home

rcsetup144.exe

Recuva

Piriform Ltd

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This is installed with multiple programs including Recuva. The file has been seen being downloaded from fs40.filehippo.com and multiple other hosts.
Publisher:
Piriform Ltd  (signed and verified)

Product:
Recuva

Description:
Recuva Installer

Version:
1.0.0.0

MD5:
3bfe7685fa597ea45b529bf250c3884d

SHA-1:
7a966bb587b048f6af128f76c419bc3d9e8de914

SHA-256:
00ac185a35c24342d4419675187220f2d24006eebb71bb870ef453a043e11523

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/28/2024 4:17:19 PM UTC  (today)

File size:
3.3 MB (3,427,424 bytes)

Copyright:
Copyright © 2006-2012 Piriform Ltd

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\rcsetup144.exe

Digital Signature
Signed by:
Piriform Ltd

Authority:
VeriSign, Inc.

Valid from:
7/6/2011 2:00:00 AM

Valid to:
8/23/2013 1:59:59 AM

Subject:
CN=Piriform Ltd, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Piriform Ltd, L=London, S=London, C=GB

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
741D340793306ACA84FAB3ABBB1567CE

File PE Metadata
Compilation timestamp:
2/24/2012 8:19:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:PPAV9DIxT5GmYfcczqRiO4i63FqPqeq9Z32f+vVQ6Kd2:PyJQr1czqvOcRq1SRo

Entry address:
0x39E3

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
28 KB (28,672 bytes)

The file rcsetup144.exe has been discovered within the following programs.

Cobian Backup 11 Gravity  by Luis Cobian
Publisher's description - “Cobian Backup is a multi-threaded program that can be used to schedule and backup your files and directories from their original location to other directories/drives in the same computer or other computer in your network.”
www.cobiansoft.com/cobianbackup.htm
About 1% of users remove it
Maxthon Cloud Browser  by Maxthon International Limited
Publisher's description - “Maxthon Cloud Browser for Windows uses a unique, innovative dual-core design that uses both Webkit and Trident. Fast and efficient, our dual-core design displays all web pages quickly and reliably.”
www.maxthon.com
3% remove it
Recuva  by Piriform
Recuva is a data recovery program and is able to recover files that have been "permanently" deleted and marked by the operating system as free space.
www.piriform.com/recuva
8% remove it
 
Powered by Should I Remove It?

The file rcsetup144.exe has been seen being distributed by the following 37 URLs.

http://fs40.filehippo.com/7054/.../rcsetup144.exe

http://filehippo.com/download/file/.../

http://filehippo.com/download/file/.../

http://filehippo.com/fr/download/file/.../

http://fs34.filehippo.com/3290/.../rcsetup144.exe

http://dc543.4shared.com/download/.../rcsetup144.exe

http://download2.rada.vn/Data/Soft/2013/02/.../Rcsetup144.exe

https://dw.uptodown.com/dwn/3efMeRanO_ALM5Pxfbtv4soZ6wbEyfHNHbKS93CA1tiLBVGg-yIO0KJShtzBjJhjHhKb_DhdMbBJNV0bNMhTvPfQmpye6DecOP8djaxozKIkycU4v1P5bj7B2Lhxmw9l/zofbzSlTDq8L75U4EXpteyx4A1Xm75TWHPtimDt0PdLrXJHtYdR87lml99ne1b3MYlXK1D1azRK5DH_rAJ5N_wQAVhRUdtlFm97pzpKm4pKgjQSiFE4XcDtHTy83nKUH/gC291M4tYbhWxfJcsqj8yTwG2r1IqxqndZwM2gEbMmCRbVd2-zi_xqJsUX9Wm6O6-RfhiyqgB5GsZAVnWiLhkw_G6KCD4YAHKXkURn2P7ko_jwAOTi9FSpmnBVXiPWV-/.../

ftp://e55ee00633a7f0278ae7a0933f9c450a:1355513742@soft.archive2.clubic.com/soft/.../recuva_recuva_1.44.778_francais_31279.exe

http://www.filehippo.com/es/download/file/.../

http://fs35.filehippo.com/3151/.../rcsetup144.exe

http://cdn.secureddownloadfiles.com/c?x=LqYoBBC9ulwfd4rEUP0LzWIHzQhDiPYjevX77BjBygs=&c=ltJIk5Yb0UHtoUCJeVy5EWcEpp VOAAPrQkjsllnDch 7QryDnq/d9Qj3O4kPr7URQJIUIGyWCOI8bMwM4tCWw==&fallback_url=http://downloadian.com/softwares/.../rcsetup_v144.exe&downloadAs=recuva.exe

http://fs41.filehippo.com/8338/.../rcsetup144.exe

http://dw.uptodown.com/dwn/WWSQH2Nm2x_50A7C1kVokqWW9m6udbZoppRtTOBUaEg2oFzdxycb2oudPEk8bgY3GbIhwGBDR_ldZCGZiHkCR0Dg2ouzQFucc1JmnBwZj7gcgCxs8lSgbUwazUE4tvLr/arHJeyJhRnky2JqoCmn6IKsRrRtKStfgKNm_j1sEZfa5zk4FW2dUfS1yvLTkkyq6p981FYSUnQTUt6cNC5JNWe-1ggoEzvgy4GWnUud2S2brLvu2C7N7VUpPiFJ57Lxl/ckvg8YWKZ0kvOamiLV6qkyYsL8HEv5laS7yS2nefQnVjPw--BRUve8HbIYBF9qus5zKgl4J61z4kLxmN01UU3y48cvfQO9DSvSc4HTKhK0pl4AzUO1QfK7HSefxi_ucI/.../

http://dc236.4shared.com/download/.../rcsetup144.exe

http://dl.cdn.chip.eu/downloads/.../rcsetup144_RO.exe

http://ftp-stahuj.centrum.cz/dl/5d5a272cb052474977ad022f8b3e8657/50ceb387/stahuj/download/software/secured/r/recuva/.../rcsetup144.exe

http://sd-cf.softonic.it/58000/58808/.../rcsetup144.exe

http://fs31.filehippo.com/7897/.../rcsetup144.exe

http://fs31.filehippo.com/7211/.../rcsetup144.exe

http://www.filehippo.com/es/download/file/.../

http://dl.cdn.chip.de/downloads/.../rcsetup144.exe

http://dl.domainforfastfiles.com/n/3.1.29/.../Recuva.exe

http://fs41.filehippo.com/1277/.../rcsetup144.exe

http://files.letoltes.com/.../Recuva 1.45.858.exe

http://fs30.filehippo.com/9863/.../rcsetup144.exe

http://fs40.filehippo.com/6008/.../rcsetup144.exe

http://fs40.filehippo.com/2420/.../rcsetup144.exe

http://fs40.filehippo.com/7222/.../rcsetup144.exe

http://fs41.filehippo.com/4694/.../rcsetup144.exe

Latest 30 of 37 download URLs

Scan rcsetup144.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.