File name:

recuva.exe

Full analysis: https://app.any.run/tasks/a8828551-9431-423b-aa22-42e08e9af292
Verdict: Malicious activity
Analysis date: January 14, 2024, 10:52:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

5FFB412044B8BFBCDA9DAB78CF4E8AC5

SHA1:

D4E81D90CEAF8179A8B8F112CFA310EC89106DD0

SHA256:

B3DF198D64BA6F401611F56743BD344C1B02915F9E5D571D271EF8557FEAF56C

SSDEEP:

393216:V3TXUxgTaSvLn5I2SriMY4+4I1uEkkTF:VA4ah2sD1+cwF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • recuva.exe (PID: 2268)

    • Registers / Runs the DLL via REGSVR32.EXE

      • recuva.exe (PID: 2268)

    • Drops the executable file immediately after the start

      • recuva.exe (PID: 2268)

    • Actions looks like stealing of personal data

      • recuva.exe (PID: 2268)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • recuva.exe (PID: 2268)

    • Reads browser cookies

      • recuva.exe (PID: 2268)

    • Reads security settings of Internet Explorer

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1540)

    • Reads settings of System Certificates

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1540)

    • Reads the Internet Settings

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1540)

    • Searches for installed software

      • recuva.exe (PID: 2268)

    • Checks Windows Trust Settings

      • recuva.exe (PID: 1540)
      • recuva.exe (PID: 2268)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2440)

    • Reads Internet Explorer settings

      • recuva.exe (PID: 1540)
      • recuva.exe (PID: 2268)

    • The process creates files with name similar to system file names

      • recuva.exe (PID: 2268)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • recuva.exe (PID: 2268)

  • INFO

    • Reads the computer name

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1540)
      • recuva.exe (PID: 1848)

    • Checks supported languages

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1848)
      • recuva.exe (PID: 1540)

    • Creates files in the program directory

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1540)

    • Creates files or folders in the user directory

      • recuva.exe (PID: 2268)

    • Checks proxy server information

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1540)

    • Reads the machine GUID from the registry

      • recuva.exe (PID: 2268)
      • recuva.exe (PID: 1540)

    • Create files in a temporary directory

      • recuva.exe (PID: 2268)

    • Application launched itself

      • msedge.exe (PID: 1544)
      • msedge.exe (PID: 2112)

    • Manual execution by a user

      • msedge.exe (PID: 2112)

    • Reads product name

      • recuva.exe (PID: 1540)

    • Reads Environment values

      • recuva.exe (PID: 1540)
      • recuva.exe (PID: 2268)

    • Reads CPU info

      • recuva.exe (PID: 1540)

    • Dropped object may contain TOR URL's

      • recuva.exe (PID: 2268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:26 00:04:50+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 428544
UninitializedDataSize: 16384
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.53.0.2096
ProductVersionNumber: 1.53.0.2096
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Piriform Software Ltd
FileDescription: Recuva Installer
FileVersion: 1.53.0.2096
LegalCopyright: Copyright © 2006-2023 Piriform Software Ltd
ProductName: Recuva
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
21
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start recuva.exe regsvr32.exe no specs recuva.exe no specs msedge.exe no specs recuva.exe msedge.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs recuva.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1568 --field-trial-handle=1316,i,15357518529482305407,873872913985724101,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
900"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1316,i,15357518529482305407,873872913985724101,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1408"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1316,i,15357518529482305407,873872913985724101,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1540"C:\Program Files\Recuva\recuva.exe" C:\Program Files\Recuva\recuva.exe
recuva.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
Recuva
Exit code:
0
Version:
1.53.0.2096
Modules
Images
c:\program files\recuva\recuva.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1544"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ccleaner.com/go/app_releasenotes?p=2&v=1.53.2096&l=1033&b=1&a=0C:\Program Files\Microsoft\Edge\Application\msedge.exe—recuva.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1848"C:\Program Files\Recuva\recuva.exe" /installationComplete "bin|folders|allusers"C:\Program Files\Recuva\recuva.exe—recuva.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
Recuva
Exit code:
0
Version:
1.53.0.2096
Modules
Images
c:\program files\recuva\recuva.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2044"C:\Users\admin\AppData\Local\Temp\recuva.exe" C:\Users\admin\AppData\Local\Temp\recuva.exe—explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
MEDIUM
Description:
Recuva Installer
Exit code:
3221226540
Version:
1.53.0.2096
Modules
Images
c:\users\admin\appdata\local\temp\recuva.exe
c:\windows\system32\ntdll.dll
2112"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.ccleaner.com/go/app_releasenotes?p=2&v=1.53.2096&l=1033&b=1&a=0C:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2128regsvr32.exe /I "C:\Program Files\Recuva\RecuvaShell.dll" /sC:\Windows\System32\regsvr32.exe—recuva.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2268"C:\Users\admin\AppData\Local\Temp\recuva.exe" C:\Users\admin\AppData\Local\Temp\recuva.exe
explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
Recuva Installer
Exit code:
0
Version:
1.53.0.2096
Modules
Images
c:\users\admin\appdata\local\temp\recuva.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
10 673
Read events
10 561
Write events
112
Delete events
0

Modification events

(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2268) recuva.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2268) recuva.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2268) recuva.exeKey:HKEY_USERS\.DEFAULT\Software\Piriform\Recuva
Operation:writeName:Language
Value:
1033
Executable files
104
Suspicious files
112
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\UserInfo.dllexecutable
MD5:2F69AFA9D17A5245EC9B5BB03D56F63C
SHA256:E54989D2B83E7282D0BEC56B098635146AAB5D5A283F1F89486816851EF885A0
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\lang-1031.dllexecutable
MD5:265BE91935B61C63CBA03F4B7F05CF7F
SHA256:7C357F11264C03E881CD604B3E8D1D36EFF1CC0BF0F9728E478B178C25A962DE
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\PF_logo.pngimage
MD5:079CCA30760CCA3C01863B6B96E87848
SHA256:8DD37D3721E25C32C5BF878B6DBA9E61D04B7CE8AEC45BDF703A41BC41802DFA
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\lang-1049.dllexecutable
MD5:5966407028D5712AE7EE5D874908C97A
SHA256:A5B7DD96329547EA34358D4F64E57908CFB6BD06CF78E2CB6DB33F9C1870A2E9
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\pfUI.dllexecutable
MD5:F7222368C66E02EE333E6FCA4FDCCB66
SHA256:B09F1359C68947C7D13123DDA3AB56360B982BEFB43C134BE815934ED4879215
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\lang-1053.dllexecutable
MD5:1181929E3ECDADED7B5526C2084CF7EC
SHA256:B1B96DABB98F5C3C0238CCC964F03E9B03885AE551146AA90E547958A2E4F14E
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\lang-1045.dllexecutable
MD5:A067AA2BF30758D3D09B34E9B8183077
SHA256:D38466C9213410B0696A48F8D2D157F42939C38A14640C5C8D8ED410855B13FD
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\lang-1028.dllexecutable
MD5:DE8DCF8665FBF2125E03E13FA0AF7E5C
SHA256:636075AF19D92AFD327FE831B28836C1FD196D10279F0FA046B6E0DE870C5A0F
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\lang-1044.dllexecutable
MD5:ED87EB680F9D852195DA551B84AFB425
SHA256:9ECBF11A016F8151C671F79CCFC61B28484DE18D1DD3E85ABB46B703EDDB8446
2268recuva.exeC:\Users\admin\AppData\Local\Temp\nsc146.tmp\ui\res\lang-1036.dllexecutable
MD5:ADBCA31238C5BDB2B100FD0677D81090
SHA256:AC082917E481081C653D2E897DD6A0B58E4AC7CBF42B17AD45D7B281CA9A423A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
67
DNS requests
96
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
488
lsass.exe
GET
200
23.53.41.251:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fa455765e490287c
unknown
compressed
4.66 Kb
unknown
1540
recuva.exe
GET
301
23.206.209.82:80
http://www.ccleaner.com/auto?p=rc&v=1.53.2096&l=1033&a=0&lk=&mk=IH82-8AEJ-BB4F-FSU3-EWAI-2TTB-7NKN-5AZH-HZ8S&o=6.1W3
unknown
—
—
unknown
—
—
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2268
recuva.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
—
—
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
binary
724 b
unknown
—
—
GET
200
142.250.185.163:80
http://ocsp.pki.goog/s/gts1d4/91LZUgfONYY/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDbZTnFanxDPwpP%2Boz3GV%2FE
unknown
binary
472 b
unknown
900
msedge.exe
GET
301
23.206.209.82:80
http://www.ccleaner.com/go/app_releasenotes?p=2&v=1.53.2096&l=1033&b=1&a=0
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2268
recuva.exe
34.117.223.223:443
analytics.ff.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
488
lsass.exe
23.53.41.251:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
488
lsass.exe
142.250.185.163:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2268
recuva.exe
23.45.96.145:443
service.piriform.com
AKAMAI-AS
DE
unknown
2268
recuva.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1540
recuva.exe
34.117.223.223:443
analytics.ff.avast.com
GOOGLE-CLOUD-PLATFORM
US
unknown
1540
recuva.exe
23.206.209.82:80
www.ccleaner.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
analytics.ff.avast.com
  • 34.117.223.223
whitelisted
ctldl.windowsupdate.com
  • 23.53.41.251
  • 23.53.42.16
  • 23.53.41.249
  • 23.53.41.242
  • 23.53.42.26
  • 23.53.42.41
  • 23.53.42.25
  • 23.53.42.66
  • 23.53.41.250
whitelisted
ocsp.pki.goog
  • 142.250.185.163
whitelisted
service.piriform.com
  • 23.45.96.145
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
license.piriform.com
  • 23.45.96.145
whitelisted
www.ccleaner.com
  • 23.206.209.82
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
cdn.cookielaw.org
  • 104.18.131.236
  • 104.18.130.236
whitelisted

Threats

PID
Process
Class
Message
1540
recuva.exe
Misc activity
ET POLICY Recuva File Recovery Software - Observed User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
recuva.exe