140f2e0a4f4163af3dc66274beb504a5ff554a46297c27ec039077b8d211b56f

Analysis

max time kernel
103s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2023, 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

recoverit_setup_full4174.exe
Size

1.2MB
MD5

3e01349dab2dbe1158981ed976ca59f9
SHA1

47189c1ec868823309193083a5b6311677893097
SHA256

140f2e0a4f4163af3dc66274beb504a5ff554a46297c27ec039077b8d211b56f
SHA512

96125b025e4117c376f1d4c5e54529fa69f0848049e086c5e264c1f597b46d4e6d8be4bfaea9f618375ee53e88b949e84d9892328b56ade27658f6cfff1a9625
SSDEEP

24576:XOXAaO/6uSLYnFYARGDgrq/fSdYHhC/+EXNP7HkBNqEL7jtf6408:srW6uSLYnPRGDgrq/X0/lON9L7jk4J

Score

8^/10

discovery evasion upx

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 10 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1248	netsh.exe
4488	netsh.exe
1156	netsh.exe
4724	netsh.exe
4064	netsh.exe
2896	netsh.exe
5712	netsh.exe
3516	netsh.exe
2096	netsh.exe
3208	netsh.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5268-3616-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/5268-3867-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	recoverit_setup_full4174.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\CrashSystem\is-0N8BQ.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-8CD5V.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\imageformats\is-V6M2L.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\HttpRequestData.exe	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\ffmpeg.exe	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\DataRecovery\is-EFGSA.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-I848O.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-4NKV4.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-KPR8E.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\pythonoffice\is-JBK6I.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-processenvironment-l1-1-0.dll	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\WorkOrder\is-EFCA3.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\recoverit.exe	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\drstat.exe	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\officeviewer.exe	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\Aspose.Email.dll	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\mediaservice\qtmedia_audioengine.dll	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\BsSndRpt64.exe	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\CrashSystem\is-7BQ74.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\VideoRepair\is-NBBE9.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\defaultjson\is-KNJ87.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-FDHDT.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\pythonoffice\is-JFG6P.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\WorkOrder\is-09FP1.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\DataRecovery\is-A0K8S.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\is-126QC.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-IVF83.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-IETQO.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\log\is-DM58P.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\audio\qtaudio_windows.dll	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\audio\qtaudio_wasapi.dll	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-C2RT4.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-T0GFM.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\pythonoffice\is-0KVC0.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\FreeImage.dll	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Innosetup\is-9O9M3.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\WorkOrder\is-7UHMV.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-D1GTI.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-RI98J.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-5H4Q1.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\defaultjson\is-O4QDJ.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-1UFGQ.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\api-ms-win-core-interlocked-l1-1-0.dll	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\videoplayer.exe	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\platforms\qoffscreen.dll	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\CrashSystem\is-CP1P2.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\CrashSystem\is-EG79J.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\DataRecovery\is-9CVGE.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-TIEHI.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\imageformats\is-LUCPE.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-QUDMD.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\api-ms-win-core-processthreads-l1-1-1.dll	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\imageformats\qico.dll	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-process-l1-1-0.dll	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\UpgradeProgram\is-DF1LT.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\dre.exe	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\Languages\Recoverit\VideoRepair\is-D8QMN.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\defaultjson\is-OBA5B.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-M6TT6.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\is-3PESB.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\pythonoffice\is-4FLDD.tmp	recoverit_64bit_full4174.tmp
File created	C:\Program Files\Wondershare\Recoverit\pythonoffice\is-M7UKV.tmp	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\drrs.exe	recoverit_64bit_full4174.tmp
File opened for modification	C:\Program Files\Wondershare\Recoverit\WsAP-Recoverit.dll	recoverit_64bit_full4174.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\is-Q5IG7.tmp	recoverit_64bit_full4174.tmp

Executes dropped EXE 3 IoCs

pid	Process
848	NFWCHK.exe
1376	recoverit_64bit_full4174.exe
4620	recoverit_64bit_full4174.tmp

Loads dropped DLL 6 IoCs

pid	Process
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	recoverit_setup_full4174.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	recoverit_setup_full4174.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\IESettingSync	recoverit_setup_full4174.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	recoverit_setup_full4174.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	recoverit_64bit_full4174.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A57B664-563C-4c2e-97E8-7F6E667FAB34}	recoverit_64bit_full4174.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A57B664-563C-4c2e-97E8-7F6E667FAB34}\Info	recoverit_64bit_full4174.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	recoverit_64bit_full4174.tmp

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp
4620	recoverit_64bit_full4174.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4620	recoverit_64bit_full4174.tmp

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1684	recoverit_setup_full4174.exe
1684	recoverit_setup_full4174.exe
1376	recoverit_64bit_full4174.exe
4620	recoverit_64bit_full4174.tmp

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 848	1684	recoverit_setup_full4174.exe	82
PID 1684 wrote to memory of 848	1684	recoverit_setup_full4174.exe	82
PID 1684 wrote to memory of 1376	1684	recoverit_setup_full4174.exe	92
PID 1684 wrote to memory of 1376	1684	recoverit_setup_full4174.exe	92
PID 1684 wrote to memory of 1376	1684	recoverit_setup_full4174.exe	92
PID 1376 wrote to memory of 4620	1376	recoverit_64bit_full4174.exe	94
PID 1376 wrote to memory of 4620	1376	recoverit_64bit_full4174.exe	94
PID 1376 wrote to memory of 4620	1376	recoverit_64bit_full4174.exe	94
PID 4620 wrote to memory of 1496	4620	recoverit_64bit_full4174.tmp	96
PID 4620 wrote to memory of 1496	4620	recoverit_64bit_full4174.tmp	96
PID 4620 wrote to memory of 1496	4620	recoverit_64bit_full4174.tmp	96
PID 1496 wrote to memory of 4488	1496	cmd.exe	98
PID 1496 wrote to memory of 4488	1496	cmd.exe	98
PID 1496 wrote to memory of 4488	1496	cmd.exe	98
PID 1496 wrote to memory of 3516	1496	cmd.exe	99
PID 1496 wrote to memory of 3516	1496	cmd.exe	99
PID 1496 wrote to memory of 3516	1496	cmd.exe	99
PID 1496 wrote to memory of 2096	1496	cmd.exe	100
PID 1496 wrote to memory of 2096	1496	cmd.exe	100
PID 1496 wrote to memory of 2096	1496	cmd.exe	100
PID 1496 wrote to memory of 3208	1496	cmd.exe	101
PID 1496 wrote to memory of 3208	1496	cmd.exe	101
PID 1496 wrote to memory of 3208	1496	cmd.exe	101
PID 1496 wrote to memory of 1156	1496	cmd.exe	104
PID 1496 wrote to memory of 1156	1496	cmd.exe	104
PID 1496 wrote to memory of 1156	1496	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\recoverit_setup_full4174.exe
"C:\Users\Admin\AppData\Local\Temp\recoverit_setup_full4174.exe"
1⤵
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Users\Public\Documents\Wondershare\recoverit_64bit_full4174.exe
  "C:\Users\Public\Documents\Wondershare\recoverit_64bit_full4174.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-Recoverit.log" /installpath: "C:\Program Files\Wondershare\Recoverit\" /DIR="C:\Program Files\Wondershare\Recoverit\" /WAEWIN=A002C
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\is-5VF3R.tmp\recoverit_64bit_full4174.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-5VF3R.tmp\recoverit_64bit_full4174.tmp" /SL5="$9016C,137048430,824832,C:\Users\Public\Documents\Wondershare\recoverit_64bit_full4174.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\Admin\AppData\Local\Temp\WAE-Recoverit.log" /installpath: "C:\Program Files\Wondershare\Recoverit\" /DIR="C:\Program Files\Wondershare\Recoverit\" /WAEWIN=A002C
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Wondershare\Recoverit\AccessInboundRule.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57209
        5⤵
        Modifies Windows Firewall
        
        PID:4488
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57210
        5⤵
        Modifies Windows Firewall
        
        PID:3516
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57211
        5⤵
        Modifies Windows Firewall
        
        PID:2096
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57212
        5⤵
        Modifies Windows Firewall
        
        PID:3208
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57213
        5⤵
        Modifies Windows Firewall
        
        PID:1156
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57214
        5⤵
        Modifies Windows Firewall
        
        PID:4724
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57215
        5⤵
        Modifies Windows Firewall
        
        PID:1248
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57216
        5⤵
        Modifies Windows Firewall
        
        PID:4064
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57217
        5⤵
        Modifies Windows Firewall
        
        PID:2896
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="RecoveritTCPAccessInboundRule" dir=in action=allow protocol=TCP localport=57218
        5⤵
        Modifies Windows Firewall
        
        PID:5712
- C:\Program Files\Wondershare\Recoverit\recoverit.exe
  "C:\Program Files\Wondershare\Recoverit\recoverit.exe"
  2⤵
  PID:4652
- - C:\Program Files\Wondershare\Recoverit\mqs.exe
    "C:\Program Files\Wondershare\Recoverit\mqs.exe" -i
    3⤵
    PID:4696
- - C:\Program Files\Wondershare\Recoverit\drlog.exe
    "C:\Program Files\Wondershare\Recoverit\drlog.exe"
    3⤵
    PID:1596
- - C:\Program Files\Wondershare\Recoverit\diskfeedback.exe
    "C:\Program Files\Wondershare\Recoverit\diskfeedback.exe" -G Test
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Wondershare_Recoverit_Processprotect\processprotect.exe
    "C:\Users\Admin\AppData\Local\Temp\Wondershare_Recoverit_Processprotect\processprotect.exe" "{37AE13D3-D12A-49D8-A085-332F5E2DEE4A}" "C:/Program Files/Wondershare/Recoverit"
    3⤵
    PID:4100
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "drrs.exe C:\ProgramData/Wondershare/Recoverit/drrs.conf --port 23007"
    3⤵
    PID:4804
  - - C:\Program Files\Wondershare\Recoverit\drrs.exe
      drrs.exe C:\ProgramData/Wondershare/Recoverit/drrs.conf --port 23007
      4⤵
      PID:2448
- - C:\Program Files\Wondershare\Recoverit\encryptassist.exe
    "C:\Program Files\Wondershare\Recoverit\encryptassist.exe"
    3⤵
    PID:220
- - C:\Program Files\Wondershare\Recoverit\cbscustomizedclient.exe
    "C:\Program Files\Wondershare\Recoverit\cbscustomizedclient.exe" /FilePath "C:\ProgramData/Wondershare/Recoverit/Customization.xml" /Language "ENG"
    3⤵
    PID:5340
- - C:\Program Files\Wondershare\Recoverit\wget.exe
    "C:\Program Files\Wondershare\Recoverit\wget.exe" wget -P, "--directory-prefix=C:/Program Files/Wondershare/Recoverit" --no-check-certificate http://download.wondershare.com/data/recoverit/bootable.ini
    3⤵
    PID:5268
- - C:\Program Files\Wondershare\Recoverit\messagepush.exe
    "C:\Program Files\Wondershare\Recoverit\messagepush.exe" "Wondershare" "4174" "11.0.4.10" "English(English)" "0" "22cODndJjSTW6bVmGaMy_ig" "{37AE13D3-D12A-49D8-A085-332F5E2DEE4A}"
    3⤵
    PID:620
- - C:\Program Files\Wondershare\Recoverit\autoupgrade.exe
    "C:\Program Files\Wondershare\Recoverit\autoupgrade.exe" "4174" "11.0.4" "" ""
    3⤵
    PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cbs.wondershare.net/go.php?m=ic&back_url=https%3A%2F%2Frecoverit.wondershare.net%2Fthankyou%2Finstall-recoverit.html%3Ff%3Dpro-drwin&client_sign={98ee057f-187c-44cc-aa11-bced7e7c4d99G}&m_nProductID=4174&installtime=1684672168
  2⤵
  PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff89b6446f8,0x7ff89b644708,0x7ff89b644718
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15929511063562475352,17721322159054209368,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Wondershare\Recoverit\AccessInboundRule.bat

Filesize
4KB

MD5
da7aa3adfd21cb28b5f67b34966c874c

SHA1
2f31b9bb5feec2d232fd4251a98f6724cae217f5

SHA256
6fa93b39597c72e347646f918d5b52ecb408cc19ab97aa074f9499fb150364a6

SHA512
131a9d350dcfa9921f8cb789e89a44e8777a40ccceb770b9a68433c569025ae975196ccfd56f6d386b4a4102d4cfbf8dea8b048ed7203724af526b21e5f7e1f4

Download Submit
C:\Program Files\Wondershare\Recoverit\BugSplat64.dll

Filesize
552KB

MD5
df4ff01fe980a7272c7b88a0503a78ea

SHA1
556b72ea464dc2d755fc2b49535d604e64e6a969

SHA256
6c1f9d454d48bdde8edb526b71b68c1f09ffa526bec5b59882c0b4a70d4da291

SHA512
8255e16b0e7f8ae90521d2c72f8846f487f3b85221b11b5b9208165d3e338399c179dc21531d1d44bfadf7c9100b88625e35b1c2e370228e332af9944b168934

Download Submit
C:\Program Files\Wondershare\Recoverit\BugSplat64.dll

Filesize
552KB

MD5
df4ff01fe980a7272c7b88a0503a78ea

SHA1
556b72ea464dc2d755fc2b49535d604e64e6a969

SHA256
6c1f9d454d48bdde8edb526b71b68c1f09ffa526bec5b59882c0b4a70d4da291

SHA512
8255e16b0e7f8ae90521d2c72f8846f487f3b85221b11b5b9208165d3e338399c179dc21531d1d44bfadf7c9100b88625e35b1c2e370228e332af9944b168934

Download Submit
C:\Program Files\Wondershare\Recoverit\FreeImage.dll

Filesize
6.6MB

MD5
126a5a7fd6fdebeca3837e26a6ef636f

SHA1
a2709920704bc72e224d1b2e9f41a90e2d98cf81

SHA256
2bb694e1948b6ba0484be73fce8684b6436f0d54bddb5347789e62885dcdea72

SHA512
e7bebed70025f5f8df4e126587810bb735291c3236aa94b90d6b896063c075d2fe5890bb7044490e57d64fe285695e3fbf0727bfa0ee26af508cd22b7ee34eec

Download Submit
C:\Program Files\Wondershare\Recoverit\FreeImage.dll

Filesize
6.6MB

MD5
126a5a7fd6fdebeca3837e26a6ef636f

SHA1
a2709920704bc72e224d1b2e9f41a90e2d98cf81

SHA256
2bb694e1948b6ba0484be73fce8684b6436f0d54bddb5347789e62885dcdea72

SHA512
e7bebed70025f5f8df4e126587810bb735291c3236aa94b90d6b896063c075d2fe5890bb7044490e57d64fe285695e3fbf0727bfa0ee26af508cd22b7ee34eec

Download Submit
C:\Program Files\Wondershare\Recoverit\LIBEAY32.dll

Filesize
2.5MB

MD5
7cbb225703f108eab9cf962ebff98691

SHA1
026a05adb6860308fa04485c9f050021ca6543fa

SHA256
949e724cc6460592666f7e780e324a6f82c8ea7dbcdf257b90d70fe228cab0ae

SHA512
44c482d81aeb0caa033fe1da344e6a069050fc24e26d14dd4907253755a16c6de76b9fddaf4134215cb1be7d131ebe6235f211acee6a0576162015d69c4c400d

Download Submit
C:\Program Files\Wondershare\Recoverit\Languages\Innosetup\is-SOTL7.tmp

Filesize
8KB

MD5
7b674010a59e9dc544472895cf710400

SHA1
a2289c6feb6ab3938a18a50aaa9311eb04f4b08a

SHA256
f7a0a26298535a4ef3cfadd81d4be61ab81cb72d60b7fa8d18b60576e8621ce4

SHA512
ba96b253691939a10acfa41b3db7b61a3c7548738607357655b4306bf9e851de9f71b87d171a65bd8d6433aecf25d2313fd191963fd2a7b48dee7ad2e5c0d11a

Download Submit
C:\Program Files\Wondershare\Recoverit\LiveUpdate.ini

Filesize
611B

MD5
ddb9c297dc360904052cd6d17a4d566c

SHA1
bc01c302807d14af268b27fe7a5541f2b0204bc0

SHA256
c573e4bf1a8ecc19376b706788134a4817d525efa8c87d99a4bfba7be3e11f88

SHA512
0f443cca3c686b8f2318d8eb74673e7f2d1a681ca0e3ce5661ea8c7ff44c65d3dac0c8830ca415b2eacf4c87a1495234dfecb995a5078d8e45b56b430eaeccc3

Download Submit
C:\Program Files\Wondershare\Recoverit\MSVCP120.dll

Filesize
644KB

MD5
0a097d81514751b500690ce3fc3223fa

SHA1
7983f0e18d2c54416599e6c192d6d2b151a2175c

SHA256
e299b35d1e3b87930a4f9a9ef90526534e8796b0def177fb2a849c27f42f1df2

SHA512
74639f4c2954b5959eb2254544bf2e06ab097219fc8588a4f154d1a369b0657176128c17911958c84ed55421fe89bf98c8ed36d803a07a28a7d4598db88027ce

Download Submit
C:\Program Files\Wondershare\Recoverit\MSVCP140.dll

Filesize
612KB

MD5
f18a5e3d3eda812aface74ff79015384

SHA1
7c268240c5d9e316da049158c0ddb893eea63ca7

SHA256
3902beac5889d9cb06d6cc095c1b41472720bb7aaa23c33d68124ca0204b3e9e

SHA512
eea760f14ca3f720c3a09d0f4f320a7f7bff0b18b34a49c370f67978bc6cab19646fde9aa2021c79ef4959f08a5af3fa3b3879d74bf8e4ca669eab0534aa7d45

Download Submit
C:\Program Files\Wondershare\Recoverit\MSVCR120.dll

Filesize
941KB

MD5
e2ca271748e872d1a4fd5ac5d8c998b1

SHA1
5020b343f28349da8c3ea48fb96c0fbab757bd5c

SHA256
0d00bf1756a95679715e93dc82b1b31994773d029fbbd4e0e85136ef082b86a9

SHA512
85d6bcaaf86f400000cf991da1b8e45e79823628dc11b41d7631aa8ee93e500e7da6e843ea04edb44d047519dabef96dcb641adc2a7b3faa5cd01e8a20b1f18e

Download Submit
C:\Program Files\Wondershare\Recoverit\PocoFoundation64.dll

Filesize
1.4MB

MD5
86e4e556cecd07fa5ab1010731732820

SHA1
e9ee2a6272dd5ab4036bf1051bce05fede7741b6

SHA256
4eed4c79c756526e2c0188261a00e34c2314bba4027a0d4853aca9db285da676

SHA512
4fe539e8b7ba086e7ce71a384a1f5d24ff70748f7c4d972c11539df6244ab19573470f54ca0583c53797f1518ad5d875e56d9112721db0a70b9a7f7f5e27f0aa

Download Submit
C:\Program Files\Wondershare\Recoverit\PocoFoundation64.dll

Filesize
1.4MB

MD5
86e4e556cecd07fa5ab1010731732820

SHA1
e9ee2a6272dd5ab4036bf1051bce05fede7741b6

SHA256
4eed4c79c756526e2c0188261a00e34c2314bba4027a0d4853aca9db285da676

SHA512
4fe539e8b7ba086e7ce71a384a1f5d24ff70748f7c4d972c11539df6244ab19573470f54ca0583c53797f1518ad5d875e56d9112721db0a70b9a7f7f5e27f0aa

Download Submit
C:\Program Files\Wondershare\Recoverit\PocoNet64.dll

Filesize
1020KB

MD5
1f3ae41a898d86f2aec80485347a8ff6

SHA1
dd16262a4738dbfcef02f34465c11fe772eeaaf7

SHA256
833d64d4dd0a8f39b97ecb0373b7ef15af636d8eedf3e660a7f269af74f411ca

SHA512
4673ad0fe3b494a994681dc081edd31e0d98f067ce3bce80d183e38e2b33ab8df77517b281c3fb40b0a086e0b93022637e27e8255be9889fb74ee288e3fd5907

Download Submit
C:\Program Files\Wondershare\Recoverit\PocoNet64.dll

Filesize
1020KB

MD5
1f3ae41a898d86f2aec80485347a8ff6

SHA1
dd16262a4738dbfcef02f34465c11fe772eeaaf7

SHA256
833d64d4dd0a8f39b97ecb0373b7ef15af636d8eedf3e660a7f269af74f411ca

SHA512
4673ad0fe3b494a994681dc081edd31e0d98f067ce3bce80d183e38e2b33ab8df77517b281c3fb40b0a086e0b93022637e27e8255be9889fb74ee288e3fd5907

Download Submit
C:\Program Files\Wondershare\Recoverit\QDRPELib.dll

Filesize
1.0MB

MD5
34ece70fabbf4ef80b6a99ea4aac5ee3

SHA1
9627ccd598c65b56ffef5facb621055b80829e07

SHA256
9b265bde763824faa739ade85a81029537875a79e986697e220943ae314d6411

SHA512
9b698ef56d8149df642098fc10dddcbbc995a75b7943dd5b8140b91901374b4c093e5f3d5348a1fe925face634a78b88e00ad0592cad52ac6d91d41fe66410a0

Download Submit
C:\Program Files\Wondershare\Recoverit\QDRPELib.dll

Filesize
1.0MB

MD5
34ece70fabbf4ef80b6a99ea4aac5ee3

SHA1
9627ccd598c65b56ffef5facb621055b80829e07

SHA256
9b265bde763824faa739ade85a81029537875a79e986697e220943ae314d6411

SHA512
9b698ef56d8149df642098fc10dddcbbc995a75b7943dd5b8140b91901374b4c093e5f3d5348a1fe925face634a78b88e00ad0592cad52ac6d91d41fe66410a0

Download Submit
C:\Program Files\Wondershare\Recoverit\QLib7z.dll

Filesize
555KB

MD5
8c797a538b683eb19af03d500bfc8535

SHA1
050bd8de133d5d1c563ee9db776b4badeb21603e

SHA256
93aa84e7fd6391ee1e88492d20ad307623ea4005a00f602ec078bcd4c67a4e7e

SHA512
226f25381e398f2d6c16a811d608686d16b84c154f2a70b38a9ddb14c58d006300acee806eb13aea101fc858569309ff5c54c33469aa049ebc72074d11c423a3

Download Submit
C:\Program Files\Wondershare\Recoverit\QLib7z.dll

Filesize
555KB

MD5
8c797a538b683eb19af03d500bfc8535

SHA1
050bd8de133d5d1c563ee9db776b4badeb21603e

SHA256
93aa84e7fd6391ee1e88492d20ad307623ea4005a00f602ec078bcd4c67a4e7e

SHA512
226f25381e398f2d6c16a811d608686d16b84c154f2a70b38a9ddb14c58d006300acee806eb13aea101fc858569309ff5c54c33469aa049ebc72074d11c423a3

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5Core.dll

Filesize
5.7MB

MD5
a28cdda2cb2d9b83964980cca06ec4eb

SHA1
02f4e37da9ecc68357833a63f9cf264a7c3c889a

SHA256
7679e76b92eff4cca21946dfb3a2ed40fc4e4217008e828656852184ad548d00

SHA512
84456b2bff80e98ba3137e99bf4bfab53b6c4e7592a80c2cfdfa29fdea8118007c028b068b9f4c6bd7fffdc004c97e6c71a929c256cf40b6cbc2800c3d39c82b

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5Core.dll

Filesize
5.7MB

MD5
a28cdda2cb2d9b83964980cca06ec4eb

SHA1
02f4e37da9ecc68357833a63f9cf264a7c3c889a

SHA256
7679e76b92eff4cca21946dfb3a2ed40fc4e4217008e828656852184ad548d00

SHA512
84456b2bff80e98ba3137e99bf4bfab53b6c4e7592a80c2cfdfa29fdea8118007c028b068b9f4c6bd7fffdc004c97e6c71a929c256cf40b6cbc2800c3d39c82b

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5Gui.dll

Filesize
6.1MB

MD5
016841d3213434d8a2be0dbd2b20a953

SHA1
cf2a4ffb501772cbc766d6734ea03f9a29fefb27

SHA256
fdc76019c81cd716f88071ffd73d797c145bcc0ffe6ac181d7fba0baa7cae45f

SHA512
8ff6b8fd71ee0392bea5c295bd27e0a199d20510728b9556f220e4a36902e357fa2da2331271a72b23131a8ef923b71412819f04d965844803b1b75e934fe7c6

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5Gui.dll

Filesize
6.1MB

MD5
016841d3213434d8a2be0dbd2b20a953

SHA1
cf2a4ffb501772cbc766d6734ea03f9a29fefb27

SHA256
fdc76019c81cd716f88071ffd73d797c145bcc0ffe6ac181d7fba0baa7cae45f

SHA512
8ff6b8fd71ee0392bea5c295bd27e0a199d20510728b9556f220e4a36902e357fa2da2331271a72b23131a8ef923b71412819f04d965844803b1b75e934fe7c6

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5Widgets.dll

Filesize
5.3MB

MD5
844f4042c21168369562e6fc669080c6

SHA1
155c41367fa3c68a1ce5b1a94799052c7a6150a8

SHA256
ce2723b5d722a7d609c9b3ba4da35c67584663cc15ace8b4e89d38122b620502

SHA512
4eb089f6f7c5e7b145f7f85700f16e8ea2c26f1c8cd098222dd7812c5fef1eae49c07ecf464b2a4d94342901cc4c0486d5d0c2b510a7bdf6a9bbe08ef45df52f

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5Widgets.dll

Filesize
5.3MB

MD5
844f4042c21168369562e6fc669080c6

SHA1
155c41367fa3c68a1ce5b1a94799052c7a6150a8

SHA256
ce2723b5d722a7d609c9b3ba4da35c67584663cc15ace8b4e89d38122b620502

SHA512
4eb089f6f7c5e7b145f7f85700f16e8ea2c26f1c8cd098222dd7812c5fef1eae49c07ecf464b2a4d94342901cc4c0486d5d0c2b510a7bdf6a9bbe08ef45df52f

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5WinExtras.dll

Filesize
472KB

MD5
3025884216161c32cb886e6b09725a48

SHA1
5fa1ba41ab5006e98fc9defa2b477cab35478947

SHA256
89304d1cb8c2f36382db77ed10649aaee26f63d383e8ff8c44c86f4f1a26fe65

SHA512
2ba360d8b293266011f6316cd8fc84e561b2bf010ff61209f1cb7b06807a030ca6e61f4912ba6150f05c4d35bde0c2356fb4d1961c497eb4c42bc091d91b4a29

Download Submit
C:\Program Files\Wondershare\Recoverit\Qt5WinExtras.dll

Filesize
472KB

MD5
3025884216161c32cb886e6b09725a48

SHA1
5fa1ba41ab5006e98fc9defa2b477cab35478947

SHA256
89304d1cb8c2f36382db77ed10649aaee26f63d383e8ff8c44c86f4f1a26fe65

SHA512
2ba360d8b293266011f6316cd8fc84e561b2bf010ff61209f1cb7b06807a030ca6e61f4912ba6150f05c4d35bde0c2356fb4d1961c497eb4c42bc091d91b4a29

Download Submit
C:\Program Files\Wondershare\Recoverit\VCRUNTIME140.dll

Filesize
83KB

MD5
0c583614eb8ffb4c8c2d9e9880220f1d

SHA1
0b7fca03a971a0d3b0776698b51f62bca5043e4d

SHA256
6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9

SHA512
79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64

Download Submit
C:\Program Files\Wondershare\Recoverit\WSDataRecovery.ini

Filesize
19KB

MD5
f10e5496cb95428ce6015c419a870140

SHA1
d2e5737168510e50fe0c3efb6c0d83da9caa3e56

SHA256
ae9af25bb66932788b88c201b88d40c9afc3c75d0849ecf1d5d34f6f92d35ff0

SHA512
c689cdff71fa9eb21bf288716d3e783fa8874fdc8ddf580f8eee892f36c1920387b19b9b90b814362cd1fe4e59cf868ed130f882b4853b9591f6d6c64067a5d8

Download Submit
C:\Program Files\Wondershare\Recoverit\WsAP-Recoverit.dll

Filesize
6.2MB

MD5
f56605e667fd48ec4b4e0e835ad8f3a3

SHA1
5689e7d16150b122f556f549deb09ca0e4518064

SHA256
0545dc6fd3e2b5e135634dad35bcc9fc63bce69b8013b88ce036ca18b2eebaa7

SHA512
8da5b6abd6fe6f9a429a48ede3b30cdade3af17b0795add109ab79df326f656343e5d75de9f4abaee3507167b0a8159957900295df51a10359843506d544ca37

Download Submit
C:\Program Files\Wondershare\Recoverit\WsAP-Recoverit.dll

Filesize
6.2MB

MD5
f56605e667fd48ec4b4e0e835ad8f3a3

SHA1
5689e7d16150b122f556f549deb09ca0e4518064

SHA256
0545dc6fd3e2b5e135634dad35bcc9fc63bce69b8013b88ce036ca18b2eebaa7

SHA512
8da5b6abd6fe6f9a429a48ede3b30cdade3af17b0795add109ab79df326f656343e5d75de9f4abaee3507167b0a8159957900295df51a10359843506d544ca37

Download Submit
C:\Program Files\Wondershare\Recoverit\cbscustomizedclient_datacollect.exe

Filesize
39KB

MD5
b07a3a60381fadd5ed6e40f592fbf6dd

SHA1
827102edb1a649835f375db7a9241b83326eecee

SHA256
a3b3a80d10308246e90451d1f4e96514cef37d5ca17314d0c9364f5d81129e61

SHA512
77bf838c98b7ed86ef705a6bd7e7f14734b597b5f2d42dd9bf4bb99e26499b114367e45e4ee9985646ed9e9f116aedf14fb242a0eeb3c24d2aae631fa0364e58

Download Submit
C:\Program Files\Wondershare\Recoverit\cdndown.dll

Filesize
621KB

MD5
e3825ebc21d47c3d692c73d19336c106

SHA1
5fe7db97a24b8d727fb6a3cc76d80e9fc03f8686

SHA256
8a8963f05e47935989e74c13eafd222a01015b5a36f96d2dc24733b9df9603bd

SHA512
d48bba22f5f1c12e8b4f07c5e8e5d722d62b95a926cce35c4b3860fb4d3037241c1ceb6c06460a3a4ab9126a197b6c925886ebb1fdce4b12b35268cae5cd3cff

Download Submit
C:\Program Files\Wondershare\Recoverit\cdndown.dll

Filesize
621KB

MD5
e3825ebc21d47c3d692c73d19336c106

SHA1
5fe7db97a24b8d727fb6a3cc76d80e9fc03f8686

SHA256
8a8963f05e47935989e74c13eafd222a01015b5a36f96d2dc24733b9df9603bd

SHA512
d48bba22f5f1c12e8b4f07c5e8e5d722d62b95a926cce35c4b3860fb4d3037241c1ceb6c06460a3a4ab9126a197b6c925886ebb1fdce4b12b35268cae5cd3cff

Download Submit
C:\Program Files\Wondershare\Recoverit\data_api.dll

Filesize
2.6MB

MD5
e2749b94acd59c3ebbe6cbbbef536c39

SHA1
bd95389b674ab5c7d7705e463fda55196d02eacf

SHA256
ae3aba7afde69d34ae104df8a59d8945455bcd1ce3e307242451b588f3d2333a

SHA512
d7e42d37e28ada3a130aafc7a22680e2b6146dd745f957e252ac106ffa326d220d1a356039afc12a02b3fc611e50f59970598fe7d76c0240ceb06d5c38e27289

Download Submit
C:\Program Files\Wondershare\Recoverit\defaultjson\is-OBA5B.tmp

Filesize
3KB

MD5
65de1af88540ae18f3a117dda252c767

SHA1
7497a46a8cdd467e6c1fda37f40ce8f7fe5964bc

SHA256
e7f5180200be17d28d17cd4aaf00e8ec1505267a38af53e7bd5cd63d779c7d1a

SHA512
e460903e702aa26ffe19bd9f4f3ae0d6b18d70f148288beeedb68d2fd2368af1f2e2f0e0acf15077cd700087f3f751045b61325982b8b6c05de6687e407623e2

Download Submit
C:\Program Files\Wondershare\Recoverit\drstat.dll

Filesize
1.3MB

MD5
5908ded58f887ead325b879280bb929c

SHA1
592bd3a26609db89ea673a024ad00f1b211ce4c2

SHA256
13a51b1c9a08836d3c4d76055030157114e588681934413197eaea5eb5a85e9c

SHA512
d1321d76f892447cb6d54f1cb5f0cd17e090c94276ad1d09adc4c8158f431775bb83d3f5d3cdf62c5959527ead7a27b6ce4f29bca784eb0645185b49fccea81f

Download Submit
C:\Program Files\Wondershare\Recoverit\drstat.dll

Filesize
1.3MB

MD5
5908ded58f887ead325b879280bb929c

SHA1
592bd3a26609db89ea673a024ad00f1b211ce4c2

SHA256
13a51b1c9a08836d3c4d76055030157114e588681934413197eaea5eb5a85e9c

SHA512
d1321d76f892447cb6d54f1cb5f0cd17e090c94276ad1d09adc4c8158f431775bb83d3f5d3cdf62c5959527ead7a27b6ce4f29bca784eb0645185b49fccea81f

Download Submit
C:\Program Files\Wondershare\Recoverit\is-63CRG.tmp

Filesize
84KB

MD5
e826d450412694feebc830a32e3c74b0

SHA1
eb4f73ea8dfa0ed011c736260e1fc37ab14c27d3

SHA256
fa33275ad5c18f2e29c58e46a6ea39c8c9f6391e92debd35de1e22e4c4271413

SHA512
d534ae4965926536baf939abed6061d91cc2ed31b1138561700b8b054f0859e3ea80aa6ae555296fed4707cfe763c3731e671c9f1396c8bf0df7c8d59222989b

Download Submit
C:\Program Files\Wondershare\Recoverit\is-9KNGM.tmp

Filesize
144KB

MD5
0750f0c68fc63be266d7f082beafd274

SHA1
662b69339ede67058e3542be8df5a3c300820fad

SHA256
0d094b9c2cae4043a5a99f0ef5a05fb95923606b13e39ebfb888d7b32e16c146

SHA512
8997d5f43ef9390d4ecf95ee9a6fff2cd6dbabd9b5cc44794ffdd4e6ed940d0d768561f1765acf5c199b89442c0c5d9328d2cc0d657d29d5041bd6bfc4e693ad

Download Submit
C:\Program Files\Wondershare\Recoverit\is-HE6G4.tmp

Filesize
202KB

MD5
92e648bc18fe9769a21e9bcf5d134512

SHA1
177657a72634de5e4a929e694c8d420597de34bc

SHA256
7935463db52637ca17e1b9f62749aa8362452d92be56c76ad579af11833e713a

SHA512
ce66d52d1e6ee859db4226d8a8babd4a8f2dadd67421145cd1981d9538c455adc613b950afb6e453659b426a5980f6c8640cd2160434bfa2e0912cb686993ea0

Download Submit
C:\Program Files\Wondershare\Recoverit\is-UJ3SN.tmp

Filesize
232B

MD5
0902754b4f3041fd31673cb63b34012d

SHA1
cc03cd2dedd25eb8bf121838c9d2e059a0ae4b93

SHA256
905e11c9a4bd25e0225fd655de86bebecdee57c88757ae95ca82f888a7173610

SHA512
b0db0ffda68bea55a9d6fbf8a3d7dfd46a420e2f4cb8ed6c5e7a4ee881386049547d451819a67a116499bc33ca722171bdf4101d625b639e11c20eb9931ef2f1

Download Submit
C:\Program Files\Wondershare\Recoverit\lantern.dll

Filesize
143KB

MD5
c89efbfd895887f5ba2da8ee0191c4ec

SHA1
7caed82ee29259ffd3c4eee4d9f71eaa33f2ba37

SHA256
fc9c6df5981e10a50ccf45baa7d9785df7c8426fc2601d1ee456813ccba4b97c

SHA512
0fa9e1d473a7d6124dea3a91413c9b3ad9a67ad037e13b6a1d7d06d9c1d077f628aee356b4b4f5488c4f08d4a62541ca7cf85cd05fa8904a17ae14c8db5ad182

Download Submit
C:\Program Files\Wondershare\Recoverit\lantern.dll

Filesize
143KB

MD5
c89efbfd895887f5ba2da8ee0191c4ec

SHA1
7caed82ee29259ffd3c4eee4d9f71eaa33f2ba37

SHA256
fc9c6df5981e10a50ccf45baa7d9785df7c8426fc2601d1ee456813ccba4b97c

SHA512
0fa9e1d473a7d6124dea3a91413c9b3ad9a67ad037e13b6a1d7d06d9c1d077f628aee356b4b4f5488c4f08d4a62541ca7cf85cd05fa8904a17ae14c8db5ad182

Download Submit
C:\Program Files\Wondershare\Recoverit\libcurl.dll

Filesize
3.4MB

MD5
396e2b289d2defedb805208539482983

SHA1
a7d5e04f3e537dd60946949de7dc6a5743816644

SHA256
7a0de50399916f8ae7b627907cde841a145e79da18bd7da65599fc373f6966b6

SHA512
0ef07275331bb2fe62477a3d88370ba783335b573ad91770c6fedae02be36aae2dfd79065f6acf2383cd334f54e3179c99aff61efa56fbb9a4d86b47d8eaeb60

Download Submit
C:\Program Files\Wondershare\Recoverit\libcurl.dll

Filesize
3.4MB

MD5
396e2b289d2defedb805208539482983

SHA1
a7d5e04f3e537dd60946949de7dc6a5743816644

SHA256
7a0de50399916f8ae7b627907cde841a145e79da18bd7da65599fc373f6966b6

SHA512
0ef07275331bb2fe62477a3d88370ba783335b573ad91770c6fedae02be36aae2dfd79065f6acf2383cd334f54e3179c99aff61efa56fbb9a4d86b47d8eaeb60

Download Submit
C:\Program Files\Wondershare\Recoverit\libeay32.dll

Filesize
2.5MB

MD5
7cbb225703f108eab9cf962ebff98691

SHA1
026a05adb6860308fa04485c9f050021ca6543fa

SHA256
949e724cc6460592666f7e780e324a6f82c8ea7dbcdf257b90d70fe228cab0ae

SHA512
44c482d81aeb0caa033fe1da344e6a069050fc24e26d14dd4907253755a16c6de76b9fddaf4134215cb1be7d131ebe6235f211acee6a0576162015d69c4c400d

Download Submit
C:\Program Files\Wondershare\Recoverit\log\bootable.ini

Filesize
190B

MD5
b93de78f7d0c383d12efeedc0935d552

SHA1
ce3b5f501336bb0b4fb00b189270560649ad7497

SHA256
de00b141c57b6a0c8f7be20d7fbd66600cd0eebef8f2045682da28e6fbe57066

SHA512
87996f5e955e75b4a83be077fb58004dfb19060d883117f9bfe8a67a2874f20283d126165e60ca0e267b6b4bad2304215e206f80c520606d352a2802093dbcc8

Download Submit
C:\Program Files\Wondershare\Recoverit\msvcp120.dll

Filesize
644KB

MD5
0a097d81514751b500690ce3fc3223fa

SHA1
7983f0e18d2c54416599e6c192d6d2b151a2175c

SHA256
e299b35d1e3b87930a4f9a9ef90526534e8796b0def177fb2a849c27f42f1df2

SHA512
74639f4c2954b5959eb2254544bf2e06ab097219fc8588a4f154d1a369b0657176128c17911958c84ed55421fe89bf98c8ed36d803a07a28a7d4598db88027ce

Download Submit
C:\Program Files\Wondershare\Recoverit\msvcp140.dll

Filesize
612KB

MD5
f18a5e3d3eda812aface74ff79015384

SHA1
7c268240c5d9e316da049158c0ddb893eea63ca7

SHA256
3902beac5889d9cb06d6cc095c1b41472720bb7aaa23c33d68124ca0204b3e9e

SHA512
eea760f14ca3f720c3a09d0f4f320a7f7bff0b18b34a49c370f67978bc6cab19646fde9aa2021c79ef4959f08a5af3fa3b3879d74bf8e4ca669eab0534aa7d45

Download Submit
C:\Program Files\Wondershare\Recoverit\msvcr120.dll

Filesize
941KB

MD5
e2ca271748e872d1a4fd5ac5d8c998b1

SHA1
5020b343f28349da8c3ea48fb96c0fbab757bd5c

SHA256
0d00bf1756a95679715e93dc82b1b31994773d029fbbd4e0e85136ef082b86a9

SHA512
85d6bcaaf86f400000cf991da1b8e45e79823628dc11b41d7631aa8ee93e500e7da6e843ea04edb44d047519dabef96dcb641adc2a7b3faa5cd01e8a20b1f18e

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
cde2424d99db56dd0d1eaf34811738c1

SHA1
cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f

SHA256
4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131

SHA512
d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-datetime-l1-1-0.dll

Filesize
17KB

MD5
acf4321ac8c8ff4d0442c799d621f8d9

SHA1
b12f87e6afc48697f1ce8b587715361e89b79cae

SHA256
69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725

SHA512
7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-debug-l1-1-0.dll

Filesize
17KB

MD5
3c47c25b8141d20b2b4d576000000a61

SHA1
04543f9cdd847ff66389c9fd1e12b444dae6383a

SHA256
290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956

SHA512
c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
e05ce0232e64328c62c9da37698566bf

SHA1
50c25e6ecec2cd17ecf3117bb9a646ba107d2b84

SHA256
573aed3f3eb436f9b7c24d51be3be2105deb8149ebda9b964660930c957b2410

SHA512
8093bd5d1ad96d759a5d9183fca27d7cb756e0884776673f132d20119e602ea33f8121893b9b90965b0eb5710e244faf4e2ad738479998fc2c5dc37f83fe18cb

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
a26c7ffcf18b62904dab7786de638ea6

SHA1
b28489bc38ee2f522ee83dcf49faeb96f39a77e3

SHA256
74075b7af84378cee0d035c020b320ee52a120b21f71a4972093c9e23d534830

SHA512
768c8d7818acacf83d8bd020ab239408673f6cf9e0e8f1be1dab2dd58c5df4e45b970baf7d8d09887280be0788790eacd6126274deaca6b1c4b7bad3e335b34f

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
6a55a7e284b51b086b63cc6f2061ce8b

SHA1
46a48a1ccf5262038b71ed4be09cf625009d078d

SHA256
d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb

SHA512
6a6ba643bf15581cd579e383bac351ccae714d50453cff52cac7dcf5bd472a170e7d33b0509c7bd50c5e76e8a0304fa88dcad63a9e2cd0694a5c56f4a21ae363

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
6e38a6bed88e1c27155e4dc428188ef0

SHA1
8b47a1960ed157f7beeb80fa4a16a723279c4efa

SHA256
144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924

SHA512
3b801875bc5a483eea6d6cc43015e759ee1f66c12585f698cb92368455f25b5309617c8beae39945cadb57009a9c9a9ce21c18dec28e86097c67d8fc5f9febab

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
9304209688e2a18d0b26997bc78fda7a

SHA1
5d4332cf1c5123418c6419d0291486c3939e8785

SHA256
d6bc1509fd2d4ea07e661f2f59395b4d71907d16f59942443a5d460df343dbf4

SHA512
5952e192b6150055bc88e672fb0254bc962abd27afb5c30cd0f52ede98ad84eba9966d721b3b6602116ff40ad5c489a24eac35dde77397db88aa46ad2bd18960

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
f42a84d78a5a15ff1a4dbac591e95783

SHA1
1cd5b5e68fd729bdd340463b53728634d342b0cd

SHA256
f60267cab87dfc1accf912c212186112aba38742f621549d6bc8d67e217e7234

SHA512
89ba6571df642dbac769c72914b30f2d27107f023a9e1cbb0c6f5412b6a69d414cd99f29de07d06592c7ab9cdfc558f3b65b7050921bd442c01417bac0a850f0

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
9f286e57e5b1c1a347adf9eef059ad5d

SHA1
631aa1aa364234acc5ad20b27f926e9cb9ee4276

SHA256
f93ddef4ac14ef778790f3f00057ab6cafc0c99dff52cc24f523d63917719970

SHA512
6df20707ccda0cf9916b7c00b11a4a82b47a0f6e87c6eba0f38e440e143b4aa6e5b48f67d09a9eeef75da2aadfbb5abc7e62362f50d674bb8a532e290699a197

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
beaae8294db31afa04fa60795c6e02ae

SHA1
8a32ebd843e461864747fe0aebf4bbf83c4ec093

SHA256
f8e8d85035bcb478ce2ab47a6476a8c756a7c8fa05bad66b9a03ece6a2ced141

SHA512
dd1a75943401ae5d20c9ee023ba77000db9433a643ec2f102cd3a72faf274deb3611954557c81120d81ff447f86b7309cec1c9005ab37ed7bb48d6e6c239b135

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
2ac1289e4dbab076b332869bef26d3ce

SHA1
60570ddd06b671e26c6a814b9c08cdfa0ef38aba

SHA256
6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26

SHA512
e226fb4739d66e2c4624a9e01ec00dbe3b37dc96995eec35660208d76a9e6758a2a29be1b7986d14074df23ea0fc39d2ce121b7bd32c553371c1b15ff3e2ef7a

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
a2661a468bb87ee9cc5dee968fd3805c

SHA1
9b17fbd552e34888f1453f9113ff4c42efaf6d6a

SHA256
dc41da54e717aef60228ee11d10669c31d3ddd532eee9ecad944c09b71b762dd

SHA512
b5c01cb3c991fcf8945c764b853f8a32fce324f01562107e086dd998a1b31f9285a0d645c96052b94c955f3626691c3ca2cc9e04d8594a0a7c042530549f1aa3

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
acbfc011d5842ba60c372ba3d222ab70

SHA1
16b8014060a04bb03215f6ce4c118bae48653bd5

SHA256
b0ae48eb5ff51fa038e1ed23c7c48d266c20c2af3f9907ee6906bb0346df7f9e

SHA512
dce34d64e6674b67c7c6e7c34886c1ede2967e6af7cfe2addfe51fcf70780a33d7308e7ce81a80149034b8f910c045b3ea81f458d9227448fc4b339dc05a59d3

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
19d14d348ac38737431a7ee2f82973e6

SHA1
11cd8f5dc5c08d133b9b006da5c84946f012cbb6

SHA256
1cd9cff9f7d24b22993a207cb81f15ce2792fa5f941e77e8280db00db6a273ae

SHA512
b3bf7426150bf3b933db4670db3b7d22530c7087efeeab0ddacfbb0bffc01aabdac68e535c7298b13a42530a1aab2340203874b5382581f59309ec9465f6a0cc

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
ea0e13feac13dc18c79eb682bef4676e

SHA1
b9db47624345c68cf07bd2677df537e0f975caf9

SHA256
2658242ccd090181ed944f682c435e5fb880f3b21d1811d43b93478901d701b0

SHA512
540b9f8b18d42e551f13de3d4a6f0f821ea23e4c85a6346b84e8b74d02cfb5413355d126913699208faefd67680c52cdf4e6ecd66fc0cb4753ee603fe9763df7

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
1af2a91dc0a4e48bab0ca123073adf30

SHA1
cf6625fd31b17d46dd31b16372840c74026d0ba2

SHA256
ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc

SHA512
45103c51fc655f608e687c8e9db24c956d12c63b0497ced3817aee3d9f5fadf0741064ccb49ae71fbf377228af315c961fa414221731ea4892425ed4939bbf51

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
9b9d1949b75df171884f6f8caba7ff59

SHA1
411adf413f53c56488d5cf68e9b4b692889f3c4b

SHA256
cffb2007c31932b092cda3a0a39f1cfcc5766b6a1c05e5eaeabc53660cbbe786

SHA512
dd2110a2406e9cf70e26076ff4bc41f5478ece318ac48e8c7d8101e14c41284ddb2ea305560e1fa27d70925525553969fdcab243b31c0fb5ac460e1f00db2b7c

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
18KB

MD5
c6e268c877a9be5b43877308b1231120

SHA1
949105c826dee6a32fe1288285e3e41cb7d04821

SHA256
eae3cd8747da3b435846901a1dbe0e430666d3d8d7ba6e54307cff5d6ee0592f

SHA512
776fe5cc3e5eb7ae9c20e15c6c5bce20fb2a0e9e81d260a08dc41860b3967c7abdc3142786421f349ebe9c43a12e261a34e3e176535b8e04545395279c439331

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
5122b8aa14a25c8567d9d0335036446f

SHA1
81961f2c8a331136f8156930779964a71e0badc4

SHA256
7b5393e2cb79f0396d5d97510e8f0955a2586aacaf60eb8de3676006cb81dc5c

SHA512
758ff98f838f3ca03ef6a9e5a0e39732afed73f4d15dd7d7a1a842c36ad00a859541b4e977af513ddcf970ed994cc27b11654ddc0f15fffd83bdbeff43084cc9

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
e1b30d56617709cf7dff5f464d7566d9

SHA1
e29646b1c90550cb86ed42782c764d41f2c70651

SHA256
5d1a854a0c5121e2e8866dad26545f7f8c2d2f1b15ed7f1ed0b72654a1fc299b

SHA512
e158389a4f71eb94a2e73706f0d52db91798104d990065029a3745dbc9a0459ed9ae96c78bd005043de9057bae66f35a174537c525385abc8e91dbbf579ba511

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
e4b64b2710725ec3332021bd8044d884

SHA1
2d7f8d87d0f395296ecdf277084d23cb9e0880e8

SHA256
9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65

SHA512
ae5570a2cd245588a3f80744c7b1af99533730ebf8926f51a2cc13004a6eb5ecb501aa8c2906e5fa5ddc5a92fb796d54af43b3e3ff97ca1cc3d898462bf7e9b2

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
67fd470a60fe8fb3f9fbe32fa52871d0

SHA1
09aba019a0d0dae7415b6d9a39e1dc67d93f130b

SHA256
1f98f9e044d32e61445c5fab3c80c2f37ca6bab3d5b22cd5611fb5df73db04a8

SHA512
f8c3f1e3bee196487aec704f128240acb57fb392db918a97176793b07726f017177abbb5a6c68822fc59ce06f04d489a78284a865efdc2de518f34ecfb0cc1e6

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f53ed8a0c18157b9e37500621dfab9ee

SHA1
b8a3131150cfd46052353309843c802d9f43df03

SHA256
5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47

SHA512
2cc98322e67ff49aacaba0b23fb559a5c4c58182e4f3965673a766d3198a26fcd7c7c340779d9fb0fc3f2649c16427ff312d87caa1feadf23dabc6675169416a

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
2b9f551cddd662c618432a75c546b296

SHA1
1ddd65fcc8bb401c734ebc2014d057328f771744

SHA256
070afbdbe5b3f3b76b6b7ea2dbb9f8deff81c6ec8706eef9080671543e2ae28b

SHA512
54df6e692ac630d969a697c9e6f379c4826ca71b7e8eaefdf502405b1333a6b483256aeba609a4a1c61e73f72d2958aaf3eb31538cc5e7a91101d7d09e3ed9dc

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
7d943f85ff8d1515a02d202ae79453d3

SHA1
94def1f7368172ac50b665e74b89e8f7aae2857b

SHA256
1d4464fe335470452e58d613028dde2f105edf969d411e90ba7ca9e343c3fc89

SHA512
e111dbef97c6c6cb3b5c2d183294620792c48a2cb16d9d91c12cede757a1c0c53d707f4294542bef47eae784893bf63fe0f0229bed4b2d0a961c8d1cc1cf43cb

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
278857b86f667c47cbcce94f5ec73ca8

SHA1
a0f5b7e7c67f3c6b8f285d39d08b740e49445755

SHA256
91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9

SHA512
ebc02d1a2e223eb0b30a8e62089735faed83add4161094493f62561a09c13a426815e7f06c20c44477691109a8c3040dc68527023bfee6d9984c42d6a05208c9

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
6493b21fefae874655c62a56a156f3eb

SHA1
c65beb46f9f03d35867ff008026d3a56fa26fb65

SHA256
8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab

SHA512
93cbe187f7fa86ac58191b5384a993135e3291873a76cc2cf81dd60c68ad7591386e4eb5ab53aaac2a6f48f7f778263b7fa0a4ea0863361910a9f1efee92b64b

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
ae83311041ee793253ff10736317a09e

SHA1
c62d06cb6cbd9d997c42a6ad7f13c06f38725069

SHA256
8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702

SHA512
0fabcb0370330460f8f525401f339535c08d768f075816989a16eff2256584cfa8fd6832df3ce3d9c2a5364b4ef58bfff53cc486e3b48d11b654f7174aa18458

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
12311308d7d65895b3920b3dd3e54b3b

SHA1
3faa74c6913f451d9c575761630b507af0c15ee3

SHA256
76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc

SHA512
67fd047e760dbdadb06cc2c34b935fdabc629fa988484a9f5120cd59d6167d943b612df65626701022b5e73c5b1177a8d813e90c5990468f51a5a11932c008ed

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
3dafcf25a2ac1becf40acbec8fc7134b

SHA1
0729fdc617403622c2edd77fdb7dd49b530e2037

SHA256
ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c

SHA512
9dbb487489c8a6af8dbd6326fe4958f489552af268f2937495ada35bb8404cfaeaf54833d8bba2966e72cd0ba3284a5fd167baf4cd6d905870f5d1ed3e5ff6c0

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
f32bd567d35d2e85504c39dede609e72

SHA1
b7a7145956466e45bbe6f7fe41e935a152c2c325

SHA256
5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e

SHA512
55396f3e5821d3f3eb5988bd3362a0cddf036de4afa8cc1214813834b5a152fc3df787a8347a7aff3de6bf112e1d2a354790f593854a59f1f49393ddf967d085

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
25KB

MD5
56c02fabc2c64174009c905570c3a22d

SHA1
e52154112ad127ab01937453490091def4d21ad2

SHA256
0aa2cf2cc029c95fc053374071d7873edddc410ff8858720ee5c29bfee62dddc

SHA512
9f22f70b5de4078fcbfdbb186d6cf220561200092eb7ceaaad9d44a5281f84abfb1729f4e447dab3753225d5fc6c44d94363e3729e5765dd2213213c327c4c1b

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-private-l1-1-0.dll

Filesize
69KB

MD5
4b27cf5cdb20aebf113df752019ffca3

SHA1
b02c6e45f704dac118f81c324122c189e3e61e17

SHA256
c1e206aa4c8014dcfdad15c16f50fbf4e3ce8e76e9406af923131ebc001dd5ac

SHA512
cd4df2478d719e159e2252e6784d24e4260c13d8f47774ac33a8e10b1fa96d38236bf2c3ebc060a5801fc19392cbe5c636befa898721bf114956c2be6476bbd1

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
fa677cfb18ba1370d8bb98681c48cfbd

SHA1
cbccd561bf53c59254fb04ab136996b81cc80d3a

SHA256
36589e9738a9358065d5a72f4276505d6c2f78101508bede05bdcceea46a8cd8

SHA512
9312acd4955d4950d851910198d4ee622b75e11262e409c79391078d12d2d0db320723a1552048acc0e9deb30378e3cd27d4fabcf2077d429eedfb275cdb73e3

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
595a997bd415c8ae0ef1e3c3b73e6091

SHA1
10f34bc2f474a43bfaac26f66ec8081106c12253

SHA256
11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f

SHA512
944f6bc405c69d6bf6dc97652e9f296658bd3de078dda50ac680e56818c00dfee909b100fc2fa9c6a891c55dbc66dd62ac52819950732c83198dbb8c04f3c9b8

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
415d765aa267382a79e56e428c80b1e1

SHA1
1bf13460b8aaac1538bf45186a1624825bb8c355

SHA256
cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15

SHA512
7236ef7b2937718409ef4eeda20318b1697e7c1c868d0df263f4be8673365d48ff6ffa2317bfd1881b6cb3dd1300410ad4f715b8e01ed321c4011aac88490d21

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
5bd5a9001cb0555c5b2b14e0cbc8d922

SHA1
4562d23fba312fe95cbc777fd7c2e37ca1e76ad9

SHA256
b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7

SHA512
a6271f28f069a00c2912f80552bd54bf0d8461886adff626b336d25943dd0ade19eb88c718602017a1986317af3eb5f94f8896e88b9367207e8b53225322cb84

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
f719ad4c04043f55a21e73805997b287

SHA1
0e88b1271b242f7933e78edcb05131612cea061e

SHA256
a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983

SHA512
752b9b4385162126729c3f09b3b75d7121c8dec00cce11f7cf1ecaffed3e79addcbcfe8bdd4e20e15b8494bfe2d24c3f2d11583860b1e03be021196bc83fc3bf

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
a405399d5b958a03e6054307a631553a

SHA1
dba43f0afd8c6e1f61cf0be7503c6f70b48b8240

SHA256
d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd

SHA512
33c64766053058fa9fa4fe689f1ca5a345b8b70443995d71aa65b64c7bb38d4dc3a2b37ad06a4ce5ca1c927ed9ea4377443eaaecc69b0e758ff265e755194287

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\libcrypto-1_1.dll

Filesize
3.3MB

MD5
0225d6124372bba720843549f9cf602f

SHA1
045055257345a336bd3602130e7623d651f5138b

SHA256
abeb51338fb5b19ceb8dc43c1bef9f95444cd1de6e82da6ce6ee1fcff6b4ddd4

SHA512
0d4ad87c944e978a4dc59a0746bff81893f8fee6bf1561a95384313e58c4efa8527b13147b87d11b1b0ca12d925324f3aa58f4e63b333a766ff35de1448a1a76

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\libssl-1_1.dll

Filesize
687KB

MD5
5b47020f6f35945c49dc9613151d3c16

SHA1
ac2d1095fbbfe6877368343e77493a904c9c2809

SHA256
87a3869cddb79a325b97e48c1d900eee1ed28013ded59f5b91ffe57c181ab8cc

SHA512
54f96d0f969d5f4737b1d3ae9d2c9599d75ad308e78ae309637b25015efcf55dee7c98c5ce19ecdbb8eccccd257d3a37edabb395ee4e4aefb5ee58db452552bb

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\msvcp140.dll

Filesize
612KB

MD5
f18a5e3d3eda812aface74ff79015384

SHA1
7c268240c5d9e316da049158c0ddb893eea63ca7

SHA256
3902beac5889d9cb06d6cc095c1b41472720bb7aaa23c33d68124ca0204b3e9e

SHA512
eea760f14ca3f720c3a09d0f4f320a7f7bff0b18b34a49c370f67978bc6cab19646fde9aa2021c79ef4959f08a5af3fa3b3879d74bf8e4ca669eab0534aa7d45

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\ucrtbase.dll

Filesize
973KB

MD5
ed82e9c6c4f7a475d7fd6ebabf3fab2a

SHA1
1062942b1bdfc8d7c8a941c152df69216010d780

SHA256
4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb

SHA512
bf7bdf4762455a1224cdf1e7cdeb73a3c24c3e04d0b01df9f46b87d174cf4a88621372aa87b7e622b210f63a453c911d88e214ba67560f8ff7d7d0d24da58ad2

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\vcruntime140.dll

Filesize
83KB

MD5
0c583614eb8ffb4c8c2d9e9880220f1d

SHA1
0b7fca03a971a0d3b0776698b51f62bca5043e4d

SHA256
6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9

SHA512
79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64

Download Submit
C:\Program Files\Wondershare\Recoverit\pythonoffice\vcruntime140_1.dll

Filesize
35KB

MD5
e576b09b506b5e8377d208d23e6c444d

SHA1
b5a8a1a34ee9429e6ea2c74e2ec3641799e5ad39

SHA256
a0857889cbbbac22e47087c45bccdfed138f7a38fc4d19764402beabd21a8da2

SHA512
05e17052eb5ee2ff58d53543eae66a8a9ee49175d26591eea1f7b334eef8821395e6c1b1d7ac0a4395b32247299cf210277311649d95c450323ff1d3554b9b99

Download Submit
C:\Program Files\Wondershare\Recoverit\quazip.dll

Filesize
170KB

MD5
e90f5c1a76f95910f47117ab6fd8e98b

SHA1
706f6088dca75206e80b7aec934253b6abd0b629

SHA256
d0e155d7d3c7f1b6ae56ffe01a3e66ad00d34c7f406fbf2744d17e5b047fae85

SHA512
abad74b0d8b40f78d8c54040a75cf449b0f8111badfa8aa0625e6f6329232c48534b68b73a80b66e0b9a16f4cd1720d189424e0f8673e8db9e632981cc51b2f4

Download Submit
C:\Program Files\Wondershare\Recoverit\quazip.dll

Filesize
170KB

MD5
e90f5c1a76f95910f47117ab6fd8e98b

SHA1
706f6088dca75206e80b7aec934253b6abd0b629

SHA256
d0e155d7d3c7f1b6ae56ffe01a3e66ad00d34c7f406fbf2744d17e5b047fae85

SHA512
abad74b0d8b40f78d8c54040a75cf449b0f8111badfa8aa0625e6f6329232c48534b68b73a80b66e0b9a16f4cd1720d189424e0f8673e8db9e632981cc51b2f4

Download Submit
C:\Program Files\Wondershare\Recoverit\recoverit.exe

Filesize
26.5MB

MD5
3c84dcfa3ba19d3df9ef8580ebad8a12

SHA1
e35225d942b9b67e69f12d73ab7e54f26bb8eecf

SHA256
278b5c5fd757d23b02a764bb3d20721d254a4f9d29d47d69c302900116200286

SHA512
1346477992d77d22b9a147d4d9e6dba95d95a0702e1f7c0101740e57f0e17eb88b94fd88c857c271f666200626036afc4ff7f3a3391491809bf28aee24a7d8f7

Download Submit
C:\Program Files\Wondershare\Recoverit\recoverit.exe

Filesize
26.5MB

MD5
3c84dcfa3ba19d3df9ef8580ebad8a12

SHA1
e35225d942b9b67e69f12d73ab7e54f26bb8eecf

SHA256
278b5c5fd757d23b02a764bb3d20721d254a4f9d29d47d69c302900116200286

SHA512
1346477992d77d22b9a147d4d9e6dba95d95a0702e1f7c0101740e57f0e17eb88b94fd88c857c271f666200626036afc4ff7f3a3391491809bf28aee24a7d8f7

Download Submit
C:\Program Files\Wondershare\Recoverit\recoveritassist.exe

Filesize
1.1MB

MD5
fe218409d2ca4b6e700cef4e09e9b231

SHA1
ec200231e0aed7410176d1b5506b78991c99d683

SHA256
6e31bb85da5b698e0e5ac32d645a7dc2d4c318029c5083f535cee7bb1ae67753

SHA512
0913814515c94d17ddde01a41b7a38225ffd25dcc9b7bd83849b7859856f053794ae62249d95f2a4728140300472c1c6e2f80a801ead6f41065aff272619c50b

Download Submit
C:\Program Files\Wondershare\Recoverit\sawrapper.dll

Filesize
3.4MB

MD5
c12febf8bae76b9ab65b76f2044fa44d

SHA1
a5eb0b4776874729692957f58b6c20556920304d

SHA256
b4ec6436d3be3aa192e9e38d13b0dff35159e61dfd45a066f7f7b631d300bd44

SHA512
da6f069121c3827095092e991c292ec6d6882d49ce38be8ab2de008452b900166c092be07468fedee40cf91d73fbd8f2c67b7fc88fca84073a316bb44789d1d7

Download Submit
C:\Program Files\Wondershare\Recoverit\sawrapper.dll

Filesize
3.4MB

MD5
c12febf8bae76b9ab65b76f2044fa44d

SHA1
a5eb0b4776874729692957f58b6c20556920304d

SHA256
b4ec6436d3be3aa192e9e38d13b0dff35159e61dfd45a066f7f7b631d300bd44

SHA512
da6f069121c3827095092e991c292ec6d6882d49ce38be8ab2de008452b900166c092be07468fedee40cf91d73fbd8f2c67b7fc88fca84073a316bb44789d1d7

Download Submit
C:\Program Files\Wondershare\Recoverit\vcruntime140.dll

Filesize
83KB

MD5
0c583614eb8ffb4c8c2d9e9880220f1d

SHA1
0b7fca03a971a0d3b0776698b51f62bca5043e4d

SHA256
6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9

SHA512
79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64

Download Submit
C:\Program Files\Wondershare\Recoverit\workorder.ini

Filesize
36B

MD5
3ae229d269514d507781d0f6ababc357

SHA1
44285a998806fd05efb26265d7aae6fbb5368f97

SHA256
5c0eb4c9bebad75f58ef219ba2344b884bf7b9700d00ac01066b810a0ad01b7d

SHA512
61cfb3c166391d767331ac36aedad816013a3cadd687a070b2bb882f6c0d543d9108b5b005a4173cdd94121349f3648091d43cb54aff14398ecea1fe96d1f432

Download Submit
C:\Program Files\Wondershare\Recoverit\workorder.ini.lock

Filesize
62B

MD5
d7c8e90b4276db4b7289487f2b400301

SHA1
0f6a209535045046dab205b7916440702b00fb2d

SHA256
2216ae08195b21d46aed8b8760bd776b23b25d8a1959d6714c5f392a5cece95b

SHA512
95080dbf08497cac0ec5f2e310ac7d56751a62cdf8e5e6565cdddbddee22ff99c0d25f0c81220ab37fa5a257c141a626aa6a2b56dc25001a99c1b117542fbc52

Download Submit
C:\Program Files\Wondershare\Recoverit\wsUpgrade.dll

Filesize
766KB

MD5
7aa297cb7dd17f57314153901f05b4b7

SHA1
dab25a0414b369a4dce85ac15bc6f7ab73b890d3

SHA256
97cdebbb7c07616ba3280ea2eaec0f4c28dc78f76b3dc01461e536919a8fdea5

SHA512
de34123118645a643879e2b2ffd61664670a216ca1866ea928a105bc9564a93c057fb38d5fd3b1d120e1005d7cc8cb5f99c72e563f09d5957a90a12caa09514c

Download Submit
C:\Program Files\Wondershare\Recoverit\wsUpgrade.dll

Filesize
766KB

MD5
7aa297cb7dd17f57314153901f05b4b7

SHA1
dab25a0414b369a4dce85ac15bc6f7ab73b890d3

SHA256
97cdebbb7c07616ba3280ea2eaec0f4c28dc78f76b3dc01461e536919a8fdea5

SHA512
de34123118645a643879e2b2ffd61664670a216ca1866ea928a105bc9564a93c057fb38d5fd3b1d120e1005d7cc8cb5f99c72e563f09d5957a90a12caa09514c

Download Submit
C:\ProgramData\Wondershare\Recoverit\AntiPiracy.ini

Filesize
152B

MD5
2742ebf51323ba76711d658dcca3065d

SHA1
84117fb63b1194637b14a9ef4f49e60ef271b23d

SHA256
4c6dcc27e4003aff8df6d11f50dd702ac66ba6c6fc44904959492700516eb46c

SHA512
3a3e59fb680b245a12a2c614168b8229841864b0bdbf9bbf41e921985740389064331ad59ce34d9f11bcbfa10ae497744a82967469a8ccc03eee8b880e16d889

Download Submit
C:\ProgramData\Wondershare\Recoverit\drrs.conf

Filesize
47KB

MD5
f7bded64b424f8358ebb3daf544ddfe9

SHA1
c9cb0ef57bc44a35cbc5cc94f8f38a3f4518584a

SHA256
3e95d5c26e41fd9dc2dc080201c43a432b7373bb0f790f47a8c18fae6a005574

SHA512
863692bae10bf02c7c66436dc13fa6fad865afa9da894a0a2b315d99df0cdcd3a5b7862e492196031df88590774d57583f90f410f28e733c701fdda5e67b4902

Download Submit
C:\ProgramData\Wondershare\Recoverit\piracyMacAddress.ini.uJMnVV

Filesize
86B

MD5
7df93e2982b29efafd8cebf36d94b6ad

SHA1
3595aff9006e778fb510dc14a337d786ec873756

SHA256
02b808e28c1019ffcdc456b64180dd96f5e0179e27f3f85ecf81b41115fcc936

SHA512
14f14a24b336d8b0ccbb4ac95904b4841bdcb7d8bc2a0775da31bf68b70f53843a272430058170d930772303761d65b367e6f896e7d8046526c9939f2b89ee2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8c9383861d9295966a7f745d7b76a13

SHA1
d77273648971ec19128c344f78a8ffeb8a246645

SHA256
b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e

SHA512
094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91fa8f2ee8bf3996b6df4639f7ca34f7

SHA1
221b470deb37961c3ebbcc42a1a63e76fb3fe830

SHA256
e8e0588b16d612fa9d9989d16b729c082b4dd9bfca62564050cdb8ed03dd7068

SHA512
5415cd41f2f3bb5d9c7dadc59e347994444321cf8abe346b08e8c5a3fc6a5adae910eda43b4251ba4e317fbb7696c45dba9fd5e7fa61144c9b947206c7b999c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a27149b5dcc7fe2165584bae2b52d379

SHA1
74f826707f3560bc84999e2de4202fb97b3750da

SHA256
af709797d430693742321dad7dbb1f32505972f25b209a89caf741d849582a9a

SHA512
e0df87c6beef29f24d3bdbc2dfe9965808d7ddba424953bf211d6dc66a49867e8bd8ddf0bf89570ff8183adc02aed514088a9735b7c3dfd2829c4fbf5d1f6d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
0267d39360609a08ca9c591104d9432c

SHA1
441ae57520c1061f44bdb8df65e883036d521e9c

SHA256
50f82977720d4d3531b185c3fe735a5e421a70e5608c434434e488363d62a9a8

SHA512
12d4f66d6d1f14c886f023edc0ab80fb9ac295eb3588493b3c28032756fbb236d7a96407aa73b3e6cb11d977cd10830682dbaa329d0fda7f31ea100f11b68bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
e08b109993e91bcf2282d59b24b5c553

SHA1
6cd7dd21248bc4e73ee0bcfa1a65915ae98d07a2

SHA256
ec5f4e85675c74b7c49e42a34a0d8329d0b093d4d21c6d874dd3b7aa116b64a9

SHA512
1d6c4beb10159775c476ec9a1eded3cb37c1ed668e05b7cfd9697293a1af411aea3581a8eabbd4d0da0aed4a79b9c7724483a168c7c1faa3c41e129b2b303fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4bd9b9a36004e25e8b1f2cc45f7cd8ba

SHA1
d8d978d27379592f133536a84be1476bc44195db

SHA256
8e2451d488a1f8bab1ba40136ec7cb399d67704919fadc58b1f360766103f3ec

SHA512
991b7a622b129bd9bf0f78549bb56ede3b0454ed1f6b63fc84d1ff70773a33fbc72bd21f5dcfe1f75a8655cdb2644f10b84d3296481a8b2fbad71760a74867cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
c4eb9456668831e335b8cb33cfb55053

SHA1
b5e2930a1e7d0a3eac11583f8aa75d59ec8945c6

SHA256
7998c32ef192b6634fcede09aa15150ac83961f290a656f1f2386adfbdfc96fd

SHA512
0a3e5c14abc805e577de0120a339b6b6e7485e7133b7f1aa37a102f2fb4c6044ae7de6876d2423b4308b4d3313c998980c7bb0017cd87119458f62ff1c9da5af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dafc3bf7b0f5f73b45838c82aab1e4f8

SHA1
6bbdf8d98efc30e1576f467620977506624d4c39

SHA256
43121a73091073657c364880e1af096a1cdf1fcaab314874a86c62d5692c718c

SHA512
692eae4d1fceb69af94691348943b82632121b2160b1214fd7d654d3599bd2e33c6c9197e5fd373fc4c4c283b8e2ea16cfeac5182a659c257332ff7ffb40320f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
591008075f77ec7f0e50a17e68009e67

SHA1
29c196d437291b35626cbdcc205dcee3224bd313

SHA256
1536957cfc27359bcb9f7b5a9413aee9e9d02d51c874bef900f8bd3521a1aba9

SHA512
444c20606b4bfb20a6729ae2d21c406728debdd02a3372cf61ef2178ccf5f5a4d0ac6ef5a09541127ac55b6efa95ffc9bbf295152b085a660bcdfb0a37a9b858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60b345592703258c513cb5fc34a2f835

SHA1
39991bd7ea37e2fc394be3b253ef96ce04088a6d

SHA256
7e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300

SHA512
0346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1e5ba0451ff36f3ea9e13836ff06ff26

SHA1
29d9432a220b56a8aff2ec973bd6006dad895117

SHA256
be939c53dedb05948868aab0d04a7a31d9883884262e1da601e23cf95ca80951

SHA512
10247ac659e1ad79d1984e617f9ded79cbddfe9c69177968f385729cf7d934c3ca82d4da8ad5dc025336b2ffdb0fbb7629fc0c400896304a5a71a001d030ee9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
397ae52be8302870d43e1e55e7aac8ba

SHA1
d5443793c2cc7194a62837716a3025ee2bbe7de2

SHA256
ff0ec3f1fd6231121b8ce570d476b9693826d93742f7b1bd6f70270106417ed2

SHA512
99ca89d2a98f74fb988ad53a893e2408b3389896819f244b6c740f8c3dc99162b75fc406f02da6443f845bddbccc4ff9c7ae4bcc8f892cb74edba1f4f24bccc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
0fd4ea7e985c2083cd0102aaafd97af2

SHA1
0879b0bd0b2f398b2a66e35dfb53b0146f731e7b

SHA256
6b98242e2b16a13034d9deaa17976e787937cc8f27b2a88004adad25716231c3

SHA512
4b027d6092a8442e511e4c824c612f2c0b55f7c03aab187ba4338a37047f0bcc95601af126f9b3dadca4a5191aa912a4e9253f2d9feddc9598320005517c9c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
b03b326e97411170a063bc7021af2789

SHA1
89116103b899792b878345d9b610b91646cca835

SHA256
2eb1aee5cf85c2428ccc95041e03f00a3243d8afbb1d6586bcc2671aad49e7b9

SHA512
0647fb3040d25b6f826a54907154c4b60cb9b0e70eb5adf75f74287ebb2bde94816fcc84b5e48d81e3bb7dfa9bf2214c8b99398f213f5873d1da10f75d7ae8ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
979a324b6a9d17f7deff027ecdc44ae5

SHA1
46ade807b7ad2dd54997259387277c41e37b3c20

SHA256
d4ff582ed57746e80d2420536921360a27fea0089d7590b8ddabd4dadb2cd31a

SHA512
64865b7c1eb046232deacd883087c35513a29ad0a8a37941d181b96628d0379287c01c191eb82e42e144f1b8c86175bf64cd30cc012453c92f12ca41f9ce0c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wondershare_Recoverit_Processprotect\processprotect.exe

Filesize
1.9MB

MD5
f74534bb6759dc9c04b9ed26dc1aebe2

SHA1
3cb2a51dc88ba2740a6971993649dd71244775e5

SHA256
cfe5f6f7e3164a2d93363e911eb845300e82a14e1aa589e5c14690479da17d2f

SHA512
4bf34d90cfa2dd9205cd2fa8e45abbca5f3ba7c415761682a0444f21cbde656dd52eed693cad3142b9e2aa562e4fe44eb28c9856c21d10d77c0b5d02dfc480fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1N2KU.tmp\Customization.xml

Filesize
61KB

MD5
e670666078cb0f59128dac6e3a1c26a2

SHA1
e3ddc989eb116bf495c597f65d2b577b23a7a11c

SHA256
60d279965e9ee882e214c996ba6a61a730b1c8e55b5736703ecfb5394c74a337

SHA512
1ec191f53c308c89b044d4b99a549c78896587da7a7c8f653f1c92471cfcb46f95206943364d728a2791122d62032dac330ee5c98bfe52196963fd95da3f24da

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1N2KU.tmp\Mutex.dll

Filesize
144KB

MD5
0750f0c68fc63be266d7f082beafd274

SHA1
662b69339ede67058e3542be8df5a3c300820fad

SHA256
0d094b9c2cae4043a5a99f0ef5a05fb95923606b13e39ebfb888d7b32e16c146

SHA512
8997d5f43ef9390d4ecf95ee9a6fff2cd6dbabd9b5cc44794ffdd4e6ed940d0d768561f1765acf5c199b89442c0c5d9328d2cc0d657d29d5041bd6bfc4e693ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1N2KU.tmp\Mutex.dll

Filesize
144KB

MD5
0750f0c68fc63be266d7f082beafd274

SHA1
662b69339ede67058e3542be8df5a3c300820fad

SHA256
0d094b9c2cae4043a5a99f0ef5a05fb95923606b13e39ebfb888d7b32e16c146

SHA512
8997d5f43ef9390d4ecf95ee9a6fff2cd6dbabd9b5cc44794ffdd4e6ed940d0d768561f1765acf5c199b89442c0c5d9328d2cc0d657d29d5041bd6bfc4e693ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1N2KU.tmp\UpdateIcon.dll

Filesize
32KB

MD5
9da5e5c13c7cdb9d40a6d48dc144f103

SHA1
9ca63e96a74cd6e15650381713a9f21f74b2bfd0

SHA256
06bc5482590c17db6d3a8a2ed284d507ed93e239690e508a44a8af6c461cd218

SHA512
914b31962ebeea3957a1e600365197744420ee73ae36b5b9aec9a32ba24310d133f1cb377dc53b04017815a3010b0f0875e250641d40e063369627ac1c67d7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1N2KU.tmp\UpdateIcon.dll

Filesize
32KB

MD5
9da5e5c13c7cdb9d40a6d48dc144f103

SHA1
9ca63e96a74cd6e15650381713a9f21f74b2bfd0

SHA256
06bc5482590c17db6d3a8a2ed284d507ed93e239690e508a44a8af6c461cd218

SHA512
914b31962ebeea3957a1e600365197744420ee73ae36b5b9aec9a32ba24310d133f1cb377dc53b04017815a3010b0f0875e250641d40e063369627ac1c67d7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1N2KU.tmp\WSOverlay.dll

Filesize
84KB

MD5
e826d450412694feebc830a32e3c74b0

SHA1
eb4f73ea8dfa0ed011c736260e1fc37ab14c27d3

SHA256
fa33275ad5c18f2e29c58e46a6ea39c8c9f6391e92debd35de1e22e4c4271413

SHA512
d534ae4965926536baf939abed6061d91cc2ed31b1138561700b8b054f0859e3ea80aa6ae555296fed4707cfe763c3731e671c9f1396c8bf0df7c8d59222989b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1N2KU.tmp\WSUtilities.dll

Filesize
202KB

MD5
92e648bc18fe9769a21e9bcf5d134512

SHA1
177657a72634de5e4a929e694c8d420597de34bc

SHA256
7935463db52637ca17e1b9f62749aa8362452d92be56c76ad579af11833e713a

SHA512
ce66d52d1e6ee859db4226d8a8babd4a8f2dadd67421145cd1981d9538c455adc613b950afb6e453659b426a5980f6c8640cd2160434bfa2e0912cb686993ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5VF3R.tmp\recoverit_64bit_full4174.tmp

Filesize
2.9MB

MD5
eaa28154d603736c0224c312628a825a

SHA1
2eecc9d0dfb2efaaeb4c4325eb2aea9652388fa5

SHA256
ccdf345021579084a9b5a0509a76dfd2d8f3d43cea4faf881a09c7f1f1d3f025

SHA512
9db87aeb0b902c42d13a756ccf6f6a34a2b695dc08080f7f1223d4e1fd7045332e6a4ead834bd03e10b82592f2b560c791fad6d30b9477642bfb2030508dcaed

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5VF3R.tmp\recoverit_64bit_full4174.tmp

Filesize
2.9MB

MD5
eaa28154d603736c0224c312628a825a

SHA1
2eecc9d0dfb2efaaeb4c4325eb2aea9652388fa5

SHA256
ccdf345021579084a9b5a0509a76dfd2d8f3d43cea4faf881a09c7f1f1d3f025

SHA512
9db87aeb0b902c42d13a756ccf6f6a34a2b695dc08080f7f1223d4e1fd7045332e6a4ead834bd03e10b82592f2b560c791fad6d30b9477642bfb2030508dcaed

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5VF3R.tmp\recoverit_64bit_full4174.tmp

Filesize
2.9MB

MD5
eaa28154d603736c0224c312628a825a

SHA1
2eecc9d0dfb2efaaeb4c4325eb2aea9652388fa5

SHA256
ccdf345021579084a9b5a0509a76dfd2d8f3d43cea4faf881a09c7f1f1d3f025

SHA512
9db87aeb0b902c42d13a756ccf6f6a34a2b695dc08080f7f1223d4e1fd7045332e6a4ead834bd03e10b82592f2b560c791fad6d30b9477642bfb2030508dcaed

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5VF3R.tmp\recoverit_64bit_full4174.tmp

Filesize
2.9MB

MD5
eaa28154d603736c0224c312628a825a

SHA1
2eecc9d0dfb2efaaeb4c4325eb2aea9652388fa5

SHA256
ccdf345021579084a9b5a0509a76dfd2d8f3d43cea4faf881a09c7f1f1d3f025

SHA512
9db87aeb0b902c42d13a756ccf6f6a34a2b695dc08080f7f1223d4e1fd7045332e6a4ead834bd03e10b82592f2b560c791fad6d30b9477642bfb2030508dcaed

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log

Filesize
2KB

MD5
fb5c96c1fc87ade65c73c0f1975f3b2a

SHA1
abfc0d1e0e6974d38762373a5b522f6bbb764f9a

SHA256
1f5ca1548484bb7873502b329cc0e77f87756942b32ada7015bb421814aed234

SHA512
7293d453d48be7dfc984e371c29a777d114caebef364c0d64cc40691ec3e4db6bf8390f2346be8ca31e623b3afcf77da0cb9d159dcfdfdb5b08a7e7585c04f5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log

Filesize
4KB

MD5
344192036f27a6ee8300b23e52fb8d4f

SHA1
c290e3653a4b61c8dbb3686449d6553122dca195

SHA256
4963d251f64f84d9076b3857c5d72ec587fa6f096850c1b89fc3986cf8c0c06a

SHA512
afb61597e2c54ff5d88e1bc15144f87edcd19ae0a5695f7d140f3b6512702ebe53f26e71719981186f415cf6aef61823c333cdd4bc2d5cdc4d9539eced0e4a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log

Filesize
672B

MD5
b2d7b6fb0dd47252d0f4ae6f15238458

SHA1
8e8ec1b91f8bf40024e9f3635ae1556d749b1126

SHA256
6b74083eded37e7be13a7018f749e5f383916321ddfa1d58e128701fc8ae1b87

SHA512
3e2cd4e1c680fb4c6077bd010cbbec5c6a9cf29999e64d0339f79d99a7f5a6e0e040acc24bc61793d00ec5afef860a5106c1d8c7769f6a888fe26fb765b23c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
960B

MD5
eead5022d6accffff7630d659c2382ac

SHA1
c623702fbf4a63a3ed247e10b4e11c1dfdd7e816

SHA256
3167ffe479b0a1601d6e1ebf14be8e51101820c3309d1a4290aef86a17b66b09

SHA512
0882af74f8559136846f1e6ec82589f4360f40022005f504a97a3989f881b6e30077155f518a6bac9224680586d990ae734c929019555080a7da631facc4bc89

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
7KB

MD5
c0a96490c79e65077cdea83520f49778

SHA1
d1383c93ca568d1d80bac684f8f6f7259b3f8bf8

SHA256
3582d234a7672b437ed1e80efc2949a426a75ee6576e9d516c2ed06464ee1e18

SHA512
1befaa93e1d462b95864d170772ec7b28391e8ba6a01908faac6c6b1eb05fe11271973774773c416a2451c58eda2fc0f0884defb46cabb75d84a906ce3baba24

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
229B

MD5
ad0967a0ab95aa7d71b3dc92b71b8f7a

SHA1
ed63f517e32094c07a2c5b664ed1cab412233ab5

SHA256
9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc

SHA512
85766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b

Download Submit
C:\Users\Public\Documents\Wondershare\recoverit_64bit_full4174.exe

Filesize
131.7MB

MD5
7f44d741d63c05c257e128d0ab267d07

SHA1
063612137eafa6888a3bc971a577d30a18882712

SHA256
bc40509495dd8eb7b03e3768a8f09ee33bd5a004781bb50b3f8c0478d28d853c

SHA512
453fbb123384cb3eef00d7b82e0752f9ae9fa0710b7c6da01fc66e42e4533114b11cad9dbff77a518355d67b351979dff584e1ea959481bccf9f8fe8c6065996

Download Submit
C:\Users\Public\Documents\Wondershare\recoverit_64bit_full4174.exe

Filesize
131.7MB

MD5
7f44d741d63c05c257e128d0ab267d07

SHA1
063612137eafa6888a3bc971a577d30a18882712

SHA256
bc40509495dd8eb7b03e3768a8f09ee33bd5a004781bb50b3f8c0478d28d853c

SHA512
453fbb123384cb3eef00d7b82e0752f9ae9fa0710b7c6da01fc66e42e4533114b11cad9dbff77a518355d67b351979dff584e1ea959481bccf9f8fe8c6065996

Download Submit
C:\Users\Public\Documents\Wondershare\recoverit_64bit_full4174.exe.~P2S

Filesize
131.7MB

MD5
7f44d741d63c05c257e128d0ab267d07

SHA1
063612137eafa6888a3bc971a577d30a18882712

SHA256
bc40509495dd8eb7b03e3768a8f09ee33bd5a004781bb50b3f8c0478d28d853c

SHA512
453fbb123384cb3eef00d7b82e0752f9ae9fa0710b7c6da01fc66e42e4533114b11cad9dbff77a518355d67b351979dff584e1ea959481bccf9f8fe8c6065996

Download Submit
memory/220-3492-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/220-3499-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/220-3485-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/220-3470-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/848-1193-0x0000000000E10000-0x0000000000E34000-memory.dmp

Filesize
144KB

Download
memory/848-1203-0x000000001C8B0000-0x000000001C8EE000-memory.dmp

Filesize
248KB

Download
memory/848-1198-0x000000001BB70000-0x000000001BBB9000-memory.dmp

Filesize
292KB

Download
memory/848-1197-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/848-1196-0x000000001B3B0000-0x000000001B6BE000-memory.dmp

Filesize
3.1MB

Download
memory/848-1195-0x000000001B390000-0x000000001B3B0000-memory.dmp

Filesize
128KB

Download
memory/848-1194-0x0000000000F70000-0x0000000000F88000-memory.dmp

Filesize
96KB

Download
memory/848-1199-0x000000001BC30000-0x000000001BC92000-memory.dmp

Filesize
392KB

Download
memory/848-1192-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/848-1200-0x000000001C170000-0x000000001C63E000-memory.dmp

Filesize
4.8MB

Download
memory/848-1201-0x000000001C6E0000-0x000000001C77C000-memory.dmp

Filesize
624KB

Download
memory/848-1202-0x000000001BB00000-0x000000001BB08000-memory.dmp

Filesize
32KB

Download
memory/1376-3165-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1376-1932-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1376-1929-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1376-1956-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2448-3432-0x00007FE0FDC00000-0x00007FE0FE000000-memory.dmp

Filesize
4.0MB

Download
memory/2732-3431-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/4620-2327-0x00000000078A0000-0x00000000078AE000-memory.dmp

Filesize
56KB

Download
memory/4620-2324-0x00000000034C0000-0x00000000034E8000-memory.dmp

Filesize
160KB

Download
memory/4620-2270-0x0000000000400000-0x00000000006F9000-memory.dmp

Filesize
3.0MB

Download
memory/4620-1936-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/4620-3163-0x0000000000400000-0x00000000006F9000-memory.dmp

Filesize
3.0MB

Download
memory/4620-1957-0x0000000000400000-0x00000000006F9000-memory.dmp

Filesize
3.0MB

Download
memory/4620-2672-0x00000000034C0000-0x00000000034E8000-memory.dmp

Filesize
160KB

Download
memory/4620-2673-0x00000000078A0000-0x00000000078AE000-memory.dmp

Filesize
56KB

Download
memory/4620-2670-0x0000000000400000-0x00000000006F9000-memory.dmp

Filesize
3.0MB

Download
memory/4620-2017-0x00000000078A0000-0x00000000078AE000-memory.dmp

Filesize
56KB

Download
memory/4620-1981-0x00000000034C0000-0x00000000034E8000-memory.dmp

Filesize
160KB

Download
memory/4652-3271-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3324-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3514-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3266-0x00007FF7C3040000-0x00007FF7C4B6B000-memory.dmp

Filesize
27.2MB

Download
memory/4652-3269-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3265-0x000001DDFC6E0000-0x000001DDFCD87000-memory.dmp

Filesize
6.7MB

Download
memory/4652-3256-0x00007FF898580000-0x00007FF898ACF000-memory.dmp

Filesize
5.3MB

Download
memory/4652-3270-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3272-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3276-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3384-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3355-0x0000000063080000-0x000000006329E000-memory.dmp

Filesize
2.1MB

Download
memory/4652-3273-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3268-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3274-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/4652-3794-0x00007FF896EC0000-0x00007FF897D81000-memory.dmp

Filesize
14.8MB

Download
memory/5268-3616-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/5268-3867-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/5340-3774-0x0000000001770000-0x0000000001780000-memory.dmp

Filesize
64KB

Download