8nI
                                                                                    MD5:1BFFCB8973C650E1C974BECF5779E647
                                                                                    SHA1:1EE72809E3CFCA64395FBC5F7ECBF249263B5190
                                                                                    SHA-256:881236AEFC52B7BB88A4CBC69D093BF8C474BE4B56D23E882822C3FC68CE16ED
                                                                                    SHA-512:EAE3B6F8075B7CDFC69E3C1AC12BBDA87E6E4F7118B3D6809AD47580CA08923FDCA0BBA13956054942B627AC9607AAE8BA557D7C1D50FB022070E77C5919C9D8
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F&..(u..(u..(u...u..(u.d,t..(u.d-t..(u.d+t..(u.d)t..(ud.)t..(uOe)t..(u..)ut.(uOe-t..(uOe(t..(uOe.u..(uOe*t..(uRich..(u........PE..L......g...........!...+.L...................`............................................@.........................0...x.......|....`..<............*...+...p......(v..8....................z......@u..@............................................text....K.......L.................. ..`.rdata...g...`...h...P..............@..@.data...."..........................@....idata...3.......4..................@..@.tls.........@......................@....00cfg.......P......................@..@.rsrc...<....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):134072
                                                                                    Entropy (8bit):5.387072189262903
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:EDKE8UEzakHmBY7bcrOU28DA++cfJo8d9nXtEYvSzqu0V8nNVGH:uKE9BvmcfJoix9vSzzW8naH
                                                                                    MD5:21A08E2366058DC7D502AB812CBA41D6
                                                                                    SHA1:30480CFB6663F1DCE72F808AE4C87EC981D0AF6F
                                                                                    SHA-256:BBA2550E780FA3FEE5C885D0FDD17073C2734D6F7D735E99334ECF854CE17A74
                                                                                    SHA-512:E5BB1EB4EDAD6DEF1206322CD0E3419DB5ACF9286B13A99F85EA228EAABCFF07CEBD8E2D1EF6EE7191D01FF93AC899B12490246FBCD767529E7DAEC82F5B22B1
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c5W..fW..fW..f^.f_..fF-.gQ..fF-.g]..fF-.gO..fF-.gS..f...gU..f.,.gX..fW..f...f.,.gT..f.,.gV..f.,.fV..f.,.gV..fRichW..f................PE..L......g...........!...+.....................................................@.......2....@.........................pL...4..d...,.......<................+... .......!..8...................L&.......!..@...............d............................text............................... ..`.rdata..oq.......r..................@..@.data...P............t..............@....idata..I<.......>..................@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc....... ......................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):570296
                                                                                    Entropy (8bit):5.948664328517629
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:ANp/Vjuz0OfVsEfcKDPnYOmyZWftZCfuyq48FK3AN:+/VqzvVsScKDPnYOmyZW+eK3AN
                                                                                    MD5:14BF467CEE974EDAC07D912E828BE068
                                                                                    SHA1:075DD910F4C922400BF0056FDDBC7E228BFA0817
                                                                                    SHA-256:1274CBD4396AB5BBD6F95897FB4A7AE35E79C67E7BECE5E1146219F1CB8BB822
                                                                                    SHA-512:CB5667AA56957FC43169CB36ACA59CC38F5676D35955DF60CE3551B46AF5D15E1B087F36A58CC9DA4860D7E3414CFF6A155AA70FB10B8285599B3C300426754C
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................6...... X...... ....... ....... ....... ......v......]!......]!..............]!......]!......]!Z.....]!......Rich............................PE..L......g...........!...+.............#...............................................V....@.........................`....w...7..........<................+.......0..xM..8....................S.......L..@............0...............................text............................... ..`.rdata..$J.......L..................@..@.data... ...........................@....idata...=...0...>..................@..@.tls.........p.......B..............@....00cfg...............F..............@..@.rsrc...<............H..............@..@.reloc...8.......:...N..............@..B................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):293816
                                                                                    Entropy (8bit):5.816943200456899
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:emR/Ao+J2NG/lsnW4IkA9wtzDziLBzUSTNu5iOnfu5/Zy7eiw8nY:e++J2NG9EW4KVgST05Bfu5/hAY
                                                                                    MD5:5D2F4C55AC1925048D04A99AC238F607
                                                                                    SHA1:6919AFBE0AD23BA764FE1AFECB1593C47951820A
                                                                                    SHA-256:5FEE8635935ED82F35DD3038D1B3C5665EFA09D6C95636A596E1BEAA47A8CCD5
                                                                                    SHA-512:0A9F3D1C1C1F5A410AFD1F9A2F3FE8F434BE50AE38B93D47BC6D152C1AF1937A34E7C309A35117CD421A1310B178E608672E36F0E50422AD71D29C5334399646
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e+..!Jy.!Jy.!Jy.(2../Jy.0.z.+Jy.0.}.+Jy.0.|.9Jy.0.x.%Jy..8x.#Jy...}.,Jy...x.&Jy.!Jx.LJy...|.(Jy...y. Jy.... Jy...{. Jy.Rich!Jy.........PE..L......g...........!...+.|...............................................................@......................... ...d...4D..........<............P...+..............8...............................@............@..4............................text...K{.......|.................. ..`.rdata...v.......x..................@..@.data.... ..........................@....idata.......@......................@..@.tls.........`......."..............@....00cfg.......p.......&..............@..@.rsrc...<............(..............@..@.reloc..b ......."..................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):418744
                                                                                    Entropy (8bit):5.737212943981008
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:JvDSfKpIl9Q0lNdXejnO0oLFo63EwsACnwE8ndr:JLmnejxoB93lEA1
                                                                                    MD5:8CE15A9EBA5F22A190392D0F5C8FA8D4
                                                                                    SHA1:4703DCBDA86AD47793ABF0CDF85505503BED2316
                                                                                    SHA-256:5E00DF02D43FBF15E3ABC4A4077E2271A5B45FA98CA8871C16F64DA74A7F1EF8
                                                                                    SHA-512:7CCCFFB80A777DA3AAA2230BBBE4BC4B602310748D2356D5300B18EE343A68872902CDDA4B7FA445983C54E6144B7A635D8F6C042A28F7D62A26E9E0CB9748DA
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Fnx~...-...-...-.w.-...-...,...-...,...-...,...-...,...-.}.,...-...,...-...-...-...,...-...,...-...-...-...,...-Rich...-........................PE..L...$..g...........!...+.<...........#.......P.......................................x....@.............................TR......h....@..<............8...+...P...0..H{..8...................L.......`z..@............................................text...&:.......<.................. ..`.rdata.......P.......@..............@..@.data....s...P...n...>..............@....idata..6F.......H..................@..@.tls......... ......................@....00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc..97...P...8..................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):163768
                                                                                    Entropy (8bit):5.613246694836995
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:rA4eI/ibUm6gH5S/hlqWo292vCAP9a6ouUWhObi9L73MGM8nNz:rA4eI/ib0/Pfp9oP9a6ouUWhjVcGM8nt
                                                                                    MD5:B6F8E1D66728A176776780AACE684E78
                                                                                    SHA1:487E59BE02659D7929C274CCB5452C1408DADC31
                                                                                    SHA-256:40EF4F94574EC0C78B0CA064857D6AD601BFD0C6EE76BBEFBEB962571DCFE088
                                                                                    SHA-512:A6450E95995D0B224BB2DDC8841AABD081C1765592E147CEBBEA247CDEF8B198FD35BF99BA8C81233816BE191241A1B1907913058F1BCE81712DA5AB4D0DE7F1
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q@..............h.......-......*......+....../.....&b/......./......./.......+......................,.....Rich............................PE..L......g...........!...+............p................................................@....@.........................p...:/...C..........<............T...+..........`...8...........................x...@............@...............................text............................... ..`.rdata...g.......h..................@..@.data...(....0......................@....idata.......@......................@..@.tls.........`.......6..............@....00cfg.......p.......:..............@..@.rsrc...<............<..............@..@.reloc..M............B..............@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):459704
                                                                                    Entropy (8bit):5.8843429786486805
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:gQa8XFpRIiJ/TIdaJ0aX2j0c0qy3wrJOeyIW86zrF7yv6qsUN4vzpX/l/kO30oBK:tXAgcTy3+JOeyIWJr5OnsfDOoBAx
                                                                                    MD5:F79B9FEEBC6E937870E80455714929E8
                                                                                    SHA1:F3D867A4CD60EB1B74C55A5F98DC5C8AC89B4C50
                                                                                    SHA-256:7812EDFB1F45537A1671B38C87898102294BD6B54BDB8DE986653F1A48694AF1
                                                                                    SHA-512:1D2739E0B2DF24BFB555841EE1E933AF66D72D949F055664548FBC5C92BFFFAEA88308C46394C5D277AD31C60E801298FAD5A66AFF24CB3C16A1AA8FE8BF4A5C
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.65o.Xfo.Xfo.Xff..fe.Xf~ [gl.Xf~ \ge.Xf~ ]gw.Xf~ Ygk.Xf..Ygm.Xf.!Yg|.Xfo.Yfp.Xf.!]gf.Xf.!Xgn.Xf.!.fn.Xf.!Zgn.XfRicho.Xf................PE..L......g...........!...+..................... ...............................0.......!....@..............................M..4x..h.......<................+......85..H{..8...........................`z..@............p..4............................text............................... ..`.rdata..8.... ......................@..@.data....&...@... ...&..............@....idata...G...p...H...F..............@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc...<.......>..................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):361400
                                                                                    Entropy (8bit):5.7970258678431374
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:hZUPesuGW6ETgRIiJ/V4dv+f+5NONLTwfCkfFiOoyQW9c2uRh0cQgdoPC11+jfrr:h+zEn0L0KktiOoyQW1uRh0c1aPi+nA4
                                                                                    MD5:1B3F6F21C871A867438D4565238D375F
                                                                                    SHA1:058D5A2487DA51F9D158A96BE1FEDD22A67A5B72
                                                                                    SHA-256:E14C5ABD26C900E7803708F78D9D1A4A02F8B87FD9498099F06EE53EE7984319
                                                                                    SHA-512:A4C9DAC6C72EE953F88DEF8418C9CBF63D27B16ABA5A33BDBF57F269C4AB4C31478F5F88B54CD5BCA15BC117A1A55F07AC06353DF3BA04DA609F815C74973904
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p..@4x..4x..4x..=...>x..%...<x..%...>x..%...!x..%...0x......6x......5x......7x..4x..Cx......2x......5x....w.5x......5x..Rich4x..........................PE..L......g...........!...+............................................................Q.....@..................................3.......p..<............X...+..............8...............................@............0...............................text............................... ..`.rdata...{.......|..................@..@.data........ ......................@....idata..j....0......................@..@.tls.........P.......2..............@....00cfg.......`.......6..............@..@.rsrc...<....p.......8..............@..@.reloc...............>..............@..B........................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):388024
                                                                                    Entropy (8bit):5.841318922086149
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:JZC+cS2s7yEgK5YsHmdH7N0MsfJEWKR+nZdrotLcJeGP0LRIiJ/wVd+zAoaLkBEX:Jcs7yEgK5YsHmdH7N0MsfJEWKR+nZdrt
                                                                                    MD5:81DB2B615AC6F0C2CE8F8B76EC38285B
                                                                                    SHA1:570E647D22AF15F6062B7B3D513F7484F48690A5
                                                                                    SHA-256:BB20CB2D6A459D62641970B610E7BBD5A60785E91563555B9DADB25E001AEAD6
                                                                                    SHA-512:F471E6B7D17B9584F77E3735F042BC4A5627528DBDB4F0FB6607EED7BAA099ACAEBB27D4E33B0D157FE8ED99DE4A3768CFD0C79787D8A4CC57B01184E9FBDF5E
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gw.............~......................................{t.......y......P...............P.......P.......P.....P.......Rich............................PE..L......g...........!...+.Z...j......c........p......................................`.....@..............................M.....,.......<................+.............8...............................@............................................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...@,...P...&...:..............@....idata.../.......0...`..............@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc...#.......$..................@..B........................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):304568
                                                                                    Entropy (8bit):5.741811046569026
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:hq3cVGpiRy1V9cMG7UbPYOkKW47aUuT8nP:hqsVHYXEULjkKWOuTAP
                                                                                    MD5:B0CE0D038C57C68C23ED2DBF56119009
                                                                                    SHA1:CC541DD25882D5BA0501F9241B56B3A59F48FC17
                                                                                    SHA-256:A7E94206E304E2C62CED3B98D4D35F582F08014D645464A2FB532DF35668A3FC
                                                                                    SHA-512:C43D33745FA0CD0C077D92CB877F5E8C41119339FA8C70EE3D89A0BFEA0C7230B52F04498EE17D60406E1B6BC98DD24F47BA661AFEF9CB54987D32A01D5AC8CA
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..r..r..r..5r..r.T.s..r.T.s..r.T.s..r.T.s..r.V.s..rr..s..rYU.s..r..r..rYU.s..rYU.s..rYUYr..rYU.s..rRich..r................PE..L...c..g...........!...+.....p............... ......................................!.....@.........................0...b1..............<............z...+.......)..hK..8....................P.......J..@............................................text...2........................... ..`.rdata....... ......................@..@.data...($..........................@....idata...U.......V..................@..@.tls.........p.......>..............@....00cfg...............B..............@..@.rsrc...<............D..............@..@.reloc.../.......0...J..............@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):254392
                                                                                    Entropy (8bit):5.612868624039746
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:+NDtrPd21OO7zloEtW43CyMj223Ecg7qLzzzAwcj8nl:YDBo1b7zlvlCBj223Ec5Rcj8nl
                                                                                    MD5:C8D92054CD27FEA044D2225E2823309E
                                                                                    SHA1:137C112617895355113E26F60BF539413DF4AB8E
                                                                                    SHA-256:6807FA98B7D65CEF3068BFEBBC4DAF465DD05F985C603D6F53B6EA63BFA95F8C
                                                                                    SHA-512:96BF82CE09F1AB09F04CEF13651DEDF840DFDFDC983AEF11E69FE815C13340D02CB3C43F58FFB4030659F178AC7BFD90F8E180BED67305B9AA4B33672863B24A
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.w.*...*...*...#..,...;$../...;$.. ...;$..<...;$..........(....%..9...*......%..!....%..+....%..+....%..+...Rich*...........PE..L...S..g...........!...+. ..........(........0............................... .......t....@.........................0....<.....@.......<................+......l(..hV..8...................L[.......U..@............................................text............ .................. ..`.rdata.......0.......$..............@..@.data...0{.......Z..................@....idata..S0.......2...J..............@..@.tls.................|..............@....00cfg..............................@..@.rsrc...<...........................@..@.reloc...-..........................@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):1266616
                                                                                    Entropy (8bit):6.056821609098966
                                                                                    Encrypted:false
                                                                                    SSDEEP:24576:xMnq4Z8w/uAH9SyQRQBQlmOlwT7cREQI/CBA5:Yqy8wfH9SySQBQlmCwT7cPq
                                                                                    MD5:6E55401B6E8024FFE8B60326168A7563
                                                                                    SHA1:53A7F127E61E466624E17BA0B4FFB6B1D622D4FD
                                                                                    SHA-256:7DD9B3B68159DAD566B5365FFFC12F7934DA7178DBCDB54B8C706D43D6A4DFBA
                                                                                    SHA-512:C033417B39CC58D56822946E87599D683F57553A10CB5D2032999CBBDFFD777AAA01C304A5C7950FD2CB26AF06EF6423F9F9DB2FDD13FFF12CBD1F45C0D96FB0
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................<......R.....................................................+...w...+..............+.......+......+.P....+......Rich...........PE..L......g...........!...+.....j......$A.......0.......................................Q....@..............................F..t1..........<............(...+.........( ..8....................+......@...@............ ..t............................text............................... ..`.rdata.......0....... ..............@..@.data...............................@....idata...... ......................@..@.tls.................B..............@....00cfg...............F..............@..@_RDATA..m............H..............@..@.rsrc...<............P..............@..@.reloc..{............V..............@..B........................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):80312
                                                                                    Entropy (8bit):4.9190410561731275
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:tQdlRFH2Uzv4w7uIv9rIYWE0D8nudQQZkLIEK+pqw+AkrKnwQIXrq1LXWlF7EHi5:tClRMhIVIQQi9yrmxWlFIVF8nmkEsnT
                                                                                    MD5:1EB71B95EEA1842D1B2DB343965FB890
                                                                                    SHA1:0D0001BBD804D83B078E8B41557D60A9025CD5F3
                                                                                    SHA-256:85A25BBBF4BB103F0F458FD46464773BC8EA4DB9F72B8CA213415FBA7299940B
                                                                                    SHA-512:11AFB8117B65CFDE6D9F59E0D39DF054323DE437D5907FF28E61BB77482584563912B0CBC8BDCDE9460A190350135F477D863F8A0DBB716DEA6EED1293A470E7
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................................0........0....0....0.....0....Rich..........................PE..L...0..g...........!...+.....|............................................................@.........................0................`..<................+...p......X...8...........................p...@............................................text...{........................... ..`.rdata..)1.......2..................@..@.data...p...........................@....idata... ......."..................@..@.tls.........@......................@....00cfg.......P......................@..@.rsrc...<....`......................@..@.reloc.......p......................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):112056
                                                                                    Entropy (8bit):5.314734121461341
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:yL2yIaAGTZCktA4MdS8/1bPGakBbRB+BTq5DXjFpoq+8nNtd:VdGVJ18/1bPGakBbRB+BwXjFpoq+8nh
                                                                                    MD5:013C65C7F6BE7E2CD8E078C50DCA57C3
                                                                                    SHA1:B3B544D11AD448B75EEFE47641220BDB9FF71561
                                                                                    SHA-256:BF2F5F214F8FAC2B42B35D11F80A50FCE153068D4C6B44FA4629611497DEB31B
                                                                                    SHA-512:082DA940FE5101655D79695D782FF70BB3E298A02E43E96FF6CBE14240B054A5706C01502160118040CCB1B9F9938FF04444A3B10A50ED2F469FD36AE31E8F96
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~#I..M...M...M..g....M...I...M...H...M...N...M...L...M.amL...M.J.L...M...L...M.J.H...M.J.M...M.J.....M.J.O...M.Rich..M.........PE..L...>..g...........!...+............................................................/.....@.........................p...e....G...........................+..............8...............................@............@...............................text............................... ..`.rdata...N.......P..................@..@.data........ ......................@....idata...M...@...N..................@..@.tls.................j..............@....00cfg...............n..............@..@.rsrc................p..............@..@.reloc..z............v..............@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):332728
                                                                                    Entropy (8bit):5.815268329187453
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:MTWUduPZuD07RIiJ/ApdbB2tW41gP1wxQ9pzOjywWXLvo8zQWbJjhzpMCuE08na:FP1+PmxQTzOjywWThaAa
                                                                                    MD5:F344935226E0363D96EC15A627DA7753
                                                                                    SHA1:1C59F7D7A8F8B236B25ADE5CC14DFCD3F8BFB58B
                                                                                    SHA-256:294D4369BB092DEDA54AB8A72CD084C8F6240FF27379173FC253A51E2BC25FC5
                                                                                    SHA-512:F44DBD169CB6317EA46E54F7B06352BDF8FAE92FDCEBC4592E4A1EAD66F62F4BCB6F09C39543A5FA3FFCC93E5A5C60A272D90537721FDF215523115A7AC4A522
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Na....w...w...w..x....w...t...w...s...w...r...w...v...w..rv...w..v...w...v.\.w..r...w..w...w.....w..u...w.Rich..w.........................PE..L......g...........!...+.....6......i........................................P............@..........................F...i........... ..<................+...0......@...8...........................X...@............................................text.............................. ..`.rdata..............................@..@.data...............................@....idata..x...........................@..@.tls................................@....00cfg..............................@..@.rsrc...<.... ......................@..@.reloc..:....0......................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):583608
                                                                                    Entropy (8bit):5.8961212002978325
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:yOdGw8h8MqpJ62asC0YhRsOhy6WOJm7Z2nL64Jg4nAU:+Z6C0YhRsOhy6WYu47nAU
                                                                                    MD5:A08E185332EE77436E0AA38F1E18F38E
                                                                                    SHA1:6B2ACD1A6CF4D83900A6F6BDAB48AF0D1C585F33
                                                                                    SHA-256:897E1218E75094F419AA34156F5084C7240EF0940BAD51298817D025054F626C
                                                                                    SHA-512:E18FA8B3B1D41077ACCCA340731BE4C1E5A1DC82049F755B0A4CE6FA0AD7B82EF13C71C9C77BF5FE0C9378C72EA5B0908EAFFF89B53CBD9EA08BB29480378DBE
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X.z.9.).9.).9.).A.).9.)...(.9.)...(.9.)...(.9.)...(.9.)wK.(.9.)\..(.9.).9.).8.)\..(.9.)\..(.9.)\.t).9.)\..(.9.)Rich.9.)........................PE..L......g...........!...+.X...f.......!.......p............................... ......`y....@.........................@....7...+..X.......<................+.......I......8...............................@............ ...............................text...|W.......X.................. ..`.rdata...U...p...V...\..............@..@.data....H.......D..................@....idata...e... ...f..................@..@.tls.................\..............@....00cfg...............`..............@..@.rsrc...<............b..............@..@.reloc..;S.......T...h..............@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):100280
                                                                                    Entropy (8bit):5.094522056117144
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:dWktxjagLfNnPOP5fF6xbqToJjK0H7cGsY8nmkEsRb6qa:Yktxja0NnP3k4H7cGsY8nNAqa
                                                                                    MD5:845CEF3117862B234147F0C180D1FB4E
                                                                                    SHA1:787F603C0F7AC129EB360416386FA37E7212A2BA
                                                                                    SHA-256:C57C70378C80C1312E1C7A7423F831E28D1891A7887DF783C9E4134D9ED296A2
                                                                                    SHA-512:E59E4DB39E59866F1F052FC84E392D1AF021EE1E3532FAA97DA3914E00B91A0D2C3F730EC1066A0191664166CF80FBAE20FE426FE076ECF68B2E556DF1F2E3B2
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................e......).......).....).....)......i.......B(.............B(....B(......B(......B(......Rich............PE..L......g...........!...+............................................................R.....@.........................@........S..........<............\...+......<... ...8...........................8...@............P...............................text............................... ..`.rdata..@N.......P..................@..@.data........0......................@....idata..;....P.......*..............@..@.tls.........p.......D..............@....00cfg...............H..............@..@.rsrc...<............J..............@..@.reloc..7............P..............@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):91064
                                                                                    Entropy (8bit):5.067524010638469
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:stb+cVRHVoeFU/tjqXS2c+CmGduTw7L3Yyt8nmkEs+7:+b+K1oiVc+Cm5Tw7Lt8nNq
                                                                                    MD5:78326BBD040AC0313BF03FAEE21F8BDD
                                                                                    SHA1:16688BB42FFD326DADCE1D1FB2697D1E417EE968
                                                                                    SHA-256:930830D3784C886561DB1CF12C2C034DA312E21A8386AF25BF566AD10770C226
                                                                                    SHA-512:6622576D2FEAE153BFA7F5CB976BD7A05A1183BAFA8B31D8A2E0C4E6A4FD862878BD8A63502D4AF08BBA5678CB7A9D6FB5E3CEF2C01F8689D4C072397179D0FC
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..;'..h'..h'..h..Vh#..h6O.i&..h6O.i-..h6O.i3..h6O.i#..h...i%..h.N.i4..h'..h{..h.N.i$..h.N.i&..h.N:h&..h.N.i&..hRich'..h........PE..L...>..g...........!...+..................................................................@.........................@........4..,....`..<............8...+...p..........8...........................0...@............0...............................text...$........................... ..`.rdata...6.......8..................@..@.data...(!..........................@....idata.......0......................@..@.00cfg.......P.......$..............@..@.rsrc...<....`.......&..............@..@.reloc..r....p.......,..............@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):148920
                                                                                    Entropy (8bit):5.348006042783025
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:PCYpECCAA4m/P8Qcdb/oM394CucfPZX16FdXD/ky2Ic8nNM:6RCCd4m/P8Qcdb/oM39ZMFF/ky2Ic8nq
                                                                                    MD5:23325DA205F89A16524787537268B796
                                                                                    SHA1:7E4064CED3EFEEF8CF5D8AD44B879DB0D1BC128F
                                                                                    SHA-256:8D40AB44B505185E35330FE9BCE803380B4ABDCFFE404996832BCC1A5DCBD2DD
                                                                                    SHA-512:19921880E00A91D22FC25E0D0CCEB07A4B77E2FFF6FE22864972B81DB5772BA6D72BAAA999DBB7B40C9F082A8A09589110D6F23678FC08E23E36A205FF0DE951
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..=..}=..}=..}4.b};..},..|>..},..|7..},..|+..},..|9..}...|?..}...|,..}=..}...}...|>..}...|<..}...}<..}...|<..}Rich=..}................PE..L......g...........!...+.....................0...............................p............@.........................`t...6......,....@..<................+...P......x@..8....................D.......?..@............................................text............................... ..`.rdata...{...0...|..."..............@..@.data...0>.......8..................@....idata..2".......$..................@..@.tls......... ......................@....00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):198072
                                                                                    Entropy (8bit):5.506024781499341
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:4YE+oBNPADlon+JD3t5Kk6mg1z6mAVRA7QZo8nx:9E+WNYDrJD3t5KrFkRA7Ko8nx
                                                                                    MD5:33CA3A35F445CC5734C55E08687F3B0F
                                                                                    SHA1:61E72D7D37AD2379E37B56ECFE2C4187B379EFDE
                                                                                    SHA-256:23E6378FE32457F336B347D356644F1F6C929DAFBBA71B0DFBBA551A258E6F97
                                                                                    SHA-512:6220ADC020A0AB7953A8F3FA006450F33DBC648A0E20166ABA0E30DEEE99E8379B7A6080A6F0452E5696030BE4F38E9601280B43A9797711FF7AA74DA37BA172
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x].....................W.......W.......W.......W......F.......mV..............mV......mV......mV......mV......Rich............................PE..L...!..g...........!...+.....*...............................................@.......T....@..............................U..(...h.......<................+... ......H...8...........................`...@...............(............................text...[........................... ..`.rdata..............................@..@.data....0.......,...\..............@....idata..B........0..................@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc....... ......................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):123320
                                                                                    Entropy (8bit):5.356556659850187
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:AJvzolLTt5vlTuN6Qs5g9yZcTLOKwLjJEkdr6i32HAfJp308nN5:A1clL109JKqkdr6i32HAfJp308nL
                                                                                    MD5:BE5CDA7F5B6F4CC2B0CFC1CE701822DF
                                                                                    SHA1:9386259799563F60000020ACC1778998F39E023F
                                                                                    SHA-256:A9B042E41535CA398C0F5F09808A03ED01D8F003197F1A1E0E380534A8A66972
                                                                                    SHA-512:E4047044A6C83071466E2DE56881EA39F7A129176DDE96DF286651A4B500D12C43B487608A18B56EB93010829AE92294E3EBC4A502C383DD273D62851E5F7813
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@...!.A.!.A.!.A.YhA.!.A..@.!.A..@.!.A..@.!.A..@.!.A.S.@.!.A5..@.!.A.!.A.!.A5..@.!.A5..@.!.A5..A.!.A5..@.!.ARich.!.A........................PE..L......g...........!...+.....................0............................................@.........................Pg..................<................+......<....?..8............................>..@............................................text...\........................... ..`.rdata..jU...0...V... ..............@..@.data................v..............@....idata..?...........................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):58808
                                                                                    Entropy (8bit):4.864972360542397
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:jtCZbNEZj/nw+Y/mKP8oMx0SDlXKWZ3lYbpwK6QNynss2m/8E9VFzSJIVGjuB8YX:Yj8xllXpJ8nmkEsg84
                                                                                    MD5:12DD31B91757E2BA3299048C3C8178B8
                                                                                    SHA1:AEEB8C23282008CDD2BBB3A54233722CE4CE53E9
                                                                                    SHA-256:8739B560E2024E094E8BD883D975ADA136B0E8A897C81BEA41D1EC760B053515
                                                                                    SHA-512:DBD0EBB59AD9F8830B7C9C585C9DE8626EDDC6F2183563DD2CF157CA184E3DCF67400977B902F746C52442A0DB20947C4AC3961C4FD3E7CB9D27BEAFD2D29149
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>J..P...P...P.......P..:Q...P..:S...P..:T...P..:U...P.F.Q...P.m;Q...P...Q...P.m;U...P.m;P...P.m;....P.m;R...P.Rich..P.........................PE..L...9..g...........!...+.`...\......5........p.......................................{....@............................................<................+......P....{..8............................z..@............................................text...K_.......`.................. ..`.rdata..v(...p...*...d..............@..@.data...h...........................@....idata..............................@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):50616
                                                                                    Entropy (8bit):5.1269095529295345
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:EIA1G77OVp/RpUu/LfVkTXiyWVBIUDI7VAf6MribXGL6Ew/z38UdjpwK6QNynssw:BAh/RpUujfVkbqVbIZ2ib75o38nmkEs7
                                                                                    MD5:F9B23B5FD88C2C749C20AC49393AD86A
                                                                                    SHA1:90D72CD55702D4545E6111F09AA73264EBA8A8B1
                                                                                    SHA-256:B854D27BAD3D2A7378D8E3B27F6B40ED54DF28EE5CCD4C91AA7034601A684656
                                                                                    SHA-512:2ECD1C6B994832805EBEF34B09B434B05EFD77840A667389980424FC4B8B8B4591A2C3DE0B42270355EA24AB02C6E38E737F680EF4F79F62861A36198D39944F
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P.a...a...a..../..a......a......a......a......a..3....a...a...a......a......a....C..a......a..Rich.a..................PE..L...r..g...........!...+.V...D...............p.......................................B....@.............................h..............<................+..........hz..8............................y..@............................................text....U.......V.................. ..`.rdata...!...p..."...Z..............@..@.data...T............|..............@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):340920
                                                                                    Entropy (8bit):5.80312440072389
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:ozMoXbKkj5y5JVRIiJ/uddQVBljYd6EbwlLzR+O+yIWol6No+El8n7:GKkj5y6YEMlL9+O+yIWXi+wA7
                                                                                    MD5:F7DB33D15034C8BF471D018CC7E01379
                                                                                    SHA1:BC5C482E9482DC46104315761FE6DE79DD92ED06
                                                                                    SHA-256:009E9F5627C7B715470123B9C0A81DEFED96DA142793F969425B65436889BAFD
                                                                                    SHA-512:672DBDE946805F7470D6348E147B825AB76EF832E08E7220037EDADA5FEAAF57991D401EE55C1FE5917659B5EE2C8D82A72C7D89572ADFFED4FADCE1EB79FA83
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.4.#.g.#.g.#.g.[Ug.#.g...f.#.g...f.#.g...f.#.g...f.#.gOQ.f.#.gd..f.#.g.#.g.#.gd..f.#.gd..f.#.gd.9g.#.gd..f.#.gRich.#.g................PE..L...@..g...........!...+.....................@...............................P.......d....@.......................................... ..<................+...0..........8...............................@............................................text....-.......................... ..`.rdata.......@.......2..............@..@.data...@...........................@....idata..y...........................@..@.tls................................@....00cfg..............................@..@.rsrc...<.... ......................@..@.reloc..5....0......................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):471480
                                                                                    Entropy (8bit):6.1655046925328545
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:w9aRIiJ/pPzd7AO1u121j9wP0t5VOzyEWcvVzPKKZknLxQlz6CeD25xDkaFwX8Ai:w4yAjWP0zVOzyEW6CUdboAF
                                                                                    MD5:451F3971986C574C80118E025D3C66AF
                                                                                    SHA1:E6F3F96B1E3206ACF4129288D139FA3FAB4A0CD4
                                                                                    SHA-256:1DA4481B4E09189486866391E8644CEF26DC98B331FE2D7A2F2D2C922EC18A2D
                                                                                    SHA-512:484AD400BD897DD6AD0B9A6FF2BE79D537040F07483BF0F81A58698EEBFCCA9FD0B522E2AC8FA6AC6E0A84534B7B76F19D4C8FDD54CA715BC63ACB5FEA96CEF8
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~Y................4......4......4......4............-5........%...-5.....-5.....-5.....-5.....Rich...........PE..L...1..g...........!...+............B........................................@......7.....@..............................5...............................+......._..@...8...........................X...@............p...............................text...{........................... ..`.rdata...M.......N..................@..@.data........P.......@..............@....idata...9...p...:...X..............@..@.00cfg..............................@..@.rsrc...............................@..@.reloc...k.......l..................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):169912
                                                                                    Entropy (8bit):5.457630566080372
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:V5XBVBdfqhUG3wlDjx3KyT4u+cGTNjM7zp+BfKqtdwzcjeENldx8nT:V9B/dfu8R3KyTob1BLw7ENHx8nT
                                                                                    MD5:829DACEFDF01B2B089BE3761E25FE4DB
                                                                                    SHA1:5D87B3D62396A07C409C6FBAAA25E07156D01349
                                                                                    SHA-256:ABE666E92080DABBB2DDF7025BB2F1CC027B23A1615CF6E8A12533E40DD5DDE9
                                                                                    SHA-512:1F6FDAF24218E1CFD2AEB475E1607812D252E541C880E8D081EBA627DB54E8B436938CBA51408E00B34DEB19A45D8A2205DA7E21AEB57012322EE40959F2AA8E
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(G.I)..I)..I)..1...I)...*..I)...-..I)...,..I)...(..I).Z;(..I).q.(..I)..I(..I).q.,..I).q.)..I).q...I).q.+..I).Rich.I).........................PE..L...i..g...........!...+.v................................................................@..................................U..|.......<............l...+..........(...8..........................@...@............P...............................text....u.......v.................. ..`.rdata...p.......r...z..............@..@.data....1.......,..................@....idata...*...P...,..................@..@.tls.................D..............@....00cfg...............H..............@..@.rsrc...<............J..............@..@.reloc...............P..............@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):113592
                                                                                    Entropy (8bit):5.3659115647771145
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:MgwoUqzz4KqoOt3KJHBhFjnu8xRJ+2SBrhUANhMGN2GMRJ38nmkEsw9:ZgqzK3t3cTfxRJ+29GN2tP38nNy
                                                                                    MD5:1058C83FA694C31E10976C94E827B17A
                                                                                    SHA1:91B4DE04D35A99A66055EB33B2AB4D7D96D9D306
                                                                                    SHA-256:784E58CBDF1DB9429A1F021E21800A7C4CDD7F61FC9F6E26E56741BC3F1DA34F
                                                                                    SHA-512:A89D0E75B79D2B90C0AF1799C7CA83B40711560D8E0EB069BEDC39161C8F93FCE5C042690C9C92947EFC5F81A510C49F8CBA7B95576D42ABB88621B12A678AB7
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6.SUWx.UWx.UWx.\/..QWx.D.{.WWx.D.|._Wx.D.}.FWx.D.y.QWx..%y.WWx...y.\Wx.UWy.,Wx...}.\Wx...x.TWx....TWx...z.TWx.RichUWx.........................PE..L......g...........!...+..................................................................@.........................P....@..............<................+......\...p...8...............................@............................................text...8........................... ..`.rdata..in.......p..................@..@.data........p.......V..............@....idata...............^..............@..@.tls.................x..............@....00cfg...............|..............@..@.rsrc...<............~..............@..@.reloc..N...........................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):115640
                                                                                    Entropy (8bit):5.244904575230372
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:k+6CweTVjTGCLNDP4PEW7XrXr4jaT1A5nh8nN8:kdCbLB4PEW7Xrb+aT1A5h8nm
                                                                                    MD5:4813F824586F497C511F1469781A411C
                                                                                    SHA1:0487AC9D3285F5CF8C86D2A54689077EF5155BF3
                                                                                    SHA-256:3B51EB144BBAD8D481B00B1A83F73ADFA04040296A83EA700B7001AF9BBE59D9
                                                                                    SHA-512:FBF4C670CBE19E6ACCD7FF41CE18D807ABF53EC618604887A51EC55161F8F8386C96651BF055E05DB47FD6C8105ACC5AADC44977D5389974818BFAED6FB44EAC
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u\..u\..u\..\..u\.}q]..u\.}p]..u\.}v]..u\.}t]..u\+.t]..u\.|t]..u\..t\..u\.|p]..u\.|u]..u\.|.\..u\.|w]..u\Rich..u\........PE..L...3..g...........!...+..................................................................@......................... C..................<................+..............8...................."..........@............................................text...x........................... ..`.rdata...N.......P..................@..@.data...0....`.......N..............@....idata...............b..............@..@.tls.................~..............@....00cfg..............................@..@.rsrc...<...........................@..@.reloc..'...........................@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):304568
                                                                                    Entropy (8bit):6.01092677721372
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:EVEoUIgNrqRIiJ/KPd76yyFgND9XsWKv9rOTyfWPkc9NF6+H4Zsj8nJ/:Qx+J9cWKFrOTyfWn9XVjAx
                                                                                    MD5:243C358DC52E195AD0150C6AAF8B0C9E
                                                                                    SHA1:5B7DBC647F65330CF6EE440258555BE0C378C4D4
                                                                                    SHA-256:FF78BFDCF5EEE02CCDDE9DC1070FBF3BBA60B2C2C333DA7A8A5CE0FCCC063F3D
                                                                                    SHA-512:CA4BEA326D1EF2D0945816A69C1B9656F9401764FA346498E802F64E6A0850EEF47A757CA4E482FF1EB0ABD7D70B1A267E7E8ED078ABFCD3DEE692A4C55C1A91
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."@.."@.."@..@.."@..!A.."@..&A.."@..'A.."@..#A.."@{.#A.."@P.#A.."@..#@."@P.'A.."@P."A.."@P..@.."@P. A.."@Rich.."@........................PE..L...r..g...........!...+..................................................................@..........................5..O....b..........<............z...+..............8...............................@............`...............................text.............................. ..`.rdata..?...........................@..@.data...l....P.......@..............@....idata..X....`.......H..............@..@.00cfg...............^..............@..@.rsrc...<............`..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):128952
                                                                                    Entropy (8bit):5.415314204978196
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:9QGdv1joXaDStC/ZWTbA0+J/4vbP5oxd5PN/K6T8nNm:WYGaD26WQ0+J/qbG06T8n8
                                                                                    MD5:A415ECCB97376F354772EF8D906777F9
                                                                                    SHA1:668F1393FDD6F5CDFA419C562E1BF7992F877D22
                                                                                    SHA-256:3B249D3FEC63903F2C4ACEEA8121B87A08A1D1CC1A8AB089A3070DBE36EAF300
                                                                                    SHA-512:3320710BCAA16A02DA5369FD4230BA573507C8A8C30E7EA04C9B828BF3763A9302F6F5F7FFCD24BC674642884D1F5543F77B1B65F8863430F7E09F4D3F452C1D
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........".C...C...C...;...C......C......C......C......C..~1...C..U...C...C..&C..U...C..U...C..U.p..C..U...C..Rich.C..........PE..L...r..g...........!...+.,...................@............................................@.............................F..............<................+...........V..8............................U..@............................................text...G+.......,.................. ..`.rdata...U...@...V...0..............@..@.data...............................@....idata........... ..................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):101304
                                                                                    Entropy (8bit):5.165290292625666
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:73WE2ePSAcBHfoaueF7AkmJrrqWLeVwfL8nNMTM:73WE2eheF7AkorrqWLeVwfL8nOTM
                                                                                    MD5:7B37C1E5D3F1664BDEFD9DB1CAECD1D1
                                                                                    SHA1:C52D9CD090954A958449366974D6CF0DA2615B37
                                                                                    SHA-256:1CB269992F44EC9C78ECA3BE68EEB1B3CE579F699896AD0FFEA8D57F830A4BCB
                                                                                    SHA-512:5980DB2374C74301677F220A55351C2816CAA4F42F28F13A1A54C96C6C1553867B2648350793C614CBAB7267EE03503B67945C060B641FD39C3EC395CC8BD873
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~r..............g..................................3m.....................................................Rich............PE..L... ..g...........!...+............................................................5.....@..................................T..@.......<............`...+......,...(...8...........................@...@............P...............................text...E........................... ..`.rdata..dH.......J..................@..@.data...`....0......................@....idata...%...P...&...$..............@..@.00cfg...............J..............@..@.rsrc...<............L..............@..@.reloc..E............R..............@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):2079672
                                                                                    Entropy (8bit):4.946178718555606
                                                                                    Encrypted:false
                                                                                    SSDEEP:49152:ogdOCx+yN0HZ9CTPZIeZcOrHdbm/7Krxcis3QT51btp9Tz1adXzp:JECx+yN0HfCPZ9ZcOrHdy/urxcis3QTU
                                                                                    MD5:01A4F76EAB2AB9AE5E84BD9F3A50AF6B
                                                                                    SHA1:D2B8CC7E62F4CADC6DD8372F4CCBF019BBF0911C
                                                                                    SHA-256:B8B861F9D207CB821676E14DDA468C8FB2B52DA4FB703154A5E599A06CD439B6
                                                                                    SHA-512:2767BE6349C8C4F02DE1E2D47B6B0A2ED27F26020652DCD008BA66061C41794B275EC490B93737E7E3A84A94786C902C2FBB21521B90C5090F9C522667706BA0
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...qp.qp.qp.x.^.up.`..sp.`..{p.`..bp.`..up....sp....vp.qp.Dp....tp....pp...2.pp....pp.Richqp.................PE..L......g...........!...+.4...^......I........P......................................*. ...@.........................pm..z...P............................+......0...p[..8............................Z..@...............P............................text...T2.......4.................. ..`.rdata.......P... ...8..............@..@.data........p.......X..............@....idata..C............^..............@..@.00cfg...............l..............@..@.rsrc................n..............@..@.reloc..a............t..............@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):513464
                                                                                    Entropy (8bit):5.948756763934595
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:QOnYZCEKnGuxR73OjyZWL2lpszwPNPbcnoUAi:QeY6GuxR73OjyZWVzwPNPbcnZAi
                                                                                    MD5:5F2A4A67DB1C5D8612AD42D63EAAA5A8
                                                                                    SHA1:C3D04BCA1C481C3834FFC928D8156E1ECB1D215C
                                                                                    SHA-256:7F83F4D80CB566F929C63BAA68CAC9A06ECEE9ACD32AC25E62563B96FDD36743
                                                                                    SHA-512:5D57F9A2DBC088C794BBF4492826F363D11364AFD10CB41AB8521B517CF87B93CB852B51318801C616788D9B59B59E73A03F9F4965C7F7A5AF9E338322C9B096
                                                                                    Malicious:false
                                                                                    Antivirus:
                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O4.5.U.f.U.f.U.f.-wf.U.f...g.U.f...g.U.f...g.U.f...g.U.f.'.g.U.f...g.U.f.U.f4T.f...g.U.f...g.U.f...f.U.f...g.U.fRich.U.f........................PE..L......g...........!...+.....P...............................................@............@.............................R..|h..@........................+......`H...@..8....................F.......?..@............`..|............................text............................... ..`.rdata...G.......H..................@..@.data....\..........................@....idata...J...`...L..................@..@.tls.................L..............@....00cfg...............P..............@..@.rsrc................R..............@..@.reloc...Q.......R...X..............@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):334264
                                                                                    Entropy (8bit):5.802007855706472
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:/rLO6RwKeuCxmO+RIiJ/vLdPj3TRQNBYywznalNOeyrWYqDZQ19xMcRaRZw38nuy:/rdCxZL7YnznWNOeyrWlZQf3AAW
                                                                                    MD5:96E3CDAC2E09D468B51C69A3B82A3844
                                                                                    SHA1:E33A7A0B47E0EA255D0ED8BD0A63D229E9B0673C
                                                                                    SHA-256:747BFF71CD9ADD3C57A1A076C0AEC49273A3F63C4B8EA9C38482D2810EBA579B
                                                                                    SHA-512:06E1C0A7AC7930F480FD00CCE7AF3A7DE49C5C48D687D87E753112FAA815D7030A19F585F6F672FF8E44B3A114699CC4EF18EA2C94E7889F471513F04EA89DD3
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.n......................^.......^.......^.......^.............._......._.............._......._......._......._......Rich............PE..L......g...........!...+............\........0...............................@......d.....@.................................x...........<................+... .......}..8............................|..@...............x............................text............................... ..`.rdata..Tx...0...z... ..............@..@.data...p...........................@....idata...".......$..................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):151992
                                                                                    Entropy (8bit):5.370358673387942
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:g8tNZBthD6WpdXpOvXkVMeO5m85/D28nNE:TtXBthLXyXeMeOF/a8nW
                                                                                    MD5:A8CE7398A7798597D94E1692D1A190CA
                                                                                    SHA1:A2B266F2F097F426AC90AE5FF591647D290A8E6C
                                                                                    SHA-256:40B5662F9BF0FA782CD9E6F18B2F1A846FBA9DCBB9E3DAD1ADC5E9466C2D3FB0
                                                                                    SHA-512:AF8A13A783857CACF9A240634E07B3099B8B9993D0179D2AB01399055363F9148496D7FD8D8581B14C5332721A1D645F10AB5F76CDF950F17A251084198B04F7
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............c.D.c.D.c.D.._D.c.D...E.c.D...E.c.D...E.c.D...E.c.D...E.c.D4..E.c.D.c.D.c.D4..E.c.D4..E.c.D4.3D.c.D4..E.c.DRich.c.D................PE..L...s..g...........!...+............D........0...............................p.......)....@..........................w..s$..h........@..<............&...+...P.......B..8............................A..@...............h............................text...:........................... ..`.rdata..#l...0...n..................@..@.data....Y.......V..................@....idata...'.......(..................@..@.00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):93112
                                                                                    Entropy (8bit):5.107765821311403
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:eI+CAiOcpyVx5atP9nlyer5R3+WRuc6i7dUNZqQPUq3zULu897+4qM1nmYK/9Kw7:e8yHMj+68n6c
                                                                                    MD5:CE0C3F0F49C65A5B107F5223ECC4C366
                                                                                    SHA1:74CF3EDB9C4434D63C0E87EE13F5DBB9F238F1CB
                                                                                    SHA-256:27F1B4C2B60B13905E159798245E178A10AF3378FBD42DBA2F6131ED8E0A8CFC
                                                                                    SHA-512:D6E7D49E61B5D73583E19C9DC937605892504636A174473E0EF8FD41C9FCC66006FA7C63175DB4808417F3D9C3E7FCA3719FE52B42D41955F877E3B390502326
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m%. )D.s)D.s)D.s <!s/D.s8.r+D.s8.r#D.s8.r?D.s8.r-D.s.6.r+D.s..r8D.s)D.sPD.s..r(D.s..r(D.s..Ms(D.s..r(D.sRich)D.s........PE..L...P..g...........!...+.................................................................@.............................)....4..,.......<............@...+..............8...............................@............0...............................text...v........................... ..`.rdata...?.......@..................@..@.data...............................@....idata...!...0..."..................@..@.tls.........`.......(..............@....00cfg.......p.......,..............@..@.rsrc...<...........................@..@.reloc...............4..............@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):154552
                                                                                    Entropy (8bit):5.364460568827147
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:evpMYjj/O672FKlekWGdGRrPlpIPCxVAd98nNzC:wpMYEyWGdGR0Aev8nI
                                                                                    MD5:1EBBBA7756C6AAE99CBB3C44764ECA68
                                                                                    SHA1:BBC6E6D85443B9676C63F279CBCD9F898EF1830B
                                                                                    SHA-256:8A7E149F836DD3DDA536ADF007B6E4C786EAEA77B3236D061B14CCB560129FA0
                                                                                    SHA-512:AAC87A4DDB3497CAB14E03AFE57AA94F3641290C537F3DE028AD969CE1017F63218783EFD603E3BB1FCC5F183A715DBC377448030D509790553B7C7E4A00800A
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................4....>.....>.....>.....>.....w.....\?............\?.....\?.....\?X....\?.....Rich............PE..L...|..g...........!...+.j..........................................................q!....@.........................@.......@$..@....`..<............0...+...p..........8..............................@............ ..@............................text....h.......j.................. ..`.rdata...b.......d...n..............@..@.data... %......."..................@....idata....... ......................@..@.tls.........@......................@....00cfg.......P......................@..@.rsrc...<....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):265656
                                                                                    Entropy (8bit):5.588628994965551
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:Bf6hReGR6i4jOZe8+H4cAbVwloz/mIbYfk/ArFVQVjVVVqbuLnJF8VYz38nj:Bf6mdi4aZelH4cAbdDSfkY9wJFLz38nj
                                                                                    MD5:D9FA251C239AAE0C3EF4A61849DE7B15
                                                                                    SHA1:38B449180D5BC59F61745F4E79FC04A8222D4CED
                                                                                    SHA-256:0EDF6D110549D0B879301C7EC93BB51093864FABC1B3B1D063D3713A25F75884
                                                                                    SHA-512:0B7FC8E5978BAE4CE342FCDA0CBE3C1B9003F3F3F86B3C83222A147E864DF1D3A4C562655453BFC0A78B92C236B46C1DE27881B6854733D3833D504E0CC15D5A
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b7.C&V..&V..&V../. ..V..7..$V..7..,V..7..0V..7.."V...$..$V.....3V..&V..^V..... V.....'V....L.'V.....'V..Rich&V..........................PE..L... ..g...........!...+.^...................p...............................@......u.....@....................................h.......<................+... ..0... ...8...........................8...@............................................text...L].......^.................. ..`.rdata.......p.......b..............@..@.data...x#....... ...v..............@....idata...#.......$..................@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc..>.... ......................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):60856
                                                                                    Entropy (8bit):4.92610415853725
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:bLD1In2/2NQeYaQy32F1ic7wRCm5saoymwRAa+KpwK6QNynss2m/8E9VFzSJIVn1:bfABYm4fwyz8nmkEsr/4
                                                                                    MD5:71F4493929E834A7A5D1FEAEE568D59F
                                                                                    SHA1:11AC1F6CFE1B634D548E8A51ED3D644B3EA3A046
                                                                                    SHA-256:1E2A6EEA3074A6FE2337D108EB1C15EB4B82CAB3BC73E570C5D5222B333BCB25
                                                                                    SHA-512:4E8DC3BCA2B11610171C189FDE54A169F2DF40EB4E081635F5E49DA4C19DCE5821B90ACC5DCB9DFA59BE014C3CB5B2C0524A7BA2D8A19617D9DD7DCCB4AABE54
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c............zC............................"p............................../..........Rich...................PE..L......g...........!...+.d...^......D........................................ ......?.....@.........................p...Q...............<................+......h.......8...................L.......(...@............................................text....c.......d.................. ..`.rdata...........0...h..............@..@.data...P...........................@....idata..6...........................@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):78264
                                                                                    Entropy (8bit):4.897794311721318
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:vBUfxHhMV3l10nBFDCMQxs3xccdl0N8nmkEs5c:ZUfP03l10nLm/a/d+N8nNa
                                                                                    MD5:E99DEE63445AD9AA873EA586A53452E5
                                                                                    SHA1:EAE2EDC5D56BD6F4F048AC1F025AD21A1950068C
                                                                                    SHA-256:5217A3D8917E2517A50CCBB22F4AE71629B1F30A935F70DDA545B5463727B2D8
                                                                                    SHA-512:7D0A5C5220F06C2B237BA839F6D550FC6A723B113BB7E1AC0A838C752E0C98DE5C15E200E6665BECCF5EDFA760081E3363B0D7055124BFA2C320482023BC8EB5
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........I...I...I...@...O...X...K...X...C...X...\...X...M.......M.......N...I...........K.......H.....}.H.......H...RichI...........................PE..L......g...........!...+.....j......M........................................`......V$....@.........................`...\...$........@..<................+...P.........8..............................@...............$............................text............................... ..`.rdata...-..........................@..@.data...............................@....idata..7...........................@..@.tls......... ......................@....00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc..X....P......................@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):105400
                                                                                    Entropy (8bit):5.159830897136034
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:5rJknAbC+Ib+W+VLYkTBp2CgVoZkzQotYnsFFrCpFwgDVSt7NIx+Oz8nmkEsq:5lknAW1+W+VRTBgVyIQYG8FSYcJz8nNq
                                                                                    MD5:431D45F5059184022706CFE31B07C05E
                                                                                    SHA1:9C8789032056A87789C813EACCA5DE009375AF6E
                                                                                    SHA-256:2B23C0D4BD40E778B48DC04EC79F3D76D6551EE9E7F10700BCB61B7199D86FD6
                                                                                    SHA-512:1F25646EC82E6D5C70004FF710C39BA6D2241574ADAE7BFA3CA9B3E2ECED7F67FF7C358252932D15DCBA8C2FD2B60D0447E13FD6788A51BBE65E961F81209126
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|?{..Q(..Q(..Q(.e.(..Q(..R)..Q(..U)..Q(..T)..Q(..P)..Q(=oP)..Q(..P(..Q(..T)..Q(..Q)..Q(...(..Q(..S)..Q(Rich..Q(................PE..L...r..g...........!...+............i.....................................................@.........................P-......Lr..........<............p...+......D...h...8...............................@............p..L............................text...g........................... ..`.rdata...G.......H..................@..@.data...@....P.......6..............@....idata.......p.......H..............@..@.tls.................X..............@....00cfg...............\..............@..@.rsrc...<............^..............@..@.reloc..&............d..............@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):213944
                                                                                    Entropy (8bit):5.877343855191366
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:YRIiJ/oQdbf2KrHMl7LcagTtgOUy1WfbU06QA8nO:Ga7YagZgOUy1W6AO
                                                                                    MD5:06F8348872155FF71111883C9F12A689
                                                                                    SHA1:D2658C1F4ED0B1C20857BACF4A70BBFF4B6DDE32
                                                                                    SHA-256:39C3118374F46EF5A0DDAC9122585CEF5D36D2CC2F7E1B29AC561EEF76024BF2
                                                                                    SHA-512:96C57806A90CF7144A5EA69E42765455DDF6A72D116C5A055A28BBD461075F8EB2611CCF59D6471B9E3DB80B41A2F8BFB8C94BA62F753963159073A30E1E0119
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................^...............u.......u.......u.~.....u.......Rich............................PE..L......g...........!...+............3........................................`............@.................................(".......@..<................+...P..L.......8...............................@............ ..(............................text............................... ..`.rdata...U.......V..................@..@.data...T...........................@....idata....... ......................@..@.00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):123320
                                                                                    Entropy (8bit):5.314033258489788
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:RO3E0whj3wQPlzMJvVw5+Kk0cTtkDupXFB124QTy8nN5gYe:RO3E0wC0zM5qcTtkDupXFBMLy8nPe
                                                                                    MD5:592D9F176E16609AF2D2BD67FCD7C0D9
                                                                                    SHA1:EF2F4855859515E6874F5FF1CC41B840B3052F76
                                                                                    SHA-256:3A15884C1DB7B1521D4866D05055FDEBB3DFD7B55DA472BD04F71499BDFFBA1C
                                                                                    SHA-512:3B62FB3A059AC1F1E3E4BD9A4A1A355456B0AE323F9F7225705A0BEB51EBAF58961B07A3C9E580134172F4D726547643E431EF27C2BDC7085D3C97E9B35A40B9
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$9..`X.D`X.D`X.Di RDfX.Dq..EcX.Dq..EjX.Dq..EtX.Dq..EdX.D.*.EbX.D...E}X.D`X.D.X.D...EaX.D...EaX.D..>DaX.D...EaX.DRich`X.D........................PE..L......g...........!...+.....................0............................................@.........................pg..................<................+.......... >..8...........................8=..@............................................text............................... ..`.rdata..wJ...0...L..................@..@.data................d..............@....idata...!......."...~..............@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):362936
                                                                                    Entropy (8bit):5.848704962238475
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:Z01ncjQYIBLHOmxI9RIiJ/FedztYSfQFOB7PBa7KeOTy5WtF4HVq3Dy5qwOR8rTk:Z01ncjQYIBrOFLwBbBaueOTy5WteVgmw
                                                                                    MD5:A48171A35E96346EB8FBCA677886A1CF
                                                                                    SHA1:555E527C893458D6FE823E74F1474A20B7C499E8
                                                                                    SHA-256:C0A9B8C60DEDB8507644257E4248A1CB0E59E72EC1DCDC530801B6F1E7A8A286
                                                                                    SHA-512:D60141A05BB1A448438CEF516AC6FB09C1D9A2AE7AC3B18F682E5DA74DCBA04BFB8BA1EC24C1C214EB517D51F951D8F23163981881E707A40D8B55958A6409A8
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.(Z".{Z".{Z".{SZv{P".{K..zY".{K..zP".{K..z@".{K..z^".{.P.z^".{...zK".{Z".{.".{...z^".{...z[".{...{[".{...z[".{RichZ".{........PE..L......g...........!...+.....`......F.....................................................@.........................`....E..,...h....p..<............^...+......x ...`..8...................Le...... _..@...............,............................text............................... ..`.rdata..............................@..@.data...............................@....idata...>.......@..................@..@.tls.........P.......,..............@....00cfg.......`.......0..............@..@.rsrc...<....p.......2..............@..@.reloc..t%.......&...8..............@..B................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):620984
                                                                                    Entropy (8bit):5.880229469023189
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:7JrEMhmdf5F6WrI9emOGyGW8Rvd3JuyfAx:75EMhmdf6WrI9emOGyGWQAx
                                                                                    MD5:051EDDABDA705ABB25FD6B5F8ED2BF54
                                                                                    SHA1:645AB0063D1875E69C493F5696A711E7257C3FDE
                                                                                    SHA-256:546E7D4939362F8FBFBC8EC0FBAA17A54A2895C61110E38C86BB0DBBC615B959
                                                                                    SHA-512:44958BF47FC480663DDBB1F3554DAD639C78AD8C80C7E0AF839DF366367DB260D42DF4360DE6922AE56E71DF1F096607ADFB4E969D059510AFBD06405B5E8674
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................C......-............................f.....f...........M..........M.....M.....M./....M.....Rich...................PE..L......g...........!...+. ...0.......'.......0............................................@..........................D..UB...........@..<............N...+...P...?......8........................... ...@............................................text............ .................. ..`.rdata..5W...0...X...$..............@..@.data...@+.......&...|..............@....idata...T.......V..................@..@.tls......... ......................@....00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc..DH...P...J..................@..B................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):50104
                                                                                    Entropy (8bit):5.077594143570386
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:pPDvKiCCZDI0/08J0P4EHpgBQyDwaPSipwK6QNynss2m/8E9VFzSJIVaD/AVw:pPc7HpgBQyu8nmkEs/N
                                                                                    MD5:50E7535D0B209553003A5C0F90DE3820
                                                                                    SHA1:99843442AC8898D4810906C12D63D83F5F1DB3FE
                                                                                    SHA-256:3854D0DFABCFA3309FB45DF013AD274BF0A82E60B0A7F9C5EF3315C03F6BD497
                                                                                    SHA-512:986D600BA4274EF3FAC0D5F22C6EF3F6C58F7C4EF4A28C0DCD07B8B1304A3116B6FEDBFFDF41ED197ED2C2519D4182292DD5665F086CC776F1E40EA54173418C
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(J|SI$/SI$/SI$/Z1./WI$/B.'.RI$/B. .YI$/B.!.GI$/B.%.WI$/.;%.QI$/..%.XI$/SI%/hI$/..!.RI$/..$.RI$/.../RI$/..&.RI$/RichSI$/........................PE..L......g...........!...+.N...J......S........`.......................................0....@..........................{..................<................+...........i..8............................h..@............................................text....M.......N.................. ..`.rdata.......`... ...R..............@..@.data................r..............@....idata...............x..............@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):123320
                                                                                    Entropy (8bit):5.63283468398536
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:u8OlQvKBTicz8TmEtsI1C3Vw1zEGi6/Bq648nNuv:NOlPBrz8TmEtsI1C3y1665i8nwv
                                                                                    MD5:097612CA92FD06837522F254E569F7FF
                                                                                    SHA1:C50E3FB96BFAB7B1C00D5CEE041780431605FF7C
                                                                                    SHA-256:07451F1AEA7754B3E51E23CEA4905A0A6BE749C0F961D176C3B63D53696A6129
                                                                                    SHA-512:0054E210EFD89666A570D9E2F8A132E45A46A62AF633A367FDE76E8EAC6B7684A050D119912761EB13A7F3BD1861C2D72D39052723584C0BE7160A282ECEF996
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]'t..F...F...F...>...F.......F.......F.......F.......F...4...F.......F...F..ZF.......F.......F......F.......F..Rich.F..........PE..L......g...........!...+."...................@.......................................D....@..........................k......<...........<................+...........M..8............................L..@...............<............................text....!.......".................. ..`.rdata...Z...@...\...&..............@..@.data...............................@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):127928
                                                                                    Entropy (8bit):5.311227067131572
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:IfN3APTSYIkkJeMmPrLhAk+MhIwiVj86JpXX69jM8nNx:IF3wSYeTMRDhR+FX628n3
                                                                                    MD5:D902CCA1BAE8A55424C48DA68D24DB54
                                                                                    SHA1:8C6810709A627B79FBD7462E605C764F2E0A0271
                                                                                    SHA-256:6048FBEB700F644FE28C8A7A75A174CE48869401423FB26231E8DD26AAA80517
                                                                                    SHA-512:23F37108D4F23E4E90BB845793571117AA37FFF187ED7877DB5F42DF6989CAB4161216C8C10841CCFCBAD937431BFDD54CC546859DFA1E37CF8FB6DC63DD81BE
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.............7....7....7....7....{.....P6......(...P6....P6....P6....P6....Rich....................PE..L......g...........!...+............~........ ...............................0......L.....@..........................f..........T.......<................+......H...`;..8....................@......x:..@............................................text............................... ..`.rdata...a... ...b..................@..@.data...`............j..............@....idata...-...........x..............@..@.tls................................@....00cfg..............................@..@.rsrc...<...........................@..@.reloc..F...........................@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):774072
                                                                                    Entropy (8bit):5.921272010881971
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:d553bCSvNq5jci4+sMib1HOuykWLrTNuplLxFk0A1:x3bRvNq5jbsMib1HOuykWqk0A1
                                                                                    MD5:DE42EF2A89FA69495DB64F17F6E474C8
                                                                                    SHA1:512970D44B5ACACD55D6422DCBE0DBF224BBBF29
                                                                                    SHA-256:A3B9065082295B7E7D41D0B6E61E36DB67FD2CC34BD5CF5C3B63718652EBABEA
                                                                                    SHA-512:400F2E2354DEC2A1B0F722DC018ED055C7FD4FB758A19526C2CB3F2DB63D745DFB92C7A6CAA0A68C9C2442C610D5C948B2C72B0BAADBA5E1398583703CEF718B
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!...e..e..e..l.).m..tO..o..tO..|..tO..m..tO..a......g...N..L..e..U...N..o...N..d...NE.d...N..d..Riche..................PE..L......g...........!...+.^...J......W,.......p......................................A.....@.........................p.......0...0.......<................+.......C......8...................L...........@...............0............................text....\.......^.................. ..`.rdata..0....p.......b..............@..@.data...(....p.......`..............@....idata...f.......h..................@..@.tls.........p.......J..............@....00cfg...............N..............@..@.rsrc...<............P..............@..@.reloc...M.......N...V..............@..B........................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):584632
                                                                                    Entropy (8bit):6.109669646663168
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:MbnHK0KwZsNy5ROQyLWfLOci6+X/0yDAH:WnHK0PZsNy5ROQyLW06+X/0AAH
                                                                                    MD5:4EB7BF1C5B28FF381951BBDF21B14D0B
                                                                                    SHA1:75C9C9F9C335D40EE2AF7135F31F301111376022
                                                                                    SHA-256:E555D8E0AA5BBD2A0D1E8AD08A671D33448CAE5A6C91A33DCC842613A1B3B824
                                                                                    SHA-512:D584C15D9DFED23A0704270F946CCBCD1FF1D0FFB089B05C3A06209AA7D028CCEE84E294FC3B420F72FA82E148F12C5B3E2811265B19593C1AF582D4EF837CD2
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uI...'..'..'.l...'.$..'.#..'."..'.&..'.pf&..'.[.&..'..&.,.'.[."..'.[.'..'.[....'.[.%..'.Rich..'.........................PE..L...d..g...........!...+.*..........0........@...........................................@..............................6..\I...........................+......\p...<..8...................LB.......;..@............0..\............................text....).......*.................. ..`.rdata.......@......................@..@.data....*......."..................@....idata..,#...0...$..................@..@.tls.........`.......4..............@....00cfg.......p.......8..............@..@.rsrc................:..............@..@.reloc..3~...........@..............@..B................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):319928
                                                                                    Entropy (8bit):6.136894058721322
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:SvPNAJ5UdqX5KiP+1SAwXrQ3xULXGk0E/9Qj8nI:wPNADaAI
                                                                                    MD5:FCCA50DA7E7D62B14E50E57E997A42AC
                                                                                    SHA1:E1D372D3502EA3776543146F35B7E72F9B2C56DD
                                                                                    SHA-256:7D41148D48BAEEEF77BD94D44B21263235AADCA56F1A6D0A8B57CD918652BC45
                                                                                    SHA-512:526A8A2691B4A009582A315FC308D9757B21D61655789455C39B4E09A0973126178BB526EBA82D852525F93D8EB0C8CF020354214FE94C685599A118825F06BF
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.X..............q......?.......?.......?.......?...............................>..............>.......>.......>.......>......Rich....................PE..L......g...........!...+.....................................................p.......p....@............................../..,...T........................+.......[.....8...............................@...............,............................text...j........................... ..`.rdata..............................@..@.data...8....P.......6..............@....idata..>............R..............@..@.00cfg...............D..............@..@.rsrc................F..............@..@.reloc...h.......j...L..............@..B................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):153016
                                                                                    Entropy (8bit):5.696807855829571
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:Ylas4hpWclRqkE3APKFiTxMhzTviY5jMXF/6AtOX178nNmCE:YlaPWcbqkcTviYxMXF/6AWZ8nbE
                                                                                    MD5:855512156867420AADB1B07CE0F3CDF3
                                                                                    SHA1:044F89DCB25131186438E43F358F2B8DB429197E
                                                                                    SHA-256:D1338ED4BD49BAF1597DA6DEA6094A727DEE96D5681A7FAC3B42F9B0F5EDE4F6
                                                                                    SHA-512:33C8E899900F0187E9CC596C60FC8295D9FD674D6CA0E8DE63CC518CD3926D905C357A4E1073DFB3C0778C80E92C4FE05A8F992FD8017118F1FC4663A1E27409
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B...B...B...K.n.N...S#..A...S#..H...S#..V...S#..F...x%..@.......@...."..O...B........"..G...."..C...."..C...."..C...RichB...........................PE..L......g...........!...+.f..........%........................................p.......K....@............................H)..L...T....@..<............*...+...P..p......8...............................@...............L............................text....e.......f.................. ..`.rdata..8i.......j...j..............@..@.data... ...........................@....idata...-..........................@..@.00cfg.......0......................@..@.rsrc...<....@......................@..@.reloc..S....P......................@..B................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):550840
                                                                                    Entropy (8bit):5.98836830502285
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:C3PyKpVb/qx0rhqNiKpZ/Qzrfnitpdy7gY8+qVOuMvS8/to4aco7LYz8nwZ:C3PhZ00DobRAq4vL25LYzAS
                                                                                    MD5:6B2964DBB0307F204417B414393482EA
                                                                                    SHA1:BD79ECE0AAEE0FF2E149992CC758A86D91320F5C
                                                                                    SHA-256:02972D4BBE646E0BEF5461A5C09E8A5A4639142E175F1CE8A0F74E994192CC85
                                                                                    SHA-512:31CB7AA770614BD71AA0BAE45BA30D2C4D0D7476190C50B502159530A4FB353DF4B7E023DC87ED3BA662088868DC2FE2CC7692CB227CDB5FF647C111FB15A6BF
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"...C...C...C...;...C..~=...C..~=g..C..~=...C..~=...C..~=...C...<...C...C..eC..>3...C...<..CC...<...C...<e..C...C...C...<...C..Rich.C..........PE..L.....d...........!...$............................................................k.....@.............................$.......@....0...............<...+...@...:..x...8...............................@............................................text............................... ..`.rdata..$'.......(..................@..@.data.... ..........................@....idata..'...........................@..@.00cfg....... ......................@..@.rsrc........0......................@..@.reloc...B...@...D..................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):181688
                                                                                    Entropy (8bit):5.891047613414363
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:A2+V0O8TtyehHduNWUODA8R1rFlOSHSg8nn:AMATWUODA8R1TOSHz8nn
                                                                                    MD5:9B77D53662D796BF6EFE7FB55B5E9911
                                                                                    SHA1:AE57CEDA3F1C7F4109C17A1DEE44F004EAFF7CC5
                                                                                    SHA-256:F757B7E2CF339B8CF029D5EA7E5B058CAAD9F60F5207EEF7B4CC93BC9C9E1303
                                                                                    SHA-512:D32DF6B78750EA47AFECE9FE9C243EEF724A26143F3308168E3F5368153F185F144BA6581E570E4B00261AFC99ED7C7334EFF96DF9A2DDA4A22F3F7B06A79DF8
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........M...M...M...D.&.C...X..O...X..A...X..G...X..O......N...M...f...w...N...w...L...w.J.L...M.".L...w...L...RichM...................PE..L.....]e...........!...%............M........ ............................................@..........................l......L...........3................+..........H_..8...........................`^..@...............L............................text............................... ..`.rdata...X... ...Z..................@..@.data................d..............@....idata...............f..............@..@.00cfg...............r..............@..@.rsrc...3............t..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):374712
                                                                                    Entropy (8bit):5.766239778909662
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:dNixCkZPG7beaW9WKV9fUFgMiHLpsK14oTp6hp2xudq0xakz+O8nt:dOFGPAJygMkps8/p6v4udqmapOAt
                                                                                    MD5:1FADD2565580517950ED2CD07311F642
                                                                                    SHA1:7DC0E6A8A89BCFF7F597F2144F9829D608973B32
                                                                                    SHA-256:9CB62B81B0EDAF5B9CD2ADD7003C62F6D60CCAE4777BDB5B80CDF08148B24804
                                                                                    SHA-512:4D53564AA3F2CE6B2CC6F0E9AABC1C795139AE3C336FD1F6216213A27687633765FEDB867CBB84930DF1FEF32A198ABD98D81F20EA70DD15B7D64712C9E411C1
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.c./.0./.0./.0.W.0./.0fQ.1./.0.W.1./.0./.0./.0fQ.1./.0fQ.1./.0fQ.1./.0.P.1./.0.P.1./.0.P.1./.0Rich./.0........................PE..L.....d...........!...$.(..........*........@...............................0......X.....@..........................'..CC...............................+..............8...............................@............................................text...n&.......(.................. ..`.rdata...*...@...,...,..............@..@.data....g...p.......X..............@....idata..t............Z..............@..@.00cfg...............h..............@..@.reloc..d ......."...j..............@..B................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):222136
                                                                                    Entropy (8bit):6.001250798647687
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:BW3bdy7vpzHmulf2ps/VRsEkug0/UvyOQEIrbvruJCWI3Z/A+oqv8nL:EUlf2psjsC/4Q9ruJCWI3ZNoW8nL
                                                                                    MD5:4382FA3166C1B7B7B982AC95D782B21C
                                                                                    SHA1:2D0B8DD25B39B419C3E9CD81ADF1227FC6D9B013
                                                                                    SHA-256:2764B18CB4327CF84BA7D17137550447528604EBAD3ECC661CF566FAA36897CE
                                                                                    SHA-512:278B4CAE611CC4A44CE056D643DE35CC3EE03A5D90333226AC4AA13AC3E483AA5FE8C564E59C0271296E49DDE0584FB7933117211E5747BA54BD970EDAF43113
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z...)...)...)..a)...)...(...)...(...)...(...)...(...)G..(...)...(...)...)...)...(...)...(...)...)...)...(...)Rich...)................PE..L......d...........!...$.............................................................+....@..............................#...B.......`..<............8...+...p..........8...............................@............@...............................text.............................. ..`.rdata..............................@..@.data........0......................@....idata.......@......................@..@.00cfg.......P....... ..............@..@.rsrc...<....`......."..............@..@.reloc.......p.......(..............@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):47104
                                                                                    Entropy (8bit):5.949565643006991
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:XT0By9agdz/xHyQg5VG2gFLMRz9y1fp5y1kauAF86oCUE1+ulyQ83TAEpg8p7:YBy9acpHyQg7G2iMR0XchuAF869V1+5f
                                                                                    MD5:CBA022DAE47A5F290875DDA49C47DA9A
                                                                                    SHA1:1B30DA0D9891EC797809AD9F8577CAB29CA7BFAF
                                                                                    SHA-256:D0FF2E4092426EF8D17C65EC031FEC3DB797F1E7A48F011767CA1CFFB3D05135
                                                                                    SHA-512:46D5C94CE828AAD8812E87C0A330227EBCEA2453C59024E97E1F0121781F58B7DCD253CA9F9612F7F8D4D367F6C1FB8E34AE2D08A7F7A5A08A9A569518D50ACF
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F_...>.T.>.T.>.T.FcT.>.T.lcT.>.T...U.>.T...U.>.T...U.>.Tp..U.>.T...U.>.T.>.T;>.T...U.>.T...U.>.T...T.>.T...U.>.TRich.>.T................PE..L......g...........!...+.0...........?.......@............................................@.............................X............................................................................B..@............@...............A..H............text..../.......0.................. ..`.rdata...w...@...x...4..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):1953792
                                                                                    Entropy (8bit):6.637566225504998
                                                                                    Encrypted:false
                                                                                    SSDEEP:49152:SDrrH+bGywMYJt4toddcb7xlYz3X/cRLmYBDopt2DtTOIAP5CKG:srlvMYJt42ddcb7HI3X/c1jBDopgwIAr
                                                                                    MD5:0716A5C9B647FEE1AE58DDBF9DF6266A
                                                                                    SHA1:78D8075BA99E86AA22661AEDBB19765A37EE1AC7
                                                                                    SHA-256:3D72EA9D39991E7300AA0FA50EC2877443AFBBD507881CDEBFDA0F5ED1517926
                                                                                    SHA-512:E704C239E88F3A2630AE4DFDDC905DBAEF6E16389A87DB04E814F78513924C7728448D4E43B3DD0E7BA71F94C3AE6C31C9CC708F763A4317F8DFF13054DBF41C
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........).^oG.^oG.^oG.,.D.EoG.,.C.|oG.,.B..oG.,.A._oG.,.F..oG.^oF.\lG.O.D.FoG.O.C.LoG.O.B.?nG...N.\oG...G._oG..._oG.^o._oG...E._oG.Rich^oG.........................PE..L......g...........!...+.|...P...............................................`............@.........................`>..x....>..@....0.......................@..`.......................................@...............H............................text....{.......|.................. ..`.rdata..v...........................@..@.data............V...b..............@....fptable..... ......................@....rsrc........0......................@..@.reloc..`....@......................@..B................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):345528
                                                                                    Entropy (8bit):6.161015595309369
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:rqGm9zpCQBRD3zx/2UStzGXHxKy2zmezGaIf55eF3GU+A8nB:rqGy3zxzmA5cmAAB
                                                                                    MD5:7686F20F3F7FE400323C9A9694CAA1D5
                                                                                    SHA1:7B5A56F99483BCFCF9CC1AD01856350D1F42CABA
                                                                                    SHA-256:396E7DF23ED807687FCF7C378D4BD0F819C7E73D28802A63AFAC705AA6AAB291
                                                                                    SHA-512:893F0C3D099F49FF322F306B6758AD85EBBF60DE51A82A877077262DD931B922EB78C5CFD183DD4BEB949A60D5075D6251193DBE5F49295C69332C184DFE6787
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?3.^]..^]..^]..&..^].. \..^].. ...^].. X..^].. Y..^].. ^..^].M.\..^]..^\..^]..!Y..^]..^]..^]..!]..^]..!...^]..!_..^].Rich.^].........................PE..L.....d...........!...$............!........................................`............@.........................P................0..<................+...@..........8...............................@............................................text............................... ..`.rdata..............................@..@.data...............................@....idata..............................@..@.rodata.............................@..@.00cfg....... ......................@..@.rsrc...<....0......................@..@.reloc.......@......................@..B........................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):450184
                                                                                    Entropy (8bit):6.688978399563446
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:n82bIggWBCs9B+zJT8N/oaTvlbJLsRXhUgiW6QR7t5s03Ooc8dHkC2esjeX8:nbTgWBCs9B+zJT8yaTvlbJLsR003Ooce
                                                                                    MD5:C53B950681B9F07A8D56F2FF272CBF5C
                                                                                    SHA1:0EC5C6084B6CE4E9A0ED3CCA02BA464450F19D36
                                                                                    SHA-256:2C0A3E328419B3B50B0430F38C6B5882E302177F4B003ABA6A0E7E035807043D
                                                                                    SHA-512:A48C886FF9DD34344094C00C8FF18EE91A359F06DAC4CD42C2E054857CD0A12121BA4BAF8E85D158FAD5A62DFE4C694E5D80C4682564FE07205CA69139A364F5
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)O&BH!uBH!uBH!u.0 t@H!uK0.uTH!uS. tAH!uBH u.H!uS."tJH!uS.%tIH!uS.$t.H!uS.!tCH!uS..uCH!uS.#tCH!uRichBH!u........................PE..L................"!...*.....|...............0.......................................P....@A.........................]......8c...........................P.......6...V..T...........................HU..@............`..0............................text............................... ..`.data....'...0......."..............@....idata..@....`.......:..............@..@.rsrc................R..............@..@.reloc...6.......8...V..............@..B........................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):33928
                                                                                    Entropy (8bit):6.925892892058338
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:GVMXaJ2gM+Blq37b8Wc85gWabg1gSt+efR7i1R9znvC4pzHRN79EJ/7R9zWZ:GhwZ+BA37dGg1HhR7in9zvC4dWF9z
                                                                                    MD5:0A7B3D48682267EE3F4A21D900403654
                                                                                    SHA1:F015CCAE4850D0603B95150311528CEFBF74E40D
                                                                                    SHA-256:9293164D5C1B5B714B62A76BA7EBF13B00216335D69FC85E2A7C2D7B03F35B0C
                                                                                    SHA-512:5792E26B8231E56A59CABFAD582317C8385570CB26DE55EF41272CEAAFC349A41DF347EF920C2C666F09FDF032319770C3767057F41F437F249C8745D6A85996
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1...0...1.b1...1.Z.0...1.Z.0...1...1...1.Z.0...1.Z.0...1.Z.0...1.Z.1...1.Z.0...1Rich...1................PE..L................."!...*............p........0...............................p......).....@A........................0,..J....@..x....P...............4...P...`..........T...........................X...@............@...............................text...z........................... ..`.data........0......."..............@....idata.......@.......&..............@..@.rsrc........P.......,..............@..@.reloc.......`.......0..............@..B................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):284240
                                                                                    Entropy (8bit):6.6030384408399785
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:x9pd605gdox12EsvrS28zkR9W2sXNBHyuu1VP+S2e2/gXJzZeZvQHxhe/ooHrniY:Hpd605gdox1vsW2HRrs9BHyuu1VP+S2H
                                                                                    MD5:C0A915ED3DE5FC628A4C66614DE2F629
                                                                                    SHA1:95E3CD101110830406908623750349AB82BB076F
                                                                                    SHA-256:99FC7E3E2E4289689E38145C80F1B495D2DC9EBCB5ADCD784D02EE362A03DDF2
                                                                                    SHA-512:1B2CDCD1E791ECE22E1CD18FB7FA67DDD3857B0C45F2A8407AB21EEFDE6FB991B1DA3CA5CBA08416F3E04AD9C72903E29A2102C8BB795269C127A553977CC325
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..T4.DT4.DT4.D.L.EV4.D]LADX4.DE..EV4.DE..E_4.DT4.D=4.DE..EQ4.DE..EG4.DE..EU4.DE.-DU4.DE..EU4.DRichT4.D........................PE..L....[.7.........."!...*............P`.......................................0.......[....@A............................@...............................PP......DI...K..T............................J..@............................................text... ........................... ..`.data....%.......$..................@....idata..............................@..@.rsrc...............................@..@.reloc..DI.......J..................@..B........................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):47240
                                                                                    Entropy (8bit):6.850134092934221
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:hdGx5ORBC5fr5FOpzX8KJM1t2g1HqU9zal+zxOW9zO+T:zGDORBC5frPOpD8KJM1VHVz4+zUizO+T
                                                                                    MD5:ADC0070A635DBDEB1BA0B3B0066F859C
                                                                                    SHA1:083661359206ED05D96D18A7A44B7AB4E78B9521
                                                                                    SHA-256:6176369D3052AF7356218E3EE1FA7BE6D83C7000448095D1A581E8584088756E
                                                                                    SHA-512:A133376A9A827FD660E2F94962C565893DB9AFE510921C6FA4F3CF438AC11C97202CCA67ED17066F4058ECDF7648A6993904C16D24981A9D6F9D2CE7E9C4542A
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.J"..."..."...i...&...+.W.$...3...#...3...)..."...C...3...'...3...>...3...#...3.;.#...3...#...Rich"...................PE..L...r............"!...*.L..........0E.......`............................... ............@A.........................T..D............................h...P..............T...............................@............................................text....J.......L.................. ..`.data...D....`.......P..............@....idata...............R..............@..@.rsrc................\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):30800
                                                                                    Entropy (8bit):6.982057486464294
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:DJiA4wZc7OQxGiOb/Wi+EWReSt+eQ3Y/7R9zWdlz2OHRN7G64XC4deR9zZjDbeH:DJVZjQDOOx/F9zEy6G64XC4dC9zZjm
                                                                                    MD5:8D349CA0EFB51A2348FA3941F357DE52
                                                                                    SHA1:F527FD79A647A8D9FC16BF7572B4C91AB1616AD7
                                                                                    SHA-256:4FA330A01151942FDEDDE2CC9DF660A07585B7D9228A9E67FB5E774148D58A4B
                                                                                    SHA-512:63B2A8BC1D9D60887A2BE34B72394A736ACE523991780D398183DDB65DAC3F6F4CDFB6A971A9391B4FEA7B510F72DD73BC440B9F06C48253F291FA5B8999778E
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K[Z.*5..*5..*5..R4..*5..R...*5...4..*5..*4..*5...6..*5...1..*5...0..*5...5..*5......*5...7..*5.Rich.*5.........................PE..L...r.l..........."!...*............P........0...............................p.......%....@A.........................#../...p@..P....P...............(..PP...`..x.......T...........................H...@............@..h............................text............................... ..`.data... ....0......................@....idata..x....@......................@..@.rsrc........P....... ..............@..@.reloc..x....`.......&..............@..B........................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):58808
                                                                                    Entropy (8bit):5.910225111986373
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:IFkdD3J9EE5gzt4YDVcDGtUplYvzgf078nmkEsou:WwjJ+Cgzt4qzzys8nNou
                                                                                    MD5:AC118710AD822D909EF73B0494C91BE3
                                                                                    SHA1:081C61260E082411FE636DD8A51CCD35507408BC
                                                                                    SHA-256:552964A63B5B611045723C688C37B2B6E54BE8526B7D3392536713424DCF2BA8
                                                                                    SHA-512:6E8F2FBBFB770D97C1166617E9F8A9A7E9F8DD22F554301563944010EC2D6BDF7E78D6106743F9B6984837FE588F364927A4D928205748A4960CEA0718098840
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9p..}...}...}...tiU.y....o..~....o..v....o..w....o..|...a......}...X...in......in..|...in9.|...in..|...Rich}...................PE..L.....d...........!...$.X...b...............p............................................@.................................X...d.......<................+..........X...8...........................p...@...............X............................text....W.......X.................. ..`.rdata...F...p...H...\..............@..@.data...p...........................@....idata..............................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):420280
                                                                                    Entropy (8bit):6.212637480045171
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:JUM/bE+Zrqo/lQ+oZSCRuwyfjTWnJmzA1:zP9/lvTCbIzA1
                                                                                    MD5:F21C1CF130C2040F0D379ADE15ED9ACF
                                                                                    SHA1:958B29959DEC6D812AA544888F650B262E383E21
                                                                                    SHA-256:4DF741B168EC10CBA46D86E849A42FA27E86ECC053EAEC42E96AEF0548A12AED
                                                                                    SHA-512:8E68A10F2AB0E8E8886F30C5EFB61F861A24FB4B2A4A2F5E2BFEA6379CB4CB20DBA47E2228A721D2B30961824ABFF0B8B172A76A05B48C8C9BAEAA9C122B92BC
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........kD..8D..8D..8M.*8L..8Q.9G..8Q.9H..8Q.9N..8Q.9B..8..9F..8D..8j..8}$.9..8}$.9E..8}$F8E..8}$.9E..8RichD..8........................PE..L....rJe...........!...%.....b......................................................zH....@..................................1.......P..<............>...+...`..........8........................... ...@............0...............................text............................... ..`.rdata..?*.......,..................@..@.data...P.... ......................@....idata.......0......................@..@.00cfg.......@......................@..@.rsrc...<....P......................@..@.reloc..w....`.......$..............@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):196536
                                                                                    Entropy (8bit):6.100800505555313
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:7Im0EozvZ5stGeWsIVrunaaDg0l8V9ON7iazso1frWmvIrx4lkF8nr:F/ozqGeWsIVry3X8V9Ozwo9lvIrnF8nr
                                                                                    MD5:5A7C6A18C0F463923A875486218782F4
                                                                                    SHA1:586296FFC048EFF674D6456626B46F8770F5C52C
                                                                                    SHA-256:B8343C92D5F1141EBAFF09863E7E29B5C31ECB8CE6C583C1E2E154287AC0D825
                                                                                    SHA-512:BCF9D7B10D98979BD2CFA774FDD7E65D3701D977054A9BE7028BC55A71B7A75B44F91EFAE94AEC3710B3A634D20852CD84F8FEFA8418FEBA5A32D8E492163EC7
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..gk..4k..4k..4b..4g..4..5i..4..5g..4..5a..4..5m..4...5j..4...5b..4k..4...4..5~..4..5j..4..|4j..4..5j..4Richk..4........PE..L......e...........!...#............[........................................ ......MJ....@.............................T...............<................+......8......8...............................@............................................text............................... ..`.rdata..T...........................@..@.data...H...........................@....idata..C...........................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc../...........................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):54712
                                                                                    Entropy (8bit):5.53326710369033
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:eTTd5rTWkWvGhpNGjmy4d+bWHp4mBFd+XI7C1Ljl+6E5oo1A5Fr1pwK6QNynss2A:eTKnG7gbS4mpqN19C1GI8nmkEs0Yg
                                                                                    MD5:4ED2388E590D976FA252705799175EA4
                                                                                    SHA1:3091DF05CEB03CCC320EE4AC2F9306B94B7E5594
                                                                                    SHA-256:17FFB1A94803E72FC10CF0181F69A7EBA9F6820B58DC28143A2ECACB3B5B91D9
                                                                                    SHA-512:AC51068ABCD74879B288A33BA25B9801D752996FFD2BFA74C524A6F65BCF82EBDB487E7E478CFB3DC9D4E0C9DABEE7168AD557A9EF37456429858D5EB1F185C4
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}...}...}....&..}.......}.......}.......}.......}..7....}...}...}.......}.......}....J..}.......}..Rich.}..................PE..L....9.f...........!...(.f...F......l...............................................Q.....@.........................@...................<................+......\.......................................@............................................text...Dd.......f.................. ..`.rdata..D............j..............@..@.data...............................@....idata..d...........................@..@.00cfg..............................@..@.rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):595896
                                                                                    Entropy (8bit):6.147054329895308
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:1X/J4nVrytXL/53XpgPZzLVwOMdIB+SoclTeNUKbUfXg9bJFOg8XdkwSGDXhhhch:1/8ydLvcBP43+ScRhhcN/Q2QTAP
                                                                                    MD5:08EE1194B85C3C78A6BE795D71E2BCDF
                                                                                    SHA1:C8AA25B801EC9A963CA2901C8D63A6E19AC16371
                                                                                    SHA-256:A64D4C372865A319A295E56364984299467AAE6793E8AA11A624F2FE7F173625
                                                                                    SHA-512:418FEF95294914359BD05E29D93A3E91F91638787A16FBB7628768AFA219E2D989431FC6B1A739BEB54D2CA151FD75A4CF2B4808E0DA082370AA5870B3989B7E
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......L.................................f...................................1}.....................1}..R...1}......1}d.............1}......Rich....................PE..L...=FKe...........!...%.@..........:........P...............................`......./....@..........................@..7.......T.......L................+... ...,..H/..8...........................`...@............................................text...Z>.......@.................. ..`.rdata.......P.......D..............@..@.data....~...P...N...<..............@....idata..}!......."..................@..@.00cfg..............................@..@.rsrc...L...........................@..@.reloc...3... ...4..................@..B........................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):693176
                                                                                    Entropy (8bit):5.978487967435767
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:Q6dj+SkL+jjp5f3Lp9ojRYhHwY7uRJH/zie7RfmmFdSUMxl4lpxzt+TiIbBwajt8:Dj+FLejTbRQvVS6+TiOBwajahs4FlKYD
                                                                                    MD5:3985FF695B838661DE83C0DEA67F563A
                                                                                    SHA1:966C95921BBD34EC43E7FD127433D0F986B20D5F
                                                                                    SHA-256:9CA5A78D1B306B251DD9A118F20771B2001962670E246156E36CE1B3329DE9D9
                                                                                    SHA-512:522A64C6344AE94D3C3959285B55104853BE1D34FD2E5416A98BCD7976A960E5E406EC5ECB043FED991DD75F9E22C86CD2A08E5119847DE54CE70B85A8891DDD
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C.+.".x.".x.".x.Zjx.".x..y.".x..y.".x..y.".x..y.".x.P.y.".x.".x.".x#..y.".x#..y.".x#..x.".x#..y.".xRich.".x........................PE..L......g...........!...+............h...............................................8[....@..............................&..(C.......p..<............h...+.......)..x...8...............................@............@..(............................text............................... ..`.rdata..X...........................@..@.data...<&..........................@....idata.."....@......................@..@.00cfg.......`......................@..@.rsrc...<....p.......0..............@..@.reloc..20.......2...6..............@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):1170904
                                                                                    Entropy (8bit):6.805826320677691
                                                                                    Encrypted:false
                                                                                    SSDEEP:24576:+WiAihjcDBXUw9y079gzyVFExlfz+pq12S5qyrmcvIZPoy4spcFOo:NiAihjmXfgzyVFEWc2SEyApcco
                                                                                    MD5:126FB99E7037B6A56A14D701FD27178B
                                                                                    SHA1:0969F27C4A0D8270C34EDB342510DE4F388752CD
                                                                                    SHA-256:10F8F24AA678DB8E38E6917748C52BBCD219161B9A07286D6F8093AB1D0318FA
                                                                                    SHA-512:D787A9530BCE036D405988770621B6F15162347A892506CE637839AC83AC6C23001DC5B2292AFD652E0804BD327A7536D5F1B92412697C3BE335A03133D5FE17
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..\...\...\......\...]...\.......\...\...\..._...\...Y...\...R...\...X...\.......\...^...\.Rich..\.........................PE..L.................!................0................................................b....@A................................t".......@...................!...P......P...T...........................p...@............ ..p............................text...P........................... ..`.data...<...........................@....idata....... ......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):267656
                                                                                    Entropy (8bit):6.547035182798101
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:+9WZ4GcvxHdmJOHpxyBIBaQ0I/Quljl1mn48MHnlwgSmiSb:+VFTmJO/BH0IYuljK48ZgS0
                                                                                    MD5:2FB4C4168E379F13B15D4E299ECF3429
                                                                                    SHA1:4C6702254054F288BEB49ADCDD6317575E83374D
                                                                                    SHA-256:8CD7BE490AD502C9980CB47C9A7162AFCCC088D9A2159D3BBBCED23A9BCBDA7F
                                                                                    SHA-512:8BC80A720CDC38D58AB742D19317FBE7C36CFB0261BB9B3D5F3B366459B2801B95F8E71FB24D85B79F2C2BC43E7EB135DAB0B81953C7007A5C01494C9F584208
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hb.:...i...i...i.{.i...i^v.h...i^v.h...i^v.h...i^v.h...i.s.h...i...i...i^v.h...i^v.h...i^v.i...i^v.h...iRich...i................PE..L....~.a.........."!.........................0............................... ......Gp....@A........................@....=...............................#......TX..\J..8............................J..@............................................text...[........................... ..`.data....o...0...l..................@....idata..............................@..@.rsrc...............................@..@.reloc..TX.......Z..................@..B........................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):90192
                                                                                    Entropy (8bit):6.9531356247764515
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:EbiyVUrqIQsn1xtg6RxkkBGCGHDWbWXaecbGasQLvBrzU6LzNa:eiyLyt/xcRjWaXaecbGzurJBa
                                                                                    MD5:C33386A6E67BE415A24D9C431FFD42AC
                                                                                    SHA1:F2F23860916471BDC332B3BD3E88DEEF64D4432B
                                                                                    SHA-256:BF33857F46E56EA7930C1EEA25C5F7175A6AAA3DF36BF8301A785E6CA726A0B9
                                                                                    SHA-512:BC6D5E908BFAA7A35A8F2E01912412B9460604EA19FD27EE5C6F1A05EB0180A07BF7BC26D430326AFC9B81D7F19FB1899E6245196A37710C3E5346D0BC2B4C98
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B..U#..U#..U#...[..W#..\[`.^#..U#..|#..D...C#..D...I#..D...F#..D...T#..D...T#..D...T#..RichU#..........................PE..L...b..m.........."!...*............`........................................P............@A................................. .......0..................PP...@.. ....$..T............................#..@............ ...............................text............................... ..`.data...\...........................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.. ....@......................@..B................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):832440
                                                                                    Entropy (8bit):4.2266940730079945
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:8bKpIi7KE5uELtroV6epz8bjflQWB2RcbcQBWarxmAAv:Jui7KEi6epzgjyPRcbcQBWarxmAAv
                                                                                    MD5:E7AB3A424311959B921C7C1D33B3B8D5
                                                                                    SHA1:4D9123CA99FE96D8AE8057731A730BCF31E52476
                                                                                    SHA-256:FD6DC9A358E1A1D2BDDC754F9D079BAFA3CCDDDCD232BBE03F61F45051D37230
                                                                                    SHA-512:458ECFCE9678F88ECE58EA528291CB9D645F246171183A6C339E53D8291865898627CA9716748D2B1D5C5CB98D59ED6B974108FAED796F68300B29FCEB6EF0E3
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...|.|.|.u.+.t....~....p....v....y.....~.h.....|.B.h...i.h...}.h.G.}.h...}.Rich|.........PE..L.....d...........!...$.....~............... ......................................J.....@..........................D......Pb..........<................+.......%..H7..8...........................`6..@............`..P............................text............................... ..`.rdata...,... ......................@..@.data........P.......<..............@....idata..0....`.......D..............@..@.00cfg.......p.......R..............@..@.rsrc...<............T..............@..@.reloc...-...........Z..............@..B........................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):645048
                                                                                    Entropy (8bit):3.2546549094815376
                                                                                    Encrypted:false
                                                                                    SSDEEP:6144:O1tLXqLuNruVRJ/RbM4YkuYFS4KRYHos6s5wAkqRm5y8IBDp6C+W9gKutRJhuusH:O1tLXoz8o3H+dqd2RcqcQ9ybfxqBEFAO
                                                                                    MD5:0841E1B8C413732EBBBA4F5EA890F667
                                                                                    SHA1:1F6C8D953211D3D41ADF779622EB9A40EF5A1643
                                                                                    SHA-256:B63CD644CF3AE4C15A2BE7E9F90020A97F6457437084BC8BC38655EF24EDD55A
                                                                                    SHA-512:73286F6B541F8AEAD928F9988CC2A63D91B8C3E685AE7D3771DDC610039807D7402EFC3360B0AF2EDB3758D32EEC50EF974853D93E3812F22B75F0764407406D
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)P.Fm1..m1..m1..dI..i1...O..o1...O..a1...O..g1...O..l1...A..o1..yN..n1..m1..O1..yN..l1..yN..l1..yNc.l1..yN..l1..Richm1..........................PE..L.....d...........!...$.V...V...............p............................................@.............................-...x...x.......<................+..........@v..8...........................Xu..@...............x............................text....U.......V.................. ..`.rdata..-....p.......Z..............@..@.data................p..............@....idata...............r..............@..@.00cfg...............|..............@..@.rsrc...<............~..............@..@.reloc..j&.......(..................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PDF document, version 1.4, 37 pages
                                                                                    Category:dropped
                                                                                    Size (bytes):242400
                                                                                    Entropy (8bit):7.40763928636876
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:x1OOm4WMdyUNZFJ8plW6tckKXXg3b3CNsPVyEFZWe8VEQ1VG6+dg:x1tT4GlWt7gmzUIlFZjoEAb+i
                                                                                    MD5:DE7E70098A72948A6340D7D8EEE1BFB0
                                                                                    SHA1:6DA27330B0B4FBEBBEA9FA718D3AAE114D0A10AF
                                                                                    SHA-256:D00BCB1AFA2E0110D8D12F9E6B9BBA78498CDE165B71537ABEA34C68734E665A
                                                                                    SHA-512:33FB1B8034F0916A09FFD1EC2E7516D3CCA633295B9AC50DA2D1F8C153720BB1FC9953F3ED1452F6A43782A8563C29D4FCB62AEDA909ADE7C6EE2441BE30F379
                                                                                    Malicious:false
                                                                                    Preview:%PDF-1.4.%.....37 0 obj .<<./Matrix [1 0 0 1 0 0]./Subtype /Form./Filter /FlateDecode./Length 99./Resources .<<./XObject .<<.>>./Font .<<./F1 38 0 R.>>./ProcSet [/PDF /Text /ImageB /ImageC /ImageI].>>./FormType 1./Type /XObject./BBox [0 0 595.28 841.89].>>.stream.x.3R..2.35W(.r.Q.w3T..30P.ISp.......Z*...+..(h..x.V.+.....).d..h*.dA......Y ..HLOU06W.O..0..-#...endstream .endobj .36 0 obj .<<./Matrix [1 0 0 1 0 0]./Subtype /Form./Filter /FlateDecode./Length 112./Resources .<<./XObject .<<.>>./Font .<<./F1 38 0 R.>>./ProcSet [/PDF /Text /ImageB /ImageC /ImageI].>>./FormType 1./Type /XObject./BBox [0 0 595.28 841.89].>>.stream.x.3R..2.35W(.r.Q.w3T..30P.ISp.......Z*...+..(h..x.V.+..&g.e&'.(d....&.d..i*.dA......Y i.HLOU06S.OS06.).... w.endstream .endobj .35 0 obj .<<./Matrix [1 0 0 1 0 0]./Subtype /Form./Filter /FlateDecode./Length 109./Resources .<<./XObject .<<.>>./Font .<<./F1 38 0 R.>>./ProcSet [/PDF /Text /ImageB /ImageC /ImageI].>>./FormType 1./Type /XObject./BBox [0 0 595.28 841
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):3641272
                                                                                    Entropy (8bit):5.976814121017557
                                                                                    Encrypted:false
                                                                                    SSDEEP:49152:zEFUBsV7OgJyTVSPD3FMj+VwOwyHW8QogeLuqqR8euqjjVt5x:4FUuVpJyJOFMj+VwOwyHW8QH79Fx
                                                                                    MD5:B7F14801C2C5173CC6A7C28CB203CD85
                                                                                    SHA1:05202E2D7DB081E5BCDE406B58F4A8F170645F2E
                                                                                    SHA-256:2EDCF6FD06D8D4AF4138EE5245556D96F6C03CC3546332EDB39DD67662E7BFC1
                                                                                    SHA-512:83FFF523421EE80F72C6402600BA08287184B4375CAB0A88728268ED5560BFB5381D5A7ED7B5CAC98407C4477B1151C6EF30D2B3CE266879E01634B8B9C0C135
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......w..R3.m.3.m.3.m.:...%.m."jn.?.m."ji.9.m."jh.*.m."jl.7.m.'.l.1.m..i.1.m..k.2.m..l.<.m.3.l...m..ki.6.m..kh.B.m..km.2.m..k..2.m.3...2.m..ko.2.m.Rich3.m.........PE..L...)..g...........!...+..$..................$...............................7.....OK8...@...........................+.j.....5.......5..............d7..+....6......>(.8....................Q(......=(.@.............5..............................text.....$.......$................. ..`.rdata..*.....$.......$.............@..@.data... .....4.......4.............@....idata...B....5..D...25.............@..@.tls..........5......v5.............@....00cfg........5......z5.............@..@.rsrc.........5......|5.............@..@.reloc........6.......5.............@..B................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):105400
                                                                                    Entropy (8bit):5.262795777529602
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:q0BW3R64QCbj7cVI8uN7uvw/O+8KB68nN3/:qkAMVI8uNKIWTKB68nN
                                                                                    MD5:02493477EDB4DAA770B9299F26D40028
                                                                                    SHA1:1A76EB162E907BF09118E5CE60924424854CE0EA
                                                                                    SHA-256:7CC5373AB7E859A80E44B026C656E538D0C649F039A9EBCAAB9618FAC2F24A8B
                                                                                    SHA-512:40F9B0BFB82F7A371505F7A5D00EA1DF31CAE6EEAA0E22360C976C160B975390AFC41EBC4EF7BC63C67AC23CCD1817C89805713D87E6F5F78487CE9991B45FDD
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........UB..;...;...;.......;..|:...;..|8...;..|?...;..|>...;..z:...;..}:...;...:...;...:.j.;..}>...;..};...;..}....;.......;..}9...;.Rich..;.........................PE..L...w..g...........!...+..................................................................@.........................p$.......S..........F............p...+..............8...............................@............P...............................text............................... ..`.rdata..;M.......N..................@..@.data........@......................@....idata..j....P.......4..............@..@.00cfg.......p.......R..............@..@.rsrc...F............T..............@..@.reloc...............^..............@..B........................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):829368
                                                                                    Entropy (8bit):5.981254448988161
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:onSttttttOtttttttsnssPPPPPPatttttt/ttttttEPttttttgxP/8Z4EjejENyD:onl6AxPUCImSqotAb
                                                                                    MD5:C32845CB6AFD3DDC49D8046A95CC96F9
                                                                                    SHA1:5309B57A248362797CEAA55EFDFB7AA62DE26EED
                                                                                    SHA-256:CCFA5F475659D3EE9503CC4D80ECCCD34C7F012A17A74BD5A4A43C6223DB5ADB
                                                                                    SHA-512:034FAC541B6AD4F33D2D2C4992B428FAFDB10EDBFAC90AB7DAF7327C7CF5C0DE758C9627B23C25E753775662A835799F0427940267B66FCCD254777550AF6F4A
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{i<.?.R.?.R.?.R.6p..5.R...S.=.R...Q.>.R...V.5.R...W.+.R..S.;.R..xS.6.R.?.S...R..W.4.R..R.>.R....>.R.?..>.R..P.>.R.Rich?.R.................PE..L...m..g...........!...+............U3...............................................e....@..........................w...]...3.......................|...+... ..L.......8...............................@............ ...............................text...u........................... ..`.rdata..............................@..@.data....0......."..................@....idata....... ......................@..@.00cfg..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):9647032
                                                                                    Entropy (8bit):5.969919160508018
                                                                                    Encrypted:false
                                                                                    SSDEEP:98304:RaQrMDU/fMNp0louGBvt8uIifQ/Fv9FI5s9aHoV:3rJENNuGBvtJdfQ/Pcs
                                                                                    MD5:61D9A2F7E5F60B6C3CE8D16047E499E5
                                                                                    SHA1:56305620AFBE4B927F7F408945B8AACE6C635A77
                                                                                    SHA-256:0189201B139E7A30AD48825D2C1C66D220FD256F7663975D874B80A1A13A91AD
                                                                                    SHA-512:7846F6D3CB747D8FF2448ECCEDA5B9853FDFDACC1631C164E588365A4890F75EAA246DC0EAADA3597E7A9DA997CEAE005BEA926CEB3AD026AEF6ABF26CCCBB25
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$...........]...]...]...T...M...L...[...L...W...L...D...L...Y...I..Y......_......Q......\......B...]...;.............\....d.\...]...\......\...Rich]...........................PE..L...`..g...........!...+..M...I.....<........ M......................................h....@......................... lq.@...XS..D........................+......|J..Xxg.8.....................g.....pwg.@............0..X#...........................text.....M.......M................. ..`.rdata..`.9.. M...9...M.............@..@.data..../.........................@....idata..E7...0...8...r..............@..@minATL.......p......................@..@.tls................................@....00cfg..............................@..@.rsrc...............................@..@.reloc..bF.......H..................@..B........................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):660920
                                                                                    Entropy (8bit):5.8922451538755976
                                                                                    Encrypted:false
                                                                                    SSDEEP:12288:AdsyZyIuFynyewEy3yKnqyiUDhV0/rmp9HOoxAP:oyiY0/CugAP
                                                                                    MD5:1FE844379BBA361165D7C3D37DA22386
                                                                                    SHA1:CCBB8321E575A091391C69E36DC20F18238675BA
                                                                                    SHA-256:ED289FFFBCBB7262E2E8B0143187AE0C8ECA6B25A5DD040F81836138EA624A85
                                                                                    SHA-512:A30D315179BF4036360B724241A62FE8FD5B74B9587F6E1082D52145EA98C049F39DF3BB787B5DB784568AA6711E508B26A82A1AFFD911A0902DB4D20B588324
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.A.../.../.../......./..{..../..{,.../..{+.../..{*.../..z..../......./.....W./..z*.../..z/.../..z.../......./..z-.../.Rich../.........PE..L...s..g...........!...+.@...........-.......P............................... ......W.....@..............................|...............................+..............8...............................@............p...............................text...;>.......@.................. ..`.rdata.......P.......D..............@..@.data....6...0...,... ..............@....idata.......p.......L..............@..@.00cfg.......p.......L..............@..@.rsrc................N..............@..@.reloc..............Z..............@..B................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):221112
                                                                                    Entropy (8bit):5.816602376107207
                                                                                    Encrypted:false
                                                                                    SSDEEP:3072:OiCUWgNLOOBY55J7TIXVkATT7sUoSFHXkQlzXpmnPLmaGxZC5EoR5wcbkZvYK8n/:lWOKDTInoSNXrmnPL/GxEEoRvhK8n/
                                                                                    MD5:E27917D1F871D121DBD9B4879811B2FF
                                                                                    SHA1:64C4D6C7D630702E07E6FCDC81E9126190FEC0CD
                                                                                    SHA-256:95A90E69ADC7B4190724B1048EE934A10E2F3B8327EBC36580E3C2260385189F
                                                                                    SHA-512:D305E8FF1EA47CF03EC9BE480F76688B1C3050E069470EA286F35A6A1F35926484A3D158E7699AE4ECE79C6F1412C2A7D71DE633898D0B926DBCF59117A74FC2
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.R.............}..................................;.......'u..............;.......;.......;.e.............;.......Rich............................PE..L...z..g...........!...+.b................................................................@.........................0...c...da.......0...............4...+...@...6..X...8...........................p...@............P..d............................text....`.......b.................. ..`.rdata...............f..............@..@.data........0......................@....idata.......P......................@..@.00cfg....... ......................@..@.rsrc........0......................@..@.reloc...>...@...@..................@..B................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                    Category:dropped
                                                                                    Size (bytes):112056
                                                                                    Entropy (8bit):5.901668787150146
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:7mUqKE5FN0gJpTWUaX7Gd61HDKLJjJHHVIOcIObq/xI8nNy:7RErZO7HDK1jtSbq/xI8nY
                                                                                    MD5:1390728977BD8769A2110426D3FF1712
                                                                                    SHA1:B375E4ED4E7ABD88C10119A92AC5CB8ED5061828
                                                                                    SHA-256:5F758833988C5051E9EDA7B0C1B6A9ADB7D11DCCB044BEB610B704408B325E9F
                                                                                    SHA-512:3861F2FFA28CAFCD39D01D245812812CED86D5A2B12EF7EAB46A0B9628CCD51DFB42E164B1A97B637C04642609C7CF53F274AC20EDEDEEB964DFB715C85F7A55
                                                                                    Malicious:false
                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.d._.d._.d.V...W.d...e.\.d.....[.d...a.T.d...`.U.d...g.^.d...e.].d._.e.q.d.K.`.P.d.K.d.^.d.K...^.d._...^.d.K.f.^.d.Rich_.d.................PE..L...2..d...........!...$............C........ ......................................j.....@..........................v.................i................+......0....j..8............................i..@............................................text............................... ..`.rdata...`... ...b..................@..@.data...x............j..............@....idata...............l..............@..@.00cfg...............v..............@..@.rsrc...i............x..............@..@.reloc..............................@..B........................................................................................................................................................................................................
                                                                                    Process:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):40
                                                                                    Entropy (8bit):3.204162526001658
                                                                                    Encrypted:false
                                                                                    SSDEEP:3:FkXQDmoMWn:+Qj
                                                                                    MD5:57B36999B5C2CC0F5AD6917AE6165574
                                                                                    SHA1:D8C463C4AD302091BEEC3C764E6233EF7C9C2AB7
                                                                                    SHA-256:13D8D2D66A2B7F6A1C07E1D219F5518793B91BC902128CF46DC34E3112B0CDFA
                                                                                    SHA-512:7D8A16921A44BC0F48859B6A0B5F9B23A0557B0574DA6C1E9679C3B6384C8965261A46C44BC392F0DB9AA23E04CACBAD4E79F202B8AAD7527FDE654F0662489E
                                                                                    Malicious:false
                                                                                    Preview:sdPC.....................P.hf.G..x!.xk3
                                                                                    Process:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):146
                                                                                    Entropy (8bit):4.865314798737803
                                                                                    Encrypted:false
                                                                                    SSDEEP:3:KhUgtiGopGdxPKXYYxAvYvv+aQ3W7cEWAX+ZFk/iEkD5kl6nqKLiBv:KptiGjPyQxhDEnkDSKqQov
                                                                                    MD5:350F9DC8E8D9FA5C212F44C8EF88EE74
                                                                                    SHA1:6AB4F322A41D1E4BEF9C53AB0C017B93FC86DE88
                                                                                    SHA-256:8D805C10050EBFC05A50377D84B7FDB64CFD5EACAB6314BD6BA3CF602CEF61B0
                                                                                    SHA-512:F678A5651595C47C969DBE17188A304742C1349C462F4BCF1A027222C32BBAFCC8528047001AE8989C82FB8A984EAB464C8A6540D46C0ACB391DA7EABA56BD10
                                                                                    Malicious:false
                                                                                    Preview:PrefsVersion=1.1.1r1..[GUI]..[Version]..Major=3..Minor=7..Micro=3..[Directories]..TempDir=C:\\Users\\user\\AppData\\Local\\Audacity\\SessionData..
                                                                                    Process:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):146
                                                                                    Entropy (8bit):4.865314798737803
                                                                                    Encrypted:false
                                                                                    SSDEEP:3:KhUgtiGopGdxPKXYYxAvYvv+aQ3W7cEWAX+ZFk/iEkD5kl6nqKLiBv:KptiGjPyQxhDEnkDSKqQov
                                                                                    MD5:350F9DC8E8D9FA5C212F44C8EF88EE74
                                                                                    SHA1:6AB4F322A41D1E4BEF9C53AB0C017B93FC86DE88
                                                                                    SHA-256:8D805C10050EBFC05A50377D84B7FDB64CFD5EACAB6314BD6BA3CF602CEF61B0
                                                                                    SHA-512:F678A5651595C47C969DBE17188A304742C1349C462F4BCF1A027222C32BBAFCC8528047001AE8989C82FB8A984EAB464C8A6540D46C0ACB391DA7EABA56BD10
                                                                                    Malicious:false
                                                                                    Preview:PrefsVersion=1.1.1r1..[GUI]..[Version]..Major=3..Minor=7..Micro=3..[Directories]..TempDir=C:\\Users\\user\\AppData\\Local\\Audacity\\SessionData..
                                                                                    Process:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):26572
                                                                                    Entropy (8bit):5.580531117430819
                                                                                    Encrypted:false
                                                                                    SSDEEP:384:dcMcfADcscZcDQRtcPc1PMQBA6cILNLIc/7NcpL57cEPicYJcgyrqAQnccBcKAMf:duxV
                                                                                    MD5:0C429A02F648C7128E96CA363348DD0A
                                                                                    SHA1:4A11CCDDF2B9054E1C0595035D70EC137D29D2A7
                                                                                    SHA-256:BEA39362F43C042F175A2414AD80286043D587D56D1E4B4FA94587FC0098E608
                                                                                    SHA-512:4FB19C70039403116EBD78461EBA3F8D26279EEDB2107D8ADB9E5C5E41FB56629BB232515AC888D3F88DAEDCBE9C80BDD621083A1CC072AD0271FFB7B0A3BE7B
                                                                                    Malicious:false
                                                                                    Preview:pluginregistryversion=1.5..[pluginregistry]..[pluginregistry/Effect]..[pluginregistry/Effect/base64\:RWZmZWN0X0F1ZGFjaXR5X0F1ZGFjaXR5X0FtcGxpZnlfQnVpbHQtaW4gRWZmZWN0OiBBbXBsaWZ5]..Path=Built-in Effect: Amplify..Symbol=Amplify..Name=Amplify..Version=3.7.3..Vendor=Audacity..Description=..ProviderID=Module__The Audacity Team_Builtin Effects_..Enabled=1..Valid=1..EffectType=Process..EffectFamily=Audacity..EffectDefault=1..EffectInteractive=1..EffectRealtime=0..EffectAutomatable=1..[pluginregistry/Effect/base64\:RWZmZWN0X0F1ZGFjaXR5X0F1ZGFjaXR5X0F1dG8gRHVja19CdWlsdC1pbiBFZmZlY3Q6IEF1dG8gRHVjaw\=\=]..Path=Built-in Effect: Auto Duck..Symbol=Auto Duck..Name=Auto Duck..Version=3.7.3..Vendor=Audacity..Description=..ProviderID=Module__The Audacity Team_Builtin Effects_..Enabled=1..Valid=1..EffectType=Process..EffectFamily=Audacity..EffectDefault=1..EffectInteractive=1..EffectRealtime=0..EffectAutomatable=1..[pluginregistry/Effect/base64\:RWZmZWN0X0F1ZGFjaXR5X0F1ZGFjaXR5X0Jhc3MgYW5kIFRyZWJsZV9CdWl
                                                                                    Process:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):27
                                                                                    Entropy (8bit):4.004344446367528
                                                                                    Encrypted:false
                                                                                    SSDEEP:3:eRoqKsUhovn:FI
                                                                                    MD5:26F7F87E331AC09BBC90B7FB4654945B
                                                                                    SHA1:838E19CAA948F25B1D0B808DC14931DB336ABF5F
                                                                                    SHA-256:727357E84243F81E768FE8BF51D315F33895B9CE4BCD54110AE7646667E5CDD2
                                                                                    SHA-512:95F2640041FFC24B2FFF4C85B0BA89B50E39EA6BB72D19D259BCC295BF3168CA191960150C3B32E2D69D5A1B541B6A671B1A70A7867971E577612FD169630F07
                                                                                    Malicious:false
                                                                                    Preview:pluginsettingsversion=1.0..
                                                                                    Process:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):27
                                                                                    Entropy (8bit):4.004344446367528
                                                                                    Encrypted:false
                                                                                    SSDEEP:3:eRoqKsUhovn:FI
                                                                                    MD5:26F7F87E331AC09BBC90B7FB4654945B
                                                                                    SHA1:838E19CAA948F25B1D0B808DC14931DB336ABF5F
                                                                                    SHA-256:727357E84243F81E768FE8BF51D315F33895B9CE4BCD54110AE7646667E5CDD2
                                                                                    SHA-512:95F2640041FFC24B2FFF4C85B0BA89B50E39EA6BB72D19D259BCC295BF3168CA191960150C3B32E2D69D5A1B541B6A671B1A70A7867971E577612FD169630F07
                                                                                    Malicious:false
                                                                                    Preview:pluginsettingsversion=1.0..
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Directory Converter, Author: GPSoftware, Keywords: Installer, Comments: This installer database contains the logic and data required to install Directory Converter., Template: Intel;1033, Revision Number: {C18396A7-35E7-4830-B61F-0C5FAC07CF20}, Create Time/Date: Tue Apr 15 22:13:22 2025, Last Saved Time/Date: Tue Apr 15 22:13:22 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                                                                                    Category:dropped
                                                                                    Size (bytes):19652608
                                                                                    Entropy (8bit):7.999251613979193
                                                                                    Encrypted:true
                                                                                    SSDEEP:393216:Ni/1w0JHs3YEFyDnWB+9jlejAHu4y6/as:NCwYEFyaqp4AO4y4a
                                                                                    MD5:BE1C1078180EF9B833853BE5A1EF73F8
                                                                                    SHA1:4095649239030E10FC6EE6692362E112336A6CC5
                                                                                    SHA-256:6251D8F0AF660E1E92506D6CEA15FD9A7D332A669A6E1B3CF47914B45267B16D
                                                                                    SHA-512:D76DE7BCC39C708B3D438C8202C5295946559D9C60B570B11C5018BFB3AD6A2CA7ED0717811EB47CF4A6499E350310475EAB1EAFD331AFDAF9FFFBD3C21454D6
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Directory Converter, Author: GPSoftware, Keywords: Installer, Comments: This installer database contains the logic and data required to install Directory Converter., Template: Intel;1033, Revision Number: {C18396A7-35E7-4830-B61F-0C5FAC07CF20}, Create Time/Date: Tue Apr 15 22:13:22 2025, Last Saved Time/Date: Tue Apr 15 22:13:22 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                                                                                    Category:dropped
                                                                                    Size (bytes):19652608
                                                                                    Entropy (8bit):7.999251613979193
                                                                                    Encrypted:true
                                                                                    SSDEEP:393216:Ni/1w0JHs3YEFyDnWB+9jlejAHu4y6/as:NCwYEFyaqp4AO4y4a
                                                                                    MD5:BE1C1078180EF9B833853BE5A1EF73F8
                                                                                    SHA1:4095649239030E10FC6EE6692362E112336A6CC5
                                                                                    SHA-256:6251D8F0AF660E1E92506D6CEA15FD9A7D332A669A6E1B3CF47914B45267B16D
                                                                                    SHA-512:D76DE7BCC39C708B3D438C8202C5295946559D9C60B570B11C5018BFB3AD6A2CA7ED0717811EB47CF4A6499E350310475EAB1EAFD331AFDAF9FFFBD3C21454D6
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):39100
                                                                                    Entropy (8bit):5.724583714752812
                                                                                    Encrypted:false
                                                                                    SSDEEP:768:+qH4io5bO+Atk05XWyWhzoYos8ovjG/hKDfpXI2FzeUeTy:v4x5K+Atk05XFjsvvq/sDfph9
                                                                                    MD5:4CA5E758EF1444D54311762570555D1F
                                                                                    SHA1:2AC423D026184247D54BE992B6D8D556CA0E8048
                                                                                    SHA-256:B3CBFDE63DEBDE84236FD9BBC28BB6D3CD25F5C218FD58BA74848338603C4164
                                                                                    SHA-512:BBE2A7AEC19044B07D4930271268681F7DD0B09209F1149563745C85EB86FA0E1141DD463B9080BC3649C086974F474963C08489DC8205A633031173EA8FE253
                                                                                    Malicious:false
                                                                                    Preview:...@IXOS.@.....@.;.Z.@.....@.....@.....@.....@.....@......&.{269E0548-9833-4152-BFAE-78ADA6691E16}..Directory Converter..TRxHlAc5qV.msi.@.....@.....@.....@........&.{C18396A7-35E7-4830-B61F-0C5FAC07CF20}.....@.....@.....@.....@.......@.....@.....@.......@......Directory Converter......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@q....@.....@.]....&.{6692B693-5A98-89D1-88D8-A7D6CC742A84}N.C:\Users\user\AppData\Local\Programs\Directory Converter\License Agreement.txt.@.......@.....@.....@......&.{6D791EF7-BFC8-2113-A063-8C94B8C5C885}J.C:\Users\user\AppData\Local\Programs\Directory Converter\Release Notes.txt.@.......@.....@.....@......&.{2A3552F7-DF7E-D0FB-6D75-E52E45E8BCFB}D.C:\Users\user\AppData\Local\Programs\Directory Converter\wodKeys.pdf.@.......@.....@.....@......&.{D1514EB2-E1C2-5D11-6C92-1585437D53CA}E.C:\Users\user\AppData\Local\Programs\Directory Converter\Audac
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                    Category:dropped
                                                                                    Size (bytes):20480
                                                                                    Entropy (8bit):1.1639080230394312
                                                                                    Encrypted:false
                                                                                    SSDEEP:12:JSbX72FjpAGiLIlHVRpZh/7777777777777777777777777vDHF1bXNbit/l0i8Q:J/QI5tDXNiiF
                                                                                    MD5:4C89ADE058BDEF5E2C92FC0001999081
                                                                                    SHA1:132D7F4C2E6583BAD42A6DFBFF1D6D957CD5E6F1
                                                                                    SHA-256:B615872FAA7C76D82D67859484AB8F5F617369FB618F7350578C67C7303A685B
                                                                                    SHA-512:D46126ABC122318CAA1EDC39DFDFC91D0E74FDB4D7126787D33360C9384C3CBDD7196D08F8DACEA7902FC241EE7731AC97B3D52A78BA448AB75C3329C775F6F2
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                    Category:dropped
                                                                                    Size (bytes):20480
                                                                                    Entropy (8bit):1.4937832789307401
                                                                                    Encrypted:false
                                                                                    SSDEEP:48:B8PhquRc06WXJaFT5b38EpG4mS5nrlpG4mSITYxL:chq1RFTls+mEmS
                                                                                    MD5:D5C994BDB834EB924EECF5EEB9C27C9B
                                                                                    SHA1:22C0121A154538DF9900C43B32F174903F26123B
                                                                                    SHA-256:49483C07258590CCCBC71A2A61CEB3F94296D005E7ABF17677D8E6817D5A21DC
                                                                                    SHA-512:C7FF104F03A0285887CE005AD169C96DDA124B5F1A357E00459467C4AAA7FF6B887D877B9003CA9FDE48B941FF7140DEF75FEC6F3562899591596BF7456CA02A
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                    Category:dropped
                                                                                    Size (bytes):363829
                                                                                    Entropy (8bit):5.365411634842625
                                                                                    Encrypted:false
                                                                                    SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauA:zTtbmkExhMJCIpEF
                                                                                    MD5:AF5FE6AA242701C79A3592C127D3F2EF
                                                                                    SHA1:E0A67F09B274FECE992EAA2B866727165E60B1E3
                                                                                    SHA-256:0B3E3D7C93C243942F27FBF286D61C8DC358D04581713CDF537EA9BED34271FE
                                                                                    SHA-512:8262E21F8552EBF4A7542A7493939DB1A4C445D72A2639B72442D56868EA0B860B4B362CD40428E29D814BA5418F30621E0E97B979DFE71CC6759E20C0311A98
                                                                                    Malicious:false
                                                                                    Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):512
                                                                                    Entropy (8bit):0.0
                                                                                    Encrypted:false
                                                                                    SSDEEP:3::
                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                    Malicious:false
                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                    Category:dropped
                                                                                    Size (bytes):20480
                                                                                    Entropy (8bit):1.4937832789307401
                                                                                    Encrypted:false
                                                                                    SSDEEP:48:B8PhquRc06WXJaFT5b38EpG4mS5nrlpG4mSITYxL:chq1RFTls+mEmS
                                                                                    MD5:D5C994BDB834EB924EECF5EEB9C27C9B
                                                                                    SHA1:22C0121A154538DF9900C43B32F174903F26123B
                                                                                    SHA-256:49483C07258590CCCBC71A2A61CEB3F94296D005E7ABF17677D8E6817D5A21DC
                                                                                    SHA-512:C7FF104F03A0285887CE005AD169C96DDA124B5F1A357E00459467C4AAA7FF6B887D877B9003CA9FDE48B941FF7140DEF75FEC6F3562899591596BF7456CA02A
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):512
                                                                                    Entropy (8bit):0.0
                                                                                    Encrypted:false
                                                                                    SSDEEP:3::
                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                    Malicious:false
                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):512
                                                                                    Entropy (8bit):0.0
                                                                                    Encrypted:false
                                                                                    SSDEEP:3::
                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                    Malicious:false
                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                    Category:dropped
                                                                                    Size (bytes):32768
                                                                                    Entropy (8bit):1.2018461206507776
                                                                                    Encrypted:false
                                                                                    SSDEEP:48:9liuwPveFXJLT5R38EpG4mS5nrlpG4mSITYxL:ziwzTns+mEmS
                                                                                    MD5:D98B90EF1E8129A2979DDF8ED3E8F827
                                                                                    SHA1:DB7996DD757ABFD9C628469B1BCC73D0EC7FE7AF
                                                                                    SHA-256:478FFB5CEE6E20EA48416B8947FEDB3354C1120270AA97F2D55CF782DD56EE65
                                                                                    SHA-512:26ED3EAEE386A20291F8B5D5D5BA1547E5F6F3A917412E4621DDA5EA200F99127D5347C701CBBCBFF171E64D9DC5DF81071409DE28B9798047C992C9022B7D5C
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                    Category:dropped
                                                                                    Size (bytes):32768
                                                                                    Entropy (8bit):1.2018461206507776
                                                                                    Encrypted:false
                                                                                    SSDEEP:48:9liuwPveFXJLT5R38EpG4mS5nrlpG4mSITYxL:ziwzTns+mEmS
                                                                                    MD5:D98B90EF1E8129A2979DDF8ED3E8F827
                                                                                    SHA1:DB7996DD757ABFD9C628469B1BCC73D0EC7FE7AF
                                                                                    SHA-256:478FFB5CEE6E20EA48416B8947FEDB3354C1120270AA97F2D55CF782DD56EE65
                                                                                    SHA-512:26ED3EAEE386A20291F8B5D5D5BA1547E5F6F3A917412E4621DDA5EA200F99127D5347C701CBBCBFF171E64D9DC5DF81071409DE28B9798047C992C9022B7D5C
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):512
                                                                                    Entropy (8bit):0.0
                                                                                    Encrypted:false
                                                                                    SSDEEP:3::
                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                    Malicious:false
                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                    Category:dropped
                                                                                    Size (bytes):32768
                                                                                    Entropy (8bit):1.2018461206507776
                                                                                    Encrypted:false
                                                                                    SSDEEP:48:9liuwPveFXJLT5R38EpG4mS5nrlpG4mSITYxL:ziwzTns+mEmS
                                                                                    MD5:D98B90EF1E8129A2979DDF8ED3E8F827
                                                                                    SHA1:DB7996DD757ABFD9C628469B1BCC73D0EC7FE7AF
                                                                                    SHA-256:478FFB5CEE6E20EA48416B8947FEDB3354C1120270AA97F2D55CF782DD56EE65
                                                                                    SHA-512:26ED3EAEE386A20291F8B5D5D5BA1547E5F6F3A917412E4621DDA5EA200F99127D5347C701CBBCBFF171E64D9DC5DF81071409DE28B9798047C992C9022B7D5C
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):32768
                                                                                    Entropy (8bit):0.07106191560328695
                                                                                    Encrypted:false
                                                                                    SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOv8KDf2dSnMgVky6lit/:2F0i8n0itFzDHF1bX2it/
                                                                                    MD5:0D271CCF9024D0B2F8CFBC0FD4BBEF61
                                                                                    SHA1:D18DB274DD90EB85A878BFA3ABDD60937BA325E1
                                                                                    SHA-256:BD5A711B9B1358331C056BF675789A6E6B9E7AF2B471FA24B79D129056666986
                                                                                    SHA-512:75137E7F7833D9F2699E6319AE47CECA52BA9DE88E432A3CA787B03ADCA80C3D90AFE4EBFD81344D31719A069BE9860BB866A319451A7B9494DFA50978B62E3E
                                                                                    Malicious:false
                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):69632
                                                                                    Entropy (8bit):0.11576810544291558
                                                                                    Encrypted:false
                                                                                    SSDEEP:24:jYxLRKOwVzG4q9ipVkwVzG4q9ipV7VPwGflrkgn+lm3:jYxL8LpG4mSLpG4mS5nrnt3
                                                                                    MD5:47AC82C9354B23AF9E69BE0761FE2761
                                                                                    SHA1:6D3C4E521BAE4D2AA462AEA259248F86C7899D3E
                                                                                    SHA-256:F20E0F0A0376755AB45119ED08FCC39C72B2426977517B58A9DF4F38282593A1
                                                                                    SHA-512:9DB1941A74D9446DDC38EB07475B02C39CE1A97EB17A8A04C19FB546AB88132361486AAFF9AC36A8FE85D69ECF4736380F55F088C964FBD1F3B31AF034154407
                                                                                    Malicious:false
                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:Composite Document File V2 Document, Cannot read section info
                                                                                    Category:dropped
                                                                                    Size (bytes):20480
                                                                                    Entropy (8bit):1.4937832789307401
                                                                                    Encrypted:false
                                                                                    SSDEEP:48:B8PhquRc06WXJaFT5b38EpG4mS5nrlpG4mSITYxL:chq1RFTls+mEmS
                                                                                    MD5:D5C994BDB834EB924EECF5EEB9C27C9B
                                                                                    SHA1:22C0121A154538DF9900C43B32F174903F26123B
                                                                                    SHA-256:49483C07258590CCCBC71A2A61CEB3F94296D005E7ABF17677D8E6817D5A21DC
                                                                                    SHA-512:C7FF104F03A0285887CE005AD169C96DDA124B5F1A357E00459467C4AAA7FF6B887D877B9003CA9FDE48B941FF7140DEF75FEC6F3562899591596BF7456CA02A
                                                                                    Malicious:false
                                                                                    Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    Process:C:\Windows\System32\msiexec.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):512
                                                                                    Entropy (8bit):0.0
                                                                                    Encrypted:false
                                                                                    SSDEEP:3::
                                                                                    MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                    SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                    SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                    SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                    Malicious:false
                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                    File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Directory Converter, Author: GPSoftware, Keywords: Installer, Comments: This installer database contains the logic and data required to install Directory Converter., Template: Intel;1033, Revision Number: {C18396A7-35E7-4830-B61F-0C5FAC07CF20}, Create Time/Date: Tue Apr 15 22:13:22 2025, Last Saved Time/Date: Tue Apr 15 22:13:22 2025, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
                                                                                    Entropy (8bit):7.999251613979193
                                                                                    TrID:
                                                                                    • Microsoft Windows Installer (60509/1) 88.31%
                                                                                    • Generic OLE2 / Multistream Compound File (8008/1) 11.69%
                                                                                    File name:TRxHlAc5qV.msi
                                                                                    File size:19'652'608 bytes
                                                                                    MD5:be1c1078180ef9b833853be5a1ef73f8
                                                                                    SHA1:4095649239030e10fc6ee6692362e112336a6cc5
                                                                                    SHA256:6251d8f0af660e1e92506d6cea15fd9a7d332a669a6e1b3cf47914b45267b16d
                                                                                    SHA512:d76de7bcc39c708b3d438c8202c5295946559d9c60b570b11c5018bfb3ad6a2ca7ed0717811eb47cf4a6499e350310475eab1eafd331afdaf9fffbd3c21454d6
                                                                                    SSDEEP:393216:Ni/1w0JHs3YEFyDnWB+9jlejAHu4y6/as:NCwYEFyaqp4AO4y4a
                                                                                    TLSH:6B1733037658EF43D87C447687EA97FFD1A40C810A7688193D4AB06D8E777A2FE2854E
                                                                                    File Content Preview:........................>......................................................................................................................................................................................................................................
                                                                                    Icon Hash:2d2e3797b32b2b99
                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                    Apr 22, 2025 13:29:31.932595015 CEST1.1.1.1192.168.2.100xef5dNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                    Apr 22, 2025 13:29:31.932595015 CEST1.1.1.1192.168.2.100xef5dNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                    050100s020406080100

                                                                                    Click to jump to process

                                                                                    050100s0.00204060MB

                                                                                    Click to jump to process

                                                                                    • File
                                                                                    • Registry

                                                                                    Click to dive into process behavior distribution

                                                                                    Target ID:0
                                                                                    Start time:07:29:30
                                                                                    Start date:22/04/2025
                                                                                    Path:C:\Windows\System32\msiexec.exe
                                                                                    Wow64 process (32bit):false
                                                                                    Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\TRxHlAc5qV.msi"
                                                                                    Imagebase:0x7ff7b76d0000
                                                                                    File size:69'632 bytes
                                                                                    MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                    Has elevated privileges:true
                                                                                    Has administrator privileges:true
                                                                                    Programmed in:C, C++ or other language
                                                                                    Reputation:high
                                                                                    Has exited:true
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                    Target ID:2
                                                                                    Start time:07:29:31
                                                                                    Start date:22/04/2025
                                                                                    Path:C:\Windows\System32\msiexec.exe
                                                                                    Wow64 process (32bit):false
                                                                                    Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                    Imagebase:0x7ff7b76d0000
                                                                                    File size:69'632 bytes
                                                                                    MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                    Has elevated privileges:true
                                                                                    Has administrator privileges:true
                                                                                    Programmed in:C, C++ or other language
                                                                                    Reputation:high
                                                                                    Has exited:false
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                    Target ID:3
                                                                                    Start time:07:29:40
                                                                                    Start date:22/04/2025
                                                                                    Path:C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe
                                                                                    Wow64 process (32bit):true
                                                                                    Commandline:"C:\Users\user\AppData\Local\Programs\Directory Converter\Audacity.exe"
                                                                                    Imagebase:0x340000
                                                                                    File size:10'525'112 bytes
                                                                                    MD5 hash:9488F51D9BB30C6DC834A5B16DE79507
                                                                                    Has elevated privileges:true
                                                                                    Has administrator privileges:true
                                                                                    Programmed in:C, C++ or other language
                                                                                    Yara matches:
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1870057325.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1871596638.000000000BBB7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1871519233.000000000BD09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1871596638.000000000BC4F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1869722097.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1869929994.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1868298021.000000000BB02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1868246669.000000000BBC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1872738664.000000000BCB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1869449978.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.2335776606.000000000BBB7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1870257236.000000000BB5B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1871559397.000000000BCB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1870257236.000000000BBBF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1872645698.000000000BDBC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1871596638.000000000BB71000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1869365554.000000000BBC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000002.2335776606.000000000BC4F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000003.00000003.1870775606.000000000BD09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                    Antivirus matches:
                                                                                    • Detection: 0%, ReversingLabs
                                                                                    Reputation:low
                                                                                    Has exited:false
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                                                                                    There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                                                                                    Execution Graph

                                                                                    Execution Coverage

                                                                                    Dynamic/Packed Code Coverage

                                                                                    Signature Coverage

                                                                                    Execution Coverage:1.6%
                                                                                    Dynamic/Decrypted Code Coverage:43.6%
                                                                                    Signature Coverage:8.1%
                                                                                    Total number of Nodes:172
                                                                                    Total number of Limit Nodes:4
                                                                                    Show Legend
                                                                                    Hide Nodes/Edges
                                                                                    execution_graph 1428 69b21db3 __std_exception_destroy 1620 3c45900 1622 3c4590a 1620->1622 1621 3c4599c 1622->1621 1623 3c458da EnumWindows 1622->1623 1623->1620 1447 69b23ef7 1448 69b23f10 1447->1448 1449 69b23f37 __current_exception __current_exception_context terminate 1447->1449 1450 69b23f54 1449->1450 1451 69b226f5 1454 69b23d56 1451->1454 1455 69b22703 _except_handler4_common 1454->1455 1489 3c43b43 ___scrt_dllmain_exception_filter 1490 3c45a4b 1492 3c43845 Concurrency::cancel_current_task 1490->1492 1491 3c45a6a 1492->1491 1493 3c43853 _CxxThrowException 1492->1493 1494 69b21d21 1497 69b21d87 __std_exception_copy 1494->1497 1496 69b21d2f 1497->1496 1624 69b22361 1625 69b22366 ___scrt_release_startup_lock 1624->1625 1626 69b22376 1625->1626 1627 69b2236a _execute_onexit_table 1625->1627 1628 69b22383 1626->1628 1629 69b23d2c _cexit 1626->1629 1498 69b2232d 1500 69b22335 ___scrt_release_startup_lock 1498->1500 1499 69b22352 _seh_filter_dll 1500->1499 1456 3c43bae 1457 3c43bb7 1456->1457 1458 3c43bbc 1456->1458 1462 3c43c2c 1457->1462 1466 3c43a78 1458->1466 1463 3c43c42 1462->1463 1465 3c43c4b 1463->1465 1476 3c43bdf GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 1463->1476 1465->1458 1467 3c43a84 ___scrt_is_nonwritable_in_current_image 1466->1467 1468 3c43aad dllmain_raw 1467->1468 1473 3c43aa8 1467->1473 1474 3c43a93 1467->1474 1469 3c43ac7 dllmain_crt_dispatch 1468->1469 1468->1474 1469->1473 1469->1474 1470 3c43b19 1471 3c43b22 dllmain_crt_dispatch 1470->1471 1470->1474 1472 3c43b35 dllmain_raw 1471->1472 1471->1474 1472->1474 1473->1470 1475 3c43b0e dllmain_raw 1473->1475 1475->1470 1476->1465 1634 3e33e0f 1635 3e31de1 Concurrency::cancel_current_task 1634->1635 1636 3e33e2e 1635->1636 1637 3e31def _CxxThrowException 1635->1637 1636->1636 1638 3c43828 1639 3c43836 Concurrency::cancel_current_task 1638->1639 1640 3c43853 _CxxThrowException 1639->1640 1522 69b2221f __std_type_info_destroy_list 1523 3c43870 1524 3c43880 1523->1524 1525 3c4387b 1523->1525 1525->1524 1527 3c438c3 1525->1527 1528 3c438cf ___scrt_is_nonwritable_in_current_image 1527->1528 1541 3c43df5 1528->1541 1530 3c438d6 1531 3c439c2 1530->1531 1532 3c438fd 1530->1532 1539 3c43939 ___scrt_is_nonwritable_in_current_image 1530->1539 1553 3c43f94 IsProcessorFeaturePresent 1531->1553 1545 3c43d57 1532->1545 1535 3c439c9 1536 3c4390c __RTC_Initialize 1536->1539 1548 3c43c77 RtlInitializeSListHead 1536->1548 1538 3c4391a 1538->1539 1549 3c43d2c 1538->1549 1539->1524 1542 3c43dfe 1541->1542 1557 3c4418c IsProcessorFeaturePresent 1542->1557 1544 3c43e0a ___scrt_uninitialize_crt 1544->1530 1559 3c43e2e 1545->1559 1547 3c43d5e 1547->1536 1548->1538 1550 3c43d31 ___scrt_release_startup_lock 1549->1550 1551 3c4418c IsProcessorFeaturePresent 1550->1551 1552 3c43d3a 1550->1552 1551->1552 1552->1539 1554 3c43faa 1553->1554 1555 3c43fb6 memset memset IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 1554->1555 1556 3c44099 1555->1556 1556->1535 1558 3c441b0 1557->1558 1558->1544 1560 3c43e3e 1559->1560 1561 3c43e3a 1559->1561 1562 3c43f94 6 API calls 1560->1562 1564 3c43e4b ___scrt_release_startup_lock 1560->1564 1561->1547 1563 3c43eb4 1562->1563 1564->1547 1478 69b21dc4 1483 69b21d3c 1478->1483 1480 69b21dd2 _CxxThrowException 1481 69b21de1 Concurrency::cancel_current_task 1480->1481 1482 69b21def _CxxThrowException 1481->1482 1483->1480 1683 3c45b33 1684 3c45b73 __current_exception __current_exception_context 1683->1684 1685 3c45b4c 1683->1685 1686 3c45b8f 1684->1686 1400 69b2214a 1401 69b22153 1400->1401 1402 69b22158 1400->1402 1416 69b221c8 1401->1416 1406 69b22014 1402->1406 1408 69b22020 ___scrt_is_nonwritable_in_current_image 1406->1408 1407 69b22049 dllmain_raw 1409 69b22063 dllmain_crt_dispatch 1407->1409 1414 69b2202f 1407->1414 1408->1407 1413 69b22044 1408->1413 1408->1414 1409->1413 1409->1414 1410 69b220b5 1411 69b220be dllmain_crt_dispatch 1410->1411 1410->1414 1412 69b220d1 dllmain_raw 1411->1412 1411->1414 1412->1414 1413->1410 1415 69b220aa dllmain_raw 1413->1415 1415->1410 1417 69b221de 1416->1417 1419 69b221e7 1417->1419 1420 69b2217b GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 1417->1420 1419->1402 1420->1419 1441 3c444ff IsProcessorFeaturePresent 1442 3c44514 1441->1442 1445 3c444d7 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 1442->1445 1444 3c445f7 1445->1444 1421 69b23e0f 1422 69b23e21 malloc 1421->1422 1423 69b23e14 _callnewh 1422->1423 1424 69b23e2e 1422->1424 1423->1422 1425 69b21de1 Concurrency::cancel_current_task 1423->1425 1426 69b23e3a 1425->1426 1427 69b21def _CxxThrowException 1425->1427 1426->1426 1565 69b21e0c 1566 69b21e17 1565->1566 1568 69b21e1c 1565->1568 1566->1568 1569 69b21e5f 1566->1569 1570 69b21e6b ___scrt_is_nonwritable_in_current_image 1569->1570 1587 69b22391 1570->1587 1572 69b21e72 1573 69b21e99 1572->1573 1574 69b21f5e 1572->1574 1581 69b21ef9 ___scrt_is_nonwritable_in_current_image 1572->1581 1591 69b222f3 1573->1591 1604 69b22530 IsProcessorFeaturePresent 1574->1604 1577 69b21f65 1578 69b21ea8 __RTC_Initialize 1578->1581 1594 69b22213 InitializeSListHead 1578->1594 1580 69b21eb6 1582 69b21ebb _initterm_e 1580->1582 1581->1568 1582->1581 1583 69b21ed0 1582->1583 1595 69b222c8 1583->1595 1585 69b21ed5 1585->1581 1586 69b21ed9 _initterm 1585->1586 1586->1581 1588 69b2239a 1587->1588 1608 69b2272c IsProcessorFeaturePresent 1588->1608 1590 69b223a6 ___scrt_uninitialize_crt 1590->1572 1610 69b223ca 1591->1610 1593 69b222fa 1593->1578 1594->1580 1596 69b222cd ___scrt_release_startup_lock 1595->1596 1597 69b222d1 1596->1597 1598 69b222d8 1596->1598 1599 69b2272c IsProcessorFeaturePresent 1597->1599 1601 69b222dd _configure_narrow_argv 1598->1601 1600 69b222d6 1599->1600 1600->1585 1602 69b222eb _initialize_narrow_environment 1601->1602 1603 69b222e8 1601->1603 1602->1600 1603->1585 1605 69b22546 1604->1605 1606 69b22552 memset memset IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 1605->1606 1607 69b22635 1606->1607 1607->1577 1609 69b22750 1608->1609 1609->1590 1611 69b223d6 1610->1611 1612 69b223da 1610->1612 1611->1593 1613 69b22449 1612->1613 1616 69b223e7 ___scrt_release_startup_lock 1612->1616 1614 69b22530 6 API calls 1613->1614 1615 69b22450 1614->1615 1617 69b223f4 _initialize_onexit_table 1616->1617 1618 69b22412 1616->1618 1617->1618 1619 69b22403 _initialize_onexit_table 1617->1619 1618->1593 1619->1618

                                                                                    Executed Functions

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2337105190.0000000069B21000.00000020.00000001.01000000.00000067.sdmp, Offset: 69B20000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2337085993.0000000069B20000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337187029.0000000069B24000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337269397.0000000069B2C000.00000004.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337292578.0000000069B2D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_69b20000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: dllmain_raw$dllmain_crt_dispatch
                                                                                    • String ID:
                                                                                    • API String ID: 3136044242-0
                                                                                    • Opcode ID: dca9b242999ad442566f0ae48cd0bffc04501b53b9500e2ec2fa2bcfb8424f1f
                                                                                    • Instruction ID: ccf03cb9c0cde1a4dd20430f476596ae0213bfa65501dabc54609eda8f920462
                                                                                    • Opcode Fuzzy Hash: dca9b242999ad442566f0ae48cd0bffc04501b53b9500e2ec2fa2bcfb8424f1f
                                                                                    • Instruction Fuzzy Hash: 0F219C76D102A8ABCF298E55CC41E7F3A79FB81B95B018125FD1CAB254C7318E02CBA0

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • _CxxThrowException.VCRUNTIME140(?,69B2B0AC), ref: 69B21DF8
                                                                                    • _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 69B23E17
                                                                                    • malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 69B23E24
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2337105190.0000000069B21000.00000020.00000001.01000000.00000067.sdmp, Offset: 69B20000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2337085993.0000000069B20000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337187029.0000000069B24000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337269397.0000000069B2C000.00000004.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337292578.0000000069B2D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_69b20000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExceptionThrow_callnewhmalloc
                                                                                    • String ID: Unknown exception
                                                                                    • API String ID: 4260808042-410509341
                                                                                    • Opcode ID: 633167a434a443c3ea3e525148ba2d90c7149f91a0ea68c19b70eb773093988d
                                                                                    • Instruction ID: 800bf038427c472e8cd3e2b9cc2249afdca48d098eddc565a412c640bdb62e24
                                                                                    • Opcode Fuzzy Hash: 633167a434a443c3ea3e525148ba2d90c7149f91a0ea68c19b70eb773093988d
                                                                                    • Instruction Fuzzy Hash: FFF0A734504389F7CF00E6A4EC1467E7BA8DF05794F14C564E82C490D0DB32E956C9D0

                                                                                    Non-executed Functions

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 03E3253C
                                                                                    • memset.VCRUNTIME140(?,00000000,00000003), ref: 03E32562
                                                                                    • memset.VCRUNTIME140(?,00000000,00000050), ref: 03E325EC
                                                                                    • IsDebuggerPresent.KERNEL32 ref: 03E32608
                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 03E32621
                                                                                    • UnhandledExceptionFilter.KERNEL32(?), ref: 03E3262B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333502537.0000000003E31000.00000020.00000001.01000000.00000067.sdmp, Offset: 03E30000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333484763.0000000003E30000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333520660.0000000003E34000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333541846.0000000003E3C000.00000008.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333560067.0000000003E3D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3e30000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
                                                                                    • String ID:
                                                                                    • API String ID: 1045392073-0
                                                                                    • Opcode ID: 4c715a137484fdc8bd18aa8e64dd1693a7996d8b247ae2f8bab3b9b8a238c44d
                                                                                    • Instruction ID: fa2396fb07ec00b17c10da12dbbf4cdbe9939c5242847121d4ad48345faa012e
                                                                                    • Opcode Fuzzy Hash: 4c715a137484fdc8bd18aa8e64dd1693a7996d8b247ae2f8bab3b9b8a238c44d
                                                                                    • Instruction Fuzzy Hash: 7A311679D012289BDF20DFA4D949BCDBBB8AF09704F1041AAE54DAB250EB709A84CF45

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 03C43FA0
                                                                                    • memset.VCRUNTIME140(?,00000000,00000003), ref: 03C43FC6
                                                                                    • memset.VCRUNTIME140(?,00000000,00000050), ref: 03C44050
                                                                                    • IsDebuggerPresent.KERNEL32 ref: 03C4406C
                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 03C44085
                                                                                    • UnhandledExceptionFilter.KERNEL32(?), ref: 03C4408F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333298648.0000000003C41000.00000020.00000001.01000000.00000054.sdmp, Offset: 03C40000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333281594.0000000003C40000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333315732.0000000003C46000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333337843.0000000003C53000.00000008.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333354978.0000000003C54000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3c40000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
                                                                                    • String ID:
                                                                                    • API String ID: 1045392073-0
                                                                                    • Opcode ID: ae782f32e5c3e7c7ec2ad4d5004eb7bab6fbf045ea41d6e35a6e3ce23cdf689d
                                                                                    • Instruction ID: 8c7fd2b6a8d47ac32350ecb8c65380fdde3a861972cbf26e1d083f0a1055df32
                                                                                    • Opcode Fuzzy Hash: ae782f32e5c3e7c7ec2ad4d5004eb7bab6fbf045ea41d6e35a6e3ce23cdf689d
                                                                                    • Instruction Fuzzy Hash: 0B31D875D05318DBDF21DFA5D9497CDBBB8AF08300F1041AAE50DEB240E7759A849F45

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 69B2253C
                                                                                    • memset.VCRUNTIME140(?,00000000,00000003), ref: 69B22562
                                                                                    • memset.VCRUNTIME140(?,00000000,00000050), ref: 69B225EC
                                                                                    • IsDebuggerPresent.KERNEL32 ref: 69B22608
                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 69B22621
                                                                                    • UnhandledExceptionFilter.KERNEL32(?), ref: 69B2262B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2337105190.0000000069B21000.00000020.00000001.01000000.00000067.sdmp, Offset: 69B20000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2337085993.0000000069B20000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337187029.0000000069B24000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337269397.0000000069B2C000.00000004.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337292578.0000000069B2D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_69b20000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
                                                                                    • String ID:
                                                                                    • API String ID: 1045392073-0
                                                                                    • Opcode ID: 714f1c0fe6caacbd0e28e447f3225aa9cef6030326c7f4f72cb293d04bda1364
                                                                                    • Instruction ID: 5a77342a01761689cf078bddb47eae67836b4d4a3c81f5cc5faf1b6d454bffa4
                                                                                    • Opcode Fuzzy Hash: 714f1c0fe6caacbd0e28e447f3225aa9cef6030326c7f4f72cb293d04bda1364
                                                                                    • Instruction Fuzzy Hash: B2314775C012689BDF21DFA0C9497DDBBB8FF08704F1040AAE50CAB290EB709A85CF44

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 03C43BF1
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 03C43C00
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 03C43C09
                                                                                    • QueryPerformanceCounter.KERNEL32(?), ref: 03C43C16
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333298648.0000000003C41000.00000020.00000001.01000000.00000054.sdmp, Offset: 03C40000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333281594.0000000003C40000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333315732.0000000003C46000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333337843.0000000003C53000.00000008.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333354978.0000000003C54000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3c40000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                    • String ID:
                                                                                    • API String ID: 2933794660-0
                                                                                    • Opcode ID: 3712820939614c5f511d5ba61fa6a362502181d0b6705b115f87b54e33c7b9b2
                                                                                    • Instruction ID: 71f020316fa9c9397fcca66ba722e888a3ab028d9fbdb0440494010084d1e17e
                                                                                    • Opcode Fuzzy Hash: 3712820939614c5f511d5ba61fa6a362502181d0b6705b115f87b54e33c7b9b2
                                                                                    • Instruction Fuzzy Hash: 86F05F75D1820DEFCF10DBB4C68999EFBF8EF1D200B918596A412E6100E730AA449B50
                                                                                    APIs
                                                                                    • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 03E32742
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333502537.0000000003E31000.00000020.00000001.01000000.00000067.sdmp, Offset: 03E30000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333484763.0000000003E30000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333520660.0000000003E34000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333541846.0000000003E3C000.00000008.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333560067.0000000003E3D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3e30000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: FeaturePresentProcessor
                                                                                    • String ID:
                                                                                    • API String ID: 2325560087-0
                                                                                    • Opcode ID: d57fad70413bf7532233481b321ffd75b5711cb4034a229821d97550774a6a3a
                                                                                    • Instruction ID: 1bd90f8b151bc71bf9bbf4f6147d448ccc8397a8f25816a0e42774badae89004
                                                                                    • Opcode Fuzzy Hash: d57fad70413bf7532233481b321ffd75b5711cb4034a229821d97550774a6a3a
                                                                                    • Instruction Fuzzy Hash: F7A16CB1901645CFDF18CF64C8857AABBB0FB4A718F28DAAAD655E7380D3349444CFA4
                                                                                    APIs
                                                                                    • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 03C441A2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333298648.0000000003C41000.00000020.00000001.01000000.00000054.sdmp, Offset: 03C40000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333281594.0000000003C40000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333315732.0000000003C46000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333337843.0000000003C53000.00000008.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333354978.0000000003C54000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3c40000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: FeaturePresentProcessor
                                                                                    • String ID:
                                                                                    • API String ID: 2325560087-0
                                                                                    • Opcode ID: 6f5e0f130518d78c64de184983e85d6e2e28cb159e8028aaa98adc3b80054ec7
                                                                                    • Instruction ID: 4bd947e1337ce2ba678486ac144a1f3dbc2f542247c9a8f658f57fef0377567c
                                                                                    • Opcode Fuzzy Hash: 6f5e0f130518d78c64de184983e85d6e2e28cb159e8028aaa98adc3b80054ec7
                                                                                    • Instruction Fuzzy Hash: 4EA148B1A006059FDB2CDF59D8867A9FBF9FB49324F28926AD416EB380D7349940CF50
                                                                                    APIs
                                                                                    • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 69B22742
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2337105190.0000000069B21000.00000020.00000001.01000000.00000067.sdmp, Offset: 69B20000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2337085993.0000000069B20000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337187029.0000000069B24000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337269397.0000000069B2C000.00000004.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337292578.0000000069B2D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_69b20000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: FeaturePresentProcessor
                                                                                    • String ID:
                                                                                    • API String ID: 2325560087-0
                                                                                    • Opcode ID: 6338a1e48a695bbace46d386b183a5925de28e5c6527da37fcffc27ec66a1414
                                                                                    • Instruction ID: b1db2d6a27356c6de09f76c39b4ccd73ad30e4fb7b8d9cbbc0e4cfc2cd038c01
                                                                                    • Opcode Fuzzy Hash: 6338a1e48a695bbace46d386b183a5925de28e5c6527da37fcffc27ec66a1414
                                                                                    • Instruction Fuzzy Hash: 39A16C719256858BDF18CF64C8827BABBB0FB4A714F24866AD619EB280D334D845CF64

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 97 3e32014-3e32025 call 3e326b0 100 3e32027-3e3202d 97->100 101 3e32036-3e3203d 97->101 100->101 104 3e3202f-3e32031 100->104 102 3e32049-3e3205d dllmain_raw 101->102 103 3e3203f-3e32042 101->103 107 3e32063-3e32074 dllmain_crt_dispatch 102->107 108 3e32106-3e3210d 102->108 103->102 106 3e32044-3e32047 103->106 105 3e3210f-3e3211e 104->105 109 3e3207a-3e3208c call 3e31bda 106->109 107->108 107->109 108->105 112 3e320b5-3e320b7 109->112 113 3e3208e-3e32090 109->113 115 3e320b9-3e320bc 112->115 116 3e320be-3e320cf dllmain_crt_dispatch 112->116 113->112 114 3e32092-3e320b0 call 3e31bda call 3e31f66 dllmain_raw 113->114 114->112 115->108 115->116 116->108 117 3e320d1-3e32103 dllmain_raw 116->117 117->108
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333502537.0000000003E31000.00000020.00000001.01000000.00000067.sdmp, Offset: 03E30000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333484763.0000000003E30000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333520660.0000000003E34000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333541846.0000000003E3C000.00000008.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333560067.0000000003E3D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3e30000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: dllmain_raw$dllmain_crt_dispatch
                                                                                    • String ID:
                                                                                    • API String ID: 3136044242-0
                                                                                    • Opcode ID: dca9b242999ad442566f0ae48cd0bffc04501b53b9500e2ec2fa2bcfb8424f1f
                                                                                    • Instruction ID: 1ae7fddd290f8675f1975e3a86a8dc1cbd3c1cd1aa3ed24c763702781b57855a
                                                                                    • Opcode Fuzzy Hash: dca9b242999ad442566f0ae48cd0bffc04501b53b9500e2ec2fa2bcfb8424f1f
                                                                                    • Instruction Fuzzy Hash: 6221A375D00228ABCB31EF55CD48AAF7A79EB82694B059B59FA456F210C731CD01CFD0

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333298648.0000000003C41000.00000020.00000001.01000000.00000054.sdmp, Offset: 03C40000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333281594.0000000003C40000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333315732.0000000003C46000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333337843.0000000003C53000.00000008.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333354978.0000000003C54000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3c40000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: dllmain_raw$dllmain_crt_dispatch
                                                                                    • String ID:
                                                                                    • API String ID: 3136044242-0
                                                                                    • Opcode ID: bbfcdaca315206a07a00baf54b9d9229b8bc8aaa4125adcbdac022be2a290556
                                                                                    • Instruction ID: 9c765193436bdb81801bfe4cf96d7e365f721825c2d0d2e26cf35a961aac541d
                                                                                    • Opcode Fuzzy Hash: bbfcdaca315206a07a00baf54b9d9229b8bc8aaa4125adcbdac022be2a290556
                                                                                    • Instruction Fuzzy Hash: CC21447AE00299AADF21DE55CC44F6F7A69EBC46A0B094115F815EF250CB308E219BD0

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • __current_exception.VCRUNTIME140 ref: 69B23F37
                                                                                    • __current_exception_context.VCRUNTIME140 ref: 69B23F47
                                                                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 69B23F4E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2337105190.0000000069B21000.00000020.00000001.01000000.00000067.sdmp, Offset: 69B20000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2337085993.0000000069B20000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337187029.0000000069B24000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337269397.0000000069B2C000.00000004.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337292578.0000000069B2D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_69b20000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: __current_exception__current_exception_contextterminate
                                                                                    • String ID: csm
                                                                                    • API String ID: 2542180945-1018135373
                                                                                    • Opcode ID: 254a1fa4a37caa603eb2b862c067655f2819e218537ce9c160242962c533d210
                                                                                    • Instruction ID: 5e01b16e6a3b4e9bea234883188402d5cd5ebb19658943030f7c16535570ecc2
                                                                                    • Opcode Fuzzy Hash: 254a1fa4a37caa603eb2b862c067655f2819e218537ce9c160242962c533d210
                                                                                    • Instruction Fuzzy Hash: 57F0DF789002889FCF00DF98D880AADBBF1FF08714F019095E818AB360D739AD42CF65

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • __RTC_Initialize.LIBCMT ref: 69B21EAC
                                                                                      • Part of subcall function 69B22213: InitializeSListHead.KERNEL32(69B2C138,69B21EB6,69B2B0D8,00000010,69B21E47,?,?), ref: 69B22218
                                                                                    • _initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(69B240EC,69B240F0,69B2B0D8,00000010,69B21E47,?,?), ref: 69B21EC5
                                                                                    • _initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(69B240E4,69B240E8,69B2B0D8,00000010,69B21E47,?,?), ref: 69B21EE3
                                                                                    • ___scrt_is_nonwritable_in_current_image.LIBCMT ref: 69B21F16
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2337105190.0000000069B21000.00000020.00000001.01000000.00000067.sdmp, Offset: 69B20000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2337085993.0000000069B20000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337187029.0000000069B24000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337269397.0000000069B2C000.00000004.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337292578.0000000069B2D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_69b20000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
                                                                                    • String ID:
                                                                                    • API String ID: 590286634-0
                                                                                    • Opcode ID: 58132a60084ae92eb0458c249d4dfa372c19bef29c4461c3c6f213ae53e49684
                                                                                    • Instruction ID: 83c3269ce118c75b6ce18bc61f521e32ee55647d74a0c96e058cac74a6321952
                                                                                    • Opcode Fuzzy Hash: 58132a60084ae92eb0458c249d4dfa372c19bef29c4461c3c6f213ae53e49684
                                                                                    • Instruction Fuzzy Hash: A921233A6682C59ADF04ABE498027BC3761EF1276DF14D059D59CAB1C1CB23504286A6

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 03E3218D
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 03E3219C
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 03E321A5
                                                                                    • QueryPerformanceCounter.KERNEL32(?), ref: 03E321B2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333502537.0000000003E31000.00000020.00000001.01000000.00000067.sdmp, Offset: 03E30000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333484763.0000000003E30000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333520660.0000000003E34000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333541846.0000000003E3C000.00000008.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333560067.0000000003E3D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3e30000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                    • String ID:
                                                                                    • API String ID: 2933794660-0
                                                                                    • Opcode ID: a24e6abd7f6282d236048e6d8ababa8d8e0eb8c321a32dcfa39954ba94d408a2
                                                                                    • Instruction ID: bf6b6aa01910b4fd2e699531559f93c8795693f156d08c68f2a791d9fb69c59a
                                                                                    • Opcode Fuzzy Hash: a24e6abd7f6282d236048e6d8ababa8d8e0eb8c321a32dcfa39954ba94d408a2
                                                                                    • Instruction Fuzzy Hash: 5FF0B274C0020CEBCF01DBB4C648AAFBBF4FF1D601B914596A512E7540E730AB849F50

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 69B2218D
                                                                                    • GetCurrentThreadId.KERNEL32 ref: 69B2219C
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 69B221A5
                                                                                    • QueryPerformanceCounter.KERNEL32(?), ref: 69B221B2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2337105190.0000000069B21000.00000020.00000001.01000000.00000067.sdmp, Offset: 69B20000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2337085993.0000000069B20000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337187029.0000000069B24000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337269397.0000000069B2C000.00000004.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2337292578.0000000069B2D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_69b20000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                    • String ID:
                                                                                    • API String ID: 2933794660-0
                                                                                    • Opcode ID: a24e6abd7f6282d236048e6d8ababa8d8e0eb8c321a32dcfa39954ba94d408a2
                                                                                    • Instruction ID: bf6b6aa01910b4fd2e699531559f93c8795693f156d08c68f2a791d9fb69c59a
                                                                                    • Opcode Fuzzy Hash: a24e6abd7f6282d236048e6d8ababa8d8e0eb8c321a32dcfa39954ba94d408a2
                                                                                    • Instruction Fuzzy Hash: 5FF0B274C0020CEBCF01DBB4C648AAFBBF4FF1D601B914596A512E7540E730AB849F50

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • __current_exception.VCRUNTIME140 ref: 03E33F37
                                                                                    • __current_exception_context.VCRUNTIME140 ref: 03E33F47
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333502537.0000000003E31000.00000020.00000001.01000000.00000067.sdmp, Offset: 03E30000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333484763.0000000003E30000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333520660.0000000003E34000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333541846.0000000003E3C000.00000008.00000001.01000000.00000067.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333560067.0000000003E3D000.00000002.00000001.01000000.00000067.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3e30000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: __current_exception__current_exception_context
                                                                                    • String ID: csm
                                                                                    • API String ID: 1340570062-1018135373
                                                                                    • Opcode ID: 254a1fa4a37caa603eb2b862c067655f2819e218537ce9c160242962c533d210
                                                                                    • Instruction ID: e95a5899a163108a50acd5148ac323d09cf72b8441065077bcb43a732cc6d4f9
                                                                                    • Opcode Fuzzy Hash: 254a1fa4a37caa603eb2b862c067655f2819e218537ce9c160242962c533d210
                                                                                    • Instruction Fuzzy Hash: 04F0AA78A002089FCF04EF98C488AADBBB1BB0A310F555155E808AB320D739AD41CF65

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • __current_exception.VCRUNTIME140 ref: 03C45B73
                                                                                    • __current_exception_context.VCRUNTIME140 ref: 03C45B83
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2333298648.0000000003C41000.00000020.00000001.01000000.00000054.sdmp, Offset: 03C40000, based on PE: true
                                                                                    • Associated: 00000003.00000002.2333281594.0000000003C40000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333315732.0000000003C46000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333337843.0000000003C53000.00000008.00000001.01000000.00000054.sdmpDownload File
                                                                                    • Associated: 00000003.00000002.2333354978.0000000003C54000.00000002.00000001.01000000.00000054.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_3c40000_Audacity.jbxd
                                                                                    Similarity
                                                                                    • API ID: __current_exception__current_exception_context
                                                                                    • String ID: csm
                                                                                    • API String ID: 1340570062-1018135373
                                                                                    • Opcode ID: d67f68a00801908b8e833cf19244804b1bdea648e27d984f4b7621a54d04b825
                                                                                    • Instruction ID: 249b00ddc7825bcc03c595cf806cdfe27a0c4e6220b1afcad0a400a7519df213
                                                                                    • Opcode Fuzzy Hash: d67f68a00801908b8e833cf19244804b1bdea648e27d984f4b7621a54d04b825
                                                                                    • Instruction Fuzzy Hash: FBF05F789042199FCF05EF98D540A9DBBB1EB0A210F164065E804EB320D739A9419B65