Windows Analysis Report
SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe

Overview

General Information

Sample name: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe
Analysis ID: 1413795
MD5: ad0e8a319e4b8a1041d04f9963e3beed
SHA1: 0a56fd5023b1bf16ea3b148a3a4567c8a2ddd953
SHA256: 1b4e3f62b7eb519512675a7d26dbdc43655e5e33369f1b82ef01be68f2194568
Tags: exe
Infos:

Detection

Score: 6
Range: 0 - 100
Whitelisted: false
Confidence: 40%

Signatures

Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
PE file contains executable resources (Code or Archives)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://www.pddmmctool.com/memorycardgetitforfree.html HTTP Parser: No favicon
Source: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.pddmmctool.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.Oh6mNxd5OYM.O%2Fd%3D1%2Frs%3DAHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g%2Fm%3D__features__#rpctoken=464348761&forcesecure=1 HTTP Parser: No favicon
Source: https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df5a0c183181f6a559%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff488c613ecfedb04f%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP Parser: No favicon
Source: https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2396622b9b3cf645%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff1c4dcb701e7ff7d7%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP Parser: No favicon
Source: https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df88765eed5a989276%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff1c4dcb701e7ff7d7%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 HTTP Parser: No favicon
Source: https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfef990f6be225d229%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff527d469655a1751d%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 HTTP Parser: No favicon
Source: https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df244b3350adbab7ff%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff527d469655a1751d%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP Parser: No favicon
Source: https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df5e7151025d28d385%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ffa0c202510d69f83b%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP Parser: No favicon
Source: https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df85bc2859b6900198%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ffa0c202510d69f83b%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 HTTP Parser: No favicon
Uses 32bit PE files
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49715 version: TLS 1.0
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Static PE information: certificate valid
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: H:\VJ_RECOVERY_5_Jun_2012\DDR_6.1.2.2_start_JAN_2019\MEMORY_CARD\RecProf_7SEP2019_DEMO\Release\DDR - Memory Card Recovery(Demo).pdb source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000005DD0000.00000004.00001000.00020000.00000000.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3238878546.00000000005CE000.00000002.00000001.01000000.00000009.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000000.2286581502.00000000005CE000.00000002.00000001.01000000.00000009.sdmp, is-149SB.tmp.1.dr
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00476F44 FindFirstFileA,FindNextFileA,FindClose, 1_2_00476F44
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00453238 FindFirstFileA,GetLastError, 1_2_00453238
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0049AF28 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose, 1_2_0049AF28
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004650D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode, 1_2_004650D0
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0046554C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode, 1_2_0046554C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00463B44 FindFirstFileA,FindNextFileA,FindClose, 1_2_00463B44
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49715 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D91a6+dT4rGFKR8&MD=2FYzvfvh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /memorycardgetitforfree.html HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/Facebook-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/Twitter-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/arrow.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/plusone.js HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/pddmmctool-bg.jpg HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/follow-us.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /u/0/se/0/_/+1/sharebutton?plusShare=true&usegapi=1&action=share&width=240&origin=https%3A%2F%2Fwww.pddmmctool.com&url=https%3A%2F%2Fwww.pddmmctool.com%2Fmemorycardgetitforfree.html&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.Oh6mNxd5OYM.O%2Fd%3D1%2Frs%3DAHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g%2Fm%3D__features__ HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/Facebook-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/Twitter-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/facebook-09.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/comment.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/Googleplus-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/linkedin-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/arrow.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/offer-ret.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/pddmmctool-bg.jpg HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/follow-us.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/like-us.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/facebook-09.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/icon_01.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/sp-dis.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/linkedin-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/Googleplus-icon.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/comment.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/offer-ret.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=plus/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g/cb=gapi.loaded_1?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=auth/exm=plus,plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g/cb=gapi.loaded_2?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/thankd-01.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/like-us.gif HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/ribion.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/icon_01.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/sp-dis.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/thankd-01.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pddmmctool/img/ribion.png HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /js/rpc:shindig_random.js?onload=init HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g/cb=gapi.loaded_0?le=scs HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.pddmmctool.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.pddmmctool.com/memorycardgetitforfree.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D91a6+dT4rGFKR8&MD=2FYzvfvh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.pddmmctool.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df5a0c183181f6a559%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff488c613ecfedb04f%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfa7667a98ad085c16%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff488c613ecfedb04f%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yC/l/0,cross/oCh4fJriDK8.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y9/l/0,cross/V-GL57iHfEB.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y6/l/0,cross/invMBnw_KCW.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y9/r/9Wbv6Zt8-vf.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y5/r/y7alrmypbND.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iEpO4/ya/l/en_US/xtD0rC1AhZ7.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yr/r/teTZ2tZqwkq.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yL/r/o0DyX3DMRvp.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iEpO4/yC/l/en_US/icjyP3R22e-.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yF/r/p55HfXW__mM.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yD/r/FEppCFCt76d.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iLl54/yP/l/en_US/tCtiM_kQVxr.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v/t39.30808-6/326343844_860818915181361_8244206260655144977_n.jpg?stp=dst-jpg_p206x206&_nc_cat=101&ccb=1-7&_nc_sid=5f2048&_nc_ohc=jLS3T9UTsiIAX9JGyEZ&_nc_ht=scontent-lga3-2.xx&edm=ANSO7JkEAAAA&oh=00_AfDnp_zQVTi0rTSwttngxrBBpTpVsUzK9W2fYYx-_toe1Q&oe=6601B09F HTTP/1.1Host: scontent-lga3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iNix4/yG/l/en_US/u8r7dUOIloj.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3isBb4/yN/l/en_US/LF0CJyoR8Zy.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3iEBX4/yz/l/en_US/jl4tn-VTEO1.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yZ/r/7HsMI9RHeJO.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y3/r/HkvD17iqK-X.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/y6/r/Glmz_lYOBT1.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v/t39.30808-6/326343844_860818915181361_8244206260655144977_n.jpg?stp=dst-jpg_p206x206&_nc_cat=101&ccb=1-7&_nc_sid=5f2048&_nc_ohc=jLS3T9UTsiIAX9JGyEZ&_nc_ht=scontent-lga3-2.xx&edm=ANSO7JkEAAAA&oh=00_AfDnp_zQVTi0rTSwttngxrBBpTpVsUzK9W2fYYx-_toe1Q&oe=6601B09F HTTP/1.1Host: scontent-lga3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yV/r/HzxD9aAXSyD.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v/t39.30808-1/324508571_1011970466449690_8269454008075439938_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=102&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Yv4oKZOdqpMAX9cwk7N&_nc_oc=Adj0IQmej3nBMnP2n_mjzvnXk_ZXQ-Idy2kTvuPYb0ITms7b3rB_7yjPjlOIG7YKHeU&_nc_ht=scontent-lga3-1.xx&edm=ANSO7JkEAAAA&oh=00_AfBXGY3uCc_5BaPtIIUSJEvXYvxWOW81MhEJfs4Vt4IdhQ&oe=660277D5 HTTP/1.1Host: scontent-lga3-1.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yw/r/UXtr_j2Fwe-.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/oCh4fJriDK8.css?_nc_x=Ij3Wp8lg5KzAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yo/r/kCwDvxe1QsQ.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yd/r/1igfs7II_g6.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/V-GL57iHfEB.css?_nc_x=Ij3Wp8lg5KzAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yU/r/znz2cJ4Kmw7.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /v/t39.30808-1/324508571_1011970466449690_8269454008075439938_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=102&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Yv4oKZOdqpMAX9cwk7N&_nc_oc=Adj0IQmej3nBMnP2n_mjzvnXk_ZXQ-Idy2kTvuPYb0ITms7b3rB_7yjPjlOIG7YKHeU&_nc_ht=scontent-lga3-1.xx&edm=ANSO7JkEAAAA&oh=00_AfBXGY3uCc_5BaPtIIUSJEvXYvxWOW81MhEJfs4Vt4IdhQ&oe=660277D5 HTTP/1.1Host: scontent-lga3-1.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yH/r/ieeHDjcGsIR.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yw/r/UXtr_j2Fwe-.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /rsrc.php/v3/yd/r/1igfs7II_g6.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /pages/call_to_action/fetch_dialog_data/?id=939139756120458&surface=pagePlugin&unit_type=VIEWER HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfa7667a98ad085c16%2526domain%253Dwww.pddmmctool.com%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwww.pddmmctool.com%25252Ff488c613ecfedb04f%2526relation%253Dparent.parent%26container_width%3D394%26header%3Dtrue%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FDDRRecovery%26locale%3Den_US%26sdk%3Djoey%26show_border%3Dtrue%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfa7667a98ad085c16%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff488c613ecfedb04f%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2396622b9b3cf645%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff1c4dcb701e7ff7d7%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df88765eed5a989276%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff1c4dcb701e7ff7d7%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df88765eed5a989276%2526domain%253Dwww.pddmmctool.com%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwww.pddmmctool.com%25252Ff1c4dcb701e7ff7d7%2526relation%253Dparent.parent%26container_width%3D394%26header%3Dtrue%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FDDRRecovery%26locale%3Den_US%26sdk%3Djoey%26show_border%3Dtrue%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df88765eed5a989276%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff1c4dcb701e7ff7d7%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /pages/call_to_action/fetch_dialog_data/?id=939139756120458&surface=pagePlugin&unit_type=VIEWER HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df244b3350adbab7ff%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff527d469655a1751d%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfef990f6be225d229%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff527d469655a1751d%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfef990f6be225d229%2526domain%253Dwww.pddmmctool.com%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwww.pddmmctool.com%25252Ff527d469655a1751d%2526relation%253Dparent.parent%26container_width%3D394%26header%3Dtrue%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FDDRRecovery%26locale%3Den_US%26sdk%3Djoey%26show_border%3Dtrue%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfef990f6be225d229%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff527d469655a1751d%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /pages/call_to_action/fetch_dialog_data/?id=939139756120458&surface=pagePlugin&unit_type=VIEWER HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df5e7151025d28d385%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ffa0c202510d69f83b%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df85bc2859b6900198%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ffa0c202510d69f83b%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.pddmmctool.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df85bc2859b6900198%2526domain%253Dwww.pddmmctool.com%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwww.pddmmctool.com%25252Ffa0c202510d69f83b%2526relation%253Dparent.parent%26container_width%3D394%26header%3Dtrue%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FDDRRecovery%26locale%3Den_US%26sdk%3Djoey%26show_border%3Dtrue%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300 HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df85bc2859b6900198%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ffa0c202510d69f83b%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /pages/call_to_action/fetch_dialog_data/?id=939139756120458&surface=pagePlugin&unit_type=VIEWER HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ps_n=0
Source: global traffic HTTP traffic detected: GET /memorycardgetitforfree.html HTTP/1.1Host: www.pddmmctool.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: chromecache_186.8.dr String found in binary or memory: <td><div class="fb-like" data-href="https://www.facebook.com/DDRRecovery" data-send="false" data-width="260" data-show-faces="false"></div></td> equals www.facebook.com (Facebook)
Source: chromecache_186.8.dr String found in binary or memory: <td style="width:400px; vertical-align:top; text-align:center"><div class="fb-like-box" data-href="https://www.facebook.com/DDRRecovery" data-width="300" data-show-faces="true" data-header="true" data-stream="false" data-show-border="true"></div></td> equals www.facebook.com (Facebook)
Source: chromecache_186.8.dr String found in binary or memory: <a href="https://twitter.com/share?url=https://www.pddmmctool.com&text=Share Memory Card Recovery Software" target="_blank"><img style="border:0px;" src="pddmmctool/img/Twitter-icon.png" alt="Twitter" /></a> equals www.twitter.com (Twitter)
Source: chromecache_186.8.dr String found in binary or memory: <a href="https://www.facebook.com/sharer.php?u=https://www.pddmmctool.com" target="_blank"><img style="border:0px;" src="pddmmctool/img/Facebook-icon.png" alt="Facebook" /></a> equals www.facebook.com (Facebook)
Source: chromecache_186.8.dr String found in binary or memory: <a href="https://www.linkedin.com/shareArticle?mini=true&url=https://www.pddmmctool.com" target="_blank"><img style="border:0px;" src="pddmmctool/img/linkedin-icon.png" alt="Linkedin" /></a> equals www.linkedin.com (Linkedin)
Source: chromecache_192.8.dr String found in binary or memory: } }).call(global);})();} catch (e) {var i = new Image();i.crossOrigin = 'anonymous';i.dataset.testid = 'fbSDKErrorReport';i.src='https://www.facebook.com/platform/scribe_endpoint.php/?c=jssdk_error&m='+encodeURIComponent('{"error":"LOAD", "extra": {"name":"'+e.name+'","line":"'+(e.lineNumber||e.line)+'","script":"'+(e.fileName||e.sourceURL||e.script||"all.js")+'","stack":"'+(e.stackTrace||e.stack)+'","revision":"1012233066","namespace":"FB","message":"'+e.message+'"}}');document.body.appendChild(i);} equals www.facebook.com (Facebook)
Source: chromecache_186.8.dr String found in binary or memory: onclick=" window.open( 'https://www.facebook.com/sharer/sharer.php?u='+encodeURIComponent(location.href), equals www.facebook.com (Facebook)
Source: chromecache_206.8.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/9cisb7Fe7ih/ equals www.facebook.com (Facebook)
Source: chromecache_201.8.dr, chromecache_191.8.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_201.8.dr, chromecache_191.8.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_191.8.dr, chromecache_214.8.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/V9vdYColc4k/ equals www.facebook.com (Facebook)
Source: chromecache_236.8.dr, chromecache_191.8.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/WRsJ32R7YJG/ equals www.facebook.com (Facebook)
Source: chromecache_192.8.dr String found in binary or memory: * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/ equals www.facebook.com (Facebook)
Source: is-149SB.tmp.1.dr String found in binary or memory: If you have previously saved Log file of DDR Recovery, you can directly load the recovery results from Log instead of scanning the drive again.support@pddmmctool.commailto:support@pddmmctool.commailto:support@pddmmctool.com?subject=DDR - Memory Card Recovery(Demo) Question&body=Dear Customer Support,%0AI am having Difficulties in using DDR - Memory Card Recovery(Demo)(Version - 6.1.2.2). %0A%0AMy Operating system is: %0A%0AI am using following security/Antivirus/Firewall Software in My Machine: %0A%0AThe Hardware Configuration details of My Machine in which I am running the software are: %0A%0A%0AThe details of my Storage media (from which I am trying to recover data) are as follows: %0AMedia Type: %0AStorage Capacity: %0AManufacturer: %0A%0APossible cause of Data Loss (if known): %0AError message (if any): %0A%0AMore Details of problem with screenshot (if any): %0Areseller@DataRecoverySoftware.commailto:reseller@datarecoverysoftware.com?subject=Affiliate/Partnership Enquiry&body= Hello,%0A I am interested in reseller / partner opportunities. My business name and contact information is as follows: %0A%0A ============================================================== %0A%0A [**Please provide your business name contact information here**] %0A%0A ============================================================== %0A%0A I am interested in following type of Partnership: %0A%0A [1.] I would like to become your affiliate and would like to earn commission by selling your Products. %0A%0A [and / or] %0A%0A [2.] I would like to become your reseller and want to purchase multiple licenses from you on discount pricing in order to earn profits by selling them to my clients/customers. %0A%0A [and / or] %0A%0A [3.] I am interested in advanced partnership options. (**Please Specify your partnership requirements**) %0Amailto:reseller@datarecoverysoftware.comhttp://www.DataRecoverySoftware.comhttp://www.pddmmctool.comhttp://www.ddrmemorycard.comhttp://www.memorycardrestore.comhttp://www.facebook.com/share.php?u=http://www.pddmmctool.com/https://www.facebook.com/plugins/like.php?href=http://www.pddmmctool.com/http://twitter.com/intent/tweet?source=sharethiscom&url=http://www.pddmmctool.com/https://plus.google.com/share?url=http%3A%2F%2Fwww.pddmmctool.com/http://www.pddmmctool.com/memorycardgetitforfree.htmlhttp://www.pddmmctool.com/memorycardsocialcomments.html~ equals www.facebook.com (Facebook)
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000005DD0000.00000004.00001000.00020000.00000000.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3238878546.00000000005CE000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: If you have previously saved Log file of DDR Recovery, you can directly load the recovery results from Log instead of scanning the drive again.support@pddmmctool.commailto:support@pddmmctool.commailto:support@pddmmctool.com?subject=DDR - Memory Card Recovery(Demo) Question&body=Dear Customer Support,%0AI am having Difficulties in using DDR - Memory Card Recovery(Demo)(Version - 6.1.2.2). %0A%0AMy Operating system is: %0A%0AI am using following security/Antivirus/Firewall Software in My Machine: %0A%0AThe Hardware Configuration details of My Machine in which I am running the software are: %0A%0A%0AThe details of my Storage media (from which I am trying to recover data) are as follows: %0AMedia Type: %0AStorage Capacity: %0AManufacturer: %0A%0APossible cause of Data Loss (if known): %0AError message (if any): %0A%0AMore Details of problem with screenshot (if any): %0Areseller@DataRecoverySoftware.commailto:reseller@datarecoverysoftware.com?subject=Affiliate/Partnership Enquiry&body= Hello,%0A I am interested in reseller / partner opportunities. My business name and contact information is as follows: %0A%0A ============================================================== %0A%0A [**Please provide your business name contact information here**] %0A%0A ============================================================== %0A%0A I am interested in following type of Partnership: %0A%0A [1.] I would like to become your affiliate and would like to earn commission by selling your Products. %0A%0A [and / or] %0A%0A [2.] I would like to become your reseller and want to purchase multiple licenses from you on discount pricing in order to earn profits by selling them to my clients/customers. %0A%0A [and / or] %0A%0A [3.] I am interested in advanced partnership options. (**Please Specify your partnership requirements**) %0Amailto:reseller@datarecoverysoftware.comhttp://www.DataRecoverySoftware.comhttp://www.pddmmctool.comhttp://www.ddrmemorycard.comhttp://www.memorycardrestore.comhttp://www.facebook.com/share.php?u=http://www.pddmmctool.com/https://www.facebook.com/plugins/like.php?href=http://www.pddmmctool.com/http://twitter.com/intent/tweet?source=sharethiscom&url=http://www.pddmmctool.com/https://plus.google.com/share?url=http%3A%2F%2Fwww.pddmmctool.com/http://www.pddmmctool.com/memorycardgetitforfree.htmlhttp://www.pddmmctool.com/memorycardsocialcomments.html~ equals www.twitter.com (Twitter)
Source: chromecache_192.8.dr String found in binary or memory: __d("LiveChatPluginConstants",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";a="LiveChatEvent/";c="mqtt";d=b("$InternalEnum")({CONNECTED:"Connected",CONNECTING:"Connecting",DISCONNECTED:"Disconnected"});e=250;b=a+"close_timestamps";var g=a+"reset_badging",h=a+"state",i=a+"switch_account",j=a+"typing",k=a+"unread_count",l=a+"update_message_list",m="platform/plugins/connect/guest",n=a+"guest_upgrade_success",o=a+"guest_upgrade_success_incognito",p=a+"navigate_to_welcome_page",q="platform/plugins/connect/access_token";a=a+"start_re_engagement";var r=124,s=187,t=24,u=424,v=288,w=313,x=219,y=40,z=36,A=24,B=18,C=708,D=540,E=244,F=202,G=509,H=430,I=6,J=0,K=1,L=-1,M="messaging_plugin",N=8634e4,O="#8A8D91",P="entrypoint:customer_chat_plugin",Q=0,R=1,S=2,T=3,U="new_message_update",V="initial_fetch",W=5e3,X="https://www.facebook.com/business/help/1661027437357021";f.MQTT=c;f.MQTTGatewayConnectionState=d;f.LOGIN_CHECK_INTERVAL=e;f.CLOSE_TIMESTAMPS=b;f.RESET_BADGING=g;f.STATE_UPDATE=h;f.SWITCH_ACCOUNT=i;f.TYPING_UPDATE=j;f.UNREAD_COUNT_UPDATE=k;f.UPDATE_MESSAGE_LIST=l;f.GUEST_MODE_CONNECT=m;f.GUEST_UPGRADE_SUCCESS=n;f.GUEST_UPGRADE_SUCCESS_INCOGNITO=o;f.NAVIGATE_TO_WELCOME_PAGE=p;f.ACCESS_TOKEN_LOGIN=q;f.START_RE_ENGAGEMENT=a;f.PROMPT_FALLBACK_HEIGHT=r;f.PROMPT_REDESIGN_FALLBACK_HEIGHT=s;f.PROMPT_CONTAINER_PADDING_HEIGHT=t;f.WELCOME_PAGE_GUEST_FALLBACK_HEIGHT=u;f.WELCOME_PAGE_NO_GUEST_FALLBACK_HEIGHT=v;f.WELCOME_PAGE_GUEST_FALLBACK_HEIGHT_WITH_COMPACT=w;f.WELCOME_PAGE_NO_GUEST_FALLBACK_HEIGHT_WITH_COMPACT=x;f.WELCOME_PAGE_ATTRIBUTION_OFFEST_HEIGHT=y;f.WELCOME_PAGE_ATTRIBUTION_OFFSET_HEIGHT_WITH_COMPACT=z;f.MAIN_IFRAME_PADDING_HEIGHT=A;f.MAIN_IFRAME_PADDING_HEIGHT_WITH_COMPACT=B;f.THREAD_PAGE_HEIGHT=C;f.THREAD_PAGE_HEIGHT_COMPACT=D;f.RE_ENGAGEMENT_COLLAPSED_DIALOG_HEIGHT=E;f.RE_ENGAGEMENT_COLLAPSED_DIALOG_HEIGHT_COMPACT=F;f.RE_ENGAGEMENT_EXPANDED_DIALOG_HEIGHT=G;f.RE_ENGAGEMENT_EXPANDED_DIALOG_HEIGHT_COMPACT=H;f.GREETING_TEXT_BOTTOM_SPACING_OFFEST=I;f.LOGGED_IN_CHAT_MODE=J;f.GUEST_CHAT_MODE=K;f.INVALID_CHAT_MODE=L;f.MESSENGING_PLUGIN=M;f.GUEST_SESSION_STORAGE_VALIDITY_MS=N;f.GUEST_SEND_BUTTON_COLOR_EMPTY_INPUT=O;f.LIVE_CHAT_ENTRYPOINT_ATTRIBUTION_TAG=P;f.ITP_CONSISTENCY_UNKNOWN_LOGGED_OUT=Q;f.ITP_CONSISTENCY_CONSISTENT_LOGGED_IN=R;f.ITP_CONSISTENCY_INCONSISTENT=S;f.ITP_CONSISTENCY_CONSISTENT_NO_ITP=T;f.NEW_MESSAGE_UPDATE=U;f.INITIAL_FETCH=V;f.PLUGIN_FADE_DELAY=W;f.HELP_DEX_LINK=X}),66); equals www.facebook.com (Facebook)
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: disableRealtimeCallback:!1,drive_share:{skipInitCommand:!0},csi:{rate:.01},client:{cors:!1},signInDeprecation:{rate:0},include_granted_scopes:!0,llang:"en",iframes:{youtube:{params:{location:["search","hash"]},url:":socialhost:/:session_prefix:_/widget/render/youtube?usegapi=1",methods:["scroll","openwindow"]},ytsubscribe:{url:"https://www.youtube.com/subscribe_embed?usegapi=1"},plus_circle:{params:{url:""},url:":socialhost:/:session_prefix::se:_/widget/plus/circle?usegapi=1"},plus_share:{params:{url:""}, equals www.youtube.com (Youtube)
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3240231690.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://twitter.com/intent/tweet?source=sharethiscom&url=http://www.pddmmctool.com/ equals www.twitter.com (Twitter)
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3240231690.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.facebook.com/share.php?u=http://www.pddmmctool.com/ equals www.facebook.com (Facebook)
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3240231690.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.facebook.com/plugins/like.php?href=http://www.pddmmctool.com/ equals www.facebook.com (Facebook)
Source: unknown DNS traffic detected: queries for: www.pddmmctool.com
Source: unknown HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1711074163023&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000006133000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, is-149SB.tmp.1.dr String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000006133000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, is-149SB.tmp.1.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000006133000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, is-149SB.tmp.1.dr String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000006133000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, is-149SB.tmp.1.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: chromecache_217.8.dr String found in binary or memory: http://csi.gstatic.com/csi
Source: is-149SB.tmp.1.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3240231690.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://twitter.com/intent/tweet?source=sharethiscom&url=http://www.pddmmctool.com/
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239936474.00000000029B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.DataRecoverySoftware.com
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000005DD0000.00000004.00001000.00020000.00000000.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3238878546.00000000005CE000.00000002.00000001.01000000.00000009.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000000.2286581502.00000000005CE000.00000002.00000001.01000000.00000009.sdmp, is-149SB.tmp.1.dr String found in binary or memory: http://www.DataRecoverySoftware.comhttp://www.pddmmctool.comhttp://www.ddrmemorycard.comhttp://www.m
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239936474.00000000029B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.ddrmemorycard.com
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000002.2292961601.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp.0.dr, is-28K57.tmp.1.dr String found in binary or memory: http://www.innosetup.com/
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239936474.00000000029B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.memorycardrestore.com
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239936474.00000000029B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3240231690.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.html
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.html)
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.html.
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.html4
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.html=
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.html?
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlC
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239476065.0000000000976000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlC:
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlD
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000003.3136264984.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlDeo)
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlH
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000003.3136214807.0000000000B94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlJ/c
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000003.3136264984.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlX
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000003.3136214807.0000000000B94000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmld/I
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000003.3136264984.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmlex4
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3239594041.0000000000B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmln
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000003.3136264984.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardgetitforfree.htmltm
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3240231690.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.pddmmctool.com/memorycardsocialcomments.html
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, 00000000.00000003.1989532345.0000000002460000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, 00000000.00000003.1990399611.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000002.2292961601.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp.0.dr, is-28K57.tmp.1.dr String found in binary or memory: http://www.remobjects.com/ps
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, 00000000.00000003.1989532345.0000000002460000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, 00000000.00000003.1990399611.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000002.2292961601.0000000000401000.00000020.00000001.01000000.00000004.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp.0.dr, is-28K57.tmp.1.dr String found in binary or memory: http://www.remobjects.com/psU
Source: chromecache_224.8.dr, chromecache_250.8.dr, chromecache_248.8.dr, chromecache_217.8.dr String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_224.8.dr, chromecache_248.8.dr String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: chromecache_185.8.dr, chromecache_250.8.dr, chromecache_248.8.dr, chromecache_217.8.dr String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_248.8.dr, chromecache_217.8.dr String found in binary or memory: https://apis.google.com
Source: chromecache_185.8.dr, chromecache_186.8.dr String found in binary or memory: https://apis.google.com/js/plusone.js
Source: chromecache_248.8.dr String found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://classroom.google.com/sharewidget?usegapi=1
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://clients3.google.com/cast/chromecast/home/widget/backdrop?usegapi=1
Source: chromecache_185.8.dr, chromecache_250.8.dr, chromecache_248.8.dr, chromecache_217.8.dr String found in binary or memory: https://clients6.google.com
Source: chromecache_224.8.dr String found in binary or memory: https://console.developers.google.com/
Source: chromecache_185.8.dr, chromecache_250.8.dr, chromecache_248.8.dr, chromecache_217.8.dr String found in binary or memory: https://content.googleapis.com
Source: chromecache_217.8.dr String found in binary or memory: https://csi.gstatic.com/csi
Source: chromecache_250.8.dr, chromecache_217.8.dr String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://dataconnector.corp.google.com/:session_prefix:ui/widgetview?usegapi=1
Source: chromecache_224.8.dr String found in binary or memory: https://developers.google.com/
Source: chromecache_224.8.dr String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/gis-migration)
Source: chromecache_250.8.dr, chromecache_217.8.dr String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://drive.google.com/savetodrivebutton?usegapi=1
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://families.google.com/webcreation?usegapi=1&usegapi=1
Source: chromecache_212.8.dr String found in binary or memory: https://fburl.com/comet_preloading
Source: chromecache_185.8.dr String found in binary or memory: https://github.com/google/safevalues/issues
Source: chromecache_192.8.dr String found in binary or memory: https://itunes.apple.com/us/app/messenger/id454638411
Source: chromecache_248.8.dr String found in binary or memory: https://pay.google.com/gp/v/widget/save
Source: chromecache_192.8.dr String found in binary or memory: https://play.google.com/store/apps/details?id=com.facebook.orca
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://play.google.com/work/embedded/search?usegapi=1&usegapi=1
Source: chromecache_217.8.dr String found in binary or memory: https://plus.google.com
Source: DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3240231690.0000000003020000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://plus.google.com/share?url=http%3A%2F%2Fwww.pddmmctool.com/
Source: chromecache_186.8.dr String found in binary or memory: https://plus.google.com/share?url=https://www.pddmmctool.com
Source: chromecache_185.8.dr, chromecache_250.8.dr, chromecache_248.8.dr, chromecache_217.8.dr String found in binary or memory: https://plus.googleapis.com
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000006133000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, is-149SB.tmp.1.dr String found in binary or memory: https://sectigo.com/CPS0B
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000006133000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, is-149SB.tmp.1.dr String found in binary or memory: https://sectigo.com/CPS0C
Source: chromecache_217.8.dr String found in binary or memory: https://ssl.gstatic.com/gb/js/
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://ssl.gstatic.com/microscope/embed/
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://talkgadget.google.com/:session_prefix:talkgadget/_/widget
Source: chromecache_186.8.dr String found in binary or memory: https://twitter.com/share?url=https://www.pddmmctool.com&text=Share
Source: chromecache_185.8.dr, chromecache_250.8.dr, chromecache_248.8.dr, chromecache_217.8.dr String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000006133000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, is-149SB.tmp.1.dr String found in binary or memory: https://www.datarecoverysoftware.com/
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://www.google.com/shopping/customerreviews/badge?usegapi=1
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://www.google.com/shopping/customerreviews/optin?usegapi=1
Source: chromecache_224.8.dr String found in binary or memory: https://www.googleapis.com/auth/plus.login
Source: chromecache_217.8.dr String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_217.8.dr String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://www.gstatic.com/partners/badge/templates/badge.html?usegapi=1
Source: chromecache_192.8.dr, chromecache_201.8.dr, chromecache_191.8.dr String found in binary or memory: https://www.internalfb.com/intern/invariant/
Source: chromecache_186.8.dr String found in binary or memory: https://www.linkedin.com/shareArticle?mini=true&url=https://www.pddmmctool.com
Source: chromecache_186.8.dr String found in binary or memory: https://www.pddmmctool.com
Source: chromecache_186.8.dr String found in binary or memory: https://www.pddmmctool.com/memorycardsocialcomments.html
Source: chromecache_185.8.dr, chromecache_248.8.dr String found in binary or memory: https://www.youtube.com/subscribe_embed?usegapi=1
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.5:49781 version: TLS 1.2
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00424014 NtdllDefWindowProc_A, 1_2_00424014
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00412A68 NtdllDefWindowProc_A, 1_2_00412A68
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0047AC34 NtdllDefWindowProc_A, 1_2_0047AC34
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042FA00 NtdllDefWindowProc_A, 1_2_0042FA00
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00457E24 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A, 1_2_00457E24
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042EDC4: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError, 1_2_0042EDC4
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_00409920 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_00409920
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00455E14 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 1_2_00455E14
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_004088C0 0_2_004088C0
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00472090 1_2_00472090
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004688B8 1_2_004688B8
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00482CD8 1_2_00482CD8
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00452194 1_2_00452194
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0043E240 1_2_0043E240
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00490830 1_2_00490830
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0043083C 1_2_0043083C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0046A974 1_2_0046A974
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004449B8 1_2_004449B8
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00434AB4 1_2_00434AB4
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00444F60 1_2_00444F60
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0048908C 1_2_0048908C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004313C8 1_2_004313C8
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00445658 1_2_00445658
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004357B8 1_2_004357B8
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0045F954 1_2_0045F954
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00445A64 1_2_00445A64
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0045BA04 1_2_0045BA04
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00489FEC 1_2_00489FEC
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 00453B40 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 0040909C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 0040596C appears 114 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 004587AC appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 00403400 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 004585A0 appears 124 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 00406F54 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 00446594 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 0040357C appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 004462C4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 004349CC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 00403684 appears 233 times
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: String function: 00407D84 appears 43 times
PE file contains executable resources (Code or Archives)
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp.0.dr Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-28K57.tmp.1.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-28K57.tmp.1.dr Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-28K57.tmp.1.dr Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, 00000000.00000003.1989532345.0000000002460000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe, 00000000.00000003.1990399611.00000000021C8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenameshfolder.dll~/ vs SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: riched20.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: usp10.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: msls31.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: riched32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: windows.shell.servicehostbuilder.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: edputil.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: mlang.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Section loaded: wkscli.dll Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: clean6.winEXE@139/157@34/11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_00409920 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 0_2_00409920
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00455E14 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx, 1_2_00455E14
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0045663C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA, 1_2_0045663C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_0040A10C FindResourceA,SizeofResource,LoadResource,LockResource, 0_2_0040A10C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo) Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe File created: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe String found in binary or memory: /LOADINF="filename"
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe String found in binary or memory: 3http://crl.usertrust.com/AddTrustExternalCARoot.crl05
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe "C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Process created: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp "C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp" /SL5="$1042E,2001392,58368,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe"
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe "C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe"
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,11828263189986585832,2122377102794854961,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1876,i,14555789001228243060,432700994428752785,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1972,i,12300057000906542716,8504664954414692300,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1916,i,10914691437147062897,4915263363139874215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1892,i,4257229397174659763,12745848979964646994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1968,i,6134146949035282613,10362111212166857023,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1964,i,15677131302647685239,15019024529132617874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1996,i,16058611461583781826,15734763615411642449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1988,i,13290975071350460854,1359381411786907000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,14986323777767075612,8587511931100266432,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1988,i,16803984610470893485,10266022204189666539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1988,i,11456400488971864275,14086600807550374540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2020,i,8244778878227412219,4732793718383455645,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,10189194106443881044,15542303253846355813,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Process created: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp "C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp" /SL5="$1042E,2001392,58368,C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe "C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe" Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1972,i,12300057000906542716,8504664954414692300,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2024,i,11828263189986585832,2122377102794854961,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1892,i,4257229397174659763,12745848979964646994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1876,i,14555789001228243060,432700994428752785,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1972,i,12300057000906542716,8504664954414692300,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1916,i,10914691437147062897,4915263363139874215,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1892,i,4257229397174659763,12745848979964646994,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1968,i,6134146949035282613,10362111212166857023,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1964,i,15677131302647685239,15019024529132617874,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1996,i,16058611461583781826,15734763615411642449,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1988,i,13290975071350460854,1359381411786907000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,14986323777767075612,8587511931100266432,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1988,i,16803984610470893485,10266022204189666539,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1988,i,11456400488971864275,14086600807550374540,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2020,i,8244778878227412219,4732793718383455645,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2000,i,10189194106443881044,15542303253846355813,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: DDR - Memory Card Recovery(Demo).lnk.1.dr LNK file: ..\..\..\..\..\..\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe
Source: Uninstall DDR - Memory Card Recovery(Demo).lnk.1.dr LNK file: ..\..\..\..\..\..\Program Files (x86)\DDR - Memory Card Recovery(Demo)\unins000.exe
Source: Software Guide.lnk.1.dr LNK file: ..\..\..\..\..\..\Program Files (x86)\DDR - Memory Card Recovery(Demo)\Software Guide.chm
Source: DDR - Memory Card Recovery(Demo).lnk0.1.dr LNK file: ..\..\..\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe
Source: DDR - Memory Card Recovery(Demo).lnk1.1.dr LNK file: ..\..\..\..\..\..\..\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe
Source: Google Drive.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Automated click: I accept the agreement
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe File opened: C:\Windows\SysWOW64\RICHED32.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Window detected: Number of UI elements: 20
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Static PE information: certificate valid
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Static file information: File size 2260952 > 1048576
Source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: H:\VJ_RECOVERY_5_Jun_2012\DDR_6.1.2.2_start_JAN_2019\MEMORY_CARD\RecProf_7SEP2019_DEMO\Release\DDR - Memory Card Recovery(Demo).pdb source: SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp, 00000001.00000003.2288736550.0000000005DD0000.00000004.00001000.00020000.00000000.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000002.3238878546.00000000005CE000.00000002.00000001.01000000.00000009.sdmp, DDR - Memory Card Recovery(Demo).exe, 00000005.00000000.2286581502.00000000005CE000.00000002.00000001.01000000.00000009.sdmp, is-149SB.tmp.1.dr
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00450A28 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_00450A28
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_00406A50 push 00406A8Dh; ret 0_2_00406A85
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_004040B5 push eax; ret 0_2_004040F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_00404185 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_00404206 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_004042E8 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_00404283 push 00404391h; ret 0_2_00404389
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_004093EC push 0040941Fh; ret 0_2_00409417
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_004085B8 push ecx; mov dword ptr [esp], eax 0_2_004085BD
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00409DDC push 00409E19h; ret 1_2_00409E11
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0041A0B8 push ecx; mov dword ptr [esp], ecx 1_2_0041A0BD
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00452194 push ecx; mov dword ptr [esp], eax 1_2_00452199
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004062CC push ecx; mov dword ptr [esp], eax 1_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0040A2DF push ds; ret 1_2_0040A2E0
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004605AC push ecx; mov dword ptr [esp], ecx 1_2_004605B0
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00458848 push 00458880h; ret 1_2_00458878
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00410970 push ecx; mov dword ptr [esp], edx 1_2_00410975
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00412DB8 push 00412E1Bh; ret 1_2_00412E13
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0040D2C8 push ecx; mov dword ptr [esp], edx 1_2_0040D2CA
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0040546D push eax; ret 1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0040553D push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004055BE push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0040563B push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004056A0 push 00405749h; ret 1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0040F828 push ecx; mov dword ptr [esp], edx 1_2_0040F82A
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00443930 push ecx; mov dword ptr [esp], ecx 1_2_00443934
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00487AF0 push ecx; mov dword ptr [esp], ecx 1_2_00487AF5
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00459B60 push 00459BA4h; ret 1_2_00459B9C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00497B18 push ecx; mov dword ptr [esp], ecx 1_2_00497B1D
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00479C7C push ecx; mov dword ptr [esp], edx 1_2_00479C7D
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00451FD0 push 00452003h; ret 1_2_00451FFB
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Code function: 5_2_00588A05 push ecx; ret 5_2_00588A18
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\is-28K57.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\is-149SB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe File created: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\Users\user\AppData\Local\Temp\is-SOFGL.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe (copy) Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DDR - Memory Card Recovery(Demo) Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DDR - Memory Card Recovery(Demo)\Uninstall DDR - Memory Card Recovery(Demo).lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DDR - Memory Card Recovery(Demo)\Software Guide.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042409C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus, 1_2_0042409C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042409C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus, 1_2_0042409C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00422CEC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow, 1_2_00422CEC
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0041815E IsIconic,SetWindowPos, 1_2_0041815E
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00418160 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement, 1_2_00418160
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042466C IsIconic,SetActiveWindow,SetFocus, 1_2_0042466C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00424624 IsIconic,SetActiveWindow, 1_2_00424624
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00418814 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient, 1_2_00418814
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042F75C IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow, 1_2_0042F75C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00417A28 IsIconic,GetCapture, 1_2_00417A28
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00485CFC IsIconic,GetWindowLongA,ShowWindow,ShowWindow, 1_2_00485CFC
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0041F5A8 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary, 1_2_0041F5A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\is-28K57.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Dropped PE file which has not been started: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SOFGL.tmp\_isetup\_setup64.tmp Jump to dropped file
Found evasive API chain (date check)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Evasive API call chain: GetSystemTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00476F44 FindFirstFileA,FindNextFileA,FindClose, 1_2_00476F44
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00453238 FindFirstFileA,GetLastError, 1_2_00453238
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0049AF28 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose, 1_2_0049AF28
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_004650D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode, 1_2_004650D0
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0046554C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode, 1_2_0046554C
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00463B44 FindFirstFileA,FindNextFileA,FindClose, 1_2_00463B44
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_0040A050 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery, 0_2_0040A050
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process information queried: ProcessInformation Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00450A28 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_00450A28
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0047A678 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle, 1_2_0047A678
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Process created: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe "C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe" Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1972,i,12300057000906542716,8504664954414692300,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Program Files (x86)\DDR - Memory Card Recovery(Demo)\DDR - Memory Card Recovery(Demo).exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pddmmctool.com/memorycardgetitforfree.html Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042F294 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA, 1_2_0042F294
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_0042E52C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid, 1_2_0042E52C
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: GetLocaleInfoA, 0_2_00405694
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: GetLocaleInfoA, 0_2_004056E0
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: GetLocaleInfoA, 1_2_004089F8
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: GetLocaleInfoA, 1_2_00408A44
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00458E58 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle, 1_2_00458E58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_004026C4 GetSystemTime, 0_2_004026C4
Source: C:\Users\user\AppData\Local\Temp\is-UR2H4.tmp\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp Code function: 1_2_00455DCC GetUserNameA, 1_2_00455DCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe Code function: 0_2_00404654 GetModuleHandleA,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy, 0_2_00404654
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1413795 Sample: SecuriteInfo.com.Program.Un... Startdate: 22/03/2024 Architecture: WINDOWS Score: 6 8 SecuriteInfo.com.Program.Unwanted.4064.19535.32194.exe 2 2->8         started        file3 40 SecuriteInfo.com.P...064.19535.32194.tmp, PE32 8->40 dropped 11 SecuriteInfo.com.Program.Unwanted.4064.19535.32194.tmp 30 28 8->11         started        process4 file5 42 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 11->42 dropped 44 C:\...\unins000.exe (copy), PE32 11->44 dropped 46 C:\Program Files (x86)\...\is-28K57.tmp, PE32 11->46 dropped 48 2 other files (none is malicious) 11->48 dropped 14 DDR - Memory Card Recovery(Demo).exe 2 14 11->14         started        process6 process7 16 chrome.exe 9 14->16         started        19 chrome.exe 14->19         started        21 chrome.exe 14->21         started        23 11 other processes 14->23 dnsIp8 50 192.168.2.5, 443, 49703, 49704 unknown unknown 16->50 52 239.255.255.250 unknown Reserved 16->52 25 chrome.exe 16->25         started        28 chrome.exe 19->28         started        30 chrome.exe 21->30         started        32 chrome.exe 23->32         started        34 chrome.exe 23->34         started        36 chrome.exe 23->36         started        38 8 other processes 23->38 process9 dnsIp10 54 142.250.64.110, 443, 49743, 49769 GOOGLEUS United States 25->54 56 142.250.81.238, 443, 49864 GOOGLEUS United States 25->56 58 13 other IPs or domains 25->58
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
31.13.71.36
 star-mini.c10r.facebook.com Ireland
32934 FACEBOOKUS false
142.250.64.110
 unknown United States
15169 GOOGLEUS false
157.240.241.35
 unknown United States
32934 FACEBOOKUS false
142.250.81.238
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
31.13.71.7
 scontent.xx.fbcdn.net Ireland
32934 FACEBOOKUS false
64.150.180.73
 pddmmctool.com United States
18501 CODERO-DFWUS false
157.240.241.1
 scontent-lga3-2.xx.fbcdn.net United States
32934 FACEBOOKUS false
142.251.35.164
 www.google.com United States
15169 GOOGLEUS false
142.251.35.174
 plus.l.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.5

Contacted Domains

Name IP Active
star-mini.c10r.facebook.com 31.13.71.36 true
scontent.xx.fbcdn.net 31.13.71.7 true
plus.l.google.com 142.251.35.174 true
scontent-lga3-1.xx.fbcdn.net 31.13.71.7 true
www.google.com 142.251.35.164 true
scontent-lga3-2.xx.fbcdn.net 157.240.241.1 true
pddmmctool.com 64.150.180.73 true
www.facebook.com unknown unknown
www.pddmmctool.com unknown unknown
connect.facebook.net unknown unknown
apis.google.com unknown unknown
static.xx.fbcdn.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.facebook.com/pages/call_to_action/fetch_dialog_data/?id=939139756120458&surface=pagePlugin&unit_type=VIEWER false
    		high
    https://www.pddmmctool.com/pddmmctool/img/thankd-01.png false
    • Avira URL Cloud: safe
    		 unknown
    https://static.xx.fbcdn.net/rsrc.php/v3/yV/r/HzxD9aAXSyD.js?_nc_x=Ij3Wp8lg5Kz false
      		high
      https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df85bc2859b6900198%2526domain%253Dwww.pddmmctool.com%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwww.pddmmctool.com%25252Ffa0c202510d69f83b%2526relation%253Dparent.parent%26container_width%3D394%26header%3Dtrue%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FDDRRecovery%26locale%3Den_US%26sdk%3Djoey%26show_border%3Dtrue%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300 false
        		high
        https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7xeUmxa13xu1syUbAih0Sw8W5U4e1qzEvzEdEc8co2czobo7W0TUhwj82owbC0LVE4W0OE2WxO0FE662y1Dw5Zx61vw4iwBgK7o1O82IzU2Xwdq1iwmE2ewnE2Lx-0iS1Axy0gq0Lo6-1Fw63w5Kwt8&__hs=19804.BP%3Aplugin_default_pkg.2.0..0.0&__hsi=7349008095135782060&__req=2&__rev=1012233066&__s=%3A%3A339a9f&__sp=1&__user=0&dpr=1&jazoest=21987&locale=en_US&lsd=Z2PIbdG_LFymmVvTmx1zUH false
          		high
          https://www.pddmmctool.com/memorycardgetitforfree.html false
            		unknown
            https://static.xx.fbcdn.net/rsrc.php/v3/yH/r/ieeHDjcGsIR.js?_nc_x=Ij3Wp8lg5Kz false
              		high
              https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0,cross/V-GL57iHfEB.css?_nc_x=Ij3Wp8lg5Kz false
                		high
                https://www.pddmmctool.com/pddmmctool/img/pddmmctool-bg.jpg false
                • Avira URL Cloud: safe
                		 unknown
                https://www.pddmmctool.com/pddmmctool/img/offer-ret.png false
                • Avira URL Cloud: safe
                		 unknown
                https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7wgo4e1QyUbFuUdE2ewmU3fw6Gwd-0ZU1upE4W0OE2Wwce0yE1VohwnU1oU1O81u83mwaS0zE1bE1AE17U2Zw146&__hs=19804.BP%3Aplugin_like_pkg.2.0..0.0&__hsi=7349008065288174733&__req=1&__rev=1012233066&__s=%3A%3Agitu3z&__sp=1&__user=0&dpr=1&jazoest=21768&locale=en_US&lsd=8TKNu0uMVjJaa3GGV-MlRA false
                  		high
                  https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7wgo4e1QyUbFuUdE2ewmU3fw6Gwd-0ZU1upE4W0OE2Wwce0yE1VohwnU1oU1O81u83mwaS0zE1bE1AE17U2Zw146&__hs=19804.BP%3Aplugin_like_pkg.2.0..0.0&__hsi=7349008095892820252&__req=1&__rev=1012233066&__s=%3A%3A12r9wm&__sp=1&__user=0&dpr=1&jazoest=21968&locale=en_US&lsd=pFWnnRDwLV1ij1olmVX6pG false
                    		high
                    https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfef990f6be225d229%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff527d469655a1751d%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 false
                      		high
                      https://www.pddmmctool.com/pddmmctool/img/Googleplus-icon.png false
                      • Avira URL Cloud: safe
                      		 unknown
                      https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/o0DyX3DMRvp.js?_nc_x=Ij3Wp8lg5Kz false
                        		high
                        https://static.xx.fbcdn.net/rsrc.php/v3/yC/l/0,cross/oCh4fJriDK8.css?_nc_x=Ij3Wp8lg5Kz false
                          		high
                          https://www.pddmmctool.com/pddmmctool/img/linkedin-icon.png false
                          • Avira URL Cloud: safe
                          		 unknown
                          https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df88765eed5a989276%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff1c4dcb701e7ff7d7%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 false
                            		high
                            https://static.xx.fbcdn.net/rsrc.php/v3iNix4/yG/l/en_US/u8r7dUOIloj.js?_nc_x=Ij3Wp8lg5Kz false
                              		high
                              https://www.pddmmctool.com/pddmmctool/img/follow-us.gif false
                              • Avira URL Cloud: safe
                              		 unknown
                              https://static.xx.fbcdn.net/rsrc.php/v3/y6/r/Glmz_lYOBT1.js?_nc_x=Ij3Wp8lg5Kz false
                                		high
                                https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df244b3350adbab7ff%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff527d469655a1751d%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 false
                                  		high
                                  https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7xeUmxa13xu1syUbAih0Sw8W5U4e1qzEvzEdEc8co2czobo7W0TUhwj82owbC0LVE4W0OE2WxO0FE662y1Dw5Zx61vw4iwBgK7o1O82IzU2Xwdq1iwmE2ewnE2Lx-0iS1Axy0gq0Lo6-1Fw63w5Kwt8&__hs=19804.BP%3Aplugin_default_pkg.2.0..0.0&__hsi=7349008095135782060&__req=4&__rev=1012233066&__s=%3A%3A339a9f&__sp=1&__user=0&dpr=1&jazoest=21987&locale=en_US&lsd=Z2PIbdG_LFymmVvTmx1zUH false
                                    		high
                                    https://static.xx.fbcdn.net/rsrc.php/v3/yr/r/teTZ2tZqwkq.js?_nc_x=Ij3Wp8lg5Kz false
                                      		high
                                      https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=auth/exm=plus,plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g/cb=gapi.loaded_2?le=scs false
                                        		high
                                        http://www.pddmmctool.com/memorycardgetitforfree.html false
                                        • 0%, Virustotal, Browse
                                        • Avira URL Cloud: safe
                                        		 unknown
                                        https://apis.google.com/js/rpc:shindig_random.js?onload=init false
                                          		high
                                          https://connect.facebook.net/en_US/all.js?hash=1cd6bd47bfb7743895b703941e18a998 false
                                            		high
                                            https://static.xx.fbcdn.net/rsrc.php/v3/yw/r/UXtr_j2Fwe-.png false
                                              		high
                                              https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/ya/l/en_US/xtD0rC1AhZ7.js?_nc_x=Ij3Wp8lg5Kz false
                                                		high
                                                https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/y7alrmypbND.js?_nc_x=Ij3Wp8lg5Kz false
                                                  		high
                                                  https://www.pddmmctool.com/pddmmctool/img/Facebook-icon.png false
                                                  • Avira URL Cloud: safe
                                                  		 unknown
                                                  https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7wgo4e1QyUbFuUdE2ewmU3fw6Gwd-0ZU1upE4W0OE2Wwce0yE1VohwnU1oU1O81u83mwaS0zE1bE1AE17U2Zw146&__hs=19804.BP%3Aplugin_like_pkg.2.0..0.0&__hsi=7349008122995911068&__req=1&__rev=1012233066&__s=%3A%3Ay8etvi&__sp=1&__user=0&dpr=1&jazoest=21685&locale=en_US&lsd=445H6-dbFeS-N8PnMaiSFh false
                                                    		high
                                                    https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/1igfs7II_g6.png false
                                                      		high
                                                      https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2396622b9b3cf645%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ff1c4dcb701e7ff7d7%26relation%3Dparent.parent&container_width=88&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&send=false&show_faces=false&width=260 false
                                                        		high
                                                        https://www.facebook.com/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df85bc2859b6900198%26domain%3Dwww.pddmmctool.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.pddmmctool.com%252Ffa0c202510d69f83b%26relation%3Dparent.parent&container_width=394&header=true&href=https%3A%2F%2Fwww.facebook.com%2FDDRRecovery&locale=en_US&sdk=joey&show_border=true&show_faces=true&stream=false&width=300 false
                                                          		high
                                                          https://www.pddmmctool.com/pddmmctool/img/Twitter-icon.png false
                                                          • Avira URL Cloud: safe
                                                          		 unknown
                                                          https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/p55HfXW__mM.js?_nc_x=Ij3Wp8lg5Kz false
                                                            		high
                                                            https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-6/326343844_860818915181361_8244206260655144977_n.jpg?stp=dst-jpg_p206x206&_nc_cat=101&ccb=1-7&_nc_sid=5f2048&_nc_ohc=jLS3T9UTsiIAX9JGyEZ&_nc_ht=scontent-lga3-2.xx&edm=ANSO7JkEAAAA&oh=00_AfDnp_zQVTi0rTSwttngxrBBpTpVsUzK9W2fYYx-_toe1Q&oe=6601B09F false
                                                              		high
                                                              https://www.pddmmctool.com/pddmmctool/img/like-us.gif false
                                                              • Avira URL Cloud: safe
                                                              		 unknown
                                                              https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7xeUmxa13xu1syUbAih0Sw8W5U4e1qzEvzEdEc8co2czobo7W0TUhwj82owbC0LVE4W0OE2WxO0FE662y1Dw5Zx61vw4iwBgK7o1O82IzU2Xwdq1iwmE2ewnE2Lx-0iS1Axy0gq0Lo6-1Fw63w5Kwt8&__hs=19804.BP%3Aplugin_default_pkg.2.0..0.0&__hsi=7349008120875342272&__req=2&__rev=1012233066&__s=%3A%3Akf6v91&__sp=1&__user=0&dpr=1&jazoest=21792&locale=en_US&lsd=B6uAdzzOL771Qe8DhbTe1Z false
                                                                		high
                                                                https://www.facebook.com/ajax/bz?__a=1&__ccg=GOOD&__dyn=7xeUmxa13xu1syUbAih0Sw8W5U4e1qzEvzEdEc8co2czobo7W0TUhwj82owbC0LVE4W0OE2WxO0FE662y1Dw5Zx61vw4iwBgK7o1O82IzU2Xwdq1iwmE2ewnE2Lx-0iS1Axy0gq0Lo6-1Fw63w5Kwt8&__hs=19804.BP%3Aplugin_default_pkg.2.0..0.0&__hsi=7349008065430460533&__req=4&__rev=1012233066&__s=%3A%3Ajte3jw&__sp=1&__user=0&dpr=1&jazoest=21964&locale=en_US&lsd=L6JsnhnuoSgB_nhHkCB-UZ false
                                                                  		high
                                                                  https://www.pddmmctool.com/pddmmctool/img/icon_01.png false
                                                                  • Avira URL Cloud: safe
                                                                  		 unknown
                                                                  https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Flike_box.php%3Fapp_id%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Dfef990f6be225d229%2526domain%253Dwww.pddmmctool.com%2526is_canvas%253Dfalse%2526origin%253Dhttps%25253A%25252F%25252Fwww.pddmmctool.com%25252Ff527d469655a1751d%2526relation%253Dparent.parent%26container_width%3D394%26header%3Dtrue%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FDDRRecovery%26locale%3Den_US%26sdk%3Djoey%26show_border%3Dtrue%26show_faces%3Dtrue%26stream%3Dfalse%26width%3D300 false
                                                                    		high
                                                                    https://www.pddmmctool.com/pddmmctool/img/comment.gif false
                                                                    • Avira URL Cloud: safe
                                                                    		 unknown
                                                                    https://www.pddmmctool.com/pddmmctool/img/facebook-09.png false
                                                                    • Avira URL Cloud: safe
                                                                    		 unknown
                                                                    https://www.pddmmctool.com/pddmmctool/img/ribion.png false
                                                                    • Avira URL Cloud: safe
                                                                    		 unknown
                                                                    https://static.xx.fbcdn.net/rsrc.php/v3/yU/r/znz2cJ4Kmw7.js?_nc_x=Ij3Wp8lg5Kz false
                                                                      		high
                                                                      https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.Oh6mNxd5OYM.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-goHQwcBQdTSfIcaYi5vOvnb-P8g/cb=gapi.loaded_0?le=scs false
                                                                        		high
                                                                        https://static.xx.fbcdn.net/rsrc.php/v3/y3/r/HkvD17iqK-X.js?_nc_x=Ij3Wp8lg5Kz false
                                                                          		high
                                                                          https://www.pddmmctool.com/favicon.ico false
                                                                          • Avira URL Cloud: safe
                                                                          		 unknown
                                                                          https://static.xx.fbcdn.net/rsrc.php/v3/yZ/r/7HsMI9RHeJO.js?_nc_x=Ij3Wp8lg5Kz false
                                                                            		high