Elcomsoft Forensic Disk Decryptor

Elcomsoft Forensic Disk Decryptor

by Elcomsoft Co. Ltd.

What is Elcomsoft Forensic Disk Decryptor?

Elcomsoft Forensic Disk Decryptor is software application developed by Elcomsoft Co. Ltd.. It is most commonly found on computers running Windows 7 with nearly 61.90% of installations running this operating system. Elcomsoft Forensic Disk Decryptor's installer is typically 4.00 MB in size and installs around 37 files. The most common release is 1.00.110.1392 with 46.03% of all installations currently using this version.

Elcomsoft Forensic Disk Decryptor is most popular in the United States with 45.59% of installations residing in this country.

Elcomsoft Forensic Disk Decryptor adds 1 scheduled task to the Windows Task Scheduler launching the program at randomly scheduled times.

Software Behaviors

Services:
  • ewsaserv.exe runs as a service named 'EWSA Control Service' (EWSASERV).
  • epr_agent.exe runs as a service named 'Elcomsoft Password Recovery Agent' (ElcomSoftDistributedAgent).
  • edpr_server.exe runs as a service named 'Elcomsoft Distributed Password Recovery Server' (ElcomSoftDistributedPasswordRecoveryServer).
  • ewsaserv64.exe runs as a service named 'EWSA Control Service' (EWSASERV).
Scheduled tasks:
  • ARCHPR.exe is scheduled as a task with the class '{C576B535-174E-4058-A42E-B70F666368DE}' (runs on registration).

Startup Entries

Registry entries:
  • epr_agent.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'Elcomsoft Distributed Agent' and executes as "C:\Program Files\Elcomsoft Password Recovery\Distributed Password Recovery\epr_agent.exe" -s.
  • edpr_server.exe is loaded in the current user (HKCU) registry as an auto-starting executable named 'ElcomSoft DPR Server' and executes as C:\Program Files\Elcomsoft Password Recovery\Distributed Password Recovery\edpr_server.exe.

Software Details

URL:
https://www.elcomsoft.ru
Support:
–
Installation path:
C:\Program Files\Elcomsoft Password Recovery\
Uninstaller:
MsiExec.exe /X{F359F477-98B4-40BD-BDC7-2EA5C51A8BF9}
Size:
4.00 MB
Language:
English

Elcomsoft Forensic Disk Decryptor Executable Details

Primary executable:
msvcr90.dll
Name:
Elcomsoft Forensic Disk Decryptor
Path:
C:\Program Files\Elcomsoft Password Recovery\msvcr90.dll
MD5:
–
SHA-1:
–
SHA-256:
–
Files installed by Elcomsoft Forensic Disk Decryptor
File Type Filename MD5
EXE
GPUManager.exe
7b0979459c8ce04bc9c95dc2ad782d4d
EXE
epr_agent.exe
ca0746ad48b1bc5e12a1e2cd29af4477
EXE
edpr_server.exe
f08775670b8e4d225881d7f3867e19a0
EXE
edpr_console.exe
f9c349f31b52165c989599d090cc4606
EXE
EINPB.exe
85c8159fd7488bc78dd9e245ac0aa166
EXE
edei.exe
43d324872442e1fd4ffec3812fe4651e
EXE
PPA.exe
3239c9773c1181f901dd93f55c3ef8dc
EXE
EFDD.exe
2044fecba8dcebae8fa62b732aa61f47
EXE
ARCHPR.exe
1702110dc23fce5e498f392a8d8eaf09
DLL
NotesPlugIn.dll
2e4fad40da034929d5d7b4e7e8525670