File name:

recuva-portable.exe

Full analysis: https://app.any.run/tasks/df77dae0-263b-4296-84b8-c00fb7c6d805
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 28, 2025, 18:33:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

264474AE9B9FD039AC0C113F88F7BD2D

SHA1:

4A3CDBD119BB149FFD96BAB9DDDB768E505460B0

SHA256:

75155568D64E958D8003F9FBB36839FC9A53BFAB3B51A8A1106A78E5BE98B2E9

SSDEEP:

98304:+wTlDCSkHS5PmyHZhMFdnr7lZI4jum8h0AYbg9o7iER1LcKn/qPP:+w1CST35hMnHI4jf5zbg9scrP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • recuva-portable.exe (PID: 6516)

    • Steals credentials from Web Browsers

      • recuva-portable.exe (PID: 6748)

    • Actions looks like stealing of personal data

      • recuva-portable.exe (PID: 6748)

    • Registers / Runs the DLL via REGSVR32.EXE

      • recuva-portable.exe (PID: 6748)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • recuva-portable.exe (PID: 6748)

    • Searches for installed software

      • recuva-portable.exe (PID: 6748)

    • Reads Internet Explorer settings

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)

    • Reads security settings of Internet Explorer

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6884)

    • Checks Windows Trust Settings

      • recuva64.exe (PID: 1580)
      • recuva-portable.exe (PID: 6748)

    • Executable content was dropped or overwritten

      • recuva-portable.exe (PID: 6748)

    • Creates a software uninstall entry

      • recuva-portable.exe (PID: 6748)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6812)

  • INFO

    • Reads Environment values

      • recuva-portable.exe (PID: 6748)
      • identity_helper.exe (PID: 7496)
      • identity_helper.exe (PID: 2280)

    • The sample compiled with english language support

      • recuva-portable.exe (PID: 6748)

    • Reads the software policy settings

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)

    • Reads the computer name

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)
      • recuva64.exe (PID: 6864)
      • identity_helper.exe (PID: 7496)
      • identity_helper.exe (PID: 2280)

    • Checks supported languages

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)
      • recuva64.exe (PID: 6864)
      • identity_helper.exe (PID: 2280)

    • Checks proxy server information

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)

    • Create files in a temporary directory

      • recuva-portable.exe (PID: 6748)

    • Reads the machine GUID from the registry

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)

    • Process checks computer location settings

      • recuva-portable.exe (PID: 6748)

    • Application launched itself

      • msedge.exe (PID: 3144)
      • msedge.exe (PID: 4144)

    • Creates files in the program directory

      • recuva64.exe (PID: 1580)
      • recuva-portable.exe (PID: 6748)

    • Creates files or folders in the user directory

      • recuva-portable.exe (PID: 6748)
      • recuva64.exe (PID: 1580)

    • Reads CPU info

      • recuva64.exe (PID: 1580)

    • Manual execution by a user

      • msedge.exe (PID: 4144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:12:29 21:34:49+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 29696
InitializedDataSize: 441856
UninitializedDataSize: 16896
EntryPoint: 0x3a1c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Piriform Ltd
FileDescription: Recuva Installer
FileVersion: 1.0.0.0
LegalCopyright: Copyright © 2006-2016 Piriform Ltd
ProductName: Recuva
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
208
Monitored processes
71
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start recuva-portable.exe ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs regsvr32.exe no specs regsvr32.exe no specs recuva64.exe no specs msedge.exe no specs recuva64.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs recuva-portable.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7516 --field-trial-handle=2248,i,43361475650823292,1131793144584682988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1220"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7372 --field-trial-handle=2248,i,43361475650823292,1131793144584682988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1304"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6660 --field-trial-handle=2248,i,43361475650823292,1131793144584682988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8208 --field-trial-handle=2248,i,43361475650823292,1131793144584682988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1520ping -n 1 -w 5000 www.piriform.comC:\Windows\SysWOW64\PING.EXE—recuva-portable.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1544"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=8352 --field-trial-handle=2248,i,43361475650823292,1131793144584682988,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
1580"C:\Program Files\Recuva\recuva64.exe" C:\Program Files\Recuva\recuva64.exe
recuva-portable.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
HIGH
Description:
Recuva
Version:
1.53.0.1087
Modules
Images
c:\program files\recuva\recuva64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1920"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2352 --field-trial-handle=2356,i,10370654653798990593,4674453927979933616,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1988"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8356 --field-trial-handle=2248,i,43361475650823292,1131793144584682988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
2120"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7340 --field-trial-handle=2248,i,43361475650823292,1131793144584682988,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Total events
11 190
Read events
11 104
Write events
82
Delete events
4

Modification events

(PID) Process:(6748) recuva-portable.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Google Toolbar
Operation:writeName:test
Value:
test
(PID) Process:(6748) recuva-portable.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Google Toolbar
Operation:delete valueName:test
Value:
test
(PID) Process:(6748) recuva-portable.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Google Toolbar
Operation:delete keyName:(default)
Value:
(PID) Process:(6748) recuva-portable.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(6748) recuva-portable.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(6748) recuva-portable.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\recuva.exe
Operation:writeName:Path
Value:
C:\Program Files\Recuva
(PID) Process:(6748) recuva-portable.exeKey:HKEY_USERS\temp.key\SOFTWARE\Piriform\Recuva
Operation:writeName:Language
Value:
1033
(PID) Process:(6884) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Operation:writeName:{435E5DF5-2510-463C-B223-BDA47006D002}
Value:
RecuvaShellExt
(PID) Process:(6884) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\RecuvaShell.DLL
Operation:writeName:AppID
Value:
{80109467-DE5A-42A1-9445-7E3952C80B6E}
(PID) Process:(6884) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{435E5DF5-2510-463C-B223-BDA47006D002}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
Executable files
115
Suspicious files
217
Text files
48
Unknown types
0

Dropped files

PID
Process
Filename
Type
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\p\syschk.dllexecutable
MD5:42FB0C5333071B1F4B04587B4E38353E
SHA256:D39C9C47075C0BD297AFFB3E5DC73B23EEE3A9E83B1E209359BDF64A620C8792
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\System.dllexecutable
MD5:41A3C964232EDD2D7D5EDEA53E8245CD
SHA256:8B65FEC615C7B371C23F8F7F344B12DC5085E40A556F96DB318ED757494D62D5
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\g\gcapi_dll.dllexecutable
MD5:2973AF8515EFFD0A3BFC7A43B03B3FCC
SHA256:D0E4581210A22135CE5DEB47D9DF4D636A94B3813E0649AAB84822C9F08AF2A0
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\ui\res\Recuva_Logo_72px.pngimage
MD5:6A2E01749E591A1CE8216DAED41B8721
SHA256:F72782600989EFF0AA13FF7C63875538C9042C32B77862475C899514F61C9290
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\p\pfWWW.dllexecutable
MD5:CB1D8D51ABC47FCF036A8AAC36C5F4AA
SHA256:903EBBD07A9D551E41BA8CF581069E5E1C70894D2E6473C009B8CED94E8C0D2F
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\ui\res\lang-1031.dllexecutable
MD5:9AACC044FD82F2FFD928403E86F70C35
SHA256:6FD3123FD744501963F2A62882980191A1536821A9337743B675E09AD305C204
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\nsExec.dllexecutable
MD5:5ED60250F74FA36A5A247A715BCD026E
SHA256:EA8026766ADC2D7CC26E2206CFDF5F0865B1426BFE3BC2AEC8F43D3FC9A072EF
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\ui\pfUI.dllexecutable
MD5:4406A985E08F66B8921DCE39FD3E7A2D
SHA256:8FBCA8477B43EF3877D3CA6CD7C077FADC46C5C45ADB78725449A194D064AE11
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\ui\res\RC_Computer.pngimage
MD5:67F13E50FA75087EF8C2074A52CC8BB1
SHA256:044EC2D36E9F573D762FC8A43EB09F7B24EB30094A4E61B5D606FD96F72D391F
6748recuva-portable.exeC:\Users\admin\AppData\Local\Temp\nsz6259.tmp\ui\res\PF_logo.pngimage
MD5:079CCA30760CCA3C01863B6B96E87848
SHA256:8DD37D3721E25C32C5BF878B6DBA9E61D04B7CE8AEC45BDF703A41BC41802DFA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
141
DNS requests
147
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6748
recuva-portable.exe
GET
302
104.82.100.9:80
http://service.piriform.com/installcheck.aspx?p=2&v=1.53.1087&vx=&l=1033&b=1&o=10W6&g=0&i=1&a=0&c=0&d=0&e=0&n=recuva-portable.exe&id=003
unknown
—
—
whitelisted
6748
recuva-portable.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
1580
recuva64.exe
GET
200
2.17.189.192:80
http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEEtIsnyCJP43sXpqLteoHJ8%3D
unknown
—
—
unknown
1580
recuva64.exe
GET
200
2.17.189.192:80
http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D
unknown
—
—
whitelisted
1580
recuva64.exe
GET
200
2.17.189.192:80
http://s1.symcb.com/pca3-g5.crl
unknown
—
—
whitelisted
1580
recuva64.exe
GET
200
2.17.189.192:80
http://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEEtIsnyCJP43sXpqLteoHJ8%3D
unknown
—
—
unknown
1580
recuva64.exe
GET
200
2.17.189.192:80
http://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D
unknown
—
—
whitelisted
1580
recuva64.exe
GET
200
2.17.189.192:80
http://sv.symcb.com/sv.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
95.100.110.72:443
www.bing.com
Akamai International B.V.
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
6748
recuva-portable.exe
23.201.241.99:443
www.piriform.com
AKAMAI-AS
CH
whitelisted
6748
recuva-portable.exe
104.82.100.9:80
www.piriform.com
AKAMAI-AS
DE
whitelisted
6748
recuva-portable.exe
104.82.100.9:443
www.piriform.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 95.100.110.72
  • 95.100.110.91
  • 2.16.204.135
  • 2.16.204.156
  • 2.16.204.146
  • 2.16.204.143
  • 2.16.204.152
  • 2.16.204.141
  • 2.16.204.138
  • 2.16.204.151
  • 2.16.204.160
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.2
whitelisted
go.microsoft.com
  • 184.28.89.167
  • 23.56.254.14
whitelisted
www.piriform.com
  • 23.201.241.99
  • 104.82.100.9
whitelisted
service.piriform.com
  • 104.82.100.9
whitelisted
license.piriform.com
  • 104.82.100.9
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
s2.symcb.com
  • 2.17.189.192
whitelisted
s1.symcb.com
  • 2.17.189.192
whitelisted

Threats

PID
Process
Class
Message
1580
recuva64.exe
Misc activity
ET INFO Recuva File Recovery Software - Observed User-Agent
1580
recuva64.exe
Misc activity
ET INFO Recuva File Recovery Software - Observed User-Agent
7124
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
7124
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
7124
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
recuva-portable.exe