CmdID

CmdID / Files

RecoveryDrive.exe

Recovery Media Creator file version info

Program on Windows 10 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real RecoveryDrive.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRecovery Media Creator

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RecoveryDrive.exe · signed by Microsoft Windows

579eff572618e38f883177239373639d9dbfd1c7fd6fd419a73a40f638cb8a63

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

6088749efa4645d265162f9bb0eb7e945af2aff6adf9e5349c025ae4b9ce2c52

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

8f7fc1bfd0eead026f70eeee716c150b9d128ecf89adfdc8d01718ca0262cd88

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

cf314d25308d859d726999507e40b9a23f6d8c58b237180520af5010cc5d899f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\RecoveryDrive.exe · signed by Microsoft Windows

550e3e8137b4dcc2f912eb14722cd4739653e75a6b86b9c7d7100e827a836285

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

4f3474844d26e788bb61745b40b2e3bf5f339ca3f229d303c318de181e638c8a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

6930b56a4387921f0526fe7f1a7e0465831f0497692ffd8623dbb8c40635d9e8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

caa922be6428ab6d74795745c197f2f2ac23f16ef4c41255591c8513b0013fb6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\RecoveryDrive.exe · signed by Microsoft Windows

b614bc1f1b489f58b13c2901ed92dd382a518680468f12b492addbf159fe84da

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names RecoveryDrive.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.