Analysis
-
max time kernel
67s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
19-03-2023 04:37
Static task
static1
Behavioral task
behavioral1
Sample
rcsetup153.exe
Resource
win10v2004-20230220-es
General
-
Target
rcsetup153.exe
-
Size
11.3MB
-
MD5
90e8564308043d11b65215dcedcdb4c0
-
SHA1
56f6ac4fda81334483b878cbb5c606312ad783ca
-
SHA256
c9b7b6b2aa03cfd41164df798f6481eb81fc7260635e7bcc5b7cfc3409660e76
-
SHA512
0f44dd5abfe7d79fd03f2b9a4ec0970a4b488c1a3e3bf5fabdea88bd61a5a81143f51dc316828ec80feed66e74ba69157294697e473c0f77030d757caa87ffb9
-
SSDEEP
196608:rEpX2/5WWnKf7YrfS2VwY6Inliwuu02znPyCC4VSC+xShskxOfLWdDSAj2VGHfN:rfWWWYzlwYXS2zP44QxwEfLGSAaVSfN
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rcsetup153.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation rcsetup153.exe -
Executes dropped EXE 2 IoCs
Processes:
recuva64.exerecuva64.exepid process 4708 recuva64.exe 2808 recuva64.exe -
Loads dropped DLL 19 IoCs
Processes:
rcsetup153.exeregsvr32.exeregsvr32.exepid process 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 3368 regsvr32.exe 1728 regsvr32.exe 1768 rcsetup153.exe 1768 rcsetup153.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\InprocServer32\ = "C:\\Program Files\\Recuva\\RecuvaShell64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
recuva64.exedescription ioc process File opened (read-only) \??\D: recuva64.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rcsetup153.exerecuva64.exedescription ioc process File opened for modification \??\PhysicalDrive0 rcsetup153.exe File opened for modification \??\PhysicalDrive0 recuva64.exe -
Drops file in Program Files directory 50 IoCs
Processes:
rcsetup153.exerecuva64.exedescription ioc process File created C:\Program Files\Recuva\Lang\lang-1044.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1028.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1035.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1026.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1050.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1062.dll rcsetup153.exe File opened for modification C:\Program Files\Recuva\RecuvaShell64.dll rcsetup153.exe File created C:\Program Files\Recuva\RecuvaShell64.dll.new rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1040.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1034.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1051.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-5146.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1032.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1025.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-3098.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1058.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-9999.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1049.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1063.dll rcsetup153.exe File created C:\Program Files\Recuva\uninst.exe rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-2074.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1068.dll rcsetup153.exe File created C:\Program Files\Recuva\recuva.exe rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1043.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1036.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1046.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1038.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1027.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1048.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1052.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1031.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1041.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1053.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1045.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1030.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1055.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1061.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1079.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1057.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1029.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-2052.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1067.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1060.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1054.dll rcsetup153.exe File created C:\Program Files\Recuva\recuva64.exe rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1037.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1071.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1066.dll rcsetup153.exe File created C:\Program Files\Recuva\Lang\lang-1059.dll rcsetup153.exe File created C:\Program Files\Recuva\SomeRandomTmpFile748329742893.tmp recuva64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
recuva64.exedescription ioc process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor recuva64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 recuva64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString recuva64.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor recuva64.exe -
Modifies data under HKEY_USERS 17 IoCs
Processes:
rcsetup153.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Piriform\Recuva rcsetup153.exe Key created \REGISTRY\USER\.DEFAULT rcsetup153.exe Key created \REGISTRY\USER\.DEFAULT\Software\Piriform rcsetup153.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Piriform\Recuva\Language = "1033" rcsetup153.exe Key created \REGISTRY\USER\S-1-5-19\Software rcsetup153.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform rcsetup153.exe Key created \REGISTRY\USER\S-1-5-20\Software\Piriform\Recuva rcsetup153.exe Key created \REGISTRY\USER\S-1-5-20 rcsetup153.exe Key created \REGISTRY\USER\.DEFAULT\Software rcsetup153.exe Key created \REGISTRY\USER\S-1-5-19 rcsetup153.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform rcsetup153.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform\Recuva\Language = "1033" rcsetup153.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform\Recuva rcsetup153.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Piriform\Recuva\Language = "1033" rcsetup153.exe Key created \REGISTRY\USER\S-1-5-19\Software\Piriform\Recuva rcsetup153.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Piriform\Recuva rcsetup153.exe Key created \REGISTRY\USER\S-1-5-20\Software rcsetup153.exe -
Modifies registry class 27 IoCs
Processes:
regsvr32.exercsetup153.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\RecuvaShellExt regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Software\Piriform\Recuva rcsetup153.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{80109467-DE5A-42A1-9445-7E3952C80B6E}\ = "RecuvaShell" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\RecuvaShellExt\ = "{435E5DF5-2510-463C-B223-BDA47006D002}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\RecuvaShell.DLL\AppID = "{80109467-DE5A-42A1-9445-7E3952C80B6E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\ = "RecuvaShellExt Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Software\Piriform\Recuva\Language = "1033" rcsetup153.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\ = "RecuvaShell 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\0\win64\ = "C:\\Program Files\\Recuva\\RecuvaShell64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\HELPDIR\ = "C:\\Program Files\\Recuva" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\RecuvaShell.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\InprocServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Software\Piriform rcsetup153.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{80109467-DE5A-42A1-9445-7E3952C80B6E} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Software rcsetup153.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\RecuvaShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\RecuvaShellExt\ = "{435E5DF5-2510-463C-B223-BDA47006D002}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\InprocServer32\ = "C:\\Program Files\\Recuva\\RecuvaShell64.dll" regsvr32.exe -
Processes:
recuva64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 recuva64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 recuva64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 recuva64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 recuva64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 recuva64.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
rcsetup153.exepid process 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
rcsetup153.exerecuva64.exevssvc.exedescription pid process Token: SeRestorePrivilege 1768 rcsetup153.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeRestorePrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4708 recuva64.exe Token: SeBackupPrivilege 4908 vssvc.exe Token: SeRestorePrivilege 4908 vssvc.exe Token: SeAuditPrivilege 4908 vssvc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
recuva64.exepid process 2808 recuva64.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
rcsetup153.exerecuva64.exepid process 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 1768 rcsetup153.exe 2808 recuva64.exe 2808 recuva64.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rcsetup153.exeregsvr32.exedescription pid process target process PID 1768 wrote to memory of 3368 1768 rcsetup153.exe regsvr32.exe PID 1768 wrote to memory of 3368 1768 rcsetup153.exe regsvr32.exe PID 1768 wrote to memory of 3368 1768 rcsetup153.exe regsvr32.exe PID 3368 wrote to memory of 1728 3368 regsvr32.exe regsvr32.exe PID 3368 wrote to memory of 1728 3368 regsvr32.exe regsvr32.exe PID 1768 wrote to memory of 4708 1768 rcsetup153.exe recuva64.exe PID 1768 wrote to memory of 4708 1768 rcsetup153.exe recuva64.exe PID 1768 wrote to memory of 2808 1768 rcsetup153.exe recuva64.exe PID 1768 wrote to memory of 2808 1768 rcsetup153.exe recuva64.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rcsetup153.exe"C:\Users\Admin\AppData\Local\Temp\rcsetup153.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /I "C:\Program Files\Recuva\RecuvaShell64.dll" /s2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/I "C:\Program Files\Recuva\RecuvaShell64.dll" /s3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files\Recuva\recuva64.exe"C:\Program Files\Recuva\recuva64.exe" /installationComplete "bin|allusers"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Recuva\recuva64.exe"C:\Program Files\Recuva\recuva64.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Recuva\RecuvaShell64.dllFilesize
351KB
MD5e2f0dbd601ca28818b1ba2d69f6a0268
SHA14d06d01fd00c3866c0cdfd6cfbcaccca849454cf
SHA256eefd30c828bbe1948cf4fc8371889936ff7638df3041aa8fb29b18cace84ed58
SHA512bb5b13d48f19be60f30732e93f8ca66b092c6a89a466e86bcb92e64c48abb158929f224afff413d104c440021331ade960d079b44799b4ae4b38f3507be9b4ca
-
C:\Program Files\Recuva\RecuvaShell64.dllFilesize
351KB
MD5e2f0dbd601ca28818b1ba2d69f6a0268
SHA14d06d01fd00c3866c0cdfd6cfbcaccca849454cf
SHA256eefd30c828bbe1948cf4fc8371889936ff7638df3041aa8fb29b18cace84ed58
SHA512bb5b13d48f19be60f30732e93f8ca66b092c6a89a466e86bcb92e64c48abb158929f224afff413d104c440021331ade960d079b44799b4ae4b38f3507be9b4ca
-
C:\Program Files\Recuva\RecuvaShell64.dllFilesize
351KB
MD5e2f0dbd601ca28818b1ba2d69f6a0268
SHA14d06d01fd00c3866c0cdfd6cfbcaccca849454cf
SHA256eefd30c828bbe1948cf4fc8371889936ff7638df3041aa8fb29b18cace84ed58
SHA512bb5b13d48f19be60f30732e93f8ca66b092c6a89a466e86bcb92e64c48abb158929f224afff413d104c440021331ade960d079b44799b4ae4b38f3507be9b4ca
-
C:\Program Files\Recuva\lang\lang-1025.dllFilesize
43KB
MD509ab3d5c272b1c3e34726252aac0aa00
SHA1d7af58974a59d79e0dbed8183082d68bd8fa676f
SHA2567db1b35b6febe6acc6c37c98b127fe53163092111844e13ff05d0d09ce2c139a
SHA512405baa702532a7c355faba5220f9d758003407e63f318d6298bb6c037753797667f95957aa3824c2dede75bfdfce05d8e1909e6be83f34f879239e3e3a13dede
-
C:\Program Files\Recuva\lang\lang-1026.dllFilesize
45KB
MD5eaf2d3ce4b5aacf072707dfab5e26f17
SHA17dbc64b1e261eb5c65f5becbf68f27fe4b985275
SHA256d2999bb838e442ca0a34619d811fd64529602b4c19fc8bf2dd29f3579a19d717
SHA51267bddd73930a2ab060b478b82229e393f2ae2b3c69fe347a17c3779a4a4c039316b6ecd2ea7c605d419ec40ac56f7d611084fa715d631ee019715018f708f313
-
C:\Program Files\Recuva\lang\lang-1027.dllFilesize
50KB
MD595ebf12104b8168fe449c935a81d37d4
SHA1b9999b55cdd950ecb4aac4a9b2aaa4fb0451b322
SHA256f272553cd68979f241184b9885dde0ecd0641bec119b70238a0ab0fb5df7a8c0
SHA5126e0b87c3babf74409339feb1aa48e4d08d08dcb9fa4fdc39c4a7ceeb6afebc0cf4f3117c9e2a2b5ca1c195823a2316f57c822a223ed0da8e5625099dcdc2faae
-
C:\Program Files\Recuva\lang\lang-1028.dllFilesize
26KB
MD51c5beb94194a3d6a232b164aaa60538b
SHA11bf993ebadd3659049bd46fd1af57a7ae0914b24
SHA25614155fb1296a0023737005ffeabcee8ac1af0f7933a1e6cc0eeb75b2a5d26978
SHA51279a5e1d39a9f44684188e16eb6fdd578e87fb83a43f70bbdbda1641c9865563d3c17aab945a8423fbf1812792c87bf8f5269f9212ee5c3f8ac1ae3020eadca29
-
C:\Program Files\Recuva\lang\lang-1029.dllFilesize
45KB
MD57f1caf8c28b06adf5d11fa1e86350f5b
SHA1fb0f005eb0f246adec2eb1077dc9a96c36ae78f1
SHA256bcdf4079402621e16a495d5702199e9ee8210ae3cc91ec07a551d439ae72ddef
SHA5126c60e19913363b1e2a098c9d3489102c64fe3f5b22cf1c8e800b972d30ab1796c3f04b721c75f684ad90c6cbefef7822a608d0d8a8744853d501a8f6e92b8046
-
C:\Program Files\Recuva\lang\lang-1030.dllFilesize
45KB
MD5391f6f821b42f7704cd14a9fed60b425
SHA113a08d7f7330ce1c6c31b74eef105d94ce748969
SHA256ec7baed5fdde3bd531cc4aa3b5ab9a64d4cf673eb95bfbbf77e72ef535193549
SHA512530a66655ddfb8c11380a18033fce7d86db4507ae602bd0cbcdbb776d47945ea27db27a1a8364098ef0eb3cf326ddfa04ffdd53c6a6af664196ab29107645e4c
-
C:\Program Files\Recuva\lang\lang-1031.dllFilesize
48KB
MD569aa97c9ca93a876ce7bf9b00b01ba7b
SHA1f42f111afaa0c63043ab1c9f154409466b6060e4
SHA25680053c4652f079f5512ceb77cde17a72a07751ea789dc946e3c8841ab9a582cd
SHA512adf619f5b0ea3c32f8135392feec0bfafa07aa5dd33ea828550d5fff71abde80523e4943342a86d1e67a064b2d407b014b0b5a7ff8716eea6952f04008a215e6
-
C:\Program Files\Recuva\lang\lang-1032.dllFilesize
51KB
MD56159a67b72ed230709441f601bf576ac
SHA1b70af5bc0ce6aafacc641dc62fe313d21f52ea2b
SHA25601ae5d89c2db1443d49a18608d5ee7fdde5c6383d32ff9c347e543073581385a
SHA5120bb0986b589be5393e2d2b9d0921024c0c895aa9950e8adc3842a217c26700b105ff8c1960f12050df2afde7108b41073db62ada0a71f149cdba5c006ba476dc
-
C:\Program Files\Recuva\lang\lang-1034.dllFilesize
51KB
MD5d82d08d87a1cf7bd51e8e44d8b438de4
SHA1f9935326438d79706e5b6fa52703c2933a3c9505
SHA2567c4f7f0e0a6e003ec667ed681573c3a471ca787f72bcfb52fe5b583b712b6023
SHA512651b969061c7027698f65aa6a7edc404dc4783093f1ddf8238e1e30e4e5ddc665b581eb1d7d030db38a9bc08624ef6bf31e06aaabf3e45692d894bc8dde3c808
-
C:\Program Files\Recuva\lang\lang-1035.dllFilesize
47KB
MD59ce51a54f147f717ea9ad8fc61a69993
SHA19dbd2a92d59fb23d0373ef9e64e1b3acd18547fa
SHA2567b2b5464bb580541dd1801d1a39f2e0031015c0c9421215e4a1107d695b7f9dc
SHA512369835b2f2d019809774dc38e601f5e9dceb9c4cf63e707a9a728b63771a5eaa45fe553f4d8ff1bf683075e96f660c5e5efabb75e212abaf6e5d5dde53030fd5
-
C:\Program Files\Recuva\lang\lang-1036.dllFilesize
51KB
MD5c51cbe724edfee2a904767a51bc92602
SHA14976364b4acb95bc9e4b1170bc4acabaa79808a8
SHA25626bbb1dc1e2e53177fb13f5cf5fa8c2b2a28bac07dbf49e0cb12350e7e592a46
SHA512a9050572bf8103953f7ebb04857113f0fb6861124a7fd5c00696df7dabafad3ecd7e875c3f386e115f0fae2a93347cdf124e57f663679b2057fad9b405e97361
-
C:\Program Files\Recuva\lang\lang-1037.dllFilesize
39KB
MD5751a9edaddbdcef72e630ecf405748d4
SHA1ad64b8385eac4b609c2411b2edc62cc37382845e
SHA25636cd7755ce3ad555fe7200641b9cebd70001039c2918fcf2d6209d162c8c332c
SHA51231ce437fcbe08bef412707206542eae23719edcb17b07fc68262c9094d690d74b5896bcff94d4423a1cf370b964b6a00ef2c82ba088fba43b0e98b55375e1a02
-
C:\Program Files\Recuva\lang\lang-1038.dllFilesize
49KB
MD5c7839ac60acb518dfba5cca36c1ee1fa
SHA135348b7986110c037d7a32feb02ee379576c269c
SHA256a6064f6008461c02153f0e602ce5ca0c14ad780ab745f6d765b974e71d22d181
SHA51240000a08f4ff26c178a3ee83b87a3b6251d57f5a3597e34e6bcd468aadfaa5e03c7c8c8f60b3db3241759cd52f6c21f3bfdbc5d3d032122eca6f55fc7aecf3f7
-
C:\Program Files\Recuva\lang\lang-1040.dllFilesize
49KB
MD512011869e5e4ae071852ceb77caebe8a
SHA1cc4c5ffc4db6fceb3e3a57ae96d6d098f033c74f
SHA2562d5206e56796b7a5f7f3ab5ffd8c65176860cf707e18c957590dbaf53564b11f
SHA5125201909937ee1dd56ee880987c7f0c5c87feb107d85b13d87fd9e98cbbab2e833a59fd6786acfc45459cf1ea13bfc9ff7170c94ada957254ca877fe4e9b6a022
-
C:\Program Files\Recuva\lang\lang-1041.dllFilesize
31KB
MD5ce2e97db024dcccd793defb25d4c8848
SHA188d5f7a813c620c8df54e3ef39135a298ba843ac
SHA256c366a4f163213092c40ee6c83c1f22119382a578a1d95b4f35b780baf8c3dd8c
SHA5126ea189d3888537920ab86aca9c31c87e8b70c1871463991dcdfbadf9a390260c99dd08da8acbf37ea98bffe9ab0388f64afc88b322a4fe50864dc93bd1bea014
-
C:\Program Files\Recuva\lang\lang-1043.dllFilesize
51KB
MD522115338dc23301dfe003af2ac45d586
SHA1b56a3545daa0a6a005bb4aaa9467ec9c6b9e3715
SHA25683d1e8f8f62bf7df240731c03e27afae79cdbcf49b5509c732ba82d4086a7f3f
SHA5123ae9decf8f79714f2b03a88ce09182446253bd61c0dcf556e919408771df374fc57497576933ee3bc887f43073c176a3e65f8394a518edf1334b7b20f3170747
-
C:\Program Files\Recuva\lang\lang-1044.dllFilesize
45KB
MD5562f2cf6d15f9a15830ad9a7b3112631
SHA12084966ad004ba90aab1b5023669462d9e4c6065
SHA256ae6fb2fa374e496214f85806207b57abe418963701fa2aed37424ef062e723b2
SHA51242f3ebe47b3ddfd99a16f0dec832844a17da96dbf13e5e27cefe1a0a83f9a0da1358deddacfb1e5a232aa91b629eb4d10d80f2dec91586a468f42a791c069c53
-
C:\Program Files\Recuva\lang\lang-1045.dllFilesize
48KB
MD5f5355563258e089e4fa63edc28f406ef
SHA101364ed0dfac3d95e55bdc657e7b9c6136440b10
SHA256417d609be4fef9dff24cd10aad131051ea72c8dbdfeb9de5a4d7dc08e7d6fc04
SHA5127ec20992ff5b8c73b669ab9211679366dc0601ea5556e03dfed9957f15e30bd30f3230a32eb04350d52e3067532e36693263e876111f199b51d37cdd93b8f6cc
-
C:\Program Files\Recuva\lang\lang-1046.dllFilesize
47KB
MD5399e14c5fbfb34d38c628b6f62489357
SHA1072a15d2019119d6384fa3315a2801cd7e964b2b
SHA25623fdbf0067efb6a3499c9fc1b46b7cefb5a79091ec53c467c129c5cf3e791d8d
SHA512740be2c3192106908723e8aa9007fddd39abe5a82f8662f452a9ba6ca3d8cb07ec82ad8bc5c4549fbf33b6a3d8db5a5dc2d0c3673fbb87d295957041e89d970b
-
C:\Program Files\Recuva\lang\lang-1048.dllFilesize
45KB
MD590f43ec553b0651382bc57971e07a09b
SHA17239c324c7eab52a67944071e996619bf9fcf857
SHA2560c395ffaa27215b5d81b9d36df54e520909dc55935919c2572881de14860cb61
SHA512ac64c25c48cd0b7cf6bf77f74c4d6411e9a18c05b8938eb90fa0f7137f89dcc7a70e2580eb867e28db7b4a97d58ee599a06464ab18c70fafceebb2c371631ec3
-
C:\Program Files\Recuva\lang\lang-1049.dllFilesize
44KB
MD598a5ddb69bc7563a748dfe5455cfbe02
SHA136bc9193908b1ecd8e3ea96f406669022561e57a
SHA256aeb0a885c8f65e53aa5dea19119a02e6affa8e55881a92fc292c4550c25c4d77
SHA5120d877ed1812a915a1201fe42404644fdf33e14e35c9e4e7b1a6cb064b03ca3826d289fcfe5ff89d50ae45941cf707ba0a508b103cca5e9520d658804197d2449
-
C:\Program Files\Recuva\lang\lang-1050.dllFilesize
49KB
MD51efee3cddde6f0209ad99161958f8ca9
SHA18afcf83a1ed73f7dc746213a2af5978a8b2e738d
SHA256d88addec337c636166d4ec46fec41e23662d56b23fa3c30241109f0d6c508799
SHA5127ef93745e8697030e7511ff61b1beeaae8069482116fc93d2cdbee238af42e702dc1a6382765a41d4b9f71232be5c81433113bacc88c08d2983a26659937e7e5
-
C:\Program Files\Recuva\lang\lang-1051.dllFilesize
44KB
MD5213321eb50c6439d62cabbae6cac1ebf
SHA1ca691b979870acb44b7e98c10f644710aa39e947
SHA2566ef20f5065718d0a614ed0a87062c1800ca72b06c97d36a3d845f60d989f046b
SHA512590dd853972b3ce283d53d8fad118241194000cc5a08a1d6b4ef6d43a4f5e34f9208d1e50e52b90ec771d6bb7eb5b55bf772fa8493df2c0bbf0031ff38fa5616
-
C:\Program Files\Recuva\lang\lang-1052.dllFilesize
46KB
MD54aaa19c1bed12be29a2441325cec1230
SHA1af6e4a627f89d34f5434884165c89286a58fdc36
SHA25648232a0de1cc476bbbb6dcd258aabcf8dc41ee6707c91028b085b694e5c02783
SHA51215bb1e65107dbb557739ad12aa4d0a8e36d508321388513c96785f2554d948d494a79827ba3fbb4a1fd7f570653583618b7beb7af24ef949de33c41c881a105f
-
C:\Program Files\Recuva\lang\lang-1053.dllFilesize
46KB
MD530a47809ee8280eca65d9ce906a32b60
SHA128a717d4f80f302d661704437a1f19679efc1014
SHA25652ec0c6f08e2d6c1b9747ef24823a23782b9625e39082fa0bbf2932b4a9d6b4d
SHA51257eb4e5b75b988629f9af05312a9fe534f6c261ee1bd74e3f56224e4c41978c0073dffb111593532d202234483bd8ebe2e9f60ddcf3878a66bbc42a59f4f8393
-
C:\Program Files\Recuva\lang\lang-1054.dllFilesize
43KB
MD588856a1ec2ece4eaea8c405ea5da673c
SHA1ffbdeb59bbdb00bc04c9fac06ef9fb93787213fd
SHA256387c7aae9a7c7338313aac3bda930d897da87b2a82f90c6baf9d11ac549bcbdc
SHA512a7adb84ee624f3155369af243702be56246df3fed25e63ec92c4d10140b740feb815f672f517bb3f8a2f8cf59cca296475a7fa2094c5aee4fc25f3dc0ec93e64
-
C:\Program Files\Recuva\lang\lang-1055.dllFilesize
44KB
MD503f444b1a82a34afc1e494d4672fc27a
SHA14b3c9d9fcc960e91cd93012623966a383bdc70ce
SHA256bd6bb09d9a5190268f1af23b9aa70d47c4049272b7eb7659382cc3bf6fa071db
SHA5128465b29891dc2bf863ef1c08b8a33ef3ac8c49eeda3f081e6969722610d7be977f138ca830626cc017ee348e826528e4760604462c12150876e92af15e0c9cc1
-
C:\Program Files\Recuva\lang\lang-1057.dllFilesize
47KB
MD5d5eb12996e948790ef64d02ddeeeee4f
SHA1d2a4c3b5bb94e1b06c117ede3c4c5f2496514e67
SHA256c8705b828d7dde9ea2323d794d619c47d3d4c7f8bec1e33cf7d7e2ab34108912
SHA512a5a4b5a29fd5a992236770d4f49378488cf21ba283610d8105cbfec8d7e44f29bce7645f5219d714e311728370330b575e5aa8c1d41dcc26c30b76410858dd31
-
C:\Program Files\Recuva\lang\lang-1058.dllFilesize
45KB
MD5dc8363eb2e72506bcd356665cb3a7272
SHA11ab82859dd01cf9cd1c610a08233e8d1a62a5873
SHA25696b0ced959bcba557c080efe27bcea1e89f7d33aae0fc03d775e9a411c406c21
SHA5124460faf017a882f696fd2d95e7689fbf576ba057c1bcede34cfa3bbe53043252b1378f073e9d3887dbcd529da98b98c982a3e48ba4945dd4a840973b4e6e549b
-
C:\Program Files\Recuva\lang\lang-1059.dllFilesize
46KB
MD5496e6f7e68aa51f34e1463bcb65f74f0
SHA1a403e62eaba19ad345d08047b00642876e43d3cc
SHA25609edc6c3460f0394af2d4bc46362d77de58d37a0ff22916e577d72d0e45e8e4c
SHA51288231d0ce69093d5a9e4131ed7954af33b0ddf5bc4588ae8aa587eb1a989b9550ef7f75fb49946ac618fe47df7586652e818f726b77cf4de089424e1b8673a95
-
C:\Program Files\Recuva\lang\lang-1060.dllFilesize
47KB
MD54cf9e3e2cee317f1882294b7258e5ee2
SHA1b32df40532b3d837373d1d634ca06108653ff089
SHA256d518e5aeecbaa3c881bfbf019a62b4859b17496617cba94c7acf54ce803dbd0a
SHA512cf75f9ee174d2a6780e4bcc220cc76e7a61d6436f333588796105b9501aa129ba69905d4fda5a0d8f1621b5c28b90ef0c9984ec81be29b377a33f782a671b06a
-
C:\Program Files\Recuva\lang\lang-1061.dllFilesize
45KB
MD59032f538fcb058974546fbb85ba59058
SHA126605ee67fe042bba1e2931b523ede0dc761511e
SHA256234a6db540db1848944d723ed7a67c7a940b71f8cc4458b6a524756b187fc42a
SHA512ec1612695cb317345931af2a78b7a8215d1f40d37b54f8980eead540085d68958a84ade88ee9558166ce31fb7963d552c53dcd35615d67e92da222b705b30e88
-
C:\Program Files\Recuva\lang\lang-1062.dllFilesize
47KB
MD51f46a3148ac60b46074d540a96253fbc
SHA1dd0e782661c4bd6d5f6bc3f740ab706bbd516a3b
SHA2569f75b93ed0825bd3a8b0d4b018aa40056528237277681f14227b8e50613ee0cb
SHA512d253117e6fbeda7e048afb858d298170b12e1f56f606e663a3960ffdb38e4bf794caa8e81d81dca59ad97f846d4889c2e204a7062e8958d845860f89ed4a17d2
-
C:\Program Files\Recuva\lang\lang-1063.dllFilesize
47KB
MD51181d1db4718742985ea81febcbda4b8
SHA156e28758390b3abfd86d45a2a75a9ae09ba1c75c
SHA256a175484bfc9c7944a4299623a38965ea7cd5eece44998001b4ca73d4c67459ba
SHA512b77951874d0aa18c4544636598f19a86bfccb9d8cc58753a188854771ea4f5351355fb6cf71544bac29208907aa5396f0e1b5af7ed302d3db6933c1ea645c6b0
-
C:\Program Files\Recuva\lang\lang-1066.dllFilesize
45KB
MD5740e75e8ca4569dfea3bebead0110da4
SHA1b5b998f59d47e91cb42d62f2215bfaa51f533263
SHA2569cd110ae75d10508ed7d994e0d517069602d60d5407b37dd9e01b1ea8e3ab56d
SHA512bb5ad285a7fcc502fe44f5bc59c763f6b44974e10d71fc59550258f7f162d90663a565b02dee29a3759e302e8b2f6f95a14adbd23c9e1dc27aaa6f78adac850d
-
C:\Program Files\Recuva\lang\lang-1067.dllFilesize
44KB
MD5e90c60b28b318b80fdf790934807d694
SHA1534033be10da65b9baa0309ff318ce6964688d95
SHA256f29c180e10221da71ac24b675e971fd3474b454029751a5cdc93f7b6186a939f
SHA51224f11959d009f6a7c85b36b64f3ef41026c8d368889bc88e8c7c6bd87b0779288c614d62c56e33176cf78e3ea23a54417d4d437d869f780e44e96881afefd0a7
-
C:\Program Files\Recuva\lang\lang-1068.dllFilesize
45KB
MD5fdd121c00d46cf347613a1533d4c0b35
SHA19ccded93f909890dc33c8accab35edcb96d51310
SHA256b2e78dd7ea53edfb602d4e6c843af474cff2cf7791d9f7983c1100bc447d514c
SHA512e4624f6fa63179af962bf96bf3247f1036e6d2ae19117b0a01cd0eaf403ceb4163d07089f7bb1eee34aafe9572dbf58c404b12198d480f8efa7827c659d398ac
-
C:\Program Files\Recuva\lang\lang-1071.dllFilesize
49KB
MD529cecf05cc41d116d01aa98147aa714a
SHA18147ee2f53b4c5a3967876a9500b0200d2a871cc
SHA256520e8f4c1a138619612b4bbacd65538cde8b6099a606d1eb409827664a0477e9
SHA512dc8f22036c33ede81fbd991936ee881d3da51fa41bc7eec964f41770f86e8cac677974a9e2defe6987217b218c374a72dc285dedfa901a5ec98b71c9b505f7b4
-
C:\Program Files\Recuva\lang\lang-1079.dllFilesize
46KB
MD5e39ef20a3f9dcdf9a87bba02fe7217c4
SHA1257b5d7b3c72e4c616464542cfbdabecca89a356
SHA256dab0bc5f85f7a6d4c71aced56d1d7014a7185cb0329a8fc52452d9a9add67d21
SHA51248046cb3560e23388a4ab249691b1d2d2647460f2b8f257b89448ee9aefd4cf93b0b7731fa0bba299f4f43985a56bb70a50d971834e079e02ed8ec12bd0967a0
-
C:\Program Files\Recuva\lang\lang-2052.dllFilesize
25KB
MD5082b024457caf398e93f8ceea8b2b05f
SHA125719da050765cfb77ec409ebcb4fac71efd802d
SHA256895abf9462d581903dad54842a99123ffda52c3cc3bf6271809e117f17583daf
SHA51290488a1fb85f99ad8430b083516691aff356aa17a9b1122607d098e8ebcd21823b6a8ce44fb7b0e646d72e7797f976061e40d3f7eb17def124b0159cdc237f1a
-
C:\Program Files\Recuva\lang\lang-2074.dllFilesize
47KB
MD51ef677941856a6cc87c42e5c54ae4e47
SHA1eaf5a9a80505ace0c7e6cd2369437bf299e6b3de
SHA25679ae97fa23b56a25ed2893a0e105a219754f1c5afa63779d525fbbc75ff49db4
SHA5127b42b12e090c705a71e71b1a4f6b5019dc5c85b488cf023b6a4ee443246fb1ca6c74ed6515d0a517b3b4a041bd870cee45c0f8fea5911177e98f80c22a60353c
-
C:\Program Files\Recuva\lang\lang-3098.dllFilesize
47KB
MD5f7ac0b30ef034606286998d71abe9bbb
SHA15a09e1cc4b83fcdca10e11c41c7c4044e909f480
SHA25642c5cb240fc3f41c1b89100a23ca395691ae248fab8a2eb293b11a2ea2465901
SHA5125d22242e4adb09085477d96cd7abdeabc214407742a4c0e3ce1d4eb11ea173fbe6b0fd6771f01d66d707f4232bc5a7916af4c98b394044d4cdb9cb277c4038fd
-
C:\Program Files\Recuva\lang\lang-5146.dllFilesize
45KB
MD52427c0f79874211461c31c5ef5d37f71
SHA17e109eac11e41973367f50d7fd3153c75918334f
SHA2563ae042317e7b1b666a9fce06a98a6972dc2a249cf9c9e73345403e72e1485e57
SHA512ae9736dea19d26f26e994cc254cf569e4726d271570c0f2a7bb0a41130a855a516d803e7348ef30353d78fc21db4b0c722ba3696a18756ecf55db6ef7fd46b28
-
C:\Program Files\Recuva\lang\lang-9999.dllFilesize
46KB
MD5eb3b78a336ddb4c9b5cc242ad26d5859
SHA10dc67d5df4ccdf3cca25bb462e354a99b585eb7a
SHA2561a633fbed97c028611b709a19fef76d4e639e72a5d09276e9fd930aaaa0e99d2
SHA5125def2c95dbd7a716d30e95ef1fd46e48c48266387e1c0337eac4c80976216965d614155ba080ac7e677b603dbcf059f4db08ed05f8444c37576bc25e590fc99a
-
C:\Program Files\Recuva\recuva64.exeFilesize
7.8MB
MD5fbc238fa96aae3fe3b9755a0f0e4e6ec
SHA1f5dd1f3bf812622bf75961e3d1125d032fa0e3cf
SHA2561fd90402820539b60da545a75e5e216c779b342d15d05b70e97432ddd20ecfc0
SHA512ce2490221ed8dd15991cc815327724965159a12c53a7c18e35277c987b28f3dcf5c694e77ad01fbe637ad7214964116302adb7f678afaddb4b1e6ea89aa77b4d
-
C:\Program Files\Recuva\recuva64.exeFilesize
7.8MB
MD5fbc238fa96aae3fe3b9755a0f0e4e6ec
SHA1f5dd1f3bf812622bf75961e3d1125d032fa0e3cf
SHA2561fd90402820539b60da545a75e5e216c779b342d15d05b70e97432ddd20ecfc0
SHA512ce2490221ed8dd15991cc815327724965159a12c53a7c18e35277c987b28f3dcf5c694e77ad01fbe637ad7214964116302adb7f678afaddb4b1e6ea89aa77b4d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.logFilesize
512KB
MD5723ffe43e3a0b8ca2a5576e165947e3b
SHA117092aa19d951234c53e182eeeebccf8f26ea97e
SHA256c72cec66fb88f0113a657fe6dd7ddc35d25658f164200e66e6bc09057f5fa13e
SHA512e2fbae8afedeaf66f9dfad2125858740476cc172f36e152357dff3ecbd518505844ee08b3784c9df068e30e24cf3dc714ce4f99626e939636f35b059eb4f8e1a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.datFilesize
14.0MB
MD5a7314de4c9d6e6b9e91bf7114ad56e05
SHA1721e76e68d164c107f0e44e85842c8e29a0621d0
SHA2562a508db55312c43e67f447e8f86f4060f042c3feec7e041aae46bcd227562f5f
SHA512d59542142f94b4466ac2b5c24793996d7130b570c68012545a397908c6bfd6a8544518ab0ecfdbc265187096b22f4c463cfe59e2cf2e348b7348216fc34b5fd4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfmFilesize
16KB
MD52973be8a177135ca598902c3c837311c
SHA17d9661ef698d1dd024eed6da179b1549d165db31
SHA25680d3cdd267bfae42a6b62eb32b17b55a8834c87f82c205f274b2b62f487efeb0
SHA512c61f52bb753159bbbce7ac35eb13bb817aa417a5bc4ceea150459fb5c555a1d0f7d7f146bcd9a0613b9de3633d5a3dbb53e9082a13eec488763315cd23f1445b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfmFilesize
16KB
MD589f288f6ce6b18134a343b9575206efd
SHA1e8108ad9029e240721b6a32efd92d1b61627db70
SHA2564a0fa622ba2db5a15757f055a7da733aeef9eb29734b380208d0d0b3206f7749
SHA51237953d91a2236788ece99301f126401c73cc9de88c25a99210c60f5a18d5d8e1f2c3f8905902bdfaf4fba3946530683d67dc3155bee04094bee308735e13bcee
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ButtonEvent.dllFilesize
5KB
MD5c24568a3b0d7c8d7761e684eb77252b5
SHA166db7f147cbc2309d8d78fdce54660041acbc60d
SHA256e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d
SHA5125d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ButtonEvent.dllFilesize
5KB
MD5c24568a3b0d7c8d7761e684eb77252b5
SHA166db7f147cbc2309d8d78fdce54660041acbc60d
SHA256e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d
SHA5125d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\System.dllFilesize
11KB
MD541a3c964232edd2d7d5edea53e8245cd
SHA176d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA2568b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\System.dllFilesize
11KB
MD541a3c964232edd2d7d5edea53e8245cd
SHA176d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA2568b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\System.dllFilesize
11KB
MD541a3c964232edd2d7d5edea53e8245cd
SHA176d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA2568b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\UserInfo.dllFilesize
4KB
MD5c1f778a6d65178d34bde4206161a98e0
SHA129719fffef1ab6fe2df47e5ed258a5e3b3a11cfc
SHA2569caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87
SHA5129c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\UserInfo.dllFilesize
4KB
MD5c1f778a6d65178d34bde4206161a98e0
SHA129719fffef1ab6fe2df47e5ed258a5e3b3a11cfc
SHA2569caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87
SHA5129c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\UserInfo.dllFilesize
4KB
MD5c1f778a6d65178d34bde4206161a98e0
SHA129719fffef1ab6fe2df47e5ed258a5e3b3a11cfc
SHA2569caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87
SHA5129c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\g\gcapi_dll.dllFilesize
348KB
MD52973af8515effd0a3bfc7a43b03b3fcc
SHA14209cded0caac7c5cb07bcb29f1ee0dc5ac211ee
SHA256d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
SHA512b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\g\gcapi_dll.dllFilesize
348KB
MD52973af8515effd0a3bfc7a43b03b3fcc
SHA14209cded0caac7c5cb07bcb29f1ee0dc5ac211ee
SHA256d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
SHA512b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\g\gcapi_dll.dllFilesize
348KB
MD52973af8515effd0a3bfc7a43b03b3fcc
SHA14209cded0caac7c5cb07bcb29f1ee0dc5ac211ee
SHA256d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0
SHA512b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\inetc.dllFilesize
23KB
MD57760daf1b6a7f13f06b25b5a09137ca1
SHA1cc5a98ea3aa582de5428c819731e1faeccfcf33a
SHA2565233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
SHA512d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\inetc.dllFilesize
23KB
MD57760daf1b6a7f13f06b25b5a09137ca1
SHA1cc5a98ea3aa582de5428c819731e1faeccfcf33a
SHA2565233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
SHA512d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\inetc.dllFilesize
23KB
MD57760daf1b6a7f13f06b25b5a09137ca1
SHA1cc5a98ea3aa582de5428c819731e1faeccfcf33a
SHA2565233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
SHA512d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\nsDialogs.dllFilesize
9KB
MD52aba8f16eca82517460013a3de7cbf67
SHA13812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA25660b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA5124e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\nsDialogs.dllFilesize
9KB
MD52aba8f16eca82517460013a3de7cbf67
SHA13812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA25660b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA5124e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\nsDialogs.dllFilesize
9KB
MD52aba8f16eca82517460013a3de7cbf67
SHA13812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA25660b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA5124e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\nsDialogs.dllFilesize
9KB
MD52aba8f16eca82517460013a3de7cbf67
SHA13812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA25660b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA5124e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\nsDialogs.dllFilesize
9KB
MD52aba8f16eca82517460013a3de7cbf67
SHA13812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA25660b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA5124e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\nsDialogs.dllFilesize
9KB
MD52aba8f16eca82517460013a3de7cbf67
SHA13812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA25660b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
SHA5124e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\p\InstallerHelper.dllFilesize
3.0MB
MD569fe0f183fa7b8eb6c9a55cb2ff93f7a
SHA11f8a64ac55a031a829f1b1b695a6933ce42f7692
SHA2564ac7b7d19ba91de4aaf02629035a44df5d346f45ec7dcf5ada2bf644265f66a0
SHA512a153d662fdb74dec9cfed138a590f17403571e3554d99d448c50abdc04f19b2f5d35ac40808012861b2875d93d6a31871ef3efb3465893f77bdd52e66c4b6523
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\p\InstallerHelper.dllFilesize
3.0MB
MD569fe0f183fa7b8eb6c9a55cb2ff93f7a
SHA11f8a64ac55a031a829f1b1b695a6933ce42f7692
SHA2564ac7b7d19ba91de4aaf02629035a44df5d346f45ec7dcf5ada2bf644265f66a0
SHA512a153d662fdb74dec9cfed138a590f17403571e3554d99d448c50abdc04f19b2f5d35ac40808012861b2875d93d6a31871ef3efb3465893f77bdd52e66c4b6523
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ui\pfUI.dllFilesize
13.6MB
MD51bfa036321fcb209564549538345a289
SHA18ede722a5cc6135847ad5276f30143022fa7bacf
SHA256547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e
SHA5129729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ui\pfUI.dllFilesize
13.6MB
MD51bfa036321fcb209564549538345a289
SHA18ede722a5cc6135847ad5276f30143022fa7bacf
SHA256547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e
SHA5129729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ui\res\Montserrat-Regular.otfFilesize
44KB
MD527e50ffd6a14cbc8221c9dbd3b5208dc
SHA1713c997ce002a4d8762c2dcc405213061233e4bc
SHA25640fc1142200a5c1c18f80b6915257083c528c7f7fd2b00a552aeebc42898d428
SHA5120a602f88cfba906b41719943465edb09917c447d746bfed5c9ce9c75d077f6aed2f8146697acd74557359f1ae267ca2a8e3a2ca40fb1633bde8e6114261abd90
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ui\res\PF_logo.pngFilesize
3KB
MD5079cca30760cca3c01863b6b96e87848
SHA198c2ca01f248bc61817db7e5faea4a3d8310db50
SHA2568dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa
SHA5123e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ui\res\RC_Computer.pngFilesize
82KB
MD567f13e50fa75087ef8c2074a52cc8bb1
SHA18f31cf48fab91b9e263105289d17c146d088274b
SHA256044ec2d36e9f573d762fc8a43eb09f7b24eb30094a4e61b5d606fd96f72d391f
SHA51244ee943ae440d93d7ec78393749667680abbe379f9e21fb10244362c2c3f9df790170c541aa30a8487ef25952068c78e44dacd48def29aa84cee78d1c1ce63ae
-
C:\Users\Admin\AppData\Local\Temp\nsj8573.tmp\ui\res\Recuva_Logo_72px.pngFilesize
9KB
MD56a2e01749e591a1ce8216daed41b8721
SHA1a4aa31d936a33eb7d58e809b738184f6b2c7e1c2
SHA256f72782600989eff0aa13ff7c63875538c9042c32b77862475c899514f61c9290
SHA512262e6b6ed89fa30f954dc73c1bb329d9ea256fefa172e12b23610e7c1ab6dad3b698cbcdc010f8c16e90b0bdd6e96d60e8aba50b876d69f9fb1f2889ac14f0fe
-
memory/1768-245-0x0000000004040000-0x0000000004050000-memory.dmpFilesize
64KB
-
memory/1768-272-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/1768-275-0x0000000007140000-0x0000000007148000-memory.dmpFilesize
32KB
-
memory/1768-276-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/1768-278-0x0000000007140000-0x0000000007148000-memory.dmpFilesize
32KB
-
memory/1768-281-0x0000000007130000-0x0000000007138000-memory.dmpFilesize
32KB
-
memory/1768-284-0x00000000070F0000-0x00000000070F1000-memory.dmpFilesize
4KB
-
memory/1768-274-0x0000000007420000-0x0000000007428000-memory.dmpFilesize
32KB
-
memory/1768-271-0x0000000007430000-0x0000000007438000-memory.dmpFilesize
32KB
-
memory/1768-306-0x00000000070F0000-0x00000000070F1000-memory.dmpFilesize
4KB
-
memory/1768-302-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/1768-299-0x0000000007220000-0x0000000007228000-memory.dmpFilesize
32KB
-
memory/1768-298-0x0000000007220000-0x0000000007228000-memory.dmpFilesize
32KB
-
memory/1768-269-0x00000000073A0000-0x00000000073A8000-memory.dmpFilesize
32KB
-
memory/1768-296-0x00000000071E0000-0x00000000071E8000-memory.dmpFilesize
32KB
-
memory/1768-251-0x0000000006330000-0x0000000006340000-memory.dmpFilesize
64KB