Edit tour

Windows Analysis Report
SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Analysis ID:	1632380
MD5:	70f6c2b0e201efc9b266fe4e00e983e5
SHA1:	d8d7fe54f9741edb429451f3fe70aa108f017233
SHA256:	99a74a02ecc5baf8627edf99518853169c7312df04bf0cd5b7f6cdccebf75831
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

PureLog Stealer

Score:	46
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Queries Google from non browser process on port 80

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Tries to delay execution (extensive OutputDebugStringW loop)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes data at the end of the disk (often used by bootkits to hide malicious code)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe (PID: 7204 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe" MD5: 70F6C2B0E201EFC9B266FE4E00E983E5)

SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp (PID: 180 cmdline: "C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp" /SL5="$204A8,7009006,1208320,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe" MD5: 140A6B9AF1C81390C3356FF3170E119F)

taskkill.exe (PID: 892 cmdline: "C:\Windows\system32\taskkill.exe" /f /im PhotosRecovery.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7820 cmdline: "C:\Windows\System32\taskkill.exe" /f /im "PRNotifier.exe" MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3588 cmdline: "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 8188 cmdline: "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PhotosRecovery.exe (PID: 1188 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PhotosRecovery.exe (PID: 3384 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /firstinstall MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PhotosRecovery.exe (PID: 2184 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" "/firstinstall" MD5: 7BE9F02B8172F28175CC2AB83A831D79)

schtasks.exe (PID: 4856 cmdline: "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 2828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=-99623905971728909&lipl=0&instdt=638769817555797323&productid=9881&os=Microsoft Windows 10 Pro&ram=4 GB&model=r6RbKLUz&proc=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769817515328761 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,303361026015526398,5801496429916471469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,303361026015526398,5801496429916471469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4448 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

PRNotifier.exe (PID: 2120 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" createschedule MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PhotosRecovery.exe (PID: 1424 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

schtasks.exe (PID: 2444 cmdline: "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PhotosRecovery.exe (PID: 4940 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /autoupdatecheck MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PhotosRecovery.exe (PID: 8200 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /startup MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PRNotifier.exe (PID: 8232 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" neweventtrigger MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PRNotifier.exe (PID: 8260 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" startup MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PhotosRecovery.exe (PID: 8508 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PRNotifier.exe (PID: 8772 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PhotosRecovery.exe (PID: 8988 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PhotosRecovery.exe (PID: 9144 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PRNotifier.exe (PID: 8244 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files\Photos Recovery\PRNotifier_log.txt	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Program Files\Photos Recovery\is-4PH0B.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Photos Recovery\is-JO409.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000015.00000002.1646964434.0000000005412000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000015.00000000.1501534699.0000000000A02000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: PRNotifier.exe PID: 8772	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
21.0.PRNotifier.exe.a00000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
21.2.PRNotifier.exe.5410000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T23:02:41.269040+0100	2803305	3	Unknown Traffic	192.168.2.5	49712	52.222.214.43	80	TCP
2025-03-07T23:02:41.459843+0100	2803305	3	Unknown Traffic	192.168.2.5	49712	52.222.214.43	80	TCP
2025-03-07T23:02:41.658877+0100	2803305	3	Unknown Traffic	192.168.2.5	49712	52.222.214.43	80	TCP
2025-03-07T23:02:56.144576+0100	2803305	3	Unknown Traffic	192.168.2.5	49718	142.250.185.228	80	TCP
2025-03-07T23:03:01.126463+0100	2803305	3	Unknown Traffic	192.168.2.5	49723	142.250.185.228	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Virustotal: Detection: 6%

Perma Link

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-ARSHF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-0FQ8G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-6U98U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-6I0DB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-JNOEK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-4NEDC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-V4P0A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-8J5T6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-CS64S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-MDDVK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-9KUAK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-TU5RQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-S10KV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-Q1O31.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-RQCQL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-3NQ6U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-6K1JK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-564VB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-TDLN4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-4PH0B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-EE79K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-JO409.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\unins000.msg	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Directory created: C:\Program Files\Photos Recovery\Magick.NET-Q8-AnyCPU.dll.partial	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\PRNotifier_log.txt	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\PRNotifier_Corruptlog.txt	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\PRNotifier_OutOfMemorylog.txt	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\notifier.json.partial

Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\4416b002-40e3-495b-ab64-83411bcb8a3b_Systweak_Ph~060FFAEF_is1

Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.214.43:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.31.254:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.79.122.22:443 -> 192.168.2.5:49725 version: TLS 1.2

Source:	Binary string: notifierlib.pdb source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp, 00000007.00000002.1537117883.000000000018C000.00000004.00000010.00020000.00000000.sdmp, PRNotifier.exe, PRNotifier.exe, 00000015.00000002.1625712438.0000000002F85000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000015.00000002.1646964434.0000000005412000.00000002.00000001.01000000.0000000D.sdmp, PRNotifier.exe, 00000021.00000002.1665230919.00000000026C8000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000022.00000002.1696645478.0000000002885000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 0000002A.00000002.1826746225.0000000003505000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\Visual Studio 2008\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: PRNotifier.exe, PRNotifier.exe, 00000015.00000002.1662501578.0000000008A22000.00000002.00000001.01000000.00000017.sdmp, is-V4P0A.tmp.7.dr
Source:	Binary string: mscorlib.pdb source: PRNotifier.exe, 00000024.00000002.1850816663.00000000016F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PRNotifier.pdbh source: PRNotifier.exe, 00000015.00000002.1625712438.0000000002E58000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000015.00000000.1501534699.0000000000A02000.00000002.00000001.01000000.0000000C.sdmp, PRNotifier.exe, 00000021.00000002.1665230919.0000000002599000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000022.00000002.1696645478.0000000002769000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 0000002A.00000002.1826746225.00000000033E9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: PRNotifier.pdb source: PRNotifier.exe, 00000015.00000002.1625712438.0000000002E58000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000015.00000000.1501534699.0000000000A02000.00000002.00000001.01000000.0000000C.sdmp, PRNotifier.exe, 00000021.00000002.1665230919.0000000002599000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000022.00000002.1696645478.0000000002769000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 0000002A.00000002.1826746225.00000000033E9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: PhotosRecovery.pdb source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp, 00000007.00000003.1503277134.0000000003520000.00000004.00001000.00020000.00000000.sdmp, PhotosRecovery.exe, 00000013.00000000.1464183078.00000133A7522000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: ?\C:\Windows\dll\System.pdb source: PRNotifier.exe, 00000024.00000002.1879166239.0000000006287000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\Regclean Pro\rcp\src\UpdateDownload\src\Release\update.pdb source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp, 00000007.00000003.1503277134.0000000003520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PhotosRecovery.pdb8 source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp, 00000007.00000003.1503277134.0000000003520000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: z:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: x:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: v:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: t:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: r:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: p:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: n:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: l:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: j:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: h:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: f:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: b:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: y:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: w:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: u:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: s:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: q:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: o:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: m:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: k:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: i:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: g:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: e:	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	File opened: c:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: a:	Jump to behavior

Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9157557h	19_2_00007FF7C9157460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	19_2_00007FF7C91602D5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	19_2_00007FF7C915A2E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9157557h	19_2_00007FF7C9157445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	19_2_00007FF7C91643B7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	19_2_00007FF7C915FBBF
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	19_2_00007FF7C915F564
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9157557h	19_2_00007FF7C91505FA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	19_2_00007FF7C915E7B9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	24_2_00007FF7C91607C8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	24_2_00007FF7C91605FA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	24_2_00007FF7C9167445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	24_2_00007FF7C916A325
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9187557h	25_2_00007FF7C91807C8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	25_2_00007FF7C918A2E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9187557h	25_2_00007FF7C91805FA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9187557h	25_2_00007FF7C9187445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	29_2_00007FF7C9167460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	29_2_00007FF7C916A325
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	29_2_00007FF7C91605FA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	29_2_00007FF7C9167445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9157557h	32_2_00007FF7C9157445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	32_2_00007FF7C915A2E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	35_2_00007FF7C9167445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C916EDEEh	35_2_00007FF7C916EBA9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	35_2_00007FF7C916FE85
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	35_2_00007FF7C916A2E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	35_2_00007FF7C916EE05
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	35_2_00007FF7C916F60F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9167557h	35_2_00007FF7C9167460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	35_2_00007FF7C9173F67
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	35_2_00007FF7C916E7B9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9157557h	39_2_00007FF7C9157460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	39_2_00007FF7C915FE85
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9157557h	39_2_00007FF7C91505FA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	39_2_00007FF7C915EE05
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	39_2_00007FF7C915F60F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9157557h	39_2_00007FF7C9157445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	39_2_00007FF7C915A325
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	39_2_00007FF7C915E7B9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9177557h	40_2_00007FF7C9177460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9177557h	40_2_00007FF7C91705FA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF7C9177557h	40_2_00007FF7C9177445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	40_2_00007FF7C917A325

Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET / HTTP/1.1 Host: www.google.com Connection: Keep-Alive
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET / HTTP/1.1 Host: www.google.com
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET / HTTP/1.1 Host: www.google.com Connection: Keep-Alive
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET / HTTP/1.1 Host: www.google.com Connection: Keep-Alive
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET / HTTP/1.1 Host: www.google.com

Source: global traffic	HTTP traffic detected: GET /pr/notifier/update.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=-1&https://www.systweak.com:443/photos-recovery/= HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/utilitykit/utility_kit_v3.aspx HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/update/update.asp?productname=PhotoRecovery&currentapplicationid=3.2.0.191&currentdbversionid=0&firstinstall=1 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/photosrecovery/dll/Magick.NET-Q8-AnyCPU.dll HTTP/1.1Content-Type: application/jsonHost: cdn.systweak.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /pr/notifier/notifier_pr_new.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=-99623905971728909&https://www.systweak.com:443/photos-recovery/=&appversion=3.2.0.191&lipl=0&instdt=638769817555797323&os=microsoft%20windows%2010%20pro&ram=4%20gb&model=r6rbkluz&proc=intel(r)%20core(tm)2%20cpu%206600%20@%202.40%20ghz&ibv=&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769817515328761 HTTP/1.1Content-Type: application/jsonHost: activate123.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /win/pr/offerhtm/PR_Notifier_New.json HTTP/1.1Content-Type: application/jsonHost: offers.systweak.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/aso.png HTTP/1.1Host: cdn.systweak.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/adr.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/apc.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/asp.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.com

Source: Joe Sandbox View	IP Address: 5.79.122.22 5.79.122.22
Source: Joe Sandbox View	IP Address: 5.79.122.22 5.79.122.22

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49712 -> 52.222.214.43:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49723 -> 142.250.185.228:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49718 -> 142.250.185.228:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.20.226
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.20.226
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.184.195
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.31.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.31.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.31.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.31.254
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.31.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.93.72.182
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: activate123.com
Source: global traffic	DNS traffic detected: DNS query: www.systweak.com
Source: global traffic	DNS traffic detected: DNS query: cdn.systweak.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: offers.systweak.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915D29D	19_2_00007FF7C915D29D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9159439	19_2_00007FF7C9159439
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9157B19	19_2_00007FF7C9157B19
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C916A372	19_2_00007FF7C916A372
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C91536FA	19_2_00007FF7C91536FA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9160030	19_2_00007FF7C9160030
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915885D	19_2_00007FF7C915885D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915AF5F	19_2_00007FF7C915AF5F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915B7BE	19_2_00007FF7C915B7BE
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9151218	19_2_00007FF7C9151218
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9156A9C	19_2_00007FF7C9156A9C
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9151138	19_2_00007FF7C9151138
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9151158	19_2_00007FF7C9151158
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9151208	19_2_00007FF7C9151208
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915C50D	19_2_00007FF7C915C50D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915C342	19_2_00007FF7C915C342
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915AB69	19_2_00007FF7C915AB69
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C915BEB9	19_2_00007FF7C915BEB9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9156EB5	19_2_00007FF7C9156EB5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C9162EFA	19_2_00007FF7C9162EFA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C916879D	19_2_00007FF7C916879D
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_05418140	21_2_05418140
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_05414780	21_2_05414780
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_05412050	21_2_05412050
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_02C2D398	21_2_02C2D398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_02C20C78	21_2_02C20C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_02C20C6F	21_2_02C20C6F
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_065FCF38	21_2_065FCF38
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_065FD375	21_2_065FD375
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_065FCF27	21_2_065FCF27
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB31E8	21_2_07EB31E8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBDEAC	21_2_07EBDEAC
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBAE90	21_2_07EBAE90
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB1E38	21_2_07EB1E38
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB5D20	21_2_07EB5D20
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB0C50	21_2_07EB0C50
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB2B98	21_2_07EB2B98
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBA860	21_2_07EBA860
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB1248	21_2_07EB1248
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB1258	21_2_07EB1258
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB31D8	21_2_07EB31D8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBDEF8	21_2_07EBDEF8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBDEC1	21_2_07EBDEC1
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBDED8	21_2_07EBDED8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBDED4	21_2_07EBDED4
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBDEBC	21_2_07EBDEBC
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBDEB5	21_2_07EBDEB5
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBAE80	21_2_07EBAE80
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB1E28	21_2_07EB1E28
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB2B88	21_2_07EB2B88
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBA850	21_2_07EBA850
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_089F08A0	21_2_089F08A0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_089F0890	21_2_089F0890
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_089F08A0	21_2_089F08A0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_089F6B91	21_2_089F6B91
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 24_2_00007FF7C91610F8	24_2_00007FF7C91610F8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 25_2_00007FF7C91810F8	25_2_00007FF7C91810F8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 29_2_00007FF7C9161138	29_2_00007FF7C9161138
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_0236D398	33_2_0236D398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_02360C78	33_2_02360C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_02360C69	33_2_02360C69
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_02361099	33_2_02361099
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_023610EB	33_2_023610EB
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 34_2_00CE0C78	34_2_00CE0C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 34_2_00CED398	34_2_00CED398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 34_2_00CE1099	34_2_00CE1099
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 34_2_00CE0C6F	34_2_00CE0C6F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 35_2_00007FF7C9178ACA	35_2_00007FF7C9178ACA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 35_2_00007FF7C9179F22	35_2_00007FF7C9179F22
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 35_2_00007FF7C917834D	35_2_00007FF7C917834D
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_018B0C78	36_2_018B0C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_018BD398	36_2_018BD398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_018B0C69	36_2_018B0C69
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F97A38	36_2_08F97A38
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F9F450	36_2_08F9F450
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F9089E	36_2_08F9089E
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F90988	36_2_08F90988
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F97A38	36_2_08F97A38
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F97A28	36_2_08F97A28
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F90C27	36_2_08F90C27
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F9F450	36_2_08F9F450
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F90487	36_2_08F90487
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F9F442	36_2_08F9F442
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F99590	36_2_08F99590
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F9057B	36_2_08F9057B
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F9371F	36_2_08F9371F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 39_2_00007FF7C9151138	39_2_00007FF7C9151138
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 40_2_00007FF7C91710F8	40_2_00007FF7C91710F8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 42_2_0310D398	42_2_0310D398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 42_2_03100C78	42_2_03100C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 42_2_03100C69	42_2_03100C69

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-ARSHF.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-6U98U.tmp.7.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000001.00000000.1269097027.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000001.00000003.1273187696.00000000026B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000001.00000003.1554944415.0000000002398000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000001.00000003.1275944543.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Source: is-V4P0A.tmp.7.dr, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: is-V4P0A.tmp.7.dr, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: is-Q1O31.tmp.7.dr, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: is-Q1O31.tmp.7.dr, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_03
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3036:120:WilError_03
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\cbackuplogmutexPRNotifier_OutOfMemorylog
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Mutant created: \Sessions\1\BaseNamedObjects\4416b002-40e3-495b-ab64-83411bcb8a3b_Systweak_Photos Recovery_setup
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Mutant created: \Sessions\1\BaseNamedObjects\4416b002-40e3-495b-ab64-83411bcb8a3b_PhotosRecoveryApp_2020user
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\PhotosRecovery_E9AC93B9-E733-40A8-9338-47A4909521B7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "PhotosRecovery.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "PRNotifier.exe")
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe "C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp "C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp" /SL5="$204A8,7009006,1208320,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe"
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im PhotosRecovery.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im "PRNotifier.exe"
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /firstinstall
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" createschedule
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" "/firstinstall"
Source: unknown	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /autoupdatecheck
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=-99623905971728909&lipl=0&instdt=638769817555797323&productid=9881&os=Microsoft Windows 10 Pro&ram=4 GB&model=r6RbKLUz&proc=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769817515328761
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,303361026015526398,5801496429916471469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,303361026015526398,5801496429916471469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4448 /prefetch:8
Source: unknown	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /startup
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" neweventtrigger
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" startup
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Process created: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp "C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp" /SL5="$204A8,7009006,1208320,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im PhotosRecovery.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im "PRNotifier.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /firstinstall	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" createschedule	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" "/firstinstall"	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup"	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=-99623905971728909&lipl=0&instdt=638769817555797323&productid=9881&os=Microsoft Windows 10 Pro&ram=4 GB&model=r6RbKLUz&proc=Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769817515328761	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,303361026015526398,5801496429916471469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2104 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2020,i,303361026015526398,5801496429916471469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4448 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues

Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: I accept the agreement

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Static PE information: section name: .didata
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp.1.dr	Static PE information: section name: .didata
Source: is-ARSHF.tmp.7.dr	Static PE information: section name: .didata

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C916C285 push es; iretd	19_2_00007FF7C916C286
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 19_2_00007FF7C91500BD pushad ; iretd	19_2_00007FF7C91500C1
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_02C20F2F push es; ret	21_2_02C20F32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_02C20F33 push es; ret	21_2_02C20F3A
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_02C244FA pushad ; retf	21_2_02C244FD
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_02C24D04 push esp; ret	21_2_02C24D09
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EB0BA1 push edx; retf	21_2_07EB0BA3
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 21_2_07EBD9AB push 3B057CA8h; ret	21_2_07EBD9B0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 24_2_00007FF7C9164D47 push ds; ret	24_2_00007FF7C9164D5F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 24_2_00007FF7C91600BD pushad ; iretd	24_2_00007FF7C91600C1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 24_2_00007FF7C9164CE3 push eax; ret	24_2_00007FF7C9164D2D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 24_2_00007FF7C9166F88 push es; iretd	24_2_00007FF7C9166FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 25_2_00007FF7C91800BD pushad ; iretd	25_2_00007FF7C91800C1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 29_2_00007FF7C9164D47 push ds; ret	29_2_00007FF7C9164D5F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 29_2_00007FF7C91600BD pushad ; iretd	29_2_00007FF7C91600C1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 29_2_00007FF7C9164CE3 push eax; ret	29_2_00007FF7C9164D2D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 29_2_00007FF7C9166F6C push es; iretd	29_2_00007FF7C9166FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 29_2_00007FF7C9166FC0 push es; iretd	29_2_00007FF7C9166FF7
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_023644FA pushad ; retf	33_2_023644FD
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_02364D04 push esp; ret	33_2_02364D09
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 34_2_00CE44FA pushad ; retf	34_2_00CE44FD
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 34_2_00CE4D04 push esp; ret	34_2_00CE4D09
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 34_2_00CE0F2F push es; iretd	34_2_00CE0F32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_018B4D04 push esp; ret	36_2_018B4D09
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_018B44FA pushad ; retf	36_2_018B44FD
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_08F9D23A push eax; iretd	36_2_08F9D23D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 39_2_00007FF7C9154D47 push ds; ret	39_2_00007FF7C9154D5F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 39_2_00007FF7C91500BD pushad ; iretd	39_2_00007FF7C91500C1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 39_2_00007FF7C9154CE3 push eax; ret	39_2_00007FF7C9154D2D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 39_2_00007FF7C9156F6C push es; iretd	39_2_00007FF7C9156FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 40_2_00007FF7C9174D47 push ds; ret	40_2_00007FF7C9174D5F

Source: is-6K1JK.tmp.7.dr	Static PE information: section name: .text entropy: 7.145148985542188
Source: is-TDLN4.tmp.7.dr	Static PE information: section name: .text entropy: 7.265764685854364

Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\WPFToolkit.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\Microsoft.Win32.TaskScheduler.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\FontAwesome.WPF.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	File created: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-V4P0A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Users\user\AppData\Local\Temp\is-OJ1IG.tmp\isxdl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-6I0DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\PhotosRecovery.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-JO409.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\WpfAnimatedGif.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-Q1O31.tmp	Jump to dropped file
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File created: C:\Program Files\Photos Recovery\Magick.NET-Q8-AnyCPU.dll.partial	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-6U98U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-TDLN4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Users\user\AppData\Local\Temp\is-OJ1IG.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\PRDLL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-ARSHF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-3NQ6U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-6K1JK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\notifierlib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\Delimon.Win32.IO.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-4PH0B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-RQCQL.tmp	Jump to dropped file
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File created: C:\Program Files\Photos Recovery\Magick.NET-Q8-AnyCPU.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\PRNotifier.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery\Photos Recovery.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery\Uninstall Photos Recovery.lnk	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	File written: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Users\user\AppData\Local\Temp\is-OJ1IG.tmp\_isetup\_setup64.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Users\user\AppData\Local\Temp\is-OJ1IG.tmp\isxdl.dll offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-ARSHF.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-ARSHF.tmp offset: 48	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-0FQ8G.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-6U98U.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-6I0DB.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-JNOEK.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-4NEDC.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-V4P0A.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-8J5T6.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-CS64S.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-MDDVK.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-9KUAK.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-TU5RQ.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-S10KV.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-Q1O31.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-RQCQL.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-3NQ6U.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-6K1JK.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-564VB.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-TDLN4.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-4PH0B.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-EE79K.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\is-JO409.tmp offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery\Photos Recovery.lnk offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery\Uninstall Photos Recovery.lnk offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Users\user\Desktop\Photos Recovery.lnk offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\unins000.msg offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\unins000.dat offset: 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\unins000.dat offset: 448	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ATUEI.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File written: C:\Program Files\Photos Recovery\unins000.dat offset: 115472	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\PHREC\backup6.bin offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 52	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 40	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 66	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 124	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 163	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 174	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 188	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\notifier.ini offset: 198	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PhotosRecovery.exe.log offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 276	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 328	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 376	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 423	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 488	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 560	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 616	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 670	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 800	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 879	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Roaming\Systweak\Photos Recovery\PhotosRecovery.txt offset: 1036	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML offset: 0	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File written: C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML offset: unknown	Jump to behavior

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 133A8130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 133C19D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 273C9600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 273E3260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 4D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 15CD8BA0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 15CF2570000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 18EFA8B0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 18EFC2C0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 1F4695F0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 1F46B000000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 20B79630000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 20B7B0A0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 2320000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 24A0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 44A0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: CE0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 2670000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 4670000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 2B799750000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 2B7B32E0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 18B0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 31F0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 51F0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 21FE6F40000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 21FE89D0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 1610CF00000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Memory allocated: 16126B70000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 30C0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 32F0000 memory reserve \| memory write watch
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Memory allocated: 3130000 memory reserve \| memory write watch

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599886	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599779	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599669	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599560	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599450	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599341	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599224	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 598738	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 598505	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 598374	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 598262	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 598161	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 598026	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597923	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597802	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597674	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597436	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597335	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597212	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 596974	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 596846	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 596614	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 596462	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 596351	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 596227	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 595824	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 595585	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 595473	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 595346	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 595092	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594992	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594851	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594739	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594613	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594357	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594253	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594118	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 594015	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 593911	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599869
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599760
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599647
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599536
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599410
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599282
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599168
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 599058
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598944
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598833
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598707
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598581
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598457
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598336
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598229
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598116
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 598001
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 597848
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 597673
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 597405
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 597287
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 597161
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 597035
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596908
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596781
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596665
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596554
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596441
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596317
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596189
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 596076
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595946
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595837
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595725
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595613
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595486
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595373
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595261
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 595087
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 594926
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 594799
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 594685
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 594574
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 594462
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 594350
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Thread delayed: delay time: 922337203685477