home

hetman_partition_recovery.exe

Hetman Software

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
Hetman Software  (signed and verified)

MD5:
1fc85e8d672a14ab87a32a2d237291e9

SHA-1:
be400eb8dcb6ee6501652ff2ac0d52c80c361070

SHA-256:
a9a5f76faf1952e48b0e0e68540df230d0a382bed2794e8062780a8efb2e579e

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/2/2024 3:38:09 PM UTC  (today)

File size:
14.5 MB (15,190,976 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\programs\hetman_partition_recovery_v2.4\hetman_partition_recovery.exe

Digital Signature
Signed by:
Hetman Software

Authority:
COMODO CA Limited

Valid from:
4/13/2015 4:00:00 AM

Valid to:
4/13/2016 3:59:59 AM

Subject:
CN=Hetman Software, O=Hetman Software, STREET="Komsomolskaya street, 13/2", L=Baryshevka, S=Kievskaya, PostalCode=07500, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00CD5D110FFB97FA9EBBC2EDEEB72CC16A

File PE Metadata
Compilation timestamp:
2/24/2012 10:19:54 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
196608:ygfdNaMg1vO3AFEgrCs/9X2tWq5AtVfLTGx9EGUu/tGJt1EOvKwfSdzH/S94QlnU:lxg5gAhGefLKjEGUln1bWdDSrzYlBEHS

Entry address:
0x3883

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, 92, 40, 00, FF, 15, 84, 81, 40, 00, 68, 4C, 92, 40, 00, 68, C0, AD, 46, 00, E8, 18, 27, 00, 00, FF, 15, B0, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
27.5 KB (28,160 bytes)

The file hetman_partition_recovery.exe has been seen being distributed by the following 16 URLs.

http://dw.uptodown.com/dwn/dp8oV6zYi3gnLrYJr36zBvlE8YgYkntsFZpqADX3YisWWyQYrTczuhOlKrBllowFrgVi-9AlmTUZlzX3v-rujQ1zv5p47u2OV_F58Tw5lJjZHavsaFujxnzIbFQaOAmx/GoZY1oKcqDTteKYGaqBNsW5DyDvuEWV9bD6DA_YZEA7u-b8iF4CNWQgysWaVhifKvhC1Gr2jtv8ZltpBUnXwQfD1qx830to_8HbFABoC0-9JO0UPmE_hzOjdGAzuuYr5/sNeKZcs6fowleclxkYezDxw1qQfLK_ix443DJmy59gE0MzE2m5_a40ad2fNWfmhekwo3k7fK05I7bgKmHQupU-aTAarCBj0dCX5G20P6t8rHHTzf3deJdx1a3uL1F_IG/.../

http://dw.uptodown.com/dwn/Df1rZLeIS-2u3M1jPUCIbO8Jd1Trfx4h03sNfwqSra98gbKtXPsJHhde6DgUeSTBnq6QqLvvHxnsWPpL99wjWz5x6xy_cPEVWEIfqHWFnsuYmC3C3dTCF4GubnMGryVV/bexNxftWnR-r-P9661436Z6kpy0dvjyHUKG9PHsKnLvqIZAPUReOt2iUkmDY1cPSVQjwXHF0Pd9GsPjgqt_hSwwd871_TI2zkgP6jynJ8CzEDncneOXiIYWAD_jA294d/.../

http://download.ksplus.komputerswiat.pl/ftp/10e611109982f2da80e6d4a97d00c3051e66e88e80cde381b557d8d041e68bac/link_xp32/2991/programy/Hetman Partition Recovery/.../hetman_partition_recovery.exe

http://dw.uptodown.com/dwn/i6W3y7IZbCB30L3_fHosfx73it5pDFLC66K5HAdUsR5aT3iFE6-7mfu9XzTj4g0uk1WRjBOKx38QcsH4EThGE0gcPGoAAHaaD3VVfJm607KfMCgjfqmelRqAJ9bl7IFN/NAjVJtoPUUoO2apriaAdHuUEY55mNN2p69FrDP5LpdZuQlQkID85VifozyVB7LK6GlKRPjjAA4m6J_2XeDxRSal0w07DX3C6gbhP_8lx2Cc13jj4L145UZkN3Jj0HXi_/R2Q6YduFoIn0DH0pMIWemnB3TTyuAjgE4RUwJtOdpMQxa2tIrqXc6HtkqJXmJmt5CVn7dLafVRUTWqXbJw-Q21lzFt9XS29gXzQ2eWvB1odQEvK7Js8EQbCgId_hce3G/.../

http://dw.uptodown.com/dwn/BjBQF-uCE-E8fcuIcyYjU_VWiLSashY6L9utlwWfz75YONxuefJm5JRATnPOSl7OFzyymTR_7g8rBIeruk3UFhBKF_CP3rX_kfdfEAiTBAU5TMm32JvNzV-XflNO8bB9/WzwXB_f743IDydcVLBbn34Hlb7B0tAUCZqHzWuYbGcsGcYakLWAP7rakzH5cFGYVUTaHh6QlbKbZ8zWhNtqn_3hFmQxXVNEr70L3rkRUNiBQkFbsku9CHBmNRcscUYFJ/LjpNOb6wyvbfbT2I1L9sVcJxrK4JeRRxpUUwISouyVoQLtd_2PG6dMs0R-VbM_GN7NmU2V0cEGEs0aX3ty_7mL6qApdwKEYQnwbAr84YxmC744g6IDjWuYYMtsTrYVbQ/.../

http://dw.uptodown.com/dwn/KqDzg9ZRYHgV7KGAqrdhXtQDbWp5Kic0UPFlP1N9_VNxU0QAfTwj45YHeg78nTqal5ROdpb8VyWhAtpff3hM_pkgCMhRSWFUh5A1s7k71ghM1El-dmDG0ZbpoTx1Hdwx/-6ZEC8qz67hT9qvFu3j2Pqu-wXu80X4TqIL8ANtm_-5VO1amPcjhQT15qIGDSNgmhP4BwXBMjx8OcwHV7VJsPal933GMPUJ4GwMCarhnmr2CGQ058d1uF0X1WhwU-JJH/.../

http://dw.uptodown.com/dwn/xGd3zIirNhrR6qldHAyuQeYl2UsQRPlPnHfezLhjS4VKtUp8j8Rg1AU-A0tp0-m6iik8vbZc7yWCw23-NjbZBPqTOugmaTiJrnFj30hRX3CU87G2BUdTVG_bf8mNkUwa/-COgvVusmfBl6YmufIP6ZKRrdtk6_LfW96Ur64sr2yVYVFza4awgxu4hNj-XA4b-ATHUJlJ8kYe9tleazNHHB6mGlOYXLXplvHCoVTeXV9-RqXxAvNUdKIxluOyHzn0a/.../

http://download.ksplus.komputerswiat.pl/ftp/876729a29034fea00d76ed9c44598b1ffc4a15c4e444c3ad6ddfdb013f053fe7/link_xp32/2991/programy/Hetman Partition Recovery/.../hetman_partition_recovery.exe

http://hetmanrecovery.com/.../hetman_partition_recovery.exe

http://download.ksplus.komputerswiat.pl/ftp/d190d44b8d7f21c4b2b633e18be7cc0f3e7eea9d88ee5b65f51494d0bad44fe5/link_xp32/2991/programy/Hetman Partition Recovery/.../hetman_partition_recovery.exe

http://dw.uptodown.com/dwn/GkqCjNiQdYf35Rc-NLsJD3BF3G-wLnWB5rlJh83ahh6-UySbGOvz3WULncDmWEarOdXeY37ENEGRWE0BkKnDurle1j8WYQXqun-vjwe-vp0UgojL80HCRRJPBlNIg9QL/A9rJ6w8OvlLVeHUCgSRlY5s_QTxDqwIifdEyNXAnPkzaerl1J5W63zq9S7QIik9Nj2tnvQ8jRVr-DkDM-BCqexgJDagoOZeTnWkSv0D2zCvzw2lMm7nSEeQvKOFGNGRX/.../

http://dw.uptodown.com/dwn/CHh8UHs9VhNGHNSLi9hCMXHwXBSlZO6SfL7BB35kAyGw5G0IXpEQdKAFKLgYyC_zdrSOCIFhx8Kwd6HcTlQTq_knGB4JxKUuMbMYdCOe1voEvBOYjdSqx4Pd1tPtBf8q/vq1SFCaKTdAvJ6vmUGCxZP0zuPl6qHT-CdOH8hC5a4OZ1QGGU3kqpAVLYi6ifDDAlPd9wdb6xN9fkRVOb_oEgPy2tVhCgfbj-7Ndf4EvNaEkiEHBEPVN2Uy8E7P4DXE0/.../

http://dw.uptodown.com/dwn/eOh2dwKsLnJL6QLtFFCANz54whzOFd6gkByNARzhJlIpRq4TCDV5Zf72v8z7CUUH0gbTWMPbkxlXGWHrEeTKvxLWpUbv45eHQca3WRttkW31L_7nHyoY8O1bd12C-PwZ/LoLgZs_Ciht14JexX-lkeuVW674sYZUXUsmJJ4dzBK24-EeNNFdgtRKuWRpJR0DkkR-d3b5EloLtnfpeNxP8P6-xdLVTLz0WjG4IO09gjFU1i_qjyoL1VsxBr7Idfx4A/.../

http://gsf-cf.softonic.com/be4/00e/.../hetman_partition_recovery.exe

http://hetman-partition-recovery.en.softonic.com/.../6CH9aeXedl4L8u BHNJXWTW LP1LFlnGQpxqjlxAPkyA8Y74Uvmh fTtY7pUIyLLVFzGIioS7lEPo2PUs9GSebt9V28WScpNyT55sXPTbb7QPWu8q1g0hZbUYq1NGRNnAWzFBzv77eJGMCvWaKrsIWWf7gZ3HpFMaNYr4Xwi9ONTOjjSFLAJpQdk8FHWJ1VmuwV8Tf9u OrthZYtCOfQ==

http://dw.uptodown.com/dwn/TTshrgND-8PiQwyCTBDcbONtlg3mwo-dLn2RBanLUrsDS2pLR7pg0jxxMqDmk9lcaoN9lBR07iPLPcCM68L-hj7MpawVY4C-EKDLw64Cl0e_PsJsZ18_KlpcRCOws6Ob/vWwn9tjquDuGqceJdcOX3hMXEJQSoisHBvrXQ7h4-vmJ1r9qlN1PTKXTvl1f_yPQCD5ghS7o4GdBnh14aHNPIIQj-3iZMpNzrdlqgWsl2WhG5FAywUpCqykDS7rR0P-k/-hZo0Y5fz3rsGyRjvU3wd4ykY9JHUN__yUUASRfPntXTuynAleQH99x_rxYhyMCZKPRg4XSu92VQU1ERfNUTYeUEjQZnn4xJG3ELo6g5ChUTPm3tqGkXILx6TaHWFW4g/.../

Scan hetman_partition_recovery.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.