RecoveryDrive.exe

  • File Path: C:\Windows\system32\RecoveryDrive.exe
  • Description: Recovery Media Creator

Screenshot

RecoveryDrive.exe

Hashes

Type Hash
MD5 49AAFC5D89D8F9C6663798C9A251D464
SHA1 9B6E2067DDC128EC38C02D1DC364D32404083E2F
SHA256 CAA922BE6428AB6D74795745C197F2F2AC23F16EF4C41255591C8513B0013FB6
SHA384 5DD5243FADCC6E6A73F79CCD6DDD9BA3F241A7E09159C7196B6B4ADC7281F890B08A7D23EE70698CF2AD292B14345A82
SHA512 4C8C938F9CD0B7C71D24D81259079649F045B07E7992B63E7AC67BA65B8B56D9CDBCCC589044D708FDD860FF02DA6513D8A170A16F88FA74C7A8BBE74D245AD7
SSDEEP 12288:Q6yg/pQ4jFwzkiizxRZACS5P8oJhVRGOTo5tFnYtBMbJ4YRWDEzp7BJD83HEl1:Q6y34jDK5RJh+mWS+Lzp7DiE
IMP F734444B0097091027AF9D4569A74AAD
PESHA1 6FFAA7E53EB816F543E19EA405A7078E5950130C
PE256 666B947F39832DF8D8302A8A4E6C659122628C04534760BCCB2825973142C3D3

Runtime Data

Window Title:

Recovery Drive

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\oleaccrc.dll.mui File
(R-D) C:\Windows\System32\en-US\RecoveryDrive.exe.mui File
(R-D) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_f47974b57ff45754\comctl32.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows\Logs\RecoveryDrive\diagerr.xml File
(RW-) C:\Windows\Logs\RecoveryDrive\diagwrn.xml File
(RW-) C:\Windows\Logs\RecoveryDrive\setupact.log File
(RW-) C:\Windows\Logs\RecoveryDrive\setuperr.log File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_f47974b57ff45754 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_de6e2bd0534e2567 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\BaseNamedObjects\SetupLogSection Section
\Sessions\2\Windows\Theme2131664586 Section
\Windows\Theme966197582 Section

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\SYSTEM32\atlthunk.dll
C:\Windows\system32\bcd.dll
C:\Windows\System32\bcrypt.dll
C:\Windows\System32\bcryptPrimitives.dll
C:\Windows\system32\Cabinet.dll
C:\Windows\System32\cfgmgr32.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\CRYPT32.dll
C:\Windows\System32\CRYPTSP.dll
C:\Windows\system32\dbgcore.DLL
C:\Windows\system32\dbghelp.dll
C:\Windows\system32\DUser.dll
C:\Windows\system32\dwmapi.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\imagehlp.dll
C:\Windows\System32\IMM32.DLL
C:\Windows\System32\kernel.appcore.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\MSASN1.dll
C:\Windows\System32\MSCTF.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ole32.dll
C:\Windows\system32\OLEACC.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\system32\ReAgent.dll
C:\Windows\system32\RecoveryDrive.exe
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\SETUPAPI.dll
C:\Windows\System32\shcore.dll
C:\Windows\System32\SHLWAPI.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\system32\UNATTEND.DLL
C:\Windows\System32\USER32.dll
C:\Windows\system32\UxTheme.dll
C:\Windows\system32\VSSAPI.DLL
C:\Windows\system32\VssTrace.DLL
C:\Windows\system32\WDSCORE.dll
C:\Windows\system32\WIMGAPI.DLL
C:\Windows\System32\win32u.dll
C:\Windows\system32\WINHTTP.dll
C:\Windows\system32\WOFUTIL.dll
C:\Windows\System32\WS2_32.dll
C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_de6e2bd0534e2567\COMCTL32.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: RECOVERYDRIVE.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 1/71
  • VirusTotal Link: https://www.virustotal.com/gui/file/caa922be6428ab6d74795745c197f2f2ac23f16ef4c41255591c8513b0013fb6/detection/

MIT License. Copyright (c) 2020-2021 Strontic.