home

windowsdevicerecoverytoolinstaller.exe

Windows Device Recovery Tool 3.0.2

Microsoft Corporation

This is a self-extracting archive and installer. The file has been seen being downloaded from 192.168.1.7 and multiple other hosts.
Publisher:
Microsoft  (signed by Microsoft Corporation)

Product:
Windows Device Recovery Tool 3.0.2

Version:
3.0.2

MD5:
5253eefc79e0f63d9d8530eb6b528ec2

SHA-1:
8fc6101691fe5cc8b9cceb266807bf4efbe1b3aa

SHA-256:
d5127329c34f40bbddd71a25475d004159a8889f447878e7f74e482b7dbed12a

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
12/26/2024 7:27:55 PM UTC  (today)

File size:
2.3 MB (2,362,216 bytes)

Product version:
3.0.2

Copyright:
Copyright (c) Microsoft. All rights reserved.

Original file name:
Bootstrapper.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
6/4/2015 12:42:45 PM

Valid to:
9/4/2016 12:42:45 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
330000010A2C79AED7797BA6AC00010000010A

File PE Metadata
Compilation timestamp:
12/8/2014 4:44:59 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
49152:EnwLl+IQ5ODejjYMc0yRy9XEFbvwi6anjx:EnwZvBDYj3cRcabIi9jx

Entry address:
0x2945F

Entry point:
E8, 00, 3A, 00, 00, E9, 7F, FE, FF, FF, 3B, 0D, 00, 20, 46, 00, 75, 02, F3, C3, E9, 89, 41, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 54, 24, 0C, 8B, 4C, 24, 04, 85, D2, 74, 7F, 0F, B6, 44, 24, 08, 0F, BA, 25, 5C, 3F, 46, 00, 01, 73, 0D, 8B, 4C, 24, 0C, 57, 8B, 7C, 24, 08, F3, AA, EB, 5D, 8B, 54, 24, 0C, 81, FA, 80, 00, 00, 00, 7C, 0E, 0F, BA, 25, 60, 20, 46, 00, 01, 0F, 82, 3A, 42, 00, 00, 57, 8B, F9, 83, FA, 04, 72, 31, F7, D9, 83, E1, 03, 74, 0C, 2B, D1, 88, 07, 83, C7, 01, 83, E9, 01, 75, F6, 8B, C8...
 
[+]

Entropy:
7.4181

Code size:
270.5 KB (276,992 bytes)

The file windowsdevicerecoverytoolinstaller.exe has been seen being distributed by the following 13 URLs.

http://192.168.1.7:55432/file/5C00-0E26/.../WindowsDeviceRecoveryToolInstaller.exe

http://dc387.4shared.com/download/.../WindowsDeviceRecoveryToolInsta.exe

https://dc261.4shared.com/download/.../WindowsDeviceRecoveryToolInsta.exe

http://go.redirectingat.com/?id=23432X820454&site=windowscentral.com&xs=1&isjs=1&url=http://go.microsoft.com/fwlink/?LinkID=525569&xguid=81e1b93593c05cdc2a25276c7b1a8572&xuuid=f7389747ae8584c4d43b77e0fca34104&xsessid=a3f1566d738717ed45cbb08304571f83&xcreo=0&xed=0&sref=http://www.windowscentral.com/roll-back-windows-phone-81-windows-10-preview&pref=https://.../&xtz=-330&abp=1

https://onedrive.live.com/download.aspx?cid=E511F9EB312C1BD0&authKey=!AK05zIFkMiFIOBM&resid=E511F9EB312C1BD0!29315

http://dc261.4shared.com/download/.../WindowsDeviceRecoveryToolInsta.exe

q=http://bit.ly/WPRCWP8&redir_token=gPyuj0Ua6RkL0gw__eLGtlRqnLp8MTQ0NTk5NDIzMUAxNDQ1OTA3ODMx

http://go.redirectingat.com/?id=23432X820454&site=windowscentral.com&xs=1&isjs=1&url=http://go.microsoft.com/fwlink/?LinkID=525569&xguid=c68bcf0e84d39c8570dec9bdb00443ff&xuuid=cb90f2044db8f7a59c47d4a31b0807f0&xsessid=f01803b9a69974a5114c1654a7b15ee5&xcreo=0&xed=0&sref=http://.../roll-back-windows-phone-81-windows-10-preview&pref=http://.../windows-phone-recovery-tool-now-called-windows-device-recovery-tool&xtz=-330&abp=1

http://download-fds.webapps.microsoft.com/supportFiles/phones/files/.../WindowsDeviceRecoveryToolInstaller.exe

http://go.microsoft.com/fwlink/.../?LinkId=522381

https://go.microsoft.com/.../?LinkID=525569

q=http://go.microsoft.com/.../?LinkID=525569&redir_token=qzcQU4iozJ6xj48UslfLCDHA4958MTQ0NjEzMjA2M0AxNDQ2MDQ1NjYz

http://go.microsoft.com/.../?LinkID=525569

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.