Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
WsiysHggF9.exe

Overview

General Information

Sample Name:WsiysHggF9.exe
Analysis ID:715159
MD5:350ea577229a9518d3b9dcd76d109e14
SHA1:b9431df0ca98d1fa3abeefc92d1bd25e4c8b4e22
SHA256:2c8960c00dfc803bb8175a6833904173b6ff044c7128c24c8de2379b47274c77
Tags:exeRedLineStealer
Infos:

Detection

RedLine
Score:50
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected RedLine Stealer
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Generic Downloader
Obfuscated command line found
Tries to detect virtualization through RDTSC time measurements
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Drops PE files to the application program directory (C:\ProgramData)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Stores files to the Windows start menu directory
Contains functionality to communicate with device drivers
Found dropped PE file which has not been started or loaded
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
Entry point lies outside standard sections
Sample file is different than original file name gathered from version info
Allocates memory with a write watch (potentially for evading sandboxes)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
File is packed with WinRar
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • WsiysHggF9.exe (PID: 5904 cmdline: C:\Users\user\Desktop\WsiysHggF9.exe MD5: 350EA577229A9518D3B9DCD76D109E14)
    • audacity-win-3.2.0-64bit.exe (PID: 5640 cmdline: "C:\ProgramData\audacity-win-3.2.0-64bit.exe" MD5: 553B47079E2FD4820EF2F9841297EF97)
      • audacity-win-3.2.0-64bit.tmp (PID: 4432 cmdline: "C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmp" /SL5="$5040E,13178964,955904,C:\ProgramData\audacity-win-3.2.0-64bit.exe" MD5: 220722BABC7320F6FF80BB591C9DA719)
        • _setup64.tmp (PID: 3612 cmdline: helper 105 0x420 MD5: E4211D6D009757C078A9FAC7FF4F03D4)
          • conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • Audacity.exe (PID: 1928 cmdline: C:\Program Files\Audacity\audacity.exe MD5: 686920484890800433A208E111666FE1)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_RedLineYara detected RedLine StealerJoe Security
    dump.pcapJoeSecurity_RedLine_1Yara detected RedLine StealerJoe Security

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      1.3.Installation_controller.exe.3fc3a610.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
      • 0x694ce:$pat14: , CommandLine:
      • 0x53416:$v2_1: ListOfProcesses
      • 0x50444:$v4_4: stringKey
      • 0x531b0:$v4_8: procName
      • 0x4e6c2:$v5_1: DownloadAndExecuteUpdate
      • 0x4e6ea:$v5_2: ITaskProcessor
      • 0x4e6b0:$v5_3: CommandLineUpdate
      • 0x4e6db:$v5_4: DownloadUpdate
      • 0x4e624:$v5_5: FileScanning
      • 0x4e8c2:$v5_7: RecordHeaderField
      • 0x4e7ec:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
      1.3.Installation_controller.exe.3fc3a610.0.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
      • 0x5c351:$s1: file:///
      • 0x5c261:$s2: {11111-22222-10009-11112}
      • 0x5c2e1:$s3: {11111-22222-50001-00000}
      • 0x579ac:$s4: get_Module
      • 0x51d04:$s5: Reverse
      • 0x5009f:$s6: BlockCopy
      • 0x582f8:$s7: ReadByte
      • 0x5c363:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
      1.3.Installation_controller.exe.3fc3a610.0.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
        1.3.Installation_controller.exe.3fc3a610.0.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
        • 0x6b2ce:$pat14: , CommandLine:
        • 0x55216:$v2_1: ListOfProcesses
        • 0x52244:$v4_4: stringKey
        • 0x54fb0:$v4_8: procName
        • 0x504c2:$v5_1: DownloadAndExecuteUpdate
        • 0x504ea:$v5_2: ITaskProcessor
        • 0x504b0:$v5_3: CommandLineUpdate
        • 0x504db:$v5_4: DownloadUpdate
        • 0x50424:$v5_5: FileScanning
        • 0x506c2:$v5_7: RecordHeaderField
        • 0x505ec:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
        1.3.Installation_controller.exe.3fc3a610.0.raw.unpackMALWARE_Win_zgRATDetects zgRATditekSHen
        • 0x5e151:$s1: file:///
        • 0x5e061:$s2: {11111-22222-10009-11112}
        • 0x5e0e1:$s3: {11111-22222-50001-00000}
        • 0x597ac:$s4: get_Module
        • 0x53b04:$s5: Reverse
        • 0x51e9f:$s6: BlockCopy
        • 0x5a0f8:$s7: ReadByte
        • 0x5e163:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

        Sigma Signatures

        ⊘No Sigma rule has matched

        Snort Signatures

        Timestamp:188.34.179.139192.168.2.610561496932850353 10/03/22-17:32:43.853269
        SID:2850353
        Source Port:10561
        Destination Port:49693
        Protocol:TCP
        Classtype:A Network Trojan was detected
        Timestamp:192.168.2.6188.34.179.13949693105612850027 10/03/22-17:32:43.736332
        SID:2850027
        Source Port:49693
        Destination Port:10561
        Protocol:TCP
        Classtype:A Network Trojan was detected
        Timestamp:192.168.2.6188.34.179.13949693105612850286 10/03/22-17:32:54.635526
        SID:2850286
        Source Port:49693
        Destination Port:10561
        Protocol:TCP
        Classtype:A Network Trojan was detected

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: WsiysHggF9.exeReversingLabs: Detection: 51%
        Source: WsiysHggF9.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Audacity_is1Jump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\AudacityJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\unins000.datJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-NL931.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-9T84T.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-0UADG.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-P90KL.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-NTE5N.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-9JHT8.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-2SCU5.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-CV5R1.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-7U34J.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-7F1IJ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-EPTFT.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-IU3MP.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-NKFUD.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-5OMUN.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-5LJ3G.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-JO5BM.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-SO45U.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-VGNVB.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-E63DL.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-7BF1G.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-MVD1T.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-J5UM8.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-OF8N5.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-DBS3U.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-7HBD3.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-EE795.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-6S7SN.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-V5T2O.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-9K9M7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-UFU1R.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-DEMF3.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-JALHN.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-19I02.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-GCDE1.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-1J0J3.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-HKQ8J.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-U641C.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-KRBVG.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-R9F1C.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-VMF33.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-NOB4R.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-37ABV.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-HKD6O.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-L050V.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-GAK9A.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-UR1D7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-3RF3V.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-EGO60.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-KJ41F.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-AG00V.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-8JNDO.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-0UDPU.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-L0CK2.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-TDP90.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-4STCS.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-H8I8G.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-UJ3RS.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-LAIB1.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-K3IU2.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-32N1E.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-0KP7K.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-8SGGQ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-IOAI2.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-K8GOH.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-KRBQ3.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-6C785.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-5BTDL.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-5AL5G.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\is-7A0A0.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\LanguagesJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\afJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\af\is-HO62N.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\arJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ar\is-T0H9J.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\beJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\be\is-M4P44.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\bgJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\bg\is-3UN24.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\bnJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\bn\is-TP6MB.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\bsJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\bs\is-2VUIJ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\caJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ca\is-6CEK5.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ca_ES@valenciaJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ca_ES@valencia\is-MT216.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\coJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\co\is-3NQSM.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\csJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\cs\is-T6M9E.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\cyJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\cy\is-H92PA.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\daJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\da\is-L5QPV.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\deJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\de\is-52QJJ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\elJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\el\is-4K82R.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\esJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\es\is-44RRB.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\euJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\eu\is-BBOJ7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\eu_ESJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\eu_ES\is-AMHSN.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\faJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\fa\is-FG87I.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\fiJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\fi\is-N6N61.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\frJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\fr\is-NL67K.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\gaJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ga\is-T5ETS.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\glJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\gl\is-OKLKC.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\heJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\he\is-O5794.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\hiJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\hi\is-SQO61.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\hrJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\hr\is-PHG0Q.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\huJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\hu\is-LCVQ1.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\hyJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\hy\is-U2HOB.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\idJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\id\is-3J2H4.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\itJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\it\is-E6HJ8.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\jaJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ja\is-JQCT8.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\kaJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ka\is-61DBE.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\kmJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\km\is-7REVL.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\koJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ko\is-J5S6V.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ltJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\lt\is-2CVMQ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\mkJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\mk\is-02VU6.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\mrJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\mr\is-NDISD.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\myJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\my\is-PIIHM.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\nbJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\nb\is-B1TJE.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\nlJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\nl\is-RTSGB.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ocJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\oc\is-FI563.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\plJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\pl\is-LEVD6.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\pt_BRJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\pt_BR\is-IMKJS.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\pt_PTJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\pt_PT\is-CU15K.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\roJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ro\is-F0KFG.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ruJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ru\is-DR3N6.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\skJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\sk\is-N11CT.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\slJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\sl\is-4TL5P.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\sr_RSJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\sr_RS\is-PRSVB.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\sr_RS@latinJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\sr_RS@latin\is-644HF.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\svJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\sv\is-BSL79.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\taJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ta\is-D76SJ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\tgJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\tg\is-KRUGD.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\trJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\tr\is-SKP1O.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\ukJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\uk\is-1SRVN.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\viJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\vi\is-DG9PQ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\zh_CNJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\zh_CN\is-5KIHE.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\zh_TWJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Languages\zh_TW\is-1MOHQ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\NyquistJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-7K270.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-NTKH4.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-D9254.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-IL8FC.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-UVR1R.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-PVUQC.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-QSS2A.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-CGAC7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-8A690.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-PPVH8.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-RHAJM.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-HH9U2.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-CFM98.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-EVALG.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-L09O0.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-5GAUM.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-NQM3B.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-ESFAT.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-13T21.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-BQNBQ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-V3FC0.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-BNLP7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-6R5OG.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-RAD77.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-G5GC0.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-DQTC5.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-MROM6.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-2UCMK.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-NPI02.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\is-MMQJF.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwavesJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-P0K9Q.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-3463Q.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-E4TOU.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-5EL2U.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-05MM5.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-727SG.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-3DJRE.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-RT5IA.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-20JHV.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-HJCIF.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-E3H07.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-C2JTA.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-O6A7U.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-P38RE.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Nyquist\rawwaves\is-4EKK3.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-InsJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-TBL3M.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-ODRMT.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-LRPH6.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-II6NQ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-11997.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-P00HI.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-EJHHE.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-6KU03.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-LHPLL.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-V3UUL.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-MD7TV.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-KU5LN.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-02MKN.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-SP0OV.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-NO5SG.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-SO3LD.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-BRLM5.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-BD9F7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-G1KMP.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-06UFT.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-6QFDO.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-P1C46.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-77BQK.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-853A0.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-QVTJ7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-591EJ.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-MQUPM.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-LKBSE.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\Plug-Ins\is-C5P2B.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\modulesJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\modules\is-JOTP7.tmpJump to behavior
        Source: C:\Users\user\AppData\Local\Temp\is-BVVE5.tmp\audacity-win-3.2.0-64bit.tmpDirectory created: C:\Program Files\Audacity\unins000.msgJump to behavior
        Source: WsiysHggF9.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
        Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: WsiysHggF9.exe, 00000000.00000003.245658936.00000000052DC000.00000004.00000800.00020000.00000000.sdmp, WsiysHggF9.exe, 00000000.00000002.303976798.0000000000272000.00000002.00000001.01000000.00000003.sdmp, WsiysHggF9.exe, 00000000.00000003.244701687.00000000052B8000.00000004.00000800.00020000.00000000.sdmp, WsiysHggF9.exe, 00000000.00000000.243769548.0000000000272000.00000002.00000001.01000000.00000003.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\mpg123\1.29.3\_\_\build\9e1553e6621f02c61665c153436b2dfb785b6498\bin\mpg123.pdb00 source: Audacity.exe, 00000010.00000002.583274055.00007FFCFF249000.00000002.00000001.01000000.00000018.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC\RelWithDebInfo\FLAC.pdb11 source: Audacity.exe, 00000010.00000002.580349736.00007FFCFF0A0000.00000002.00000001.01000000.00000013.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\ogg\1.3.4\_\_\build\ad5261bf6074807e7189c351b0f79b113bf2f6c0\build\RelWithDebInfo\ogg.pdb source: Audacity.exe, 00000010.00000002.576735272.00007FFCFEEB9000.00000002.00000001.01000000.00000010.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC++\RelWithDebInfo\FLAC++.pdb!! source: Audacity.exe, 00000010.00000002.583539424.00007FFCFF270000.00000002.00000001.01000000.00000019.sdmp
        Source: Binary string: _.pdb source: Installation_controller.exe, 00000001.00000003.378455694.000000003FC3A000.00000004.00000020.00020000.00000000.sdmp
        Source: Binary string: D:\a\audacity\audacity\.build.x64\bin\RelWithDebInfo\modules\mod-script-pipe.pdb source: audacity-win-3.2.0-64bit.tmp, 0000000B.00000002.516640303.0000000000198000.00000004.00000010.00020000.00000000.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbis.pdb** source: Audacity.exe, 00000010.00000002.578547685.00007FFCFEFAB000.00000002.00000001.01000000.00000011.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC\RelWithDebInfo\FLAC.pdb source: Audacity.exe, 00000010.00000002.580349736.00007FFCFF0A0000.00000002.00000001.01000000.00000013.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\flac\1.3.3\_\_\build\4fab43cea7baf5ca3c7db544507a05b38a68f73e\build\src\libFLAC++\RelWithDebInfo\FLAC++.pdb source: Audacity.exe, 00000010.00000002.583539424.00007FFCFF270000.00000002.00000001.01000000.00000019.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbis.pdb source: Audacity.exe, 00000010.00000002.578547685.00007FFCFEFAB000.00000002.00000001.01000000.00000011.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\vorbis\1.3.7\_\_\build\3b26581a680ab99eb0ef725aa935a0289708df91\build\lib\RelWithDebInfo\vorbisenc.pdb source: Audacity.exe, 00000010.00000002.579864349.00007FFCFF065000.00000002.00000001.01000000.00000012.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\mpg123\1.29.3\_\_\build\9e1553e6621f02c61665c153436b2dfb785b6498\bin\mpg123.pdb source: Audacity.exe, 00000010.00000002.583274055.00007FFCFF249000.00000002.00000001.01000000.00000018.sdmp
        Source: Binary string: D:\a\audacity\audacity\.conan\data\wxwidgets\3.1.3.3-audacity\_\_\build\f80b0ba6cc698a650654b5966db925c8f7197d7d\build_subfolder\bin\wxbase313u_vc_x64_custom.pdb source: Audacity.exe, 00000010.00000002.593483340.00007FFCFF758000.00000002.00000001.01000000.00000022.sdmp
        Source: Binary string: C:\devel\projects\audacity\audacity\.conan\data\expat\2.2.9\audacity\stable\build\ad5261bf6074807e7189c351b0f79b113bf2f6c0\build_subfolder\bin\libexpat.pdb source: Audacity.exe, 00000010.00000002.585991860.00007FFCFF3A4000.00000002.00000001.01000000.0000001D.sdmp
        Source: C:\Users\user\Desktop\WsiysHggF9.exeCode function: 0_2_0024A534 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,
        Source: C:\Users\user\Desktop\WsiysHggF9.exeCode function: 0_2_0025B820 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,Ge