ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Resubmissions

25-12-2024 03:42

241225-d9c21axjdn 10

25-12-2024 03:39

241225-d74ryawqfw 10

25-12-2024 03:37

241225-d6fzgswqbw 10

25-12-2024 03:21

241225-dwt4cswpdj 10

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Size

321KB
MD5

04ba14a9828b000add142d0bcb42ac2d
SHA1

928a705a481384dee3aa9985bb2a9e1e6827902f
SHA256

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33
SHA512

2fc56d6fdf360c0435f76822f3d99288c3b31462931eb128c7ed895bf93d88b00663801c1a5394b1ae5bb081ac76b004deaf46fdf2b0b9c027b2945a7c030909
SSDEEP

6144:ba4FsUiep6JzvI74kZO/+SJtwOW8HFBwK3SBDmhYfFQ:ba4Fs/7IfO/+SJFW8HF+KCIG

Score

10^/10

ryuk defense_evasion discovery execution impact persistence ransomware spyware stealer vmprotect

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Ryuk family
ryuk
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral11/memory/2916-0-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral11/memory/2916-2-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral11/memory/2916-9-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral11/memory/2916-30948-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"	reg.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\Wks9Pxy.cnv	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01216_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADVCMP.DIC	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292248.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART11.BDR	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\APPTL.ICO	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152626.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199465.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POSTL.ICO	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\grvschema.xsd	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IT.XML	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_OFF.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\BUTTON.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21334_.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0075478.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSSPC.ECF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.FR.XML	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18202_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_OliveGreen.gif	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR41F.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02389_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Trek.thmx	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME44.CSS	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\SHOT.WAV	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Interacts with shadow copies 3 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
73148	vssadmin.exe
73288	vssadmin.exe
71948	vssadmin.exe
73012	vssadmin.exe
73368	vssadmin.exe
73464	vssadmin.exe
72584	vssadmin.exe
73708	vssadmin.exe
71740	vssadmin.exe
68736	vssadmin.exe
72700	vssadmin.exe
68452	vssadmin.exe
72736	vssadmin.exe
72888	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Token: SeBackupPrivilege	73280	vssvc.exe
Token: SeRestorePrivilege	73280	vssvc.exe
Token: SeAuditPrivilege	73280	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1808	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2916 wrote to memory of 1808	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2916 wrote to memory of 1808	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2916 wrote to memory of 1808	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2916 wrote to memory of 1100	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	19
PID 1808 wrote to memory of 2752	1808	cmd.exe	32
PID 1808 wrote to memory of 2752	1808	cmd.exe	32
PID 1808 wrote to memory of 2752	1808	cmd.exe	32
PID 1808 wrote to memory of 2752	1808	cmd.exe	32
PID 2916 wrote to memory of 1164	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	20
PID 2916 wrote to memory of 1612	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	25
PID 2916 wrote to memory of 72444	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	34
PID 2916 wrote to memory of 72444	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	34
PID 2916 wrote to memory of 72444	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	34
PID 2916 wrote to memory of 72444	2916	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	34
PID 72444 wrote to memory of 72584	72444	cmd.exe	36
PID 72444 wrote to memory of 72584	72444	cmd.exe	36
PID 72444 wrote to memory of 72584	72444	cmd.exe	36
PID 72444 wrote to memory of 72584	72444	cmd.exe	36
PID 72444 wrote to memory of 73708	72444	cmd.exe	38
PID 72444 wrote to memory of 73708	72444	cmd.exe	38
PID 72444 wrote to memory of 73708	72444	cmd.exe	38
PID 72444 wrote to memory of 73708	72444	cmd.exe	38
PID 72444 wrote to memory of 72700	72444	cmd.exe	39
PID 72444 wrote to memory of 72700	72444	cmd.exe	39
PID 72444 wrote to memory of 72700	72444	cmd.exe	39
PID 72444 wrote to memory of 72700	72444	cmd.exe	39
PID 72444 wrote to memory of 68452	72444	cmd.exe	40
PID 72444 wrote to memory of 68452	72444	cmd.exe	40
PID 72444 wrote to memory of 68452	72444	cmd.exe	40
PID 72444 wrote to memory of 68452	72444	cmd.exe	40
PID 72444 wrote to memory of 71740	72444	cmd.exe	41
PID 72444 wrote to memory of 71740	72444	cmd.exe	41
PID 72444 wrote to memory of 71740	72444	cmd.exe	41
PID 72444 wrote to memory of 71740	72444	cmd.exe	41
PID 72444 wrote to memory of 71948	72444	cmd.exe	42
PID 72444 wrote to memory of 71948	72444	cmd.exe	42
PID 72444 wrote to memory of 71948	72444	cmd.exe	42
PID 72444 wrote to memory of 71948	72444	cmd.exe	42
PID 72444 wrote to memory of 68736	72444	cmd.exe	43
PID 72444 wrote to memory of 68736	72444	cmd.exe	43
PID 72444 wrote to memory of 68736	72444	cmd.exe	43
PID 72444 wrote to memory of 68736	72444	cmd.exe	43
PID 72444 wrote to memory of 72736	72444	cmd.exe	44
PID 72444 wrote to memory of 72736	72444	cmd.exe	44
PID 72444 wrote to memory of 72736	72444	cmd.exe	44
PID 72444 wrote to memory of 72736	72444	cmd.exe	44
PID 72444 wrote to memory of 72888	72444	cmd.exe	45
PID 72444 wrote to memory of 72888	72444	cmd.exe	45
PID 72444 wrote to memory of 72888	72444	cmd.exe	45
PID 72444 wrote to memory of 72888	72444	cmd.exe	45
PID 72444 wrote to memory of 73012	72444	cmd.exe	46
PID 72444 wrote to memory of 73012	72444	cmd.exe	46
PID 72444 wrote to memory of 73012	72444	cmd.exe	46
PID 72444 wrote to memory of 73012	72444	cmd.exe	46
PID 72444 wrote to memory of 73148	72444	cmd.exe	47
PID 72444 wrote to memory of 73148	72444	cmd.exe	47
PID 72444 wrote to memory of 73148	72444	cmd.exe	47
PID 72444 wrote to memory of 73148	72444	cmd.exe	47
PID 72444 wrote to memory of 73288	72444	cmd.exe	48
PID 72444 wrote to memory of 73288	72444	cmd.exe	48
PID 72444 wrote to memory of 73288	72444	cmd.exe	48
PID 72444 wrote to memory of 73288	72444	cmd.exe	48
PID 72444 wrote to memory of 73368	72444	cmd.exe	49

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1100

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1612

C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
"C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:72444
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72584
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:73708
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72700
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:68452
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:71740
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:71948
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:68736
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72736
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72888
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:73012
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:73148
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:73288
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:73368
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:73464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:73280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata

Filesize
754B

MD5
0234909867df70848da2b47f81ac9135

SHA1
825c3e61d843b8100b3c4d00b1fa0216c3db8513

SHA256
1586a0ae7bda8f48c656512591f2f670cd8cebf8828d18238657e3afbdc9fe44

SHA512
628c9beec6388b7f66f66db3c3946f4a021e6d3056ba51a365162bf56acd73600215893cfb6d9c39d2ddb9555ae8781502f43dac116ff1dff81ddbe5bc5208dd

Download Submit
C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml

Filesize
562B

MD5
ce870bbaa68540cbf31b3cff1eb14894

SHA1
64fd189d76b90e7755d459fec29c60ea23f351ef

SHA256
575e4d637646f19c7b8f1eb86be73735321d9837ea812e043c2ff78cfcc99184

SHA512
9e6179a5cb87835b8b232e02e1b6b1d39106f94a2578c2cefea8b62f4b12fec3f096a7e6641195af637fe58bf1a051697263f37a50987bc9df2790970cc92f90

Download Submit
C:\ProgramData\Microsoft Help\Hx.hxn

Filesize
674B

MD5
a971905f313a2c8ed9522192379d8110

SHA1
9b19960984b642d1964e6a3e8db68d39790f888e

SHA256
bbe07e45da10b0d213e0e78594fe28ab8e5b17017f823594bfb450872023e139

SHA512
7fc2eb6ef3975ddab8e1df9dfbc003937446d6af42bed8c321e47dd8c315610059857ca3413f744830879ed694f07041e239cdc9584283f1465055e0c9c264fe

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW

Filesize
13KB

MD5
9c9ae82e4f3f33f418ba8694e2a893a9

SHA1
881cb0378d0f6731ddda211a2f3af7c462a0b666

SHA256
f5cea8f7fa40bde983d57a932dee1074e74a797a3dc7297a97f60bc76e47e836

SHA512
84a10a691455d2e12b5fb07e9c570cd7a5ac7a7fdc45e02961cbcae3dfd97a5f20dc8217847010fdb4ed42351afd815b8558b7f3ab92a2b06875c4dffe8db260

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW

Filesize
13KB

MD5
d25c69062ad0f500e44524ec8c92000d

SHA1
75f4eeb01b82d6ce271b99a0f02683a9be66699b

SHA256
e7b30a188fed0a878e02c3dc33a631f0329dca112a4fe08ce966038314fd695c

SHA512
5ff561f7826ad416f1bd19529d340b71035c952e9221a1c807bab6819c908ee812e7c6abb97c27c3530eced18056a772e2311962f08ada52fabe96c412a57fa6

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

Filesize
10KB

MD5
f9f05dd6e8f39f9470da9665324520de

SHA1
fc2733db9487e741258cfc687398d3e966158c3d

SHA256
4da295f77671674ff6b20ec53bdda1a53ab742cc2b2b90517132922ee39df4ae

SHA512
ba03957a955cb33e9a3b8517acb75325578b923aafbf0216cda5e8d468a6538a27fbc847f6f054da99d4e7f8289ce550f9ace41d7583eac05af2daade9e5b66a

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD

Filesize
9KB

MD5
e0ff27bbc0d5aa87eaf02d378249ac5b

SHA1
43bc1d43dc90a4834a433e038f30376129379f61

SHA256
eda0fa3ff93d08dc77eddbbbd5c0651153204a63db0f6d0dc44261fe33659ab4

SHA512
4837b9675beaf577935b4082304543131b596a93006f140b5b4ed0161f856c8fb8fe885a92a5e83c6cd09e5949a74b5f57a18223236a1e00ba4bb41176db5c07

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

Filesize
626B

MD5
ac558426652e71c240ee0af078740723

SHA1
d5ad397ae2d008d0c0584fe83b2e095065a22c26

SHA256
ccd4bf8f622dd021a3cf0a97fd6a2263cb8725c3bf46739df71718883e1971c7

SHA512
db1a36bcc51b8e47e43fa45a818a98489e5a07ceb1038ca86e27d0a6d13eeba94b65e04d2c73eb974858fc855ca10502f28194df97ad8cbf472746d30ebed4b0

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn

Filesize
658B

MD5
67560e6dad3cfedfea682cd6635184c5

SHA1
b9c2c294a77b16c1f9d1530c1b3cd8cd11193d6b

SHA256
cae272f807fcc8170140ff675cefd574a60bdd5230609defb5f546380245f9ec

SHA512
1af24a81074bf010955152eacc6310d4ba03f6805d51a9fdced5e864ee05a3576e3a9890fd98320c9524dfc4346c55d2e77931670b3c0ca6ef23cd72497456b1

Download Submit
C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

Filesize
626B

MD5
36b8a532350a2e9cdf7ef2a61aa26d1a

SHA1
448de0c5dad86a244d51e44c0a6ce5e9edbd5b87

SHA256
a53ff53b4fd62c6e9172e534869f5152b8218ae1deaaaf779c5f6711d315d576

SHA512
5eb7a9ac7566501f4bb40f086d92526414cf3f2e21bfa0dc76364d4604d5226ce1057b7b8fbebdfce6dc4f1fa836d0a91882828dee943d3db62ad8bdf67494aa

Download Submit
C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

Filesize
642B

MD5
6f88dbbdfd0646251871646581e06e1b

SHA1
8025821d6faed0a740a82c3ed8e5ce09aafe30b4

SHA256
9d75f058043ceeb7f3f48f340d5e347914efcc98595e434c9b3cefa22f29240f

SHA512
6d312e71ae4542bfe8e8e386c4d94fceb2462f62af21b230517c40528c2e89f6c0652c1f442e85b73d1b7fbda64616faf9d3d1bddfb8a6bdde93a79f063341d2

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn

Filesize
658B

MD5
255ce0da4040852dd3739c7a99b07187

SHA1
cabfbe0c175015238027f8cca8ca1e14f9f4d261

SHA256
38c9470936d6dcbc8d3a2e4bf185534ba4df6cef53cd197ed402d286e87b1527

SHA512
ebdcbdc9ce574167bcd2f2029bcf0ae7119cdb3bc568e0de18475c1bfa4b882a0e641b4decbb7ce78abc11e2c21b81519969e96f2b7fae9f8396673a6a52929e

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn

Filesize
690B

MD5
9dc30ba408aebdf28fa4fae86ddf8d3f

SHA1
06959c57620ccdfe45009e142acc21b1551d4397

SHA256
fa86869f46199666e5281a678453fe9d055e6c11fd6501e7bc9726c75b93cc36

SHA512
4b6810db54ffa74ccf60c33305f27ee9488c0f40b1722999beb3f46b1520585281ca8e1295694adc23a9940e57faf262efd8023c3260685612263a6a949fb7b7

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn

Filesize
658B

MD5
dd9f4102067de44e052dd90bdbccd9d4

SHA1
7b8cb2614af80967b6960344edf95a8ff6776c1a

SHA256
8823d7d15e24ba8e5249d16169b12d06485010a80ae461080ec8038a3e11258c

SHA512
b7d79db430e38c316f1a3ac5d0eabe73e48c3bd10b0d26c3c21ca394d021633ce5d14380c4fa003184a511414c775b98404207aa82afe9ce8c033efdc38b106b

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn

Filesize
674B

MD5
f8864b5527d7ef0d2639566e68c8914c

SHA1
d12ae9f791928d16abc9e4705e6029093e6b58d3

SHA256
fe934b8185f62aa43b1cdf48ef654f2c7445987305b58c79fe31d5122234a1eb

SHA512
067237c22d613181a7b4284d5c27a7990e333b00e9fbe3907789a095806db56cd22acf157df2905426b4d3caee93d3909caea39c2cca6532a567a466be69a4f5

Download Submit
C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

Filesize
626B

MD5
da3f1a229ba729822d3997c2942dc755

SHA1
baa2cdd51e7f451f3950e509850dbb72681213c0

SHA256
886b44807e4c713570cada1113f8881df031a3b6f76468a2a254267c7017a811

SHA512
05d721f5f38966b3c39403f718e274321f2106e4121ed72e2202f1437be0e9858ad933986ef2ddbe823c31bf10cb2419eea83baeccdb691e418131c0e44eb722

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

Filesize
626B

MD5
cd8ef7c8911ee58821ed6c476922e7c3

SHA1
66b1731a25bcc4df7ba794d9d6bb09aeda3f4cdd

SHA256
a1f0e4fea7b2f9c18ec39f41aff383b959daf2449df688a32a4a6e480072d4cd

SHA512
3d2c2440df0a3c82410be3dcb34780c1248f9ec11b0e43bf6a30fcd7e21a3884d41869601f322e9c3d8618a82c3739885fa7031a2bf79f1808b7179ad6cc7958

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn

Filesize
658B

MD5
d792a1f60f9cb8b464541aaec5c6022a

SHA1
4d8b7e16331be7dfd4de99369e8b6c836593f8d5

SHA256
23e63643f79c4cb6042bc6e96022bbcc8ba36b1f1e3227d60c9f446291d2c0a6

SHA512
e87ad4b7a68df9047f078a5adf3b664f0b754f7d459a5c1c3a6f19a8ec17585370f019e92904498ecd83f5d64a7c8c965acf89a636bbe23be57690a6ddc61b04

Download Submit
C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

Filesize
642B

MD5
6f5b22e3e2f2c5c045eaa9f19ff30acb

SHA1
cd77acfe8b07214b6b6b5d697538af8b6efc8f76

SHA256
f12ee41564c18cc0bc0bf9e43cea736b60d98000a3c3dd311cbecfc75903b83c

SHA512
fe8ded5de982f5f7601a93518fb5b91f2f5558362d3b5a37f9dc65a3577ee1eb38fa8e28c672526f651f115275f9fb2848068f317d8423623a51686c8bc6d28d

Download Submit
C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

Filesize
626B

MD5
b0346871678076602e76c0d16feb8ab7

SHA1
4789578ac56747248ddfe9f102e7a9b2922757bb

SHA256
ae722b66db6775a53584eaee33149497729527fce5903f9304bfde56bd844613

SHA512
318ed36af93e5b43859b684ce208eddd087c115193e6bda36257a25b30aaf83591bb5fd80217a0f218c2bb362d04f46a953221569288e5761af6982697800a2a

Download Submit
C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn

Filesize
642B

MD5
ead68aeb15d677ec89f38286e8a388da

SHA1
3f6d278ce158bc24fba7387a19589156e71fb5b9

SHA256
eb555c92fe5da5177e89a99cfb07d214e3fdb7621ffb30748795255e9f3679ab

SHA512
27e6fb5140f42646b0b36a42056df16ee3aad1a94f1ce7f872f2a1635014382ba658ce3c2078ecb2c821d3680708f0652e7c631ff33c7cfa6dc5e638881b4d7b

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn

Filesize
642B

MD5
d297af70af61944c43d2d5ff392612be

SHA1
d2855f0b4de444fef287800ffdc35484021f8567

SHA256
c91deceb27d89ec0b8940589bb1c7c3b724f2f3f5abeda52f276d5deffaa95a1

SHA512
cf7b0032d749ed38de469e052823c89158aa9b9e6ab0175da1fca3949d3ca43c2e789ac9dbd9a1097c134e89cc134e5f82a9e9ec60b876ef751e42e3684ec66a

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn

Filesize
674B

MD5
f2d8bf798761ff1e6b7f874c8cca1c93

SHA1
233efaac2c468d06dbca09b91badecf3eb8c3e0d

SHA256
5065f60e9dcc6b9d14dea6b38754068d8c36c11a46573201348006b9d7f319cb

SHA512
635ed083d92edb85d0b2bed3c1e069db9b5e9544e0dce7d954437d1ff16c22219e534b071af069a4a4ae12710a1b87723fcbfba969c5d236663f14a84babcebc

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn

Filesize
658B

MD5
1565b4a718d54ccc41fa42e00d5cd453

SHA1
075d2374dbfce85b3d9e6c803d02f2c9cc98380c

SHA256
a46662a8d0fa7c60bfd33980dd96c9cbd4ac2dc233dabbb298bba7a6c3a4b9fa

SHA512
4f5b5583e1eab038be3d370f3aa09e21bbbb5d074da7213e615ffba68dd3d8d91c0005a6de763f5259524969e1fa6022ec44ac9446c6b9e5b772b27a98f113da

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn

Filesize
674B

MD5
59d69d2fda51d818640c27d0b0b12f4d

SHA1
0603564d1b21c11952d43e81f2fea1e8064eb7e2

SHA256
3682e7910e34d9ca54cfc4f6ec0fbe70dd5d7351b3c854ff0516003554cb0fb0

SHA512
ca4ada8824c9477cbb2fc1ed4140ed8d90820b9eb2251de09ab369f5fc809e7b6e548536563b891952a7b0cb13779766be38427339eec5c2bb2f467b2ea02579

Download Submit
C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn

Filesize
642B

MD5
03498ed3f1607d6229e003f4309e7515

SHA1
278ead7b29eabe6cb7288813bb1312ce31f64658

SHA256
206f3ca8b138734e4f54f1341f0a05abca8be1459db326ae5bb9ed2d34cb02c3

SHA512
3137e8b9868988521bb83847a74e313e5e06494db7325e6626e86ffa8526809a0e5ee3759bd47621464211f221826bde662ff519ee43e5c10b4542a3f341c3a2

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn

Filesize
642B

MD5
ccecf930fcbf57e45690bb36a2e164d9

SHA1
c826c83183c927b72eacaa5328acf0837a304a9d

SHA256
8dc1ec0d3052844a84c7dcda7076e4fc848fec3d3746471d159532bdb157f760

SHA512
a6536b1f6dc186f167a9703eebd666f2e4e0b4bf7fa91cffe4311fcd3ff16721bb10867e4f7d54c22b808389650ad5b05bbdcb93c2de2465b9aec9fb71d64a40

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn

Filesize
674B

MD5
5feedcc879527a0fcab03956a02f571e

SHA1
50343d316678078e758e73812ce2ffa8e59b60b2

SHA256
7a5b747a6f01b7330f085000c685f5e7756c3c0cb9d7d5436a224b4c28434956

SHA512
150a2a97e14e7e6dadb67dd0b09dc08721fcb7ca889e576701edfc8c89f88e31002c170d80c683968f6e19c3b0224b56373dbb0207415720b7bb309b8d763d75

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl

Filesize
6KB

MD5
473e338c64be152fca70841aea88cf59

SHA1
7675869e596ed7a9839fc9c15da80264144b09bb

SHA256
3875fc8058c6c14bc7da3e55edcd5bbfb677718f859b590324cdb7e2c214dfd2

SHA512
7511facc06fe36d8855fbbaacd46c793db9d5ab72f7c5f6e072fc679c37d17b081dea621735f2467b5c55bd9a1beb488d4ac126138356dd4a626dc726573abe5

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D

Filesize
12KB

MD5
efdf6cf2871953cb24920e7aafc5bed6

SHA1
7188d6abdb579e5a6ea5fa03d9e0b13f1e4677bb

SHA256
c4732f1d5dcfb0d106598b97268622c289109c7ef3b2a016d8d9bd1f4bcd4330

SHA512
2ea6ee66b5e8cb56f003a3b6d90ba9ca8d1ad7fbea57fb1c42fa53586a968b6298d15db00ac72c264fe0a736e3b0ac27659f8a69cfb419b6872e51d82e8b5d01

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
1d1b6eaafd6a66a6a27ba6b104e1b663

SHA1
560997a852beff906947e5a2b6f40da7490969f4

SHA256
1355a73211a6be89c2de4351f80936d7ae41cd16f35c8cbd9df90a20c0e01949

SHA512
892922854924efcca341e0027990f4ee2e47d33924aab52afd89f0a2d6ac51d68c756358551035492a24bf0c5026cc0bb9204f69ec8930bc4bc87466185ed8d3

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W

Filesize
409KB

MD5
e4b15a1c924c473add980e3f1794c260

SHA1
01a0d5c12ed8970fa9c1ffe0ad78e48c9ebb9234

SHA256
f72f7aec402887f330e9dfec83b78596791a406c506ccd19a88e6b4b56436087

SHA512
efca623ecb1f05833217035de05cf6d9c91e37832a55f9e83f4a703177f0b8fd97b45f29497c0e8a1015ade64c5bc532b32722eaf809d228db6e9e1b0a449f75

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H

Filesize
531KB

MD5
e8017b0866b427731eebe119b066f36a

SHA1
3bb613d9580c43201d6a413c1146f73aab0f0599

SHA256
2c715e779763e4ced115b84622cea07b206131ce1d3dd045640e83343374f606

SHA512
44807c6b8c6832599b6efc289d5401c8bc83a785c92e3b9cc5f3bcc6fc8bd36c1c5613a6712c875f718241742532cd9ad1b58b62369262416d326077d253e4ae

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D

Filesize
14KB

MD5
67ce7eabb1c459a9e440650ac7aac618

SHA1
f7af1ac66ac40052d5e0f6b615bd3edd285a6cb9

SHA256
577f44dc7be59f7a9b9bb180bdb1f56422a9078afd648a1281d48b79bb56843d

SHA512
2422a76ea7c96d4a8994e304c89962c808219072b82e705540f0e09db41d1279768b5570873adb9ccb0a2ed48e98a0ba8bb532462a7df432db138fa1af874ef1

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q

Filesize
1.2MB

MD5
6a0bf3df4b8e644903db4ecd37af9899

SHA1
8ba29eea7aba31d18e5b7fe777257152b4f4455d

SHA256
e291ab16448601d6441c53557ad46b6103a69ad22cf1b898d29e14809e6d171b

SHA512
c6384c680efeef24122d22fb57f71f6191092d313556bdb0b08de935ca7be9a0a78fc50390a233e7435c1ea0cbe6dcdb65f95d7afdde167327316cddfdb5ac00

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D

Filesize
12KB

MD5
7817df95b48d422f74eb14c01f961c5d

SHA1
3e3d5af91da8ec0ce8f472bcb17007a446107f9f

SHA256
74adae01cd92dbae7ab01efc55ae7b1523b092adc952388b0812aa2cbbab5af9

SHA512
90439b87155cac066dcb02e08b7636afdb7f7ab7b8a0b7b10ee033074e20d4ed7c11ee0570dc43268c8324ea9dbb41ec6ead24a0edb0e56bc89ec18d62e9994e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
4ce0f58079a792d04bae0f0806a16588

SHA1
2adf0db07102c63f8f928b88f3a127f83d9c7d5a

SHA256
dc95516648fd6b3efb56e9b96a3aca6c4e3b249ab8fd6dd19935dbfdcab5afcd

SHA512
4c8f9bc659f91010b20aac954b6ee09219df5f3e6f084286fae628c8fb1ecbca73dbbcfd3a2036ebe6a1eca27c8bf427c1446d82a6598b65a3dc613e44bde0eb

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W

Filesize
201KB

MD5
f91abf8bc67b9498f076a053c9809756

SHA1
1d5c57e29506918272b810c29479901255c964ff

SHA256
08ea5f076d0c7857a2402cec195aad0d290b3b02927faa205d7cf795212e83e5

SHA512
4ff88e25fb2b616ab56bae5749bac16dac4640c4464add91f775a20a3e42ebb4d9a71c93475ab2de5e127f10b765189d12a7e3e0febe3a749560ef02a1b8713e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H

Filesize
491KB

MD5
c93d42d857a4973562e6c543d8ff63ec

SHA1
8194070bcb67216e789b81e89b87a2e8d5403516

SHA256
18472b99ca28a753ac3d7eec7e0612c5ce5ebb8f61a42ea6cf5e4ccc1c1eee71

SHA512
b03215f0c4e945bbc6eddaa366f75b920e1b2852656a69dcb8450741a579ec6d554d57c5cfe40f4faa258e0f271dd926ff69a0d745006196e6bfb6545df114c2

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D

Filesize
14KB

MD5
a9fa8cb1132aea755f60b52d88897e7f

SHA1
0bd1e6e194c65b4be1a341e518274373d4fbab7f

SHA256
83d0486019078eb2b572548478a8cdfcce32d62e00e48cfe18881ee4880aeca7

SHA512
c7a37ea8878f897e77f30bd426e72d5ce27434393a908e89216b4f90f6b7550c0789ee4c0af4d53270b6e4fe2f3a50bbfd613453c74bc9bfacd23911027b68b6

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q

Filesize
864KB

MD5
2479e40fecb1089f29bc64dc7c7e35e7

SHA1
8aa1145e447cd277ebec74a984a829e53b558641

SHA256
317c2c74a44ebb9c938a016a4354a336df9a8e1776915fdaf7f44b21512ba94c

SHA512
d8b065fb4d24c32b5c18b531b23418116c76b15b58a9db6e9cf27a60dc1c6ae49083f506cdd09bcac37503610869f5cf5496f35be249621c1b34de82174a2d71

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D

Filesize
12KB

MD5
1bbb91287aa1cd897f1b80df20c21085

SHA1
9d67e218ae4ff5c511c4628b766e7a5ed189e3b4

SHA256
0524ee73c80f73c814782a33f8782097dfd90804357984bc399f6557613f7092

SHA512
deebb7f655e6442656a1ae3ccbbe80a100b97f9db35b2018479ac0c5d5e18d2097de583d9a9a695005b06e3a69322faad59790c6cd0a22b87e2daa5ac1572a71

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
34c6083bfcf300ae0519159bf5dd7790

SHA1
27c2ef1801e729693a2668131fb5e3dd6b8bde45

SHA256
a9c82d0ede9f56fc70cf1b1f7bb5f5b59742365740d91dec0feef1cf1fb4b45c

SHA512
7f03a15aa6274d9d70eed9f1aece15ec392dfd01414fe8b6d6fe020040ccb003ddadebcf1fcbf97f7851046954ed19ccc682621cc306bb033847bb34906b4a15

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W

Filesize
425KB

MD5
4bf17d5b8fbde2af7434f68f05a28c83

SHA1
b31641323084bebd393efdf446acbaa565c354f7

SHA256
7138a38e12a46d145bba8f5d9730b3ad7b8af4b737a2f2df08d4d9d66d302da6

SHA512
5253699c78269625bd22ec83445eb5b08e7dcf23952e8c21f3216998bb4f22f80e8f27a0a2c0ffd897f3b6bb51d075cc3f6c31438eb598dd8b4a42533122dc0e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H

Filesize
531KB

MD5
00ebf37af307af7ef30f5477282bb7c8

SHA1
56793298d0b817c54b7ebc888cc3c027fe9a313d

SHA256
aeeb8f71a838534d07fac0196276b5b7ac7eba875e107f41f872a096a595e3ff

SHA512
ac5b0831cabb3a5810c6046b77f70a99b727ebc9a86c1b5d3e4a3db99a04602d5ce0960a7f39ca0f4a22a5bbadc16d0a7b0f718da26b52e1081917a19e170fd8

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D

Filesize
14KB

MD5
3c4e28ffef86eb161f3f3a1a537b103f

SHA1
211e6e454d6c3b7afd0e1d72d073d6d5ae3ccea9

SHA256
a9d1f07fb48c621fb66a522fcd93044e44da03e0bd60226dd9537d41a83a4fa2

SHA512
6beafab64754bbf8dbe686a0ee3b7ea87317f736893e6afa2d4714b26149033c5ad8de95ca93cc6113196f80d8147a41513889824fbd9325e3f3f063392c03f2

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q

Filesize
1.0MB

MD5
88e1246ffddf151c63941b5fd52b6444

SHA1
09f5cee94b20860825bcf1a51690b4e42b65065b

SHA256
3d58734f22b5d73e183f9c4484b6ae8a5829502863f5860fe1ee951f9c4f77c4

SHA512
0b4bc2655d4ae0fa7cfba46bb9ab82a0f11c290c0fb69dc7dd4bf6e6e04f1a77db023079ce471683201ad639a7847dbd989df84e469bf7fb0c532d0043392198

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D

Filesize
12KB

MD5
425fb114a0bb219d9e23e91564f96889

SHA1
26a761c9877d94ead65e788e0872d78d9ad7c1b0

SHA256
5235677497d07183122a36aba1d0491462103dde7124d8f605966410bb4906fa

SHA512
6da105c8934367282854873d8cf29e1d33fd3094a24e85fec0698b169d88c85695a74007b110867a202e01f8aafea907fbceab0be300888386ebaeb69e0662a7

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
d399ae2ac886daba63d7c4714a770dea

SHA1
2f5312462016e7a75dd00d6e60f768df1b04f1e1

SHA256
69ae8ac048d13c41e531b31009d405e06bf36179d7e7cbd457af7925b2148c99

SHA512
48928063c37b18c2c614f87a9a01729e8c75539c1b7227660f83a48f7af85d56bc4421d41e4a0a20b4995673eb693c50f93cfd295e17ca157d450dcf1f54a004

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
5888b8cd92d846b8fcee58a19dfd4676

SHA1
761349348865c1ef72d7977725be41e30de66544

SHA256
1da5651046d8b349803c08f8fa080ad0929c77199a79ea2d95a1d493f8730366

SHA512
d779a680f186c76cea490045166cd34e376948c9edaa2a94dfae56e069be7f3b16a7814c52965e23d8eeda3deec6daa2134036f4a489f32f9e1ab668193c78e3

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H

Filesize
546KB

MD5
d398241873ac69f9d1947af32b2ad25d

SHA1
83f328f101b7349fc7a855b6f79f576a6b3d5f1c

SHA256
e610a0ed0cd4de79e049b17c17f92c62e8a1fc33baf0b30e53d10ca6b93685b5

SHA512
88907c8ea22364e75036826e33452f12e3e38729bd8eadf6f06174a6f560a953044d7779314b8b45338780c31fba0e160a17dcf204936ce646cf5465358f2652

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D

Filesize
14KB

MD5
0f10ff40c505cba7a95e5fab28eee3be

SHA1
3adf88eb4f81e3992aaf516a0697b4fae60ad2f7

SHA256
f1759ab927befbac726ecf7a4085f6023a6fa5dbf179345b6f6780f20efd3fa2

SHA512
2a42b3100fb77c3124b828cfe27708ef89631eac2df6c79187fc0e3037dc7ae3fcad44d2b5c5047c50ef4fb0b2861cb0611967e86ba1cf0f50a2d5e16b75be2f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q

Filesize
1.1MB

MD5
635c4bc60ba35102fb51b8c5fce1e77f

SHA1
1d38130d89a69cb91c2b87787e66213dea69e15c

SHA256
0ec481d5b1f7a7051e9272b5d914aefa1581c67964a90283ebdd6bc092e15c39

SHA512
8050216aac0d4bde897c021094f6b0f244af5ab955e1911501cd5660027281ab41784df82ae97dcc1b8db279725ac429b121813c0ad322b15e93fa3b6f1eb87c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D

Filesize
12KB

MD5
d19d87a902a13e9c9cfb304a7506f10e

SHA1
27724e480203151e2288775eb022be972f6e28e0

SHA256
edcd1c1bb6ebae8b4a6f06f6a54b5812bb3af47d722f60320a8af5f16c75defb

SHA512
fd216e4cb0da86ee3991de24003442f0fe303b0831a889fc68d04c40d41cbcd99361778bbbd6df8a2562fcb04a52a6a25e51c7ad593dd764808a4583cb8599d9

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
eb1696ed608f45e1ecd0d3ff143eb53d

SHA1
d0f9de06f79480c2363310c72db13e0244d203b5

SHA256
e6334f1bd3ff53e9464d1d7122c94e3ea7461dbe78bbfae2e7f6cda6340073ab

SHA512
7ae472e3ef93412de5b1195b9d947c720c5f032d41b768f0e90933dd6bf2a6c22527f0763294a25c4eeba2cc26ca27b0ec015fe318f0f519abe19aee34abe7e3

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
fc124989a5e4c75ef154445aed58f1ac

SHA1
05923d9a7429f5b9509018478fe98fc98b078cf7

SHA256
972c928d789a05655d9a420806487be7862494ef35776df96ceaa8d4fa4c29f1

SHA512
aa2fde18780fe1eafb3f2139172fff9204aecb55c78623d31eedcd942d452e9c37d452c46341c9f4d47edbc65553a68b88f6e400cec7998dab89ba47346437bd

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H

Filesize
530KB

MD5
be980c9dd257469e19fb78a20f56ed78

SHA1
8a312e57fe0349b6b5dd69beaca8b7798a6842b2

SHA256
f6e32fd3ef6faca990cee5839211f16c93998d1496aad04f4bf2ddfe36c654f9

SHA512
dd2c633a1514d8c969a8d6853121e6be48fd3bafc90234dc318c5c67540f945191b1eaaf15e768bf63c8f2a8c60eb5fd590c3e7e8338b3f0c47ba251c0028341

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D

Filesize
14KB

MD5
d5da0b47cd5d057616cc62ad2e430a3d

SHA1
69090fcd1a74dbadfb02898d63d26d3406b52973

SHA256
f6acd6fc0253e529960cc691a0319afc94faf1d5d873aa23962aef0df88d552c

SHA512
16437f33dcf91b00a6ffc142c9041474416f42aee3c83990930372869882421e4976c1fa9afdde8cbf43c7e9704bad4488d7420cd2feba057dc65a433561775d

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q

Filesize
1.0MB

MD5
5aa4cd5e5bebc0809457a77e1d955362

SHA1
2549e75d8435c064279cae36436ce761fbe7eb88

SHA256
57e3d20430552eabbb5dbfe37929f49b1790a53fce5f7da10eb7359a64575bf8

SHA512
4cbf977b2ac025ccceacbc7eff92a4aa527db9e78b670d890de8ca603e43f3d2000ec1200fa40dd52dd3f74f4faf04e696df8b1025a6af84e4d2e39e266d08dc

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D

Filesize
12KB

MD5
22cdf415d78e725017e80b7fe8c91b4b

SHA1
e6dcae76df3e535212a1b28e44271c9242213edd

SHA256
d10d51ed5ec19c0348e249506ae7a41dc9531c65968db961d190fd25ae09ea50

SHA512
d97506467fb41f251c1b8d3af89e1cc44eef0ba56ec326f127f30cb716b74a632da6270c2c30a8b46409bff9ca5c6e49b3d7dc3a513294189266b9784513e9a8

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
bfcf4ff841cdef4d8616af4abc3d028d

SHA1
5c7edeed2a0bdd5748b0d8d1f7aab581feff733f

SHA256
6e1bca9a5aee664e8b8187e859b03c341f43deb39405edd13968ea7aba198ac8

SHA512
acb28ee01efce9068361723c19d8f943779c19cb9797307e8e51f55e6046518948ed1fa77999533e3f4651df0d0a5ada6a910a25b59c87c407f85a2f0a5ab306

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W

Filesize
357KB

MD5
6649ee7a278e24eed227e6c581e8d9c9

SHA1
a5da40ef13ce16a1e8727890e78acfc40003d931

SHA256
66a1633bfb0dacccc2ad93e47fe680851eaa36193e19e84c6c4342ea568ff5ed

SHA512
e753ee6ee541820fed45ffaadd51287d5e4bfa7c51376ca5e89089894822ead264f26684e9909b247fb0436371b7fcbd835ce497d05b388df75c171a9966e9c0

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H

Filesize
352KB

MD5
f5486de2a4697981a0eeef0e5d1c4c57

SHA1
d6544cf8f1cb0fbf9234af02c8f26993f5d253b6

SHA256
fcbc4d3f1a5e0e63e4032d54dec71cb78f47fc7c8736a4f3426e440fbe75cfa5

SHA512
3e8be42afd06b502552489ff548027e6714e0e0d1298e835d9790cbba5fe78e28780ec695b16e6339fec129bc7e3581eef350a5897667bbc38209b6cc8b35876

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D

Filesize
14KB

MD5
aca9d338ab3410eae7ff4d8f2f41ad48

SHA1
8a5736d94bf01dfc1a71282bc5e7c80a7ce1d527

SHA256
371b0f69569dbce7c3b39423b22d0bff2a1dc588dbb758387778836b767d84a6

SHA512
bc0e2694e4c793aab8d710a2719f59fb6b48844e49f10f7fd57fb6e8bdfe89266c99f7d3b0833be3ce046e675a0c9ad315a20a1c66d5dc17bf7763a81544a89d

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q

Filesize
1.2MB

MD5
3bf40c5d4629a00c71845e3a521671d0

SHA1
2c1ec4ea62051886f9e0cc330b69202c88b6ae28

SHA256
f8a08ea27683e46aac2c8d0d3934ee666b9d9342f7dab606c8ab870590ac1d37

SHA512
21538b5d7d4078eb6903b7d0f4ee352c09a22364a197fa1da7aa74644f03cbb3d25e1c6e5496a9b8e77f6966a499de8b1bf5001e7990abf129f9439a71ee661a

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_5a410d66-f84f-4a6b-9b29-3982febe58d9

Filesize
338B

MD5
bcc238286e95ff25a55f5822331a4aba

SHA1
3e16c4775908913a60d27da1cd1294d33e49cc51

SHA256
053a747d8bafd4acf8be21314e7bd4020d6fae5bddfff2748e597991f29649a2

SHA512
91c31f978437e7b52622b4d1d95f772fb5194e3eb0e52a9a77dc3e736d8329aa28254927ace8ec0171738d9a5b49c53afbd7c169ca9499bc8195e383d81b0747

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_5a410d66-f84f-4a6b-9b29-3982febe58d9

Filesize
322B

MD5
e86064cdf263796962c6573b0e6c3512

SHA1
113e886ecc678a342d59accb4cc0738cd8cfc0fe

SHA256
9efaff828ffdc4e9383e8a7470f6663ba7c6a50a706e0a120d55efa3dc86b34c

SHA512
8eb60c950e6afdb8b2ac6d6c7de7b634525634a406a7e7e653f5d9c7a0dae6d1ee1be1f37df076ae93d983ed90109c3618382ffbdd749d51076b0e0555ce113b

Download Submit
C:\ProgramData\Microsoft\MF\Active.GRL

Filesize
14KB

MD5
6b421eec8fa9d3dfb51cf653dbad62a3

SHA1
77401d6679ceaa63db42e867efca2daeb2d0613c

SHA256
36a669767a0e3d3ebda2655537b327d24d2f2125b45113c919e00775e9076caf

SHA512
40accb460ad250d1d483b120a475f8f6987d526b9566127dc6308030c038573e8bdea0dfc76538fd46a32baec8eea4231fe025ea647f4be43c1b5456a5c387e2

Download Submit
C:\ProgramData\Microsoft\MF\Pending.GRL

Filesize
14KB

MD5
2c24bb58997ca456b66e20f52274332f

SHA1
84107256fc6972db7f782fb073abb27afa8fa4f6

SHA256
907f55b9f2bf9096ab3b071bb648fec84e7aaa738b1b77aabdbb7e7f5a1aa2f3

SHA512
d35f930a08ccb717909dba4618c66cd6416cd6cc7de585783c7e5a1eeb4538383e07daf556e5294221a2504dd35e1a6c80de6b7e8c11a4d57fe836906295c2c4

Download Submit
C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

Filesize
5KB

MD5
659a90d45609f5d3607a962530a299d9

SHA1
a265f66b15a0dd60c6c87f85ae3e720feb2d144b

SHA256
75bc68b3ebd78f10cbdf49fab02361ca8d02db9acf85038c844a056f0b8d70c6

SHA512
688e132f79e85dea6de413e6a35ef90747f0d6c17309fe999fe49bbf65438c45f436083685c3fdedbeb3ab23144a549f1c30876729d60c308b3f899d483fcaed

Download Submit
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico

Filesize
24KB

MD5
b0e861578d7bec8e6077afe51445a6bd

SHA1
e35dc6776046a03013131b8459ac9125db38f04c

SHA256
a4d1c0ab511ca373f208002996f49f05e87623fce6b8674a235dea70729a588a

SHA512
2fed277968b53f13015222ab3595e343ce04dcc415b827541526c51bcc7618c63cc31dd242c2bd71f2466a4066f9a260cada7a5c5639661c9267754d20093b84

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

Filesize
341KB

MD5
07d3e6fe583bdce70ae49759142e84d4

SHA1
f89099c90b53762ae6188737f9213dc60e49547a

SHA256
55fe116d490f369f4256e2db9416f27ac261ee0b1123c10ff96983f8a6421c78

SHA512
bc5f63ba86f972c4817a70957d1b837591ba402bbe3f411edac32b6080fe37f34d02c0939307aa69785564aec27fa98e3ccc9ef794983d76f18edb10d95ba81b

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySite.ico

Filesize
24KB

MD5
ee1eb63118b34a231fcef2ee8e6bbb80

SHA1
85d7b6be1c4bb21025db86544fa87d26aa0b7338

SHA256
92a0fd191d8a678b349e2dcd340e0d1bad383996359d181237622d6a710228b6

SHA512
a0bcdbfc50fb5cfab59a087066bf24dc5582398888938e6fb5910b099606a4938d30dc430262007bfa80b97005bd6860353f79d2ab0ccffe1df4f5c8d9203311

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico

Filesize
24KB

MD5
dc066d2f57d1d9e21a3a09458238f002

SHA1
68d80dca526de9aa7c4c591cdd8ca174d1659845

SHA256
1f2c1df2d9fac5358bad823b05651abe8ec4afaa535385c8a72a483588a88853

SHA512
a943ddc3ecfdf54561e0891ada694ccab0fdb5c3d6b300a1d715e0a73d8de9dea374cf766a6f20257ff8679e26b098fb06ed058d4f5a66382c1ae3bd03a0eb63

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico

Filesize
24KB

MD5
5a911bb3b2e38e2b80ca830059abaa8c

SHA1
f0726b10dd37a764c4d76036c2900df32fb53ff2

SHA256
43dfe803959ece6454f268a3f1e13217edc427e518adbb194ec025fdbc3927fe

SHA512
ce4b27cbe2646a4ab1289e6c01785bccf529fad15dabc63a8d3d6fee1a1b0d17caa66fc14cfc1cb7dfe91aa0db78afd700064ee82ae446a810697318084e8c2f

Download Submit
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat

Filesize
31KB

MD5
6e7a1a14b121c1eed2608361c33976aa

SHA1
08c3f5b98ff0462cba5467d861780c909f729f06

SHA256
1ea8c283b8a24ae55fb824e2a32749c80dd764388c0f1d8db86a8ea91f89d867

SHA512
32d5fea7759c680fc0780c3aa9a8f4a619aa508b86989486340278a4ea6269acc736a3f3da8657125a47b25c5efadd6680c74e2982aa6002d45f3d50c3287b66

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp

Filesize
48KB

MD5
b566a0703111c5310e2c50ed2c6bc752

SHA1
652302b8f14cbb1255632714bb3bb3dd51f2a6c3

SHA256
e04c5b1144b949714db6b826c9b2a39cd5c394849a6db829130ac1386b08d41e

SHA512
76d7bbee880ddc2910d23fd91441bd78abc0b1f597b4720318f97244d8571666587a57e94715cc2cbd1309d23ab4bb0a6ba7e8a89445d7e840421a7a181c23d7

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user.bmp

Filesize
48KB

MD5
b2829b56a9112c7e6110cbdc047b89c5

SHA1
84562528a8d257c256ddbdeda576c7c2da6dc67e

SHA256
d19882659e4e79417b7961536fa9d5777b90c40bfea515e714c7db61c16e1042

SHA512
4e98029f7bb22e523e63c2643587c0fd57b691ab24e62d3ca08f5d838ba0dcfa7bfc2a8543159d5d86e2f2077e344b1f0e63d7b84900a2b78f1836d8f474d6f3

Download Submit
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm

Filesize
914B

MD5
ce3e873264d53fc46a86005e9de88bab

SHA1
81c1d020f94ad70edc0abdd43e70f7ff965d1e74

SHA256
2fe4c02ccfe81c3c9f3cf9a043d455cb6b7c7be75a20188b144eecfbc88b14a1

SHA512
252544f878a255b7d710321c4aa04cecddecfd551a1f93fe704f422caf7463daba128bda80b83e66fdb1f67bdc8032ee8eb236ab8fe478b53ae18d439638fe35

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.5MB

MD5
a707b7da11b2c4f85632ce1a547ade2e

SHA1
9ce6bcd58ac5f0439a3a6aee6fa9522711fc0b79

SHA256
8869097d758b2ef50235442d53de43759a60f55706e808d6f089bd836f604df2

SHA512
3cf61f69ca61b753616380dc106bfc157be2bf9b0f9daf2f4b32cdaa19f014d81b4465a4c69907cb9f2f291aac27625d0a4e055de13152046300d5a0cf7342e4

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
148KB

MD5
b3454213cfbd0e6c382d947bdbaef22e

SHA1
175f5132f8e94055d5ba46cc8fc02956eb0f3c19

SHA256
4451e0f92c36671d087dcfc97d8bd9e98613b9348ee67659d57a9b6347863ed8

SHA512
b4507ca825e1dac3d7e04bd93ea49a45eabd4d35b5d8ffe1b95dcc7c99a12a24f6205ed168d5b9c5fef847bd97ff3a0265ecefd4e689881d0db35954c359c373

Download Submit
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm

Filesize
1KB

MD5
0462db8b0e755ade4e0693b681a92dea

SHA1
a6408c0f9221fe727a169b9a1195cd4b384d87ae

SHA256
8d925be394dcfbe82f052c00dbf88fc514e62e5e216cd2d1674f4036d3699cf6

SHA512
73534509aea8367036cc7b2a7bbdfe0d08064682d2b6d55dcc51e75b7062e398d481814060dc23179e6b36a494bba2153da9ed94f48db3d59c7f8a733e7b3eca

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.3MB

MD5
f7c34f7f35b82bc84bf7cf20cf1d8364

SHA1
460041e7a483ef0f8f343c5a65a6a35b590d2b2b

SHA256
3b65689ec0e56be3e23021d9a27687e8f3b65298e005db3c5034c8771524c92d

SHA512
e083c218b2a1c222553464c88002610645a74dc484fbac36acd6754481a75888bd253ffa561698b2fc54b561f51c23ea3814e0657f44ae4989011209ad50a31c

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
140KB

MD5
4f79381abc78d73de52cdb32bf3b92c1

SHA1
83d2811f06de752cb466427c5648b1a59593a529

SHA256
584c83a05f8279147903ede7933e1d6c3aeb37ec43716b13d5ccd9f38c203489

SHA512
ca40dc06bd081984a9277005c1226ff4d4a07e09a12f9d29f12613dbacf8b9c2af83e16c296bdaa897b37d0c4403b5f422f114c8aab98d9454c3e51ecdd04f34

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm

Filesize
1KB

MD5
616aa7b57e11758cba9d680c3bb72690

SHA1
102a8e759ea60ec109e84505b8eb579400f8652a

SHA256
1f53e4bcdd211e6575a7f90e4daf50450c3e8783ee7e3d7a5ad91c6a45b432a8

SHA512
1273773c280abda85417608f5ae5ed9fdae80c5d26cfdf1b8b72434fd27512b9b4d1e96059a47ac14133273bad7238de55a5d68b78a2d6ee1fd5a7544726eb83

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm

Filesize
930B

MD5
fe2d41a7dffe1f744694648313f86366

SHA1
9f6f9a2c79c1eb595c434b4534cd3346a50db367

SHA256
7c7c5458017861db2191487ea1f97830beedd3f6b95288ad2d4a84e8f6bfce65

SHA512
5ac87227c4cc4066c7f73904b845b8f123c3b3c54557080fd6ab9346d14252df0f3ec5f9834e310492b74e0ce3c91970d1c42df0ec6bd3932c4c8c5e91b938c1

Download Submit
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
870KB

MD5
c5090997f5a0fbd6b981ade7c6ce252d

SHA1
3b196726e4b69d39cf09ab937347e8ed533f5ad6

SHA256
726a348777382de25c1553b93cc45b9debfd9344345a35350fab1cd415665a46

SHA512
60d10b21a74cf0793bf25d521af36a8acdd2f1f59cbbd5afbd5838fd43e830d6bcdfe1dadb2a28889ee068beb6350426c2a9c0156547f181a410c691da381315

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.4MB

MD5
cbb108543b746f622626cdbb2992be9e

SHA1
408f671c3632de82ab3a658086148ae446dc5ff5

SHA256
0ec61a3549fa6e9242449a777056e100149d3c4b77476824a17bb967c69d767b

SHA512
39e873b07ef65f7fd76f09d3e461ce208997cf5ecbe840208babbcccf1e306963a1b1db7fba18da4785934cad9afbec41ac5c4ce7ab14765133361f8aeaf7ff8

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
180KB

MD5
e0523f12027d2c98b1de7f7aca5186bd

SHA1
b3f3dd16be2ee652dc4e17928783b76d974a60ce

SHA256
ac9b2bf2d017aa92037b1477e9a64bf228057e0bc8955e3fad72b6377c9535f0

SHA512
f71afc52a4e3ae471427758f189f84b5926d9a8f6c6ab069c8ae66197705c3bb0909594467e95521eeb39bad2f266e9fe11b19d919a86a9ed59e2aa2be99eef1

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.7MB

MD5
29a19dfb40a81158cb2a9187f4146287

SHA1
cef7418a833ba5f8cd46a1dd53b5f61cc9b78fcb

SHA256
b3cfac0796861d5e578b7aedfeb231ed3d76371d869c252639c83d1d70b3a088

SHA512
ba4d3abf962b329cc53aaef776b92e16ed09327d9403a6e77ffd1ef11a2a8bad724f11e00be3c847bd46b50bd980a4dff90e37e28ee82fa71a08eb4ddad6e279

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
140KB

MD5
b480976e2d7f2fe19906686e8715828f

SHA1
3d3a25177019b193ebf30f0eed48872da5b98776

SHA256
d9b1cb522d206206fa9fe54ed19d7f69f0a5862ff06ffa82389ce8f0631c814a

SHA512
2758a602c12b7cfdc48d67c954d5e1a53acb3ad69d3098cbc285f6464fc5f43b3ec224a7c3b50888f26ab6a4c77afa0f501374c9f1648eb63806d7a2748f1a48

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
4621122ed772713b656d85594a89fc47

SHA1
2c052aacfa5c7e9c69ca4db12f177a52018d932e

SHA256
3ee028fc8e72638413de088d95898bf27130d33e87fb201997d0536e0a9cf705

SHA512
dd2f6c5c14dc7e838f53dcaf1519e79a101f44699cbbd4bc84f09acc9f3e2bfee18a935c2bacd7c77fdc2520423e29e6052f8f5165bf0d6f0e6e4d47dbf4955c

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
148KB

MD5
99930820696dc512eb1c4b30b373f047

SHA1
ff8d12205a725cc604aabeb0e14a839002e82281

SHA256
a8ca7e5313405884186e02982676d0671a9e2fbe93447787f8b19d9adbe3de21

SHA512
0f03a915bbd48368d302740a99a61d929413d8fa366eeecdaca970f39da96aada402db60bce436a59f4f7511517d82e28cdf1ce8fe1e26479a79d137b70893b4

Download Submit
C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
802KB

MD5
8d0337fe6e536c66e7ccd06ebb28d7c9

SHA1
d9961ea9cba838e0a65a04913d997ed94c0d9de8

SHA256
3243700869e0027bfd808235a62b2f0a148219d5e891eaef56b53c55cec5afeb

SHA512
a4554fc8621c902d6de67e8e18b7a669355d0e27b25d4481463eca1b29e5581ae0cc981c76a2de2a653e16a279d0e5cf04ef6ab9535646e4892dceec1a33c787

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
8d22323032e03b5aaf123b3e99d78c37

SHA1
ce2404a117659d4778ffc95eaa01a1db7606f860

SHA256
4fde27a1ecea7d3d646ba6b680a60245edee1b8750a71eae53b31facd3d89969

SHA512
f731d8414a57716ec71cc6fec0364f04b91621fa03f5cdce4a810a2fb31887cb4225d8cf78a9ea0069fc47aa81a5dd819f653b0218ab9db93e8b2ffd4b38544c

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
180KB

MD5
b79b6a0b03596e729d6e7100fbdc542f

SHA1
159e3c4d3f9acfeeb4fe80d3a35063095ad67670

SHA256
dd555a4caa3401ad2fc98a052b50eb40df623d2858cebc1605de906e0dc45adc

SHA512
17787965b337f1026e34551266c252c8f2f713b935f07418e5d4e7d7cc5c980d04ca6ed011114bb1b72f72bc4985a0ec851113d9fb2779bcc01bb47915ab0e7c

Download Submit
C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
1010KB

MD5
b0237c9bc12ee8af7be628e0616af4b1

SHA1
066f83071e3d1d5803d23fef13f9ae32c8d70436

SHA256
c673c345c1cd01326d0a9e2250da1acc5792e3a312532f6d1b7c00d6e61e58bb

SHA512
f6e478612e80687024caaa34e82836a9b3d2695141d9003cf818ad148809215edbf8ebf38a57ef4f95eb324588ec2a9c56c437d41f9cbfeb26eacc6866e91a7b

Download Submit
C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
791KB

MD5
e3c4afad8e481bc8215a37c4deee09c3

SHA1
22be600907899638ace3420cb9c43b6f27998043

SHA256
59a9e9c8a3ab84c1cd9e6ef060b91f327ed07d06cf240d8e984a681bb0d66097

SHA512
a413aba92b53cb6ba943320dd4bf467567cd773a3abc5a3d1b463fb99ac069d1ed4bd392c2fc184af0f83d18fe476ae7a2b16dafd4926a9008827689807771e6

Download Submit
C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
974KB

MD5
1e7295b4f2d5c80f7877cd330310dc58

SHA1
14b9103dd44bc874b8d56010bfc3db60b776ce79

SHA256
da10287a0eb61344d5136c83b1cd286f11ca53c024e8d60f3dd9b409f565dc49

SHA512
daf8ed62396fa67bccf7893cfb68fc277c3c783efb188fab70a2603c54437b60277b634b97365f92f68c7a334ce02c03ef5a512dbb6dddec089d80a80ab925e4

Download Submit
C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
742KB

MD5
be75e48137dc1ca2284f7b5667895fe8

SHA1
24c7780e1fbf1f77fea6537e921af57ecd391c8f

SHA256
2a89a5599a5a995145692c7f21d241f17d4a7f4090edd5ed05d4a21472626f14

SHA512
c2d10721bd6101921673ee59f7b46f2a143cc20616145557ca78d51371a6a2f42a7111eca42268b95d48ef998b08b15ac8dfc38670116361670540763aaeff88

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm

Filesize
914B

MD5
4a8ab9469f1935a4385b010e39f095c7

SHA1
756f0ca6d0b8b4d0bc449ea9881709288ea19546

SHA256
101ed54b191ece362f69975889c9ce8f28c6e0c5c61cd1e3c41f1e374da4914f

SHA512
5f5702cd35e7a4bba98ff46d9aab23c50350f762b97524d2f4503110fa9e8fd82560c9ed5ad05c917d5590e084be73ae3ae0e9b6352d7deea33b7585154c7c1d

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm

Filesize
930B

MD5
3e2c914e03ad95bb19778009371feaa9

SHA1
fcb4695a29b054e3fcfd88bf152a4bb2f6adccb2

SHA256
0772e55ef29a4862482b25065bd2d53189921002fc4d470f9e7e8cb7780c4889

SHA512
5ee8f6981415bf77f9e823d03ac35859aa44b13ca78916224efaacd2298228e3e95bcf7af1a70574c9cebf64a6f4ffb4afea8b39f17e4d35b65ca3f5780bd2a3

Download Submit
C:\RyukReadMe.txt

Filesize
804B

MD5
cd99cba6153cbc0b14b7a849e4d0180f

SHA1
375961866404a705916cbc6cd4915de7d9778923

SHA256
74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

SHA512
0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

Download Submit
C:\users\Public\window.bat

Filesize
1KB

MD5
d2aba3e1af80edd77e206cd43cfd3129

SHA1
3116da65d097708fad63a3b73d1c39bffa94cb01

SHA256
8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

SHA512
0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

Download Submit
\??\c:\Program Files\BackupClose.vdw

Filesize
340KB

MD5
3c4e97226f5e97cda76622a20e571355

SHA1
67fbc1798a1df636f67faadd435ee27daa9be012

SHA256
5206c6db3fe7c4706ebe59dbc41c334f62abed500a23856b56952147669abaae

SHA512
a7f20692b9444a5f849bc09d03b46b49f650ab5ceee6ae3401d85e5cea3cb62eae70ea428abe128f67bf92cb2a737b591f9cdedc2f2525e728db40dc245f229d

Download Submit
\??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak

Filesize
12KB

MD5
b22df2dbd4336e89c80b3dac82e92a83

SHA1
f1250bf83f4323bed581a2982be050a050bce2ab

SHA256
97109a4e1cc8fd0c205605495ad01301473c860d0f5a1ac2c20f6aa040cacd99

SHA512
919e42b8acc79c53539c5936b13a51618913baa905eb6a50773921e03ac09f5cdb3e1205fcc8be116785ea7c167a75f378a24379229b1f4783b79c77f86f958a

Download Submit
\??\c:\Users\Admin\Documents\BackupCopy.odp

Filesize
1.1MB

MD5
beab7e1159ba15e94ef688ce21341b43

SHA1
713f14764bd288a6ab854ce99fb39acae50eaec8

SHA256
e6b8192b15b0492efdac9b8e5d4b331b62188ede783d2e5fa27e474c668f09c4

SHA512
6d9f7b62cb3333b4d298e68709af55d247548208174abd8d6c61abd3e8a2faf052ebd41fe5c71d5b0161041e25066e7e4bf0c9e576487af56b22f7ed72c411b5

Download Submit
\??\c:\Users\Admin\Music\BackupClose.xsl

Filesize
268KB

MD5
4f0a32224023d0e19891b760f7c92b3f

SHA1
d8545c7aa0ec33f2ce91faa4d598e1d9c0976453

SHA256
288733a2d987efca147e7b7a77a6e35411992fc0de6b97affb32dc9794a85e51

SHA512
353379f233f71cf39a875703140e9e31da836a3f86e4f330336b4f86da48e753c1342c1bc23ae8ede657016ea70dbc44a617a5f82d853f72fb556a4a4390de5b

Download Submit
memory/1100-3-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2916-2-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2916-30948-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2916-9-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2916-0-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download