RecoveryDrive.exe

  • File Path: C:\Windows\system32\RecoveryDrive.exe
  • Description: Recovery Media Creator

Screenshot

RecoveryDrive.exe

Hashes

Type Hash
MD5 B9B3DC6F2EB89E41FF27400952602C74
SHA1 24AE07E0DB3ACE0809D08BBD039DB3A9D533E81B
SHA256 630518CB2E4636F889D12C98FB2E6BE4E579C5EEB86F88695D3F7FFF3F5515C4
SHA384 98DAD1A401D1FF26015E9C875746A3D0E3A0FFD1775E953326BE87D63C9003DE8ADF4A2FC6F61AB84BCC79FF3B590EA3
SHA512 7906954B881F1051A0C7F098E096BC28EDDCC48643B8BF3134DD57B8C18D8BEBA4F9A0AC5D348DE2F9B8EA607C3E9CB0E61D91E4F3BA1FEFB02839F928E3E3FE
SSDEEP 12288:gIZa+P3twzxiPpRdZX3vmnN2BuEtUh8YJxE5BiMh0jtscUU0NA2OBO/1fXq7IC:gIttwzKBualsvCgtsFOB6C7
IMP 8CFA0431E99BE5BB24FEA0ED41B3FE04
PESHA1 287481510555AEA6739D32ED23A4C44ED8F2569B
PE256 A729C176DCB1C744CE65F54570B81D8D871ABB37A34DA518CC79D5E6EE8FA297

Runtime Data

Window Title:

Recovery Drive

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\oleaccrc.dll.mui File
(R-D) C:\Windows\System32\en-US\RecoveryDrive.exe.mui File
(R-D) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9\comctl32.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Windows\Logs\RecoveryDrive\diagerr.xml File
(RW-) C:\Windows\Logs\RecoveryDrive\diagwrn.xml File
(RW-) C:\Windows\Logs\RecoveryDrive\setupact.log File
(RW-) C:\Windows\Logs\RecoveryDrive\setuperr.log File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9 File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\BaseNamedObjects\SetupLogSection Section
\Sessions\1\Windows\Theme449731986 Section
\Windows\Theme1396518710 Section

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\RecoveryDrive.exe
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002EC6579AD1E670890130000000002EC
  • Thumbprint: F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: RECOVERYDRIVE.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4/detection

MIT License. Copyright (c) 2020-2021 Strontic.