home

FileScav.exe

File Scavenger

QueTek Consulting Corporation

This is a setup program which is used to install the application. This is the uninstaller utility registered in the Windows Control Panel for the program File Scavenger 5.1 (pt) by QueTek Consulting Corporation. The file has been seen being downloaded from www.pt.quetek.com.
Publisher:
QueTek Consulting Corporation  (signed and verified)

Product:
File Scavenger

Description:
File Scavenger (R) - Premium data recovery tool

Version:
5.1.3.0

MD5:
7c1408c6be18ea9f96e41428256992db

SHA-1:
58b93a2c061d2ddc0b2c11b661c181ebcd1b2961

SHA-256:
f17b6f077310776feff0cc35f47b1c29a7290b6de8b79b91b1e7db4f2c647fa7

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/28/2024 3:15:14 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
W32/Sality.AT
7.11.30.172

File size:
4.5 MB (4,741,696 bytes)

Product version:
5.1.3.0

Copyright:
Copyrights (c) 1998-2015 QueTek Consulting Corporation. All rights reserved.

Trademarks:
File Scavenger

Original file name:
FileScav.exe

File type:
Executable application (Win64 EXE)

Language:
English (United States)

Common path:
C:\Program Files\file scavenger 5.1\filescav.exe

Digital Signature
Signed by:
QueTek Consulting Corporation

Authority:
Thawte, Inc.

Valid from:
11/1/2015 10:00:00 PM

Valid to:
11/3/2016 9:59:59 PM

Subject:
CN=QueTek Consulting Corporation, OU=SALES, O=QueTek Consulting Corporation, L=Houston, S=Texas, C=US

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4104787EF6EF6B6FABBF062883271464

File PE Metadata
Compilation timestamp:
11/20/2015 10:38:33 AM

OS version:
6.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:jtES5CHKm+IJ5ojnCwm8YeRUcAysEBAdUlp9iPgNbe3PVaR6uOQW+HZJUTAdxdmA:JenAeIR3yhaNxdmpdv9K

Entry address:
0x276120

Entry point:
48, 83, EC, 28, E8, 1F, EE, 00, 00, 48, 83, C4, 28, E9, 36, FE, FF, FF, CC, CC, 48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 49, 8B, D9, 49, 8B, F0, 48, 8B, FA, 4D, 85, C9, 75, 04, 33, C0, EB, 56, 48, 85, C9, 75, 15, E8, 1D, 4B, 00, 00, BB, 16, 00, 00, 00, 89, 18, E8, 95, F7, 00, 00, 8B, C3, EB, 3C, 4D, 85, C0, 74, 12, 48, 3B, D3, 72, 0D, 4C, 8B, C3, 48, 8B, D6, E8, EC, 10, 00, 00, EB, CB, 4C, 8B, C2, 33, D2, E8, 60, 16, 00, 00, 48, 85, F6, 74, C5, 48, 3B, FB, 73, 0C, E8, DD, 4A, 00, 00, BB...
 
[+]

Code size:
2.7 MB (2,822,144 bytes)

Program Uninstaller
Program name:
File Scavenger 5.1 (pt)

Display publisher:
QueTek Consulting Corporation

Display version:
5.1.1.0

Uninstall string:
C:\Program Files\File Scavenger 5.1\FileScav.exe /uninstall


The file FileScav.exe has been seen being distributed by the following URL.

http://www.pt.quetek.com/.../64fspt51.exe

Scan FileScav.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.