home

datarescueprofessional.exe

DataRescueProfessional

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from en.softonic.com and multiple other hosts.
Publisher:
DataRescueProfessional

Product:
DataRescueProfessional

Description:
DataRescueProfessional Setup

Version:
3.4.0.151

MD5:
a1450ac846c990762f9e1821a25cb007

SHA-1:
1acba4dddc38ee380a65bef2894ec8f84c6806d6

SHA-256:
f406844fc95f597c2abe7e99b219b1a3ed2bed13fc1b0386b2d893ffc18642d3

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 5:22:19 PM UTC  (today)

File size:
1.7 MB (1,746,974 bytes)

Product version:
3.4.0.151

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\datarescueprofessional.exe

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:O9/DQTocmC94cDarZwxKwCakHMVBA1B102PUzu5q:o/DQE39wxTCrMVe0+m0q

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9456

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file datarescueprofessional.exe has been seen being distributed by the following 4 URLs.

http://en.softonic.com/sads/tracker.php?ev=c&co=GR&sid=200b8a4e1ec5cbf87389089c8b976f4c&upv=f1dece905f24d455c49e4750191bd1f1&z=results&sk=0&abp=0&params=F39B2A32BFC101987B1458170C278E032123FF0E09F5565AD6A3C9E074A2DA093675831985D27C86F886968A58280ADAE53A5C2076CCA58FF4033BE7AA12F8F1FE51788F0DD01931A14B805CDC4CE19676110D17840417BACE4F1AEE246E81470994FD19FA756C86F4B233A0ACB30BC221F6B93BAC4DA57EA7DF058EE84FD40E0285F58085469B551D3E260204F3795199C7394AFF3ACEB2545A02E7E1206D6E81D26052634467A15C4B4AC97D5BA6E8&h=E6242C3E7705AF061AAE70BB5A91470109942F8FBB79C1C9E1DE89D15177C320&directdownload=1&f=69711709&d=http://datarescueprofessional.com/.../DataRescueProfessional.exe

http://datarescueprofessional.com/.../DataRescueProfessional.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=ZA&sid=7fe8f3573fb306070824e6c7bc2ef542&upv=8a7582e4352e08ec6d1f78dc660374fe&z=results&sk=0&abp=0&params=F39B2A32BFC101987B1458170C278E032123FF0E09F5565AD6A3C9E074A2DA093675831985D27C86F886968A58280ADAF99C86F45F8CC8D8358C52D819EAEB2F803211A7B9FD9D561719F10460B535D0CB7B817996A5A77E13C0D45BEB51583C36333505CF5CFE070743B8AD1034F691EDDFE3FEF5A85E07E4A45B479677F3CC0CFA68C3F874FDDB451BBC9ADC7CCA9B8952A6B29477F325AE1E56C25250C1E36C2C413255710AC3B148AB57C0DE17DF&h=737523D3467739FD6A92609DFC18F71C85BB4C623A957C8DFBFB02E962A1B3CF&directdownload=1&f=69711709&d=http://datarescueprofessional.com/.../DataRescueProfessional.exe

http://en.softonic.com/sads/tracker.php?ev=c&co=AE&sid=f6895b535e5d10e70f83c3c39ceded0b&upv=ffd2d482c6c3d21347ca3eafcf02f7fc&z=download-cpd&sk=654&abp=0&params=F39B2A32BFC101987B1458170C278E032123FF0E09F5565AD6A3C9E074A2DA091C37C8825E09746CF34E2DEB6FD204DDA7DA3FDADF53CE225DD0CE6D50F235BBCDA7688C46FA96816204C50AF2C85A98129A5490E901C488C91AC19F0BDE1A17713078AE011BC32E7431C227771C2299D53FB93B5355AD71677972BA9026BFC83451756D5F54A7906752AF15DE963B3147F35973048970BB8A835FE2DE21989E&h=D10AA7A7C4BAC95DB9C009289EA8B01EAC5D31961C149F044BD3AEB9A2050F94&directdownload=1&f=69711709&d=http://datarescueprofessional.com/.../DataRescueProfessional.exe

Scan datarescueprofessional.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.