Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1631926
MD5:	e4265c65f6f798bdc3f1644caaa09379
SHA1:	5c72cd53fb3091b5cdb44021a05abd4cb116ef32
SHA256:	a5847cf2d171622e07ec1cb81015033c57f60e7bf3e3f808a5dbdcb44ffe4498
Tags:	exeSocks5Systemzuser-jstrosch
Infos:

Detection

Socks5Systemz

Score:	88
Range:	0 - 100
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Yara detected Socks5Systemz

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to infect the boot sector

Joe Sandbox ML detected suspicious sample

PE file has a writeable .text section

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6976 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E4265C65F6F798BDC3F1644CAAA09379)

file.tmp (PID: 6992 cmdline: "C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp" /SL5="$203AA,4337550,56832,C:\Users\user\Desktop\file.exe" MD5: 01EB6207431C47E642C878967668AC73)

photorecoverylib.exe (PID: 7040 cmdline: "C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe" -i MD5: 84FDC770D4A9ECD786E59A0C9F7F9C26)

svchost.exe (PID: 6332 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6760 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6708 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 1156 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sppsvc.exe (PID: 2648 cmdline: C:\Windows\system32\sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)

svchost.exe (PID: 3184 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4724 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 6740 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 1444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2733155463.0000000000B51000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000002.00000002.2733849718.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: photorecoverylib.exe PID: 7040	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Sigma Signatures

System Summary

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 616, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6332, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T17:35:13.162008+0100	2028765	3	Unknown Traffic	192.168.2.9	49690	176.113.115.96	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T17:35:13.918490+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49690	176.113.115.96	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 18%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045D230 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	1_2_0045D230
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045D2E4 ArcFourCrypt,	1_2_0045D2E4
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045D2FC ArcFourCrypt,	1_2_0045D2FC
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Unpacked PE file: 2.2.photorecoverylib.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Photo Recovery Library_is1

Jump to behavior

Source: unknown

HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.9:49690 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: msvcp100.i386.pdb source: is-V0I3T.tmp.1.dr

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00452AD4 FindFirstFileA,GetLastError,	1_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	1_2_00475798
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00498FDC

Source: Joe Sandbox View

IP Address: 176.113.115.96 176.113.115.96

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49690 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49690 -> 176.113.115.96:443

Source: global traffic

HTTP traffic detected: GET /ai/?key=8f3f2b3ab71046392219e2a5231678fbb38f926d19fe6595cd66946851e91fcd85241ab258d84629326be8ea43a8f51f8a95b5cd212a91f953c588fb52d6db9f51a9a0a29d5954cad713479a672918d4348dd7d4915f4cc1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.96

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_00B52B95 WSASetLastError,WSARecv,WSASetLastError,select,

2_2_00B52B95

Source: global traffic

Source: file.tmp, 00000001.00000002.2733554548.00000000060F3000.00000004.00001000.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000000.892056485.0000000000889000.00000002.00000001.01000000.00000009.sdmp, is-GSQB7.tmp.1.dr, PhotoRecoveryLib.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: file.tmp, 00000001.00000002.2733554548.00000000060F3000.00000004.00001000.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000000.892056485.0000000000889000.00000002.00000001.01000000.00000009.sdmp, is-GSQB7.tmp.1.dr, PhotoRecoveryLib.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: file.tmp, 00000001.00000002.2733554548.00000000060F3000.00000004.00001000.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000000.892056485.0000000000889000.00000002.00000001.01000000.00000009.sdmp, is-GSQB7.tmp.1.dr, PhotoRecoveryLib.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.3.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: is-140KI.tmp.1.dr, is-ED1JI.tmp.1.dr	String found in binary or memory: http://icu-project.org
Source: PhotoRecoveryLib.exe.2.dr	String found in binary or memory: http://nanoways.com/check/%hs
Source: file.tmp, 00000001.00000002.2733554548.00000000060F3000.00000004.00001000.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000000.892056485.0000000000889000.00000002.00000001.01000000.00000009.sdmp, is-GSQB7.tmp.1.dr, PhotoRecoveryLib.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: file.tmp, file.tmp, 00000001.00000002.2732189124.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: file.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: file.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: file.exe, 00000000.00000003.876435661.0000000002330000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.876600889.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, file.tmp, file.tmp, 00000001.00000002.2732189124.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: file.exe, 00000000.00000003.876435661.0000000002330000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.876600889.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000002.2732189124.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B15000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/
Source: photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/L
Source: photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/ai/?key=8f3f2b3ab71046392219e2a5231678fbb38f926d19fe6595cd66946851e91fcd85241
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000004.00000002.1369629824.000001D5CAE59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000004.00000003.1369036849.000001D5CAE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369101779.000001D5CAE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369691577.000001D5CAE81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000004.00000002.1369691577.000001D5CAE81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000004.00000002.1369667719.000001D5CAE68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000004.00000002.1369704181.000001D5CAE88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368901090.000001D5CAE86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000004.00000003.1369101779.000001D5CAE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369592263.000001D5CAE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368987440.000001D5CAE67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369667719.000001D5CAE68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369592263.000001D5CAE3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000004.00000002.1369605520.000001D5CAE42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000004.00000003.1369112838.000001D5CAE49000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000004.00000003.1369036849.000001D5CAE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369605520.000001D5CAE42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368987440.000001D5CAE67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369667719.000001D5CAE68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000003.00000003.1207075388.000001F6D8E60000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: PhotoRecoveryLib.exe.2.dr	String found in binary or memory: https://nanoways.com/activate
Source: PhotoRecoveryLib.exe.2.dr	String found in binary or memory: https://nanoways.com/activate/?prefill=%hs
Source: PhotoRecoveryLib.exe.2.dr	String found in binary or memory: https://nanoways.com/deactivate
Source: PhotoRecoveryLib.exe.2.dr	String found in binary or memory: https://nanoways.com/deactivate/?prefill=%hs
Source: PhotoRecoveryLib.exe.2.dr	String found in binary or memory: https://nanoways.com/qr/%1
Source: svchost.exe, 00000004.00000003.1369153560.000001D5CAE31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dyn
Source: svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000004.00000003.1369153560.000001D5CAE31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs
Source: svchost.exe, 00000004.00000003.1369112838.000001D5CAE49000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000004.00000003.1369112838.000001D5CAE49000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369629824.000001D5CAE59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000004.00000003.1369057942.000001D5CAE5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000004.00000003.1369153560.000001D5CAE31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.vpC
Source: svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000004.00000002.1369629824.000001D5CAE59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: file.tmp, 00000001.00000002.2733554548.00000000060F3000.00000004.00001000.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000000.892056485.0000000000889000.00000002.00000001.01000000.00000009.sdmp, is-GSQB7.tmp.1.dr, PhotoRecoveryLib.exe.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2732565926.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.875695832.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.875588106.0000000002330000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000003.877978618.0000000002378000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000002.2732626716.0000000000654000.00000004.00000020.00020000.00000000.sdmp, file.tmp, 00000001.00000002.2733349175.0000000002378000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000003.877877861.0000000003250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.easycutstudio.com/support.html
Source: PhotoRecoveryLib.exe.2.dr	String found in binary or memory: https://www.openssl.org/docs/faq.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443

Source: unknown

HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.9:49690 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: photorecoverylib.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PhotoRecoveryLib.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0042F594 NtdllDefWindowProc_A,	1_2_0042F594
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00423B94 NtdllDefWindowProc_A,	1_2_00423B94
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004125E8 NtdllDefWindowProc_A,	1_2_004125E8
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00479380 NtdllDefWindowProc_A,	1_2_00479380
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045763C PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_0045763C

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_0042E944: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E944

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0045568C

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00470C74	1_2_00470C74
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0043533C	1_2_0043533C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004813C4	1_2_004813C4
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00467848	1_2_00467848
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004303D0	1_2_004303D0
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0044453C	1_2_0044453C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004885E0	1_2_004885E0
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00434638	1_2_00434638
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00444AE4	1_2_00444AE4
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0048ED0C	1_2_0048ED0C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00430F5C	1_2_00430F5C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045F16C	1_2_0045F16C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004451DC	1_2_004451DC
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045B21C	1_2_0045B21C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004455E8	1_2_004455E8
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00487680	1_2_00487680
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0046989C	1_2_0046989C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00451A30	1_2_00451A30
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0043DDC4	1_2_0043DDC4
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_004067B7	2_2_004067B7
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609660FA	2_2_609660FA
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6092114F	2_2_6092114F
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6091F2C9	2_2_6091F2C9
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096923E	2_2_6096923E
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6093323D	2_2_6093323D
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095C314	2_2_6095C314
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60950312	2_2_60950312
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094D33B	2_2_6094D33B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6093B368	2_2_6093B368
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096748C	2_2_6096748C
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6093F42E	2_2_6093F42E
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60954470	2_2_60954470
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609615FA	2_2_609615FA
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096A5EE	2_2_6096A5EE
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096D6A4	2_2_6096D6A4
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609606A8	2_2_609606A8
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60932654	2_2_60932654
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60955665	2_2_60955665
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094B7DB	2_2_6094B7DB
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6092F74D	2_2_6092F74D
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60964807	2_2_60964807
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094E9BC	2_2_6094E9BC
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60937929	2_2_60937929
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6093FAD6	2_2_6093FAD6
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096DAE8	2_2_6096DAE8
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094DA3A	2_2_6094DA3A
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60936B27	2_2_60936B27
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60954CF6	2_2_60954CF6
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60950C6B	2_2_60950C6B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60966DF1	2_2_60966DF1
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60963D35	2_2_60963D35
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60909E9C	2_2_60909E9C
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60951E86	2_2_60951E86
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60912E0B	2_2_60912E0B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60954FF8	2_2_60954FF8
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B8D0A6	2_2_00B8D0A6
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B5E089	2_2_00B5E089
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B670C0	2_2_00B670C0
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B6BAFD	2_2_00B6BAFD
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B6D32F	2_2_00B6D32F
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B70DB4	2_2_00B70DB4
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B6B609	2_2_00B6B609
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B7267D	2_2_00B7267D
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B6BF15	2_2_00B6BF15
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_00B6874A	2_2_00B6874A

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00408C1C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00406AD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 0040596C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00407904 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00445E48 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00457FC4 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00457DB8 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00434550 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00403494 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 004533B8 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00446118 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: String function: 00403684 appears 229 times
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: String function: 00B72A10 appears 128 times

Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: file.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: photorecoverylib.exe.1.dr	Static PE information: Resource name: RT_FILE type: PE32+ executable (console) x86-64, for MS Windows
Source: photorecoverylib.exe.1.dr	Static PE information: Resource name: RT_INST type: PE32 executable (EFI application) Intel 80386 (stripped to external PDB), for MS Windows
Source: photorecoverylib.exe.1.dr	Static PE information: Resource name: RT_INST type: PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows
Source: is-AHI27.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-AHI27.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-AHI27.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: PhotoRecoveryLib.exe.2.dr	Static PE information: Resource name: RT_FILE type: PE32+ executable (console) x86-64, for MS Windows
Source: PhotoRecoveryLib.exe.2.dr	Static PE information: Resource name: RT_INST type: PE32 executable (EFI application) Intel 80386 (stripped to external PDB), for MS Windows
Source: PhotoRecoveryLib.exe.2.dr	Static PE information: Resource name: RT_INST type: PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows

Source: is-I6HJ6.tmp.1.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.2.dr	Static PE information: Number of sections : 19 > 10

Source: file.exe, 00000000.00000003.876435661.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe
Source: file.exe, 00000000.00000003.876600889.00000000020C8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal88.troj.evad.winEXE@15/38@0/2

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_00B5F8D0 _memset,FormatMessageA,GetLastError,FormatMessageA,GetLastError,

2_2_00B5F8D0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_0045568C

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_00455EB4 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

1_2_00455EB4

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: CloseServiceHandle,CreateServiceA,CloseServiceHandle,CloseServiceHandle,

2_2_004016EB

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_0046E5B8 GetVersion,CoCreateInstance,

1_2_0046E5B8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409C34

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_0040DCE3 StartServiceCtrlDispatcherA,

2_2_0040DCE3

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_0040DCE3 StartServiceCtrlDispatcherA,

2_2_0040DCE3

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:1444:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: photorecoverylib.exe, photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: photorecoverylib.exe, photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: photorecoverylib.exe, photorecoverylib.exe, 00000002.00000003.897978531.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2734209557.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.2.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: file.exe

Virustotal: Detection: 18%

Source: file.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: file.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp" /SL5="$203AA,4337550,56832,C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe "C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe" -i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp "C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp" /SL5="$203AA,4337550,56832,C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe "C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe" -i	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Photo Recovery Library_is1

Jump to behavior

Source: file.exe

Static file information: File size 4588286 > 1048576

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: msvcp100.i386.pdb source: is-V0I3T.tmp.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Unpacked PE file: 2.2.photorecoverylib.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Unpacked PE file: 2.2.photorecoverylib.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_00450334 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450334

Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /4
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /19
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /35
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /51
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /63
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /77
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /89
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /102
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /113
Source: is-I6HJ6.tmp.1.dr	Static PE information: section name: /124
Source: sqlite3.dll.2.dr	Static PE information: section name: /4
Source: sqlite3.dll.2.dr	Static PE information: section name: /19
Source: sqlite3.dll.2.dr	Static PE information: section name: /35
Source: sqlite3.dll.2.dr	Static PE information: section name: /51
Source: sqlite3.dll.2.dr	Static PE information: section name: /63
Source: sqlite3.dll.2.dr	Static PE information: section name: /77
Source: sqlite3.dll.2.dr	Static PE information: section name: /89
Source: sqlite3.dll.2.dr	Static PE information: section name: /102
Source: sqlite3.dll.2.dr	Static PE information: section name: /113
Source: sqlite3.dll.2.dr	Static PE information: section name: /124

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004849F4 push 00484B02h; ret	1_2_00484AFA
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0040995C push 00409999h; ret	1_2_00409991
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00458060 push 00458098h; ret	1_2_00458090
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004860E4 push ecx; mov dword ptr [esp], ecx	1_2_004860E9
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004062C4 push ecx; mov dword ptr [esp], eax	1_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004783C8 push ecx; mov dword ptr [esp], edx	1_2_004783C9
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004104F0 push ecx; mov dword ptr [esp], edx	1_2_004104F5
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00412938 push 0041299Bh; ret	1_2_00412993
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0049AD44 pushad ; retf	1_2_0049AD53
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0040CE48 push ecx; mov dword ptr [esp], edx	1_2_0040CE4A
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00459378 push 004593BCh; ret	1_2_004593B4
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0040F3A8 push ecx; mov dword ptr [esp], edx	1_2_0040F3AA
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004434B4 push ecx; mov dword ptr [esp], ecx	1_2_004434B8
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0045186C push 0045189Fh; ret	1_2_00451897
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00451A30 push ecx; mov dword ptr [esp], eax	1_2_00451A35
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00495BE4 push ecx; mov dword ptr [esp], ecx	1_2_00495BE9
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00419C38 push ecx; mov dword ptr [esp], ecx	1_2_00419C3D

Source: is-6E918.tmp.1.dr

Static PE information: section name: .text entropy: 6.90903234258047

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0

2_2_00B5E8B2

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\icuin51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\Qt5PrintSupport.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\Qt5Concurrent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-6E918.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-V0I3T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-K1S5M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	File created: C:\ProgramData\PhotoRecoveryLib\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-QDB3N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-RCQCM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\uninstall\is-AHI27.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	File created: C:\ProgramData\PhotoRecoveryLib\PhotoRecoveryLib.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-N9I92.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\msvcp100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\icuuc51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\libGLESv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-I6HJ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-140KI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-ED1JI.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	File created: C:\ProgramData\PhotoRecoveryLib\PhotoRecoveryLib.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	File created: C:\ProgramData\PhotoRecoveryLib\sqlite3.dll			Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0

2_2_00B5E8B2

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_0040DCE3 StartServiceCtrlDispatcherA,

2_2_0040DCE3

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004241EC IsIconic,SetActiveWindow,SetFocus,	1_2_004241EC
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004241A4 IsIconic,SetActiveWindow,	1_2_004241A4
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00418394 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418394
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004843A8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_004843A8
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0042286C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_0042286C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0042F2F0 IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	1_2_0042F2F0
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004175A8 IsIconic,GetCapture,	1_2_004175A8
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00417CDE IsIconic,SetWindowPos,	1_2_00417CDE
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00417CE0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CE0

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_0041F128 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F128

Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,

2_2_00B5E9B6

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\uninstall\is-AHI27.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\icuin51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\Qt5PrintSupport.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\Qt5Concurrent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-6E918.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-N9I92.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-V0I3T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-K1S5M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\msvcp100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\icuuc51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\libGLESv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-QDB3N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-RCQCM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-I6HJ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-140KI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-ED1JI.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-6007

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

API coverage: 3.0 %

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe TID: 7044	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe TID: 7044	Thread sleep time: -158000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe TID: 6352	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe TID: 6352	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6528	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6596	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00452AD4 FindFirstFileA,GetLastError,	1_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	1_2_00475798
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: 1_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00498FDC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B78

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: svchost.exe, 00000008.00000002.2732896974.0000015E59A53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: photorecoverylib.exe, 00000002.00000002.2732888991.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXv
Source: svchost.exe, 00000008.00000002.2733018152.0000015E59A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6b
Source: svchost.exe, 00000008.00000002.2732982430.0000015E59A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:#p
Source: photorecoverylib.exe, 00000002.00000002.2734039883.0000000003542000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.2732496866.0000015E59A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000008.00000002.2733054395.0000015E59A8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000008.00000002.2732982430.0000015E59A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000`
Source: photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=
Source: svchost.exe, 00000008.00000002.2732896974.0000015E59A53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-6763
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	API call chain: ExitProcess graph end node			graph_2-60134

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_00B680FE IsDebuggerPresent,

2_2_00B680FE

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_00B6E6BE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

2_2_00B6E6BE

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_00450334 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450334

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_00B55E59 RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_memset,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,_memset,_memset,_memset,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,_memset,_memset,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

2_2_00B55E59

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_00B680E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00B680E8

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_00478DC4 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_00478DC4

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_0042EE28 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,

1_2_0042EE28

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_0042E0AC AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E0AC

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe

Code function: 2_2_00B5E86A cpuid

2_2_00B5E86A

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: GetLocaleInfoA,	1_2_00408578
Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	Code function: GetLocaleInfoA,	1_2_004085C4

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_00458670 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00458670

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp

Code function: 1_2_00455644 GetUserNameA,

1_2_00455644

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: svchost.exe, 00000009.00000002.2733165199.000001FF80702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.2733165199.000001FF80702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.2733155463.0000000000B51000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2733849718.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: photorecoverylib.exe PID: 7040, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000002.00000002.2733155463.0000000000B51000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2733849718.0000000002E4B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: photorecoverylib.exe PID: 7040, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	2_2_609660FA
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	2_2_6090C1D6
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,	2_2_60963143
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_6096A2BD
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,	2_2_6096923E
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,	2_2_6096A38C
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	2_2_6096748C
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	2_2_609254B1
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_6094B407
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6090F435 sqlite3_bind_parameter_index,	2_2_6090F435
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,	2_2_609255D4
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609255FF sqlite3_bind_text,	2_2_609255FF
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,	2_2_6096A5EE
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,	2_2_6094B54C
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,	2_2_60925686
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,	2_2_6094A6C5
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,	2_2_609256E5
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	2_2_6094B6ED
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6092562A sqlite3_bind_blob,	2_2_6092562A
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,	2_2_60925655
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_6094C64A
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	2_2_609687A7
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_6095F7F7
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,	2_2_6092570B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6095F772
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	2_2_60925778
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6090577D sqlite3_bind_parameter_name,	2_2_6090577D
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	2_2_6094B764
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6090576B sqlite3_bind_parameter_count,	2_2_6090576B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_6094A894
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6095F883
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,	2_2_6094C8C2
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,	2_2_6096281E
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,	2_2_6096583A
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,	2_2_6095F9AD
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6094A92B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6090EAE5 sqlite3_transfer_bindings,	2_2_6090EAE5
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_6095FB98
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	2_2_6095ECA6
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_6095FCCE
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_6095FDAE
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,	2_2_60966DF1
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_60969D75
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.7\photorecoverylib.exe	Code function: 2_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	2_2_6095FFB2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	5 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Bootkit	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	5 Windows Service	21 Software Packing	NTDS	46 System Information Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 DLL Side-Loading	LSA Secrets	81 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	8%	ReversingLabs
file.exe	18%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\ProgramData\PhotoRecoveryLib\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\Qt5Concurrent.dll (copy)	4%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\Qt5PrintSupport.dll (copy)	4%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\icuin51.dll (copy)	2%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\icuuc51.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-140KI.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-6E918.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-ED1JI.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-I6HJ6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-K1S5M.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-N9I92.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-QDB3N.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-RCQCM.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\is-V0I3T.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\libEGL.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\libGLESv2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\msvcp100.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\msvcr100.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\sqlite3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\uninstall\is-AHI27.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Photo Recovery Library 5.7\uninstall\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DTBFQ.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-V1UC2.tmp\file.tmp	3%	ReversingLabs

Source	Detection	Scanner	Label
https://176.113.115.96/L	0%	Avira URL Cloud	safe
https://nanoways.com/qr/%1	0%	Avira URL Cloud	safe
https://nanoways.com/activate	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.vpC	0%	Avira URL Cloud	safe
https://176.113.115.96/ai/?key=8f3f2b3ab71046392219e2a5231678fbb38f926d19fe6595cd66946851e91fcd85241ab258d84629326be8ea43a8f51f8a95b5cd212a91f953c588fb52d6db9f51a9a0a29d5954cad713479a672918d4348dd7d4915f4cc1	0%	Avira URL Cloud	safe
http://www.bingmapsportal.com	0%	Avira URL Cloud	safe
https://nanoways.com/deactivate	0%	Avira URL Cloud	safe
https://nanoways.com/deactivate/?prefill=%hs	0%	Avira URL Cloud	safe
https://nanoways.com/activate/?prefill=%hs	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dyn	0%	Avira URL Cloud	safe
https://dynamic.t	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	0%	Avira URL Cloud	safe
http://www.remobjects.com/psU	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	0%	Avira URL Cloud	safe
http://nanoways.com/check/%hs	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	0%	Avira URL Cloud	safe
https://176.113.115.96/ai/?key=8f3f2b3ab71046392219e2a5231678fbb38f926d19fe6595cd66946851e91fcd85241	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://176.113.115.96/ai/?key=8f3f2b3ab71046392219e2a5231678fbb38f926d19fe6595cd66946851e91fcd85241ab258d84629326be8ea43a8f51f8a95b5cd212a91f953c588fb52d6db9f51a9a0a29d5954cad713479a672918d4348dd7d4915f4cc1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://176.113.115.96/L	photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000004.00000002.1369667719.000001D5CAE68000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://176.113.115.96/	photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B15000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nanoways.com/qr/%1	PhotoRecoveryLib.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	file.exe	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.vpC	svchost.exe, 00000004.00000003.1369153560.000001D5CAE31000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000004.00000003.1369036849.000001D5CAE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369101779.000001D5CAE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369691577.000001D5CAE81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000004.00000002.1369605520.000001D5CAE42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nanoways.com/activate	PhotoRecoveryLib.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://nanoways.com/deactivate	PhotoRecoveryLib.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000004.00000003.1369101779.000001D5CAE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369592263.000001D5CAE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368987440.000001D5CAE67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369667719.000001D5CAE68000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	file.tmp, file.tmp, 00000001.00000002.2732189124.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000004.00000003.1369057942.000001D5CAE5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/docs/faq.html	PhotoRecoveryLib.exe.2.dr	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000004.00000002.1369704181.000001D5CAE88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368901090.000001D5CAE86000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000004.00000002.1369563898.000001D5CAE24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368987440.000001D5CAE67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369667719.000001D5CAE68000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369592263.000001D5CAE3F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs	svchost.exe, 00000004.00000003.1369153560.000001D5CAE31000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000004.00000003.1369112838.000001D5CAE49000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369629824.000001D5CAE59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	file.exe	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000004.00000003.1369036849.000001D5CAE5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369605520.000001D5CAE42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nanoways.com/activate/?prefill=%hs	PhotoRecoveryLib.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000004.00000003.1369112838.000001D5CAE49000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://icu-project.org	is-140KI.tmp.1.dr, is-ED1JI.tmp.1.dr	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000004.00000002.1369629824.000001D5CAE59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nanoways.com/deactivate/?prefill=%hs	PhotoRecoveryLib.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dyn	svchost.exe, 00000004.00000003.1369153560.000001D5CAE31000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/psU	file.exe, 00000000.00000003.876435661.0000000002330000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.876600889.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000002.2732189124.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 00000004.00000003.1369128551.000001D5CAE41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	edb.log.3.dr	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000003.00000003.1207075388.000001F6D8E60000.00000004.00000800.00020000.00000000.sdmp, edb.log.3.dr	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000004.00000002.1369629824.000001D5CAE59000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	file.exe, 00000000.00000003.876435661.0000000002330000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.876600889.00000000020C8000.00000004.00001000.00020000.00000000.sdmp, file.tmp, file.tmp, 00000001.00000002.2732189124.0000000000401000.00000020.00000001.01000000.00000004.sdmp, file.tmp.0.dr	false		high
https://www.easycutstudio.com/support.html	file.exe, 00000000.00000002.2732565926.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.875695832.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000003.875588106.0000000002330000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000003.877978618.0000000002378000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000002.2732626716.0000000000654000.00000004.00000020.00020000.00000000.sdmp, file.tmp, 00000001.00000002.2733349175.0000000002378000.00000004.00001000.00020000.00000000.sdmp, file.tmp, 00000001.00000003.877877861.0000000003250000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nanoways.com/check/%hs	PhotoRecoveryLib.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000004.00000003.1369068481.000001D5CAE58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://176.113.115.96/ai/?key=8f3f2b3ab71046392219e2a5231678fbb38f926d19fe6595cd66946851e91fcd85241	photorecoverylib.exe, 00000002.00000002.2732888991.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000004.00000002.1369691577.000001D5CAE81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000004.00000003.1369112838.000001D5CAE49000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.1368999689.000001D5CAE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.1369654225.000001D5CAE63000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.113.115.96	unknown	Russian Federation		49505	SELECTELRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1631926
Start date and time:	2025-03-07 17:32:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@15/38@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 172 Number of non-executed functions: 289
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, e16604.f.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
176.113.115.96	tKBxw8eOIV.exe	Get hash	malicious	Socks5Systemz	Browse
	tKBxw8eOIV.exe	Get hash	malicious	Socks5Systemz	Browse
	soft.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse
	9uWGaRcOv8.exe	Get hash	malicious	Socks5Systemz	Browse
	9uWGaRcOv8.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	silk.exe	Get hash	malicious	Socks5Systemz	Browse
	silk.exe	Get hash	malicious	Socks5Systemz	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SELECTELRU	nabmpsl.elf	Get hash	malicious	Unknown	Browse	45.10.108.219
	NIwz1MK5d8.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	https://cdn.discordapp.com/attachments/1208290127424528417/1347131831350464562/mzSeCT06HitK85Fb.exe?ex=67cab5c9&is=67c96449&hm=1f5dd426eb7614f3776b7dafbe51534751657ba41ccf0472c966fb8b5a3984a3&	Get hash	malicious	Unknown	Browse	5.178.87.202
	5c9465cda4.exe	Get hash	malicious	Amadey, GCleaner, LiteHTTP Bot, LummaC Stealer, Mint Stealer, PureLog Stealer, Stealc	Browse	176.113.115.6
	GMOgZgNpNu.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	176.113.115.6
	xIwQcY1fc4.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer	Browse	176.113.115.6
	zPlhdcABwL.exe	Get hash	malicious	Amadey	Browse	176.113.115.6
	d5Wai5fIAK.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	176.113.115.6
	2raqmphRKT.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	176.113.115.6

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	tKBxw8eOIV.exe	Get hash	malicious	Socks5Systemz	Browse	176.113.115.96
	tKBxw8eOIV.exe	Get hash	malicious	Socks5Systemz	Browse	176.113.115.96
	xn3nGSFdRn.exe	Get hash	malicious	Vidar	Browse	176.113.115.96
	soft.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse	176.113.115.96
	9uWGaRcOv8.exe	Get hash	malicious	Socks5Systemz	Browse	176.113.115.96
	9uWGaRcOv8.exe	Get hash	malicious	Socks5Systemz	Browse	176.113.115.96
	file.exe	Get hash	malicious	Socks5Systemz	Browse	176.113.115.96
	file.exe	Get hash	malicious	Socks5Systemz	Browse	176.113.115.96
	yMwA2Hcj3Q.dll	Get hash	malicious	CobaltStrike, Metasploit	Browse	176.113.115.96

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\PhotoRecoveryLib\sqlite3.dll	tKBxw8eOIV.exe	Get hash	malicious	Socks5Systemz	Browse
	tKBxw8eOIV.exe	Get hash	malicious	Socks5Systemz	Browse
	soft.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse
	9uWGaRcOv8.exe	Get hash	malicious	Socks5Systemz	Browse
	9uWGaRcOv8.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	silk.exe	Get hash	malicious	Socks5Systemz	Browse
	silk.exe	Get hash	malicious	Socks5Systemz	Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program

Windows Analysis Report
file.exe