Edit tour

Windows Analysis Report
SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Analysis ID:	1632380
MD5:	70f6c2b0e201efc9b266fe4e00e983e5
SHA1:	d8d7fe54f9741edb429451f3fe70aa108f017233
SHA256:	99a74a02ecc5baf8627edf99518853169c7312df04bf0cd5b7f6cdccebf75831
Infos:

Detection

PureLog Stealer

Score:	46
Range:	0 - 100
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

Contains functionality to infect the boot sector

Queries Google from non browser process on port 80

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Tries to delay execution (extensive OutputDebugStringW loop)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes data at the end of the disk (often used by bootkits to hide malicious code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Detected suspicious crossdomain redirect

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64native

SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe (PID: 5364 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe" MD5: 70F6C2B0E201EFC9B266FE4E00E983E5)

SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp (PID: 6604 cmdline: "C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp" /SL5="$10402,7009006,1208320,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe" MD5: 140A6B9AF1C81390C3356FF3170E119F)

taskkill.exe (PID: 6464 cmdline: "C:\Windows\system32\taskkill.exe" /f /im PhotosRecovery.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

taskkill.exe (PID: 2720 cmdline: "C:\Windows\System32\taskkill.exe" /f /im "PRNotifier.exe" MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 2264 cmdline: "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

conhost.exe (PID: 2112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 3156 cmdline: "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

conhost.exe (PID: 3212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PhotosRecovery.exe (PID: 6220 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PhotosRecovery.exe (PID: 3528 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /firstinstall MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PhotosRecovery.exe (PID: 7020 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" "/firstinstall" MD5: 7BE9F02B8172F28175CC2AB83A831D79)

schtasks.exe (PID: 7540 cmdline: "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup" MD5: 796B784E98008854C27F4B18D287BA30)

conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

chrome.exe (PID: 8296 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft Windows 10 Pro&ram=16 GB&model=To Be Filled By O.E.M.&proc=Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 8708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2224,i,10976282736854956991,13483950440466252950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2236 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

PRNotifier.exe (PID: 1188 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" createschedule MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PhotosRecovery.exe (PID: 8264 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

schtasks.exe (PID: 1764 cmdline: "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

conhost.exe (PID: 3264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PhotosRecovery.exe (PID: 8400 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /startup MD5: 7BE9F02B8172F28175CC2AB83A831D79)

schtasks.exe (PID: 6220 cmdline: "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup" MD5: 796B784E98008854C27F4B18D287BA30)

conhost.exe (PID: 6604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 4616 cmdline: "schtasks.exe" /query /TN "Photos RecoveryNotifier" MD5: 796B784E98008854C27F4B18D287BA30)

conhost.exe (PID: 2060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PRNotifier.exe (PID: 8428 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" neweventtrigger MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PRNotifier.exe (PID: 8440 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" startup MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PhotosRecovery.exe (PID: 8532 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /autoupdatecheck MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PRNotifier.exe (PID: 5864 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PhotosRecovery.exe (PID: 5084 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PhotosRecovery.exe (PID: 904 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /startupnag MD5: 7BE9F02B8172F28175CC2AB83A831D79)

PRNotifier.exe (PID: 2740 cmdline: "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger MD5: AD3DA10FE4A18F63B38FDEEA4814A073)

PhotosRecovery.exe (PID: 8276 cmdline: "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues MD5: 7BE9F02B8172F28175CC2AB83A831D79)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files\Photos Recovery\is-LHAGN.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Photos Recovery\is-NBIC5.tmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000002.25280463806.0000000004B42000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000000.25213259685.00000000005F2000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.PRNotifier.exe.4b40000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.0.PRNotifier.exe.5f0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T23:22:26.800066+0100	2803305	3	Unknown Traffic	192.168.11.20	49770	18.155.192.53	80	TCP
2025-03-07T23:22:26.973688+0100	2803305	3	Unknown Traffic	192.168.11.20	49770	18.155.192.53	80	TCP
2025-03-07T23:22:27.147106+0100	2803305	3	Unknown Traffic	192.168.11.20	49770	18.155.192.53	80	TCP
2025-03-07T23:22:36.146943+0100	2803305	3	Unknown Traffic	192.168.11.20	49815	142.251.32.36	80	TCP
2025-03-07T23:22:37.789028+0100	2803305	3	Unknown Traffic	192.168.11.20	49823	142.251.32.36	80	TCP
2025-03-07T23:22:38.780550+0100	2803305	3	Unknown Traffic	192.168.11.20	49827	103.235.46.115	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Virustotal: Detection: 6%

Perma Link

Source: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297

HTTP Parser: No favicon

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-FR949.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-9LRVH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-I2VP2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-B6MF2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-I22C6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-0EAA2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-1GNSQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-RS1CM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-4AKND.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-P5GL8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-TLCJN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-F5HQB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-PGJ2N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-DQ5GR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-AI6CK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-SGA1P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-EN0US.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-G4IGI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-QCDA7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-LHAGN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-6COGJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\is-NBIC5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Directory created: C:\Program Files\Photos Recovery\unins000.msg	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\PRNotifier_log.txt	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\PRNotifier_Corruptlog.txt	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\PRNotifier_OutOfMemorylog.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\scoped_dir8296_1934465154
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_8296_1307061967
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Directory created: C:\Program Files\Photos Recovery\Magick.NET-Q8-AnyCPU.dll.partial
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Directory created: C:\Program Files\Photos Recovery\notifier.json.partial

Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\4416b002-40e3-495b-ab64-83411bcb8a3b_Systweak_Ph~060FFAEF_is1

Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.11.20:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.11.20:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.11.20:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.11.20:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.11.20:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.155.192.53:443 -> 192.168.11.20:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.11.20:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.79.122.22:443 -> 192.168.11.20:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 165.227.176.158:443 -> 192.168.11.20:49832 version: TLS 1.2

Source:	Binary string: C:\dd\WPF_1\src\wpf\src\ControlsPack\WPFToolkit\obj\Release\WPFToolkit.pdb source: PhotosRecovery.exe, 0000000D.00000002.25300690638.0000027AF6F02000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: I:\MyProjects_Sept2021\PR_Trunk\bin\x64\Release\PRDLL.pdb source: PhotosRecovery.exe, 0000000D.00000002.25337160104.00007FF87A89F000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.pdb source: PhotosRecovery.exe, 00000019.00000002.25357419725.00000240678DC000.00000004.00000020.00020000.00000000.sdmp, PhotosRecovery.exe, 00000023.00000002.25360759433.000001F71C72D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: notifierlib.pdb source: PRNotifier.exe, PRNotifier.exe, 00000017.00000002.25280463806.0000000004B42000.00000002.00000001.01000000.0000000D.sdmp, PRNotifier.exe, 00000017.00000002.25260979853.0000000002725000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000018.00000002.25261867631.00000000036E5000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000021.00000002.25431178087.0000000002FF8000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000024.00000002.25521584260.0000000002A35000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\Visual Studio 2008\Projects\TaskService\obj\Release\Microsoft.Win32.TaskScheduler.pdb source: PhotosRecovery.exe, 0000000D.00000002.25302546736.0000027AF7042000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Users\mohammad.shabbir\Downloads\WpfAnimatedGif-master\WpfAnimatedGif-master\WpfAnimatedGif\obj\Debug\WpfAnimatedGif.pdb source: PhotosRecovery.exe, 0000000D.00000002.25290517095.0000027AF6742000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\Programming\Projects\Delimon\Win32FileLibrary\Win32FileLibrary\obj\Release\Delimon.Win32.IO.pdb source: is-QCDA7.tmp.2.dr
Source:	Binary string: C:\Users\Tommy\Documents\GitHub\Font-Awesome-WPF\src\WPF\FontAwesome.WPF\bin\Signed-Net35\FontAwesome.WPF.pdbTF source: PhotosRecovery.exe, 0000000D.00000002.25291528125.0000027AF6782000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: PRNotifier.pdbh source: PRNotifier.exe, 0000000E.00000002.25278577271.0000000002C19000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 0000000E.00000000.25213259685.00000000005F2000.00000002.00000001.01000000.0000000C.sdmp, PRNotifier.exe, 00000017.00000002.25260979853.00000000025F8000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000018.00000002.25261867631.00000000035C9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Runtime.Remoting.pdbpdbing.pdb33 source: PhotosRecovery.exe, 00000023.00000002.25338799970.000001F702401000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\mohammad.shabbir\Downloads\WpfAnimatedGif-master\WpfAnimatedGif-master\WpfAnimatedGif\obj\Debug\WpfAnimatedGif.pdbh source: PhotosRecovery.exe, 0000000D.00000002.25290517095.0000027AF6742000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: PRNotifier.pdb source: PRNotifier.exe, 0000000E.00000002.25278577271.0000000002C19000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 0000000E.00000000.25213259685.00000000005F2000.00000002.00000001.01000000.0000000C.sdmp, PRNotifier.exe, 00000017.00000002.25260979853.00000000025F8000.00000004.00000800.00020000.00000000.sdmp, PRNotifier.exe, 00000018.00000002.25261867631.00000000035C9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Runtime.Remoting.pdb source: PhotosRecovery.exe, 00000019.00000002.25357419725.00000240678DC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PhotosRecovery.pdb source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp, 00000002.00000003.25214291336.0000000003670000.00000004.00001000.00020000.00000000.sdmp, PhotosRecovery.exe, 0000000C.00000000.25184414090.000002159E612000.00000002.00000001.01000000.00000009.sdmp, is-I2VP2.tmp.2.dr
Source:	Binary string: C:\Users\Tommy\Documents\GitHub\Font-Awesome-WPF\src\WPF\FontAwesome.WPF\bin\Signed-Net35\FontAwesome.WPF.pdb source: PhotosRecovery.exe, 0000000D.00000002.25291528125.0000027AF6782000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Runtime.Remoting.pdbDJ source: PhotosRecovery.exe, 00000023.00000002.25338799970.000001F70243D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb source: PhotosRecovery.exe, 00000019.00000002.25357419725.00000240678DC000.00000004.00000020.00020000.00000000.sdmp, PhotosRecovery.exe, 00000023.00000002.25338799970.000001F70243D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\Regclean Pro\rcp\src\UpdateDownload\src\Release\update.pdb source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp, 00000002.00000003.25214291336.0000000003670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PhotosRecovery.pdb8 source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp, 00000002.00000003.25214291336.0000000003670000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: z:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: x:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: v:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: t:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: r:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: p:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: n:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: l:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: j:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: h:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: f:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: d:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: b:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: y:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: w:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: u:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: s:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: q:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: o:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: m:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: k:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: i:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: g:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: e:
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	File opened: c:
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File opened: a:

Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8864A0 FindFirstFileA,lstrlenA,CreateFileA,ReadFile,VirtualAlloc,VirtualFree,SetFilePointer,CloseHandle,FindNextFileA,lstrcpynA,FindClose,VirtualFree,VirtualFree,	13_2_00007FF87A8864A0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A87B450 lstrlenW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,lstrcpyW,GetTickCount,MoveFileW,RemoveDirectoryW,VirtualProtect,VirtualProtect,VirtualProtect,VirtualProtect,RemoveDirectoryW,	13_2_00007FF87A87B450
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A886860 FindFirstFileA,lstrlenA,CreateFileA,GetFileSize,lstrcpynA,lstrcpynA,lstrcpynA,FindClose,VirtualFree,VirtualFree,CloseHandle,FindNextFileA,	13_2_00007FF87A886860

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FE7557h	12_2_00007FF826FE7460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	12_2_00007FF826FEE7B9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	12_2_00007FF826FEF564
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FE7557h	12_2_00007FF826FE7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	12_2_00007FF826FF43B7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	12_2_00007FF826FEFBBF
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	12_2_00007FF826FF02D5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	12_2_00007FF826FEA2E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF82701D9D3h	13_2_00007FF826FF77B5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FF7557h	13_2_00007FF826FF07C8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FFE0A3h	13_2_00007FF826FFD6F0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FFE0A3h	13_2_00007FF826FFD6F0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF82701EBF3h	13_2_00007FF826FF3525
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF82700086Eh	13_2_00007FF827000471
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	13_2_00007FF826FFA2E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FFE0A3h	13_2_00007FF826FFDFAA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FFE0A3h	13_2_00007FF826FFDE58
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FF7557h	13_2_00007FF826FF7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF82700222Bh	13_2_00007FF82700216D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272CDD72h	13_2_00007FF8272CDC0F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272D20EAh	13_2_00007FF8272D1F15
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272C1D8Eh	13_2_00007FF8272C1B01
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272D3564h	13_2_00007FF8272D33E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272CBFD5h	13_2_00007FF8272CBE0D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272D5F8Bh	13_2_00007FF8272D5E09
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272C78BBh	13_2_00007FF8272C754D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272C9231h	13_2_00007FF8272C9199
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272DA094h	13_2_00007FF8272D9F72
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8272DA094h	13_2_00007FF8272D9FA0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FE7557h	17_2_00007FF826FE7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	17_2_00007FF826FEA2E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	20_2_00007FF826FC7460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	20_2_00007FF826FC7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	22_2_00007FF826FCA325
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	22_2_00007FF826FC07C8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	22_2_00007FF826FC7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	22_2_00007FF826FC06D0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D6C72h	22_2_00007FF8271D6C62
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D8B2Ah	22_2_00007FF8271D87B5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D8C77h	22_2_00007FF8271D87B5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D8DEDh	22_2_00007FF8271D87B5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D8F59h	22_2_00007FF8271D87B5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D2182h	22_2_00007FF8271D2076
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D75D4h	22_2_00007FF8271D7530
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF8271D16E2h	22_2_00007FF8271D1579
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	25_2_00007FF826FC07C8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	25_2_00007FF826FC7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	25_2_00007FF826FCA325
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	25_2_00007FF826FC06D0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FCF031
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	34_2_00007FF826FC7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FCE442
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FD3C85
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FCEDEEh	34_2_00007FF826FCEBA9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FCEBA9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FCFBBD
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FCE620
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FCA2A2
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FC7557h	34_2_00007FF826FC7460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FD3F48
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FCFBE0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	34_2_00007FF826FD3E91
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FF7557h	35_2_00007FF826FF07C8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FF7557h	35_2_00007FF826FF7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	35_2_00007FF826FFA325
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FF7557h	35_2_00007FF826FF06BF
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FD7557h	37_2_00007FF826FD7460
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FDEDEEh	37_2_00007FF826FDEBA9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then jmp 00007FF826FD7557h	37_2_00007FF826FD7445
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	37_2_00007FF826FDA325
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	37_2_00007FF826FDE7B9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	37_2_00007FF826FDEE05
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	37_2_00007FF826FDF60F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 4x nop then dec eax	37_2_00007FF826FDFE85

Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET / HTTP/1.1 Host: www.google.com Connection: Keep-Alive
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET /sorry/index?continue=http://www.google.com/&q=EgRmgfycGKvjrb4GIjC8e9LWJ4infWHwRL79Pwbs-poniLE3npCRuEPsRVobxVBtrStBHVvjP4pfbsacBzYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET / HTTP/1.1 Host: www.google.com
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	HTTP traffic: GET /sorry/index?continue=http://www.google.com/&q=EgRmgfycGK3jrb4GIjDpfkxdynGZr8JGCOhIFS85q0tNLvzYV3nkIEfcmbjSe7r-9fT0f3EN41ChVWzxZncyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /pr/notifier/update.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=-1&https://www.systweak.com:443/photos-recovery/= HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/update/update.asp?productname=PhotoRecovery&currentapplicationid=3.2.0.191&currentdbversionid=0&firstinstall=1 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/utilitykit/utility_kit_v3.aspx HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/update/update.asp?productname=PhotoRecovery&currentapplicationid=3.2.0.191&currentdbversionid=0&firstinstall=0 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/utilitykit/utility_kit_v3.aspx HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/photosrecovery/dll/Magick.NET-Q8-AnyCPU.dll HTTP/1.1Content-Type: application/jsonHost: cdn.systweak.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /pr/notifier/update.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=2973889335994299950&https://www.systweak.com:443/photos-recovery/=&appversion=3.2.0.191&lipl=0&instdt=638769829421302977&os=microsoft%20windows%2010%20pro&ram=16%20gb&model=to%20be%20filled%20by%20o.e.m.&proc=intel(r)%20core(tm)%20i9-9900k%20cpu%20@%203.60ghz&ibv=&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pr/notifier/notifier_pr_new.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=2973889335994299950&https://www.systweak.com:443/photos-recovery/=&appversion=3.2.0.191&lipl=0&instdt=638769829421302977&os=microsoft%20windows%2010%20pro&ram=16%20gb&model=to%20be%20filled%20by%20o.e.m.&proc=intel(r)%20core(tm)%20i9-9900k%20cpu%20@%203.60ghz&ibv=&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 HTTP/1.1Content-Type: application/jsonHost: activate123.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /win/pr/offerhtm/PR_Notifier_New.json HTTP/1.1Content-Type: application/jsonHost: offers.systweak.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /pr/notifier/update.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=2973889335994299950&https://www.systweak.com:443/photos-recovery/=&appversion=3.2.0.191&lipl=0&instdt=638769829421302977&os=microsoft%20windows%2010%20pro&ram=16%20gb&model=to%20be%20filled%20by%20o.e.m.&proc=intel(r)%20core(tm)%20i9-9900k%20cpu%20@%203.60ghz&ibv=&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/aso.png HTTP/1.1Host: cdn.systweak.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/adr.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/apc.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/asp.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=http://www.google.com/&q=EgRmgfycGKvjrb4GIjC8e9LWJ4infWHwRL79Pwbs-poniLE3npCRuEPsRVobxVBtrStBHVvjP4pfbsacBzYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=http://www.google.com/&q=EgRmgfycGK3jrb4GIjDpfkxdynGZr8JGCOhIFS85q0tNLvzYV3nkIEfcmbjSe7r-9fT0f3EN41ChVWzxZncyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.com

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49770 -> 18.155.192.53:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49823 -> 142.251.32.36:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49827 -> 103.235.46.115:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49815 -> 142.251.32.36:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.65.15.245
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.21.226
Source: unknown	TCP traffic detected without corresponding DNS query: 104.18.21.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.65.15.245
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.49.34
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.49.34
Source: unknown	TCP traffic detected without corresponding DNS query: 23.62.46.147
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.189.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.189.163
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.134
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.151.134
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 239.255.255.250
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /pr/notifier/update.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=-1&https://www.systweak.com:443/photos-recovery/= HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/update/update.asp?productname=PhotoRecovery&currentapplicationid=3.2.0.191&currentdbversionid=0&firstinstall=1 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/utilitykit/utility_kit_v3.aspx HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /photosrec/update/update.asp?productname=PhotoRecovery&currentapplicationid=3.2.0.191&currentdbversionid=0&firstinstall=0 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /photosrec/utilitykit/utility_kit_v3.aspx HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/photosrecovery/dll/Magick.NET-Q8-AnyCPU.dll HTTP/1.1Content-Type: application/jsonHost: cdn.systweak.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /css/new-bootstrap.min.css HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /css/style.css HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /css/stylesheet.css HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /css/after-install2.css HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /js/jquery.min.js HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /utils/common.js HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /views/common/breadCrumb.js HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /pr/notifier/update.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=2973889335994299950&https://www.systweak.com:443/photos-recovery/=&appversion=3.2.0.191&lipl=0&instdt=638769829421302977&os=microsoft%20windows%2010%20pro&ram=16%20gb&model=to%20be%20filled%20by%20o.e.m.&proc=intel(r)%20core(tm)%20i9-9900k%20cpu%20@%203.60ghz&ibv=&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /js/params.js HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /tracking/trLambdaService.js HTTP/1.1Host: www.systweak.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _csrf=DlSQBOdXPgfBbN9NmoSxaXc5
Source: global traffic	HTTP traffic detected: GET /td/rul/942863319?random=1741386154625&cv=11&fst=1741386154625&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be5362v889458153z8890137388za201zb890147902&gcd=13l3l3R3l5l1&dma=0&tag_exp=102067808~102482433~102539968~102587591~102640600~102717422~102788824~102814059&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.systweak.com%2Fphotos-recovery%2Fafter-install%2F%3Futm_source%3Dsystweak%26utm_campaign%3Ddefault%26affiliateid%3D%26utm_medium%3Dnewbuild_2025%26utm_content%3DAfterInstall%26utm_term%3DSetup%26page%3Dinstall%26x-cid%3D%26utm_days%3D0%26langcode%3Den%26appversion%3D3.2.0.191%26isreg%3D0%26isexpired%3D0%26macid%3D2973889335994299950%26lipl%3D0%26instdt%3D638769829421302977%26productid%3D9881%26os%3DMicrosoft%2520Windows%252010%2520Pro%26ram%3D16%2520GB%26model%3DTo%2520Be%2520Filled%2520By%2520O.E.M.%26proc%3DIntel(R)%2520Core(TM)%2520i9-9900K%2520CPU%2520%40%25203.60GHz%26ibv%3D%26pid%3D9881%26iev%3D0%26utm_updt%3D%26utm_update&hn=www.googleadservices.com&frm=0&tiba=Thank%20you%20for%20installing%20Photos%20Recovery!&npa=0&pscdl=noapi&auid=1428785574.1741386151&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&_tu=Cg HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/942863319?random=1741386154630&cv=11&fst=1741386154630&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be5362v889458153z8890137388za201zb890147902&gcs=G1--&gcd=13l3l3R3l5l1&dma=0&tag_exp=102067808~102482433~102539968~102587591~102640600~102717422~102788824~102814059&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.systweak.com%2Fphotos-recovery%2Fafter-install%2F%3Futm_source%3Dsystweak%26utm_campaign%3Ddefault%26affiliateid%3D%26utm_medium%3Dnewbuild_2025%26utm_content%3DAfterInstall%26utm_term%3DSetup%26page%3Dinstall%26x-cid%3D%26utm_days%3D0%26langcode%3Den%26appversion%3D3.2.0.191%26isreg%3D0%26isexpired%3D0%26macid%3D2973889335994299950%26lipl%3D0%26instdt%3D638769829421302977%26productid%3D9881%26os%3DMicrosoft%2520Windows%252010%2520Pro%26ram%3D16%2520GB%26model%3DTo%2520Be%2520Filled%2520By%2520O.E.M.%26proc%3DIntel(R)%2520Core(TM)%2520i9-9900K%2520CPU%2520%40%25203.60GHz%26ibv%3D%26pid%3D9881%26iev%3D0%26utm_updt%3D%26utm_update&label=j2klCKmktroBENfny8ED&hn=www.googleadservices.com&frm=0&tiba=Thank%20you%20for%20installing%20Photos%20Recovery!&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=1428785574.1741386151&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&_tu=Cg&ct_cookie_present=0 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/942863319/?random=1741386154625&cv=11&fst=1741384800000&bg=ffffff&guid=ON&async=1&gtm=45be5362v889458153z8890137388za201zb890147902&gcd=13l3l3R3l5l1&dma=0&tag_exp=102067808~102482433~102539968~102587591~102640600~102717422~102788824~102814059&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.systweak.com%2Fphotos-recovery%2Fafter-install%2F%3Futm_source%3Dsystweak%26utm_campaign%3Ddefault%26affiliateid%3D%26utm_medium%3Dnewbuild_2025%26utm_content%3DAfterInstall%26utm_term%3DSetup%26page%3Dinstall%26x-cid%3D%26utm_days%3D0%26langcode%3Den%26appversion%3D3.2.0.191%26isreg%3D0%26isexpired%3D0%26macid%3D2973889335994299950%26lipl%3D0%26instdt%3D638769829421302977%26productid%3D9881%26os%3DMicrosoft%2520Windows%252010%2520Pro%26ram%3D16%2520GB%26model%3DTo%2520Be%2520Filled%2520By%2520O.E.M.%26proc%3DIntel(R)%2520Core(TM)%2520i9-9900K%2520CPU%2520%40%25203.60GHz%26ibv%3D%26pid%3D9881%26iev%3D0%26utm_updt%3D%26utm_update&hn=www.googleadservices.com&frm=0&tiba=Thank%20you%20for%20installing%20Photos%20Recovery!&npa=0&pscdl=noapi&auid=1428785574.1741386151&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&_tu=Cg&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCjtLzMuRaZ_vw39an4MihZxV-pZRQpaH7qgg&random=2588598073&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft%20Windows%2010%20Pro&ram=16%20GB&model=To%20Be%20Filled%20By%20O.E.M.&proc=Intel(R)%20Core(TM)%20i9-9900K%20CPU%20@%203.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/942863319/?random=1741386154625&cv=11&fst=1741384800000&bg=ffffff&guid=ON&async=1&gtm=45be5362v889458153z8890137388za201zb890147902&gcd=13l3l3R3l5l1&dma=0&tag_exp=102067808~102482433~102539968~102587591~102640600~102717422~102788824~102814059&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.systweak.com%2Fphotos-recovery%2Fafter-install%2F%3Futm_source%3Dsystweak%26utm_campaign%3Ddefault%26affiliateid%3D%26utm_medium%3Dnewbuild_2025%26utm_content%3DAfterInstall%26utm_term%3DSetup%26page%3Dinstall%26x-cid%3D%26utm_days%3D0%26langcode%3Den%26appversion%3D3.2.0.191%26isreg%3D0%26isexpired%3D0%26macid%3D2973889335994299950%26lipl%3D0%26instdt%3D638769829421302977%26productid%3D9881%26os%3DMicrosoft%2520Windows%252010%2520Pro%26ram%3D16%2520GB%26model%3DTo%2520Be%2520Filled%2520By%2520O.E.M.%26proc%3DIntel(R)%2520Core(TM)%2520i9-9900K%2520CPU%2520%40%25203.60GHz%26ibv%3D%26pid%3D9881%26iev%3D0%26utm_updt%3D%26utm_update&hn=www.googleadservices.com&frm=0&tiba=Thank%20you%20for%20installing%20Photos%20Recovery!&npa=0&pscdl=noapi&auid=1428785574.1741386151&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&_tu=Cg&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwCjtLzMuRaZ_vw39an4MihZxV-pZRQpaH7qgg&random=2588598073&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlqHLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/942863319/?random=123433870&cv=11&fst=1741386154630&bg=ffffff&guid=ON&async=1&gtm=45be5362v889458153z8890137388za201zb890147902&gcs=G1--&gcd=13l3l3R3l5l1&dma=0&tag_exp=102067808~102482433~102539968~102587591~102640600~102717422~102788824~102814059&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.systweak.com%2Fphotos-recovery%2Fafter-install%2F%3Futm_source%3Dsystweak%26utm_campaign%3Ddefault%26affiliateid%3D%26utm_medium%3Dnewbuild_2025%26utm_content%3DAfterInstall%26utm_term%3DSetup%26page%3Dinstall%26x-cid%3D%26utm_days%3D0%26langcode%3Den%26appversion%3D3.2.0.191%26isreg%3D0%26isexpired%3D0%26macid%3D2973889335994299950%26lipl%3D0%26instdt%3D638769829421302977%26productid%3D9881%26os%3DMicrosoft%2520Windows%252010%2520Pro%26ram%3D16%2520GB%26model%3DTo%2520Be%2520Filled%2520By%2520O.E.M.%26proc%3DIntel(R)%2520Core(TM)%2520i9-9900K%2520CPU%2520%40%25203.60GHz%26ibv%3D%26pid%3D9881%26iev%3D0%26utm_updt%3D%26utm_update&label=j2klCKmktroBENfny8ED&hn=www.googleadservices.com&frm=0&tiba=Thank%20you%20for%20installing%20Photos%20Recovery!&value=0&npa=0&pscdl=noapi&auid=1428785574.1741386151&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&_tu=Cg&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgijxbECCPfOsQIIkMmxAgjTxbECCOvMsQIIz86xAiIBAUABSidldmVudC1zb3VyY2UsIHRyaWdnZXI9bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=CITFvsKo__bKGyITCOz9gPqA-YsDFQebjggdY9gu4TIMCANiCAgAEAAYACAAMgwIBGIICAAQABgAIAAyDAgHYggIABAAGAAgADIMCAhiCAgAEAAYACAAMgwICWIICAAQABgAIAAyDAgKYggIABAAGAAgADIMCAJiCAgAEAAYACAAMgwIC2IICAAQABgAIAAyDAgVYggIABAAGAAgADIMCB9iCAgAEAAYACAAMgwIE2IICAAQABgAIAAyDAgSYggIABAAGAAgADrGBGh0dHBzOi8vd3d3LnN5c3R3ZWFrLmNvbS9waG90b3MtcmVjb3ZlcnkvYWZ0ZXItaW5zdGFsbC8_dXRtX3NvdXJjZT1zeXN0d2VhayZ1dG1fY2FtcGFpZ249ZGVmYXVsdCZhZmZpbGlhdGVpZD0mdXRtX21lZGl1bT1uZXdidWlsZF8yMDI1JnV0bV9jb250ZW50PUFmdGVySW5zdGFsbCZ1dG1fdGVybT1TZXR1cCZwYWdlPWluc3RhbGwmeC1jaWQ9JnV0bV9kYXlzPTAmbGFuZ2NvZGU9ZW4mYXBwdmVyc2lvbj0zLjIuMC4xOTEmaXNyZWc9MCZpc2V4cGlyZWQ9MCZtYWNpZD0yOTczODg5MzM1OTk0Mjk5OTUwJmxpcGw9MCZpbnN0ZHQ9NjM4NzY5ODI5NDIxMzAyOTc3JnByb2R1Y3RpZD05ODgxJm9zPU1pY3Jvc29mdCUyMFdpbmRvd3MlMjAxMCUyMFBybyZyYW09MTYlMjBHQiZtb2RlbD1UbyUyMEJlJTIwRmlsbGVkJTIwQnklMjBPLkUuTS4mcHJvYz1JbnRlbChSKSUyMENvcmUoVE0pJTIwaTktOTkwMEslMjBDUFUlMjBAJTIwMy42MEdIeiZpYnY9JnBpZD05ODgxJmlldj0wJnV0bV91cGR0PSZ1dG1fdXBkYXRlZGF0ZT0mYmR0cz0yOS0wMS0yMDI1JngtbGlwPSZpbnN0ZHRzPTA3LTAzLTIwMjUmYmR0PTYzODc2OTgyOTM5OTkwMTI5N0JXQ2hBSWdNLXF2Z1lRdUx6d2dOakkzOU1TRWkwQS1NVkdQR3NFY1NsdHVZZ2h3V3dBOFhlLUhLOUhNYXBnQ0NRdnJCYTc4MTBQMmpNNi02cV9iMU5TaTlF&is_vtc=1&cid=CAQSKQCjtLzMAeuMPPAkwAsH81JzXpMZFDEEOUjyD_VSgTLDNRrU4oJR7IMO&eitems=ChAIgM-qvgYQ4teTpqy39uoWEh0AAoov_FCl_iafRL_y8CFH27Gh-k8dxDvMHCwiSg&random=2658262624 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozill
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/942863319/?random=123433870&cv=11&fst=1741386154630&bg=ffffff&guid=ON&async=1&gtm=45be5362v889458153z8890137388za201zb890147902&gcs=G1--&gcd=13l3l3R3l5l1&dma=0&tag_exp=102067808~102482433~102539968~102587591~102640600~102717422~102788824~102814059&u_w=1920&u_h=1080&url=https%3A%2F%2Fwww.systweak.com%2Fphotos-recovery%2Fafter-install%2F%3Futm_source%3Dsystweak%26utm_campaign%3Ddefault%26affiliateid%3D%26utm_medium%3Dnewbuild_2025%26utm_content%3DAfterInstall%26utm_term%3DSetup%26page%3Dinstall%26x-cid%3D%26utm_days%3D0%26langcode%3Den%26appversion%3D3.2.0.191%26isreg%3D0%26isexpired%3D0%26macid%3D2973889335994299950%26lipl%3D0%26instdt%3D638769829421302977%26productid%3D9881%26os%3DMicrosoft%2520Windows%252010%2520Pro%26ram%3D16%2520GB%26model%3DTo%2520Be%2520Filled%2520By%2520O.E.M.%26proc%3DIntel(R)%2520Core(TM)%2520i9-9900K%2520CPU%2520%40%25203.60GHz%26ibv%3D%26pid%3D9881%26iev%3D0%26utm_updt%3D%26utm_update&label=j2klCKmktroBENfny8ED&hn=www.googleadservices.com&frm=0&tiba=Thank%20you%20for%20installing%20Photos%20Recovery!&value=0&npa=0&pscdl=noapi&auid=1428785574.1741386151&uaa=x86&uab=64&uafvl=Chromium%3B128.0.6613.120%7CNot%253BA%253DBrand%3B24.0.0.0%7CGoogle%2520Chrome%3B128.0.6613.120&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&_tu=Cg&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgijxbECCPfOsQIIkMmxAgjTxbECCOvMsQIIz86xAiIBAUABSidldmVudC1zb3VyY2UsIHRyaWdnZXI9bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=CITFvsKo__bKGyITCOz9gPqA-YsDFQebjggdY9gu4TIMCANiCAgAEAAYACAAMgwIBGIICAAQABgAIAAyDAgHYggIABAAGAAgADIMCAhiCAgAEAAYACAAMgwICWIICAAQABgAIAAyDAgKYggIABAAGAAgADIMCAJiCAgAEAAYACAAMgwIC2IICAAQABgAIAAyDAgVYggIABAAGAAgADIMCB9iCAgAEAAYACAAMgwIE2IICAAQABgAIAAyDAgSYggIABAAGAAgADrGBGh0dHBzOi8vd3d3LnN5c3R3ZWFrLmNvbS9waG90b3MtcmVjb3ZlcnkvYWZ0ZXItaW5zdGFsbC8_dXRtX3NvdXJjZT1zeXN0d2VhayZ1dG1fY2FtcGFpZ249ZGVmYXVsdCZhZmZpbGlhdGVpZD0mdXRtX21lZGl1bT1uZXdidWlsZF8yMDI1JnV0bV9jb250ZW50PUFmdGVySW5zdGFsbCZ1dG1fdGVybT1TZXR1cCZwYWdlPWluc3RhbGwmeC1jaWQ9JnV0bV9kYXlzPTAmbGFuZ2NvZGU9ZW4mYXBwdmVyc2lvbj0zLjIuMC4xOTEmaXNyZWc9MCZpc2V4cGlyZWQ9MCZtYWNpZD0yOTczODg5MzM1OTk0Mjk5OTUwJmxpcGw9MCZpbnN0ZHQ9NjM4NzY5ODI5NDIxMzAyOTc3JnByb2R1Y3RpZD05ODgxJm9zPU1pY3Jvc29mdCUyMFdpbmRvd3MlMjAxMCUyMFBybyZyYW09MTYlMjBHQiZtb2RlbD1UbyUyMEJlJTIwRmlsbGVkJTIwQnklMjBPLkUuTS4mcHJvYz1JbnRlbChSKSUyMENvcmUoVE0pJTIwaTktOTkwMEslMjBDUFUlMjBAJTIwMy42MEdIeiZpYnY9JnBpZD05ODgxJmlldj0wJnV0bV91cGR0PSZ1dG1fdXBkYXRlZGF0ZT0mYmR0cz0yOS0wMS0yMDI1JngtbGlwPSZpbnN0ZHRzPTA3LTAzLTIwMjUmYmR0PTYzODc2OTgyOTM5OTkwMTI5N0JXQ2hBSWdNLXF2Z1lRdUx6d2dOakkzOU1TRWkwQS1NVkdQR3NFY1NsdHVZZ2h3V3dBOFhlLUhLOUhNYXBnQ0NRdnJCYTc4MTBQMmpNNi02cV9iMU5TaTlF&is_vtc=1&cid=CAQSKQCjtLzMAeuMPPAkwAsH81JzXpMZFDEEOUjyD_VSgTLDNRrU4oJR7IMO&eitems=ChAIgM-qvgYQ4teTpqy39uoWEh0AAoov_FCl_iafRL_y8CFH27Gh-k8dxDvMHCwiSg&random=2658262624 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/5
Source: global traffic	HTTP traffic detected: GET /pr/notifier/notifier_pr_new.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=2973889335994299950&https://www.systweak.com:443/photos-recovery/=&appversion=3.2.0.191&lipl=0&instdt=638769829421302977&os=microsoft%20windows%2010%20pro&ram=16%20gb&model=to%20be%20filled%20by%20o.e.m.&proc=intel(r)%20core(tm)%20i9-9900k%20cpu%20@%203.60ghz&ibv=&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 HTTP/1.1Content-Type: application/jsonHost: activate123.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /win/pr/offerhtm/PR_Notifier_New.json HTTP/1.1Content-Type: application/jsonHost: offers.systweak.comConnection: Close
Source: global traffic	HTTP traffic detected: GET /pr/notifier/update.asp?utm_source=systweak&utm_medium=newbuild_2025&utm_campaign=default&affiliateid=&isreg=0&isexpired=0&dis=0&utm_term=&utm_days=0&lang_code=en&productid=9881&macid=2973889335994299950&https://www.systweak.com:443/photos-recovery/=&appversion=3.2.0.191&lipl=0&instdt=638769829421302977&os=microsoft%20windows%2010%20pro&ram=16%20gb&model=to%20be%20filled%20by%20o.e.m.&proc=intel(r)%20core(tm)%20i9-9900k%20cpu%20@%203.60ghz&ibv=&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297 HTTP/1.1Host: activate123.comCache-Control: no-store,no-cachePragma: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/aso.png HTTP/1.1Host: cdn.systweak.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/adr.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/apc.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET /setups/utlkt/images/asp.png HTTP/1.1Host: cdn.systweak.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=http://www.google.com/&q=EgRmgfycGKvjrb4GIjC8e9LWJ4infWHwRL79Pwbs-poniLE3npCRuEPsRVobxVBtrStBHVvjP4pfbsacBzYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.com
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=http://www.google.com/&q=EgRmgfycGK3jrb4GIjDpfkxdynGZr8JGCOhIFS85q0tNLvzYV3nkIEfcmbjSe7r-9fT0f3EN41ChVWzxZncyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.baidu.com

Source: global traffic	DNS traffic detected: DNS query: activate123.com
Source: global traffic	DNS traffic detected: DNS query: www.systweak.com
Source: global traffic	DNS traffic detected: DNS query: cdn.systweak.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s1kegmsmob.execute-api.us-east-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: offers.systweak.com

Source: global traffic	TCP traffic: 192.168.11.20:58370 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:58370 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:58370 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:58370 -> 239.255.255.250:1900

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 12_2_00007FF826FF8F1A	12_2_00007FF826FF8F1A
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 12_2_00007FF826FFA372	12_2_00007FF826FFA372
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 12_2_00007FF826FF879D	12_2_00007FF826FF879D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A87FAE0	13_2_00007FF87A87FAE0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A87E810	13_2_00007FF87A87E810
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A87EEE0	13_2_00007FF87A87EEE0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A87D390	13_2_00007FF87A87D390
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A89B3B4	13_2_00007FF87A89B3B4
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8963C8	13_2_00007FF87A8963C8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8743E0	13_2_00007FF87A8743E0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A871B50	13_2_00007FF87A871B50
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A890B44	13_2_00007FF87A890B44
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A889B60	13_2_00007FF87A889B60
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A897480	13_2_00007FF87A897480
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A873480	13_2_00007FF87A873480
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A883CA0	13_2_00007FF87A883CA0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A874CF0	13_2_00007FF87A874CF0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A882CE0	13_2_00007FF87A882CE0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A878C30	13_2_00007FF87A878C30
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A869440	13_2_00007FF87A869440
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A872990	13_2_00007FF87A872990
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A89E19C	13_2_00007FF87A89E19C
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8699A0	13_2_00007FF87A8699A0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88E1CE	13_2_00007FF87A88E1CE
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88A910	13_2_00007FF87A88A910
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A875900	13_2_00007FF87A875900
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A863950	13_2_00007FF87A863950
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A86E150	13_2_00007FF87A86E150
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A876140	13_2_00007FF87A876140
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88BA80	13_2_00007FF87A88BA80
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8872C0	13_2_00007FF87A8872C0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A873A10	13_2_00007FF87A873A10
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A87C230	13_2_00007FF87A87C230
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A893A68	13_2_00007FF87A893A68
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88E25F	13_2_00007FF87A88E25F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88EFB0	13_2_00007FF87A88EFB0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A896FA8	13_2_00007FF87A896FA8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88CFAA	13_2_00007FF87A88CFAA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8677B0	13_2_00007FF87A8677B0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8817D0	13_2_00007FF87A8817D0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8657F0	13_2_00007FF87A8657F0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A89A704	13_2_00007FF87A89A704
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A870F50	13_2_00007FF87A870F50
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88C090	13_2_00007FF87A88C090
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A87B8B0	13_2_00007FF87A87B8B0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A866830	13_2_00007FF87A866830
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88E020	13_2_00007FF87A88E020
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A89B050	13_2_00007FF87A89B050
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A886860	13_2_00007FF87A886860
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88B5C0	13_2_00007FF87A88B5C0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88C5C0	13_2_00007FF87A88C5C0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8935D8	13_2_00007FF87A8935D8
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A888D30	13_2_00007FF87A888D30
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A89CD38	13_2_00007FF87A89CD38
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A876560	13_2_00007FF87A876560
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A8886C0	13_2_00007FF87A8886C0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A86FE00	13_2_00007FF87A86FE00
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A89D634	13_2_00007FF87A89D634
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A868E20	13_2_00007FF87A868E20
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A866640	13_2_00007FF87A866640
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A891674	13_2_00007FF87A891674
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A868670	13_2_00007FF87A868670
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A871670	13_2_00007FF87A871670
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF827000EE5	13_2_00007FF827000EE5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF8272CC33D	13_2_00007FF8272CC33D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF8272CA269	13_2_00007FF8272CA269
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF8272D79F1	13_2_00007FF8272D79F1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF8272D3621	13_2_00007FF8272D3621
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_02980C78	14_2_02980C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0298D398	14_2_0298D398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_02981099	14_2_02981099
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_02980C69	14_2_02980C69
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_06432720	14_2_06432720
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_06432310	14_2_06432310
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643B0D0	14_2_0643B0D0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643E161	14_2_0643E161
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_064331A8	14_2_064331A8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_06433CF8	14_2_06433CF8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643AAA0	14_2_0643AAA0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_06433AA0	14_2_06433AA0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643B0C2	14_2_0643B0C2
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643319A	14_2_0643319A
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_06436FD0	14_2_06436FD0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643AA90	14_2_0643AA90
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0793085D	14_2_0793085D
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_07936B92	14_2_07936B92
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0793085D	14_2_0793085D
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_07930891	14_2_07930891
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF8271D87B5	22_2_00007FF8271D87B5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF8271D1765	22_2_00007FF8271D1765
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_04B42050	23_2_04B42050
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_04B44780	23_2_04B44780
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_04B48140	23_2_04B48140
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_00BE0C78	23_2_00BE0C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_00BED398	23_2_00BED398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_00BE1099	23_2_00BE1099
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_00BE10EB	23_2_00BE10EB
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_00BE0C69	23_2_00BE0C69
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 24_2_01B30C78	24_2_01B30C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 24_2_01B3D398	24_2_01B3D398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 24_2_01B30C69	24_2_01B30C69
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_01430C78	33_2_01430C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_0143D398	33_2_0143D398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_01430C69	33_2_01430C69
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A313D0	33_2_07A313D0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A382C0	33_2_07A382C0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A36FB8	33_2_07A36FB8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A3164B	33_2_07A3164B
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A36573	33_2_07A36573
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A31557	33_2_07A31557
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A382B1	33_2_07A382B1
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A382C0	33_2_07A382C0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A301F1	33_2_07A301F1
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A36FB8	33_2_07A36FB8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A36F80	33_2_07A36F80
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A3CE21	33_2_07A3CE21
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A31CF7	33_2_07A31CF7
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A31A58	33_2_07A31A58
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07A3196E	33_2_07A3196E
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE20B8	33_2_07BE20B8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BEAF90	33_2_07BEAF90
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE0E90	33_2_07BE0E90
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE5E40	33_2_07BE5E40
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BEDBF8	33_2_07BEDBF8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE1938	33_2_07BE1938
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BEA960	33_2_07BEA960
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE0528	33_2_07BE0528
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE0518	33_2_07BE0518
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE20A7	33_2_07BE20A7
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BEAF80	33_2_07BEAF80
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BEAF18	33_2_07BEAF18
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BE1929	33_2_07BE1929
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 33_2_07BEA952	33_2_07BEA952
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 34_2_00007FF826FD2ADB	34_2_00007FF826FD2ADB
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 34_2_00007FF826FD8ACA	34_2_00007FF826FD8ACA
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 34_2_00007FF826FD9F22	34_2_00007FF826FD9F22
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 34_2_00007FF826FD834D	34_2_00007FF826FD834D
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_00F30C78	36_2_00F30C78
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_00F3D398	36_2_00F3D398
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_00F310EB	36_2_00F310EB
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_00F31099	36_2_00F31099
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_00F30C69	36_2_00F30C69
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_0596AE70	36_2_0596AE70
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_0596A840	36_2_0596A840
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_0596DAD8	36_2_0596DAD8
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_059620D0	36_2_059620D0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_059620C1	36_2_059620C1
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_05963F68	36_2_05963F68
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_0596AE63	36_2_0596AE63
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_05963809	36_2_05963809
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_0596A83B	36_2_0596A83B
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_05962B00	36_2_05962B00
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_05962AF0	36_2_05962AF0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_07A863A0	36_2_07A863A0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_07A85098	36_2_07A85098
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_07A85060	36_2_07A85060
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_07A8B4AA	36_2_07A8B4AA
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_07A863A0	36_2_07A863A0
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_07A85098	36_2_07A85098
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 36_2_07AA3358	36_2_07AA3358

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: String function: 00007FF87A861970 appears 60 times
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: String function: 00007FF87A876E40 appears 80 times
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: String function: 00007FF87A876D50 appears 221 times

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-FR949.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-I2VP2.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000000.00000000.25038351211.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000000.00000003.25042248238.000000007FB60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000000.00000003.25234720674.0000000002408000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe, 00000000.00000003.25040644167.0000000002820000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Source: is-LHAGN.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-LHAGN.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-LHAGN.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-LHAGN.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-NBIC5.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-NBIC5.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-NBIC5.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: is-NBIC5.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'

Source: is-1GNSQ.tmp.2.dr, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: is-1GNSQ.tmp.2.dr, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: is-DQ5GR.tmp.2.dr, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: is-DQ5GR.tmp.2.dr, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: is-LHAGN.tmp.2.dr, cTaskbar.cs	Task registration methods: 'RegisterReponse'

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Mutant created: \Sessions\1\BaseNamedObjects\4416b002-40e3-495b-ab64-83411bcb8a3b_PhotosRecoveryApp_2020user
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:304:WilStaging_02
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\cbackuplogmutexPRNotifier_OutOfMemorylog
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3572:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Mutant created: \Sessions\1\BaseNamedObjects\4416b002-40e3-495b-ab64-83411bcb8a3b_Systweak_Photos Recovery_setup
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3212:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3264:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2112:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2060:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3264:304:WilStaging_02
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\PhotosRecovery_E9AC93B9-E733-40A8-9338-47A4909521B7

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "PhotosRecovery.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "PRNotifier.exe")
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe "C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Process created: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp "C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp" /SL5="$10402,7009006,1208320,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe"
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im PhotosRecovery.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im "PRNotifier.exe"
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /firstinstall
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" createschedule
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" "/firstinstall"
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft Windows 10 Pro&ram=16 GB&model=To Be Filled By O.E.M.&proc=Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297
Source: unknown	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /startup
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" neweventtrigger
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" startup
Source: unknown	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /autoupdatecheck
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2224,i,10976282736854956991,13483950440466252950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2236 /prefetch:3
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup"
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: unknown	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /startupnag
Source: unknown	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" startup neweventtrigger
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Process created: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp "C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp" /SL5="$10402,7009006,1208320,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im PhotosRecovery.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im "PRNotifier.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" /firstinstall	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Program Files\Photos Recovery\PRNotifier.exe "C:\Program Files\Photos Recovery\PRNotifier.exe" createschedule	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /delete /tn "Photos Recovery_ST" /f	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" "/firstinstall"	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup"	Jump to behavior
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.systweak.com/photos-recovery/after-install/?utm_source=systweak&utm_campaign=default&affiliateid=&utm_medium=newbuild_2025&utm_content=AfterInstall&utm_term=Setup&page=install&x-cid=&utm_days=0&langcode=en&appversion=3.2.0.191&isreg=0&isexpired=0&macid=2973889335994299950&lipl=0&instdt=638769829421302977&productid=9881&os=Microsoft Windows 10 Pro&ram=16 GB&model=To Be Filled By O.E.M.&proc=Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz&ibv=&pid=9881&iev=0&utm_updt=&utm_updatedate=&bdts=29-01-2025&x-lip=&instdts=07-03-2025&bdt=638769829399901297	Jump to behavior
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2224,i,10976282736854956991,13483950440466252950,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2236 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier_startup"
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN "Photos RecoveryNotifier"
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Process created: C:\Program Files\Photos Recovery\PhotosRecovery.exe "C:\Program Files\Photos Recovery\PhotosRecovery.exe" loadvalues

Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Automated click: I accept the agreement
Source: C:\Windows\System32\conhost.exe	Automated click: Next >
Source: C:\Windows\System32\conhost.exe	Automated click: Next >
Source: C:\Windows\System32\conhost.exe	Automated click: I accept the agreement
Source: C:\Windows\System32\conhost.exe	Automated click: Next >
Source: C:\Windows\System32\conhost.exe	Automated click: I accept the agreement

Source: is-LHAGN.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	.Net Code: Type.GetTypeFromHandle(Kp3eZNOyNqfl614RmD.FillConfiguration(16777246)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Kp3eZNOyNqfl614RmD.FillConfiguration(16777245)),Type.GetTypeFromHandle(Kp3eZNOyNqfl614RmD.FillConfiguration(16777247))})
Source: is-NBIC5.tmp.2.dr, EwV3ECxYhIse1SOarW.cs	.Net Code: Type.GetTypeFromHandle(Kp3eZNOyNqfl614RmD.CollectValue(16777297)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(Kp3eZNOyNqfl614RmD.CollectValue(16777281)),Type.GetTypeFromHandle(Kp3eZNOyNqfl614RmD.CollectValue(16777293))})

Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	Static PE information: section name: .didata
Source: SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp.0.dr	Static PE information: section name: .didata
Source: is-FR949.tmp.2.dr	Static PE information: section name: .didata

Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 12_2_00007FF826FE6FC0 push es; iretd	12_2_00007FF826FE6FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 12_2_00007FF826FF7E65 push ebp; iretd	12_2_00007FF826FF7E68
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88CFA2 push rsp; retf	13_2_00007FF87A88CFA5
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88CFA6 push rsp; retf	13_2_00007FF87A88CFA9
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF87A88CF9E push rsp; retf	13_2_00007FF87A88CFA1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF826EDD2A5 pushad ; iretd	13_2_00007FF826EDD2A6
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF826FFD6F0 pushfd ; retn B60Fh	13_2_00007FF826FFDEA1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF826FFADA9 pushfd ; retf	13_2_00007FF826FFAF81
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 13_2_00007FF8272C59FB push es; retf	13_2_00007FF8272C5A07
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_029844FA pushad ; retf	14_2_029844FD
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_02984D04 push esp; ret	14_2_02984D09
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_06432261 push edx; retf	14_2_06432263
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_06436C7A push es; ret	14_2_06436C7C
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643ADC2 push E8FF2E52h; ret	14_2_0643ADD9
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 14_2_0643DBEB push 3B051BA8h; ret	14_2_0643DBF0
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 17_2_00007FF826FE90F0 push ss; retf	17_2_00007FF826FE9192
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 17_2_00007FF826FE9178 push ss; retf	17_2_00007FF826FE9192
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 20_2_00007FF826FC4CE3 push eax; ret	20_2_00007FF826FC4D2D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 20_2_00007FF826FC6F6C push es; iretd	20_2_00007FF826FC6FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 20_2_00007FF826FC6FC0 push es; iretd	20_2_00007FF826FC6FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 20_2_00007FF826FC4D47 push ds; ret	20_2_00007FF826FC4D5F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FCD565 pushfd ; retn B60Fh	22_2_00007FF826FCDAA1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FC4CE3 push eax; ret	22_2_00007FF826FC4D2D
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FC90F0 push ss; retf	22_2_00007FF826FC9192
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FC6F6C push es; iretd	22_2_00007FF826FC6FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FC6FC0 push es; iretd	22_2_00007FF826FC6FF7
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FCD565 pushfd ; retn B60Fh	22_2_00007FF826FCDAA1
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FC4D47 push ds; ret	22_2_00007FF826FC4D5F
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF826FC9178 push ss; retf	22_2_00007FF826FC9192
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	Code function: 22_2_00007FF8271D7A16 push ss; iretd	22_2_00007FF8271D7A17
Source: C:\Program Files\Photos Recovery\PRNotifier.exe	Code function: 23_2_00BE44FA pushad ; retf	23_2_00BE44FD

Source: is-EN0US.tmp.2.dr	Static PE information: section name: .text entropy: 7.145148985542188
Source: is-QCDA7.tmp.2.dr	Static PE information: section name: .text entropy: 7.265764685854364
Source: is-NBIC5.tmp.2.dr	Static PE information: section name: .text entropy: 7.157538012146479

Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\WPFToolkit.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\Microsoft.Win32.TaskScheduler.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\FontAwesome.WPF.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.5412.9015.527.exe	File created: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-FR949.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-NBIC5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-I2VP2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-QCDA7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-DQ5GR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\PhotosRecovery.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Users\user\AppData\Local\Temp\is-A5URL.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\WpfAnimatedGif.dll (copy)	Jump to dropped file
Source: C:\Program Files\Photos Recovery\PhotosRecovery.exe	File created: C:\Program Files\Photos Recovery\Magick.NET-Q8-AnyCPU.dll.partial	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-EN0US.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-LHAGN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\PRDLL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-B6MF2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-1GNSQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Users\user\AppData\Local\Temp\is-A5URL.tmp\isxdl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\notifierlib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\Delimon.Win32.IO.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-SGA1P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\is-AI6CK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\Program Files\Photos Recovery\PRNotifier.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery\Photos Recovery.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-GM2JN.tmp\SecuriteInfo.com.Program.Unwanted.5412.9015.527.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photos Recovery\Uninstall Photos Recovery.lnk	Jump to behavior