home

rcsetup149.exe

Recuva

Piriform Ltd

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This file is installed with the program Recuva. The file has been seen being downloaded from www.filehippo.com and multiple other hosts.
Publisher:
Piriform Ltd  (signed and verified)

Product:
Recuva

Description:
Recuva Installer

Version:
1.0.0.0

MD5:
c8014185e0e072bfb5778f09d1291642

SHA-1:
f7511d8f7e2d032a517a400eea63374798ff4bb0

SHA-256:
2165adc24dc4d7deb4d33163e5ed304a473fb12ae754bc2179ef6906cf77df51

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
4/26/2024 1:23:18 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Bundled.Toolbar.Google
7.9180

Vba32 AntiVirus
Malware-Cryptor.Win32.General.4
3.12.24.3

File size:
3.8 MB (3,992,416 bytes)

Copyright:
Copyright © 2006-2013 Piriform Ltd

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\rcsetup149.exe

Digital Signature
Signed by:
Piriform Ltd

Authority:
VeriSign, Inc.

Valid from:
6/24/2013 5:00:00 PM

Valid to:
9/24/2015 4:59:59 PM

Subject:
CN=Piriform Ltd, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Piriform Ltd, L=London, S=London, C=GB

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
785AF6D521F67E132D53385742CE9B35

File PE Metadata
Compilation timestamp:
2/24/2012 11:19:59 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:t3gEsghjr+KIPgoeOQbCCJFRkcpYUrCcCwHwOjcBFWMcxY:t3/phf+KegfOQ+CJbkSBQOjIFaY

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Entropy:
7.9954

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file rcsetup149.exe has been discovered within the following program.

Recuva  by Piriform
Recuva is a data recovery program and is able to recover files that have been "permanently" deleted and marked by the operating system as free space.
www.piriform.com/recuva
8% remove it
 
Powered by Should I Remove It?

The file rcsetup149.exe has been seen being distributed by the following 50 URLs.

http://www.filehippo.com/download/file/.../

http://fs13.filehippo.com/4852/.../rcsetup149.exe

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/es/download/file/.../

http://filehippo.com/download/file/.../

http://www.filehippo.com/pl/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://filehippo.com/pl/download/file/.../

http://www.filehippo.com/es/download/file/.../

https://www.dropbox.com/s/.../rcsetup149.exe

http://www.filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://www.filehippo.com/download/file/.../

http://recuva.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/trmsvRChbxdrflJq3ZIylWvGBwIpOyJQHULsGkn/5HGzfdnWqxccihnG5l29VD27XNhp07D5Ack6W2VUkEUX83BdiBsP7g/.../KfxC1qM6JrY=

http://fs41.filehippo.com/5905/.../rcsetup149.exe

Latest 30 of 188 download URLs

Scan rcsetup149.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.