home

windows-password-recovery-bootdisk-5-1-build-5-1-0-2-32-bits.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from www.ranchsendgift.com and multiple other hosts.
MD5:
1f28582937cd17344bd1a91a9ae6ef74

SHA-1:
6df74452a86e207fc543510d5f8c1f0c3082af16

SHA-256:
52594f8e566adc297ef4867decce132a3726984aa89d4e9a7795b776253ef1ca

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
6/23/2025 11:54:44 AM UTC  (today)

File size:
11.7 MB (12,285,310 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\windows-password-recovery-bootdisk-5-1-build-5-1-0-2-32-bits.exe

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
196608:IYmdtsJVuIoidC9KSI4gbMKWx+ZeA7dv8b4M/AjMi3gPWNKawg21HzDI+tEkQgS:IjidEdjPKWojvSji3kawg21HzDItkQr

Entry point:
50, 4B, 03, 04, 14, 00, 00, 00, 08, 00, E3, 8C, 63, 45, F6, A4, A0, B1, DD, 72, BB, 00, 3C, D2, BB, 00, 0E, 00, 00, 00, 42, 6F, 6F, 74, 44, 69, 73, 6B, 35, 31, 2E, 65, 78, 65, EC, FD, 07, 5C, 14, CB, D3, 30, 0A, CF, B2, 0B, 2C, B0, 08, 0A, E6, 84, 8A, 11, 51, 10, 33, A0, A4, 45, 54, 50, 24, 98, 13, 0A, 08, 48, 12, 76, 15, 15, 14, 5C, 51, 96, 11, C5, 70, CC, 39, A7, A3, 18, 8E, 22, 26, 60, 11, 44, 51, 11, 13, 66, CC, 83, 8B, 8A, 88, 02, 82, EC, 57, D5, 33, 0B, A8, C7, FF, F3, 3C, EF, 77, BF, FB, DE, FB, FB...
 
[+]

The file windows-password-recovery-bootdisk-5-1-build-5-1-0-2-32-bits.exe has been seen being distributed by the following 3 URLs.

http://www.ranchsendgift.com/qzMAxq7JoqvLSPynUEeVXGh2abpe QU97UZ7Qg7IYpm wQ26MgWBLvuiCuNdNvTrFJf2dcaVXXTxyTmfcjuwCuj0p1b8lHoA76ePxL3AlMgv3ujisn65fiMjHDag63xgSYBRPhYpCaAf4AHFp4BbrHjJw9 aOR_tz5waCWTq9be5w6sN6dE19K37I3j_lPydkBvfYLWZjtHHGGtxJDsgwy B1EoXNhfpi0bqgWFvR4_a wKjVqM=-GyoAAMRTFhs1CTbBpO_gkAP2bw8SDDTYGDtXMCTfmPFvvmg24ZaNE9zwLg==

http://d210.cdn.m6web.fr/soft/.../windows-password-recovery-bootdisk_5-1-0-2_en_224812.zip?st=xvV7J74kWNiGJE6Ig6z1bg&e=1470938979

http://www.rixler.com/.../bootdisk.zip

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.