» edpr_server.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

edpr_server.exe

Elcomsoft Distributed Password Recovery

ElcomSoft

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘ElcomSoft DPR Server’. This is installed with Elcomsoft Distributed Password Recovery.

File name:

edpr_server.exe

Publisher:

Elcomsoft Co. Ltd. (signed by ElcomSoft)

Product:

Elcomsoft Distributed Password Recovery

Description:

Elcomsoft Distributed Password Recovery Server

Version:

2.99.544

MD5:

dd969b18a0996afbfb4f7320e2368fec

SHA-1:

6cebd91aa4e8b922c7fd47c0473177babe880072

SHA-256:

dcd6b7b15504033641255be831b6c09631364fc52f0da106e9ec00ba08112f0e

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/27/2024 2:34:58 AM UTC (today)

File size:

479.2 KB (490,664 bytes)

Product version:

2.99.544

Trademarks:

Elcomsoft is a registered trademark of Elcomsoft Co. Ltd.

Original file name:

edpr_server.exe

File type:

Executable application (Win32 EXE)

Common path:

C:\Program Files\elcomsoft password recovery\distributed password recovery\edpr_server.exe

Digital Signature

Signed by:

ElcomSoft

Authority:

COMODO CA Limited

Valid from:

9/26/2012 4:00:00 AM

Valid to:

9/27/2015 3:59:59 AM

Subject:

CN=ElcomSoft, O=ElcomSoft, STREET="Bolshaya Serpuhovskaya"" Street, 44, OF.19", L=Moscow, S=N/A, PostalCode=115093, C=RU

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

1748F43D845D4B8E655BA399F2F7EF9F

File PE Metadata

Compilation timestamp:

3/28/2014 3:25:14 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

12288:PsbN53fk9PoKCvwEh1+BLVMYRCwqiKQhH1Zr:Qxc96vnuUwqi/d1

Entry address:

0xADB6E14

Entry point:

E8, 5D, EC, FF, FF, A4, 6E, 23, 46, 43, CF, A6, 1E, 8D, 86, 6F, B4, C6, 17, DB, F5, 99, 09, 9B, 72, 98, B3, 1C, 76, 26, EB, 75, 57, 9B, 82, B4, 5F, C6, CB, 5E, A3, 10, 21, AE, 52, 75, C4, AF, 64, 1E, AF, 94, CA, 91, A6, 29, 4D, 2A, 15, 3B, FB, 96, A4, 1F, 29, 3A, 92, 44, B9, C6, 64, 98, 39, 73, C4, E8, 2B, 74, FD, 2E, 70, 89, 17, 4F, 44, 32, 48, F9, 33, 6C, F3, CF, B5, 5B, CC, 68, 20, 62, D1, 7F, A5, C9, 6E, D6, C1, 91, 2F, A5, 92, A2, 52, 94, 60, 6A, 34, 95, AA, D8, B4, 9C, 00, AF, 30, 07, 07, 76, 69, 42... 
[+]

Code size:

301 KB (308,224 bytes)

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

ElcomSoft DPR Server

Command:

C:\Program Files\elcomsoft password recovery\distributed password recovery\edpr_server.exe

The file edpr_server.exe has been discovered within the following program.

Elcomsoft Distributed Password Recovery by ElcomSoft Co. Ltd.

Publisher's description - “High-performance distributed password recovery for forensic and government agencies, password recovery and data recovery services and corporations. Recover the most complex passwords and strong encryption in realistic timeframes.”

www.elcomsoft.com/edpr.html

11% remove it

Scan edpr_server.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.