ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Resubmissions

25-12-2024 03:42

241225-d9c21axjdn 10

25-12-2024 03:39

241225-d74ryawqfw 10

25-12-2024 03:37

241225-d6fzgswqbw 10

25-12-2024 03:21

241225-dwt4cswpdj 10

Analysis

max time kernel
61s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Size

321KB
MD5

04ba14a9828b000add142d0bcb42ac2d
SHA1

928a705a481384dee3aa9985bb2a9e1e6827902f
SHA256

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33
SHA512

2fc56d6fdf360c0435f76822f3d99288c3b31462931eb128c7ed895bf93d88b00663801c1a5394b1ae5bb081ac76b004deaf46fdf2b0b9c027b2945a7c030909
SSDEEP

6144:ba4FsUiep6JzvI74kZO/+SJtwOW8HFBwK3SBDmhYfFQ:ba4Fs/7IfO/+SJFW8HF+KCIG

Score

10^/10

ryuk defense_evasion discovery execution impact persistence ransomware vmprotect

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Ryuk family
ryuk
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/784-2-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral1/memory/784-1-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral1/memory/784-9-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral1/memory/784-30950-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\en-US\eula.rtf	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00918_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1036\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.ELM	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00723_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Thule	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baku	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\NewSubmit.wmx	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240719.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXC	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_F_COL.HXK	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152556.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14982_.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.LEX	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR10F.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Name.accft	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107138.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15021_.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN010.XML	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101865.BMP	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\CT_ROOTS.XML	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 3 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
73248	vssadmin.exe
73060	vssadmin.exe
72696	vssadmin.exe
69596	vssadmin.exe
72848	vssadmin.exe
73184	vssadmin.exe
72596	vssadmin.exe
67800	vssadmin.exe
73100	vssadmin.exe
69020	vssadmin.exe
73004	vssadmin.exe
73132	vssadmin.exe
73216	vssadmin.exe
72732	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
15692	chrome.exe
15692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe
Token: SeShutdownPrivilege	15692	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe
15692	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2488	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	31
PID 784 wrote to memory of 2488	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	31
PID 784 wrote to memory of 2488	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	31
PID 784 wrote to memory of 2488	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	31
PID 784 wrote to memory of 1120	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	19
PID 2488 wrote to memory of 2900	2488	cmd.exe	33
PID 2488 wrote to memory of 2900	2488	cmd.exe	33
PID 2488 wrote to memory of 2900	2488	cmd.exe	33
PID 2488 wrote to memory of 2900	2488	cmd.exe	33
PID 784 wrote to memory of 1164	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	20
PID 784 wrote to memory of 1632	784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	25
PID 15692 wrote to memory of 16592	15692	chrome.exe	36
PID 15692 wrote to memory of 16592	15692	chrome.exe	36
PID 15692 wrote to memory of 16592	15692	chrome.exe	36
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17828	15692	chrome.exe	38
PID 15692 wrote to memory of 17844	15692	chrome.exe	39
PID 15692 wrote to memory of 17844	15692	chrome.exe	39
PID 15692 wrote to memory of 17844	15692	chrome.exe	39
PID 15692 wrote to memory of 18088	15692	chrome.exe	40
PID 15692 wrote to memory of 18088	15692	chrome.exe	40
PID 15692 wrote to memory of 18088	15692	chrome.exe	40
PID 15692 wrote to memory of 18088	15692	chrome.exe	40
PID 15692 wrote to memory of 18088	15692	chrome.exe	40
PID 15692 wrote to memory of 18088	15692	chrome.exe	40
PID 15692 wrote to memory of 18088	15692	chrome.exe	40
PID 15692 wrote to memory of 18088	15692	chrome.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
"C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:69360
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72596
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72696
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:69020
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:67800
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:72732
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:69596
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:72848
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:73004
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:73060
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:73100
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:73132
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:73184
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:73216
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:73248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:15692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4ac9758,0x7fef4ac9768,0x7fef4ac9778
  2⤵
  PID:16592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:2
  2⤵
  PID:17828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:8
  2⤵
  PID:17844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:8
  2⤵
  PID:18088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:1
  2⤵
  PID:18928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:1
  2⤵
  PID:18936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1400 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:2
  2⤵
  PID:18648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3324 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:1
  2⤵
  PID:18412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4052 --field-trial-handle=1304,i,6999337183593541532,2377163012422059936,131072 /prefetch:8
  2⤵
  PID:72812

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:18992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:72640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF

Filesize
7KB

MD5
fbd1ef938107aa8889c0a89d7686ac4b

SHA1
872a51d3aebe5c0599a1d71fc6cdcdd30e1e8437

SHA256
13b0e9395f038a59fce2fc2d5ee2acbd7f0dfa87e693ce4ab2ae33c126ed197a

SHA512
469c3fe485e3db6bd76ed5c7f6cd90acf42c6db307f3a3aaa8e26c56cac1a820545c9cd15d36d6c701d5268a58258903e2c5ff6dd1616f8727870b01e72f969e

Download Submit
C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata

Filesize
754B

MD5
083f04837572a06a4fdf91f080ef9c19

SHA1
2e2422d323085f27238a9f79c9de0722ab02e992

SHA256
cd93e705d88cd0578c34dd906038e3950b2e514e1835b77834adc084f172c846

SHA512
002b73c61423ce9d97ba96a833161957ebbd237885aa9fb2957a9bb16230dca3abb4a2795b499f32019c3fc5ffcfbe0b48cf109be28c81634b8e505bd95bc5a9

Download Submit
C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml

Filesize
562B

MD5
d0bb359430223aad9e0dd495a1401205

SHA1
c05cc8e87827a4ee8dfe254047a4ec4c6408e534

SHA256
ecb72a3acd853afc219bfd60b637cc988ea9fd97d1a528f293a8204e1629781d

SHA512
53d5600242064cf3b4ab208b89f13d27ea52a882be5415a178bcc03960bce712ed8b9e3fd08a8e9684d016254014b7cc3d6ca6f971ac1394e392080e11eb762b

Download Submit
C:\ProgramData\Microsoft Help\Hx.hxn

Filesize
674B

MD5
26716ea9e2f41f355a140e677c48ed01

SHA1
15c0615ece9721215cc964be0c3c6c91661354b7

SHA256
d71d924de4ab4880d4585e5459ef19ec4bf3a61d3b12707c0592f7e2cea5129e

SHA512
ca8fb7ece3184698432e011911fdf5f6b1f7fe82cc76fca5327a5a6808a4bc04253f7c214ffd9b9588d4787559cef4e65fd71701f335a0a68c02b4eeb7997086

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW

Filesize
13KB

MD5
74d90ef6ebf37accfe42a01445b57c34

SHA1
e7530d8fb51d17a76571f1b1e47ed3c453923a27

SHA256
f7f4ca9527d3e3b3a6f9d4e3b98fe9444e65baaa964ca4c9fae5b2d00e8175dd

SHA512
045a2c97408d75a95d2f3fd59662ea0bd91e5523d44376dd6d85488e72a519814b99888a53085a2787f8b036c9399275a7e3000c80de18419d30b9b54d5899db

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW

Filesize
13KB

MD5
0fcb2a98e894cb75ea7b93150b01a87a

SHA1
391c1f1bb3feb1349d8670837ec990224055bc23

SHA256
9775c3682ef1ffda3f3697757f15e778b0af899b2a7960b5cb6a62a3d07f0f11

SHA512
25f02ae21d2bef79fef6d1604d9dc1ead3b4d285ddd7333b3bcdd1f6d4ef69c4fc679e6a3ab610b2123538d42ba07138f6eb481b31a17d4a0a4b2bc2b7b14799

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

Filesize
10KB

MD5
1d1d5274f9c9032304e3bd8592615203

SHA1
7b99e92dc45fe40ecffe9fa2999c3eb532fac349

SHA256
ba932591d7b41151f836503bdbbe39abd903b8288b87ee8e728f9697ca3aa7cc

SHA512
a238e361195d57d12ca016f3535a53bf26a76864f3208961a9cb333c38c7fe03a4bc08743e8bef78b62663ab5f72c11a071ac38b49366ec50bc167cd533a19e3

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD

Filesize
9KB

MD5
6f64b439734675baa2a7351f0015c4e9

SHA1
d2f58d2bb9e7ce35412fb669a1f726a740c50506

SHA256
4e17518726905763cfdc0a6cd6e6131ad33599b2ec16fba23dbc52955007d3ad

SHA512
401d9bca1123441c128ea4d027cc2bbde7b47645f50c615c58a8a85af46ac04079e3d29ddc4459a9747e42d9bd34343c5ede4b362dbb22c92f1406d8d9e53d34

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

Filesize
626B

MD5
12d1039a62b5730e10e272e74fe3d03c

SHA1
6d11fc90d6fac8a61c637a8a6ec72f5497a8495f

SHA256
05fabcc9c9c1838d4231cd33bff522eb349888a569a5a41369f876344f05495c

SHA512
44cab4fcd332651e4661b55db4942946074ffc6544ced63ee6db1595561dbd5d8d6b5b97c6cbcab452acda98e2f873149b325ac90f61042ddfb69334ba0bdf48

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn

Filesize
658B

MD5
c4b9a8ea38cc86c9ad7e980679c7f373

SHA1
209103c13ecf80db58cc1611a97a7dcd4a0a036b

SHA256
08ef16bae151179ad01cdc62339a45288da002ddb5a2d1cd6babf78248b04122

SHA512
7ed8618fe8418ea43dbbae6bf05ecbdcb7166266551eaa1931b228aafb3d913a5b8cd54145c6c7ddf4bfff2794e5ed33822bcf0d5d65bc4ca55013e492e53030

Download Submit
C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

Filesize
626B

MD5
90ed0efad1ec44d49cf36b3cab3f85d0

SHA1
cc50711bf89d240cb1a3f0d98ed97bb84aed1eed

SHA256
ae939598fa5843ebec028d77912ab89b82de84326d2583c4ff89f0b1bf357aac

SHA512
c2f1f6947ffb7d39397642d91cc7b0eea325158567a0c4f33fe0956f2d9cac153b6bfacab0888fdf6d89335e94ce42c42a6ba1b4f38cbd659408987b9e4b8902

Download Submit
C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

Filesize
642B

MD5
739bc9f234c73e98fc84d1590acbb556

SHA1
46c9b2277c3c76abadc1b440cb433467b489c251

SHA256
3e57bd8e9f402a46aeeb5a75198e2cfa48a4f146a13280469c3d1c819ce30e1b

SHA512
3727219d9a89fb170682daea1d46681b13929b2b70851967fa32f8024cf0e0521370867785d3b7ea59f4860cb5d520c51718aa58757cc35966b4001ee1e6b123

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn

Filesize
658B

MD5
87e6c26b4fac2e0c693d7ee586001ce3

SHA1
7115462592445a52a79495f6d5efa783ff35545c

SHA256
97b96eeb99f23246f5e002431d9ebabcb0c1e6f5563bdfe8864cfbc9e709e0e0

SHA512
c79da2b85733161224b305b01c88ff9bd3637e56365d816489d3752a611b759467562908ab01a7279a2c9e1bfdefb618efc8dca5e2244a423b44903d8551c9af

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn

Filesize
690B

MD5
481d798c1c2575fb828d64f6a15d4701

SHA1
21a7b028e22ad83d557429b718065021e5f5ead7

SHA256
52c0ed626faf19f52b8d81bfd27aaee18719a104d5aecac0d833b71e4203e510

SHA512
68fd4ede83583b266237cd85f012a66e5ee861fd789185447b714bc20d28ce5c7809106ac2ac50d52c0e68942d6ad295f6ccba797f771d63e31e384816d1eb22

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn

Filesize
658B

MD5
0ee6b7996a5ac52551fb418032216bae

SHA1
c18893750bb654200f5ef8fc63bbd12c07599f6f

SHA256
60bb6c420e1779e7227497e19841251cf88a1ad2c3a8dd5617e621b73ec5a7c8

SHA512
583b2cffb57fb517b3e21a229c8f756935079c4dd00881e7420974225402e32c196e459147f08e67a0147448b55c247ba253b5c228dc0186eb07bd01b6ee86fb

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn

Filesize
674B

MD5
0b3df3532c2e424681025f374868b3ea

SHA1
a4c49c05855f68650a48bd7a9cddf3602ad0b644

SHA256
ba51174296000aca8a0aaf16a77b01cf6000cdae5c3a9451e80d1625451b97f4

SHA512
1f44369911a4617e81099c56b9cb25f6c979d5da5de2c7df66595b49418338237729c57cf58a184116ccb4b7fad3721f6124be655c5d02b05f7f97ce89105118

Download Submit
C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

Filesize
626B

MD5
7fe33702686b333fc6ca810d3fcd1242

SHA1
c368a3eb550b5e1cdaac65db568a1ad3ca99877b

SHA256
77379c0d9e8c80d2cb02230e6a2371fbcb521aa7e80dce9c6815c1d9070c130a

SHA512
6a684d6bdc44b36c1af4ac756e08ff9e434d38aaffab1169127b5eb478c873ee39513645299629a28d4f5965a74468dbbff16f23322fabf6981281b7a7292bad

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

Filesize
626B

MD5
cef2120f4d39a2f7abddaa1ab69216c0

SHA1
17b7bfac812828d0c129ca3080991df3b1aeb06c

SHA256
283e652ad6a45388f74c24336c76a4776b0b5fa32c855d916e2241f7f8939850

SHA512
83ce235595dee42c294ca5cacfd0116c8a1f1b984ccfeb30a5a1a40f4bd4784bc7e9e80187c276518b923f6265169a8bb815ed9752b8ffdf900e1fa7abfad3e8

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn

Filesize
658B

MD5
2be0522dda88d55f0f65ed5a64c60a98

SHA1
25aa5f88cdcb186e477324e87f49f92aaa07aee8

SHA256
bfea6f29e677104e3ea8f20987a01e269d6113ab6660633b365e051aab90be77

SHA512
809a87e1d4050981a82512d1b777d0a6f234de23d670aa740afdf9c01cbf755d074e9c5348384934b000f6fcc0b122197d8433dce5c0502cb045108b7cc8d453

Download Submit
C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

Filesize
642B

MD5
ce1c3e287c89e58f20524e4401e5c6df

SHA1
d1f786135c5f87856d2dcede2356348627490879

SHA256
29ffb5e2b79edf98a17a9f493b2445f21d7bc8bf967f1a715a2cf7157faedb51

SHA512
cfff2528f05fbd75abcde313399eb6d137afeee8be2e20906d4fcd87efd76a80ae88ffae908d01b1edcd6cafbc501623b4c0e6e07b267287c2475055b9b0be1b

Download Submit
C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

Filesize
626B

MD5
3b718610612da26415dd4177380049c0

SHA1
b20a4556b182d7e7b98a97912d98b12079b784c3

SHA256
724542fc5d6d16c1714994a2cac2d04ba6f522be2ae1808d52354f71ac6518c3

SHA512
e5a36dfa6a487dc6321ea3c58159f9fb10b3f99860f92ae69ad43b32bad2a8ea0bbb39c82aeb743620eb5a3e1cbbe82e2c601cdf276dfac4a254bdce560ce9cc

Download Submit
C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn

Filesize
642B

MD5
7cae685b0d640286fced0307265a9f41

SHA1
272919d25cef81606eba911df13243e32d461b4d

SHA256
d65353b6fa17a26267f46c65b2da3b84cf470b0ddba9651d53acef302cc37fc5

SHA512
fd595f16ad7e7668a9166eb57a9e1633a5924fe8a2b321e92242cf88df01f70f83b51a2f14a950f41509a223099d5de741e4f35c99f6f24453f28ced75e29042

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn

Filesize
642B

MD5
0a0f15961cb4011e61bc97f750a84ef7

SHA1
feb52fa0e9b99a540304088a460b3548a8300b0f

SHA256
a2f474d851cb7e91b74d13ece248332495700084dd7c1ef86d884c1be3f3bb0a

SHA512
8f3453958bf01b118d6bfe005e438657c669591c4ce9a25f13728d217740bfba565d467436cff28847d3446facb9f18c0c26f81f781e27606e6475bd5a82eebc

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn

Filesize
674B

MD5
f431592f31a50482059126a7c4743c8a

SHA1
2fb9b17559bba2476b1691cad466dfabd47ef824

SHA256
2e16b28b7dd835e3a180f57e89668d0b7f1e02d44459400ce60ba04d55aeaad8

SHA512
d749b52e6dcf76378850c45c1d07699d93275847e93a85270de1c00db648bcc3da47a4ca2e48b9cd733589acb700bafe59a92f9d756c683c5ea8cd30a25e877f

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn

Filesize
658B

MD5
eb272bc2c360dbb4adcd0b3241f8808e

SHA1
285c69e76f5981e652e21d05887840508ec465f9

SHA256
7448ef43206ab72b3052eaec05c7256df243dc1e6ffea134c6ed9a263e52e440

SHA512
19231332fb7777aaed4ec6dcbdd8084aec6089f1b584e83b58cfed1585f36a8e943b8231eb8cc469069a5524c35667fca054d0dc943417152309163be383ad16

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn

Filesize
674B

MD5
1deb0b6ad9bf4963b534ee970d286c0a

SHA1
fcf7e6c4617f77ba2df8197e8d36f1aad90a4d23

SHA256
0fba1780dada53e84bb2c0e3a27a4ef2c6e233d9f2956700674486e78b362894

SHA512
a8374070046814cf5271d5a78f656c627e5a398a59f93de247379693f239a0ec1b6727d3b7b933164d63fe2beb1aa2528a86db98c0e4cd5d51fba386b91d9915

Download Submit
C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn

Filesize
642B

MD5
f667ca5a49e8882f1fe117826aec9be5

SHA1
cd93427f30d824428e5aea199eeb12f969cc6e8e

SHA256
eecc71de57228acb32935dd61fefcfd6c6e66298dcb147bd3674e61eda9e39f1

SHA512
0cd4aa44ab19125f75109fa52fb9ac4a49903ac7628d6fcf9870873d02fdf357c01c6b99b9d4c41e8d81a16f3b184cde7401a13e0522e4742b356b6bad923a50

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn

Filesize
642B

MD5
27fb268cad28554887ca3293f2ef918a

SHA1
81ef1ff5f1460cc6f04f88eb991146e89a6c5c67

SHA256
493ebfa5cad3537967e7e180d0ed02695878e717a527a4964d0bf1e6d4e297e8

SHA512
cc482c01bcb4341ae2223ef19f9a1d7e1bda92f484b2a5f8d7159bfb7e3f46379674d7538ec1429cc9bcd75137b1d82eff4efef6301951654c2a520e4d47a308

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn

Filesize
674B

MD5
a8872dd120457ec6ef98957bcaa248dc

SHA1
8f44afb1e63a993a35adce17d9dfef9c754ebf22

SHA256
fe8a84a17088c95793dab097e54277176c5cc3c80d3523f2cdba630bf6b57c5a

SHA512
f797ca565cda7f88e87cccdfe4a110576fa7ab82212d055423ebce1d501b50bff709136a30f0ab50ecc5887721960f92f35bd1baae21d28b697cb3f8b923c9d2

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl

Filesize
6KB

MD5
ae7976eecbf335cce62a35a5398b71f3

SHA1
1aba6a40e3a6ab8c1e8968a5d4619236e6baa67c

SHA256
29dc2b7c5ca9b4d8e195deaf7ef659a7a79fb6e4aeb0825b7e1a2b061b783242

SHA512
2c35611c4c927484ac60a923b916008c825d3cd5dd57eca1fce6883f779fc46d816ad137b820ff3a90ba024bb804d16e12f8744f488d2bd68347aefdc7021f2c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D

Filesize
12KB

MD5
afe00a20c4ea585150089906db3423e2

SHA1
5116d550e026b0abf68d58cd52334688644d8eae

SHA256
db72a4766afc1d20a51b80fa520d21925056b1f090f118186b3cf7730d95aad3

SHA512
5acedf2b83f0067f8e47ff858c347e71b7e6bf84a8ab953984d519e2ad36c473fdae97105993d334f3d7572f789436b0653eee30a47b101e7e22a0e8b791c22c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
c335b0fb9f3992a0ce353ccf4f9efce1

SHA1
182b2ff0015143b3b056a94ce05b086803143fa5

SHA256
2edfc72ae5be76efc74db42d28cf6a8ee4988699e1e0812b427a8fbf9cfae759

SHA512
4887e91143806116262c4852a1ab2bb480d56e9e211718529749307d0e2e5a48c82c07266afc47d50e948f8136cfa1e3e94367bd244623d3bffda9e6d45a7876

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W

Filesize
409KB

MD5
8aa67e952d233ebe5ae75a751126c9e0

SHA1
4c4ef8b7b0712f6a3735fcdf7b14862a6c78db36

SHA256
aef8fa2fde4e2d6287945066328674af00fcc62ab98410e429e906ba80819951

SHA512
f47811fb1865ff6a999225f671c82773d79174306241d4c90e3564d9c3f99dd5eee4abc0903ae37cfa2741f6dc22d3e1298075839a73c321f4ee0309aff95739

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H

Filesize
531KB

MD5
9e6ffa4db1b46a23a70882f1ae64b953

SHA1
e821cf88ea74b3280ea665816a9bbf1f2802a79e

SHA256
d6f8652b734e48f347938571483e48bbdc01ad35e32f08692d808d306af59a35

SHA512
705ee6a27a83ad753ce3b3a94709a13cd6e787bef69e50c2dc0aab10aedd20fb58dd2b199268bcc1514ffcf143fccf8b54161b0526298ff219a677306c46c985

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D

Filesize
14KB

MD5
e09104384110f16c333239869d698d6d

SHA1
f87b62be185d956de424baf39408bc626d04b5bb

SHA256
f5103419e253c7260728e00adebea5ce82a5fc33fec14b2d7a4c9c97cef029ed

SHA512
93949e6bf958b8969c6e741ba491bb0104ed5931189602064b9e45f54f42cb69220e0223ee26f2311c00c7e6907a128d715758906140e7a0d0cea7f9c0261dbe

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q

Filesize
1.2MB

MD5
aaedbcf59316c658431db46e8089498c

SHA1
16b720084404421d448d5c7affd67ee6b621674b

SHA256
9d5330c5eeb3ecd35a7c2dc7337f73b6521231e3a8c0af57ed73aca82b2fa0a3

SHA512
6a3dae0df4b4b9bffa6136c81819925818346cf55a48aa1f3e22b34081392856fcce27c3a3e092c5f8f840a44d1d5410c7d9be79f017773efefa1033b6ff360c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D

Filesize
12KB

MD5
a756d257fb2928bd46a38d57986a332a

SHA1
c9a4ad8b67e5ea8c39911e8deaac8fd0bf55f7a6

SHA256
f5addf53fc6df1c2bf476569e987b09b750f9d67672a1d7f6defbf337785be31

SHA512
3af219eb14d108b0be6565c844cb511b5507b667f30d56ee1c5adb0f7b5dccff3706080fd356b4ad9c97b3a0791d47e487195203c98de0380fa87bead553ee56

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
6902999ab94a831d5fcb599449d2ede4

SHA1
2c208a3145fb8c7683334dacdd578eec86e4eaae

SHA256
09d5c94dff0fb604e749f3685d9bc304b4ce89afdae8ddd0007a1afd8b1feee9

SHA512
654d0114c858b7c9c5f607a91f69713a6a19a73ca28fb17d9f926c07500b9b9b5b95547c809bf9f233e81e520b3abf6f28191865556da4d660f1214aa2c377ab

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W

Filesize
201KB

MD5
d0bab494d3a33a68753a32a0050efc4e

SHA1
0ef35f44f9c505f3bcc5df174d69c23a13683cce

SHA256
16a046af8c7aea1c054a42cc36bbd524cf0fc893ee3a72b64e3719ae7cb93f58

SHA512
d3b13e2c1561ebb9447053c65e1ad75b04bbb9929906b889d83495f815f24e9680048e3a15b0717fcf2369f7939e554a60ea9d9de812eaf11834e66e4ad62dd0

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H

Filesize
491KB

MD5
3ad10a1993f8af9dd3cd6119dfb015b3

SHA1
95ec96e11b70a64fd544a24b206715b9bb3113b7

SHA256
7e3d722ad578c11e7bcf1f97ffa856ef3f287b622c7985b870bc35285f7ec962

SHA512
9b3fe6b6e996c3d2159f3be435ef15a37e0b6f9e9aa8c2f797ab3143bde632ca236a642b318b3336424bcdb6f1071a87121d3b13f9cc622954b9956719db1c11

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D

Filesize
14KB

MD5
d4eb374bfae21338eb8bb0ca07171229

SHA1
2d02a469ccec747f4ea52510c9d5741b789d1573

SHA256
6362e925b5cec3f3e521e6a37ec218537fa65a005acac792b407d882f18567e7

SHA512
fe955abd45dfa572d65a0a6ed262e6ef42b4cc92277fc84810159f2427fd10bdaad3b3da2f932e74a7281de0bc8f84662070cc6ba6823b7bafb26097693e5d8f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q

Filesize
864KB

MD5
fb0f15877bcdf7da074f051268f149a2

SHA1
7cdf73b8bca7a8928447c7bd145e904b63093479

SHA256
ada99f78ef1b979d26bbe12bbd95aaf2b0763b974c9e75e69803ec41fe1b96bf

SHA512
6c517bd772b5d4fbad059cba961f840d130a85e114bc426b4ee124d5d638f22ba00f4e5a6450993a2685aa4a702e9c5607a315a2d4d44ec22d8bdb9e7d3b3d38

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D

Filesize
12KB

MD5
cfdd14ce793f356206e0cc8eef04814a

SHA1
9d28311eba9a805f585911fc21b3e5a00fc417fb

SHA256
2ccb93d52cc840c191aaf9fc93aea0c62ca64a451a49417e21aef29108afd852

SHA512
78ce6ef9827d2daa75e6f16b4622e6c65da279a01e5e8e6f3a6c9252995470647a7689aff324fa33605d38e76f791a4fcaf42eaccc7bf20d1bd3aed95133c079

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
1998d5bfa70ac81682f8fc041b3eb4f8

SHA1
ef21f0e769a794d285e2af4fdccf028014a1ced4

SHA256
93fccc5b4202a596e4838b7214ff8722f7f73ae9b3a1771abd407970acd3d0e8

SHA512
2ec3d69acbe422e44a16f443136564bcbb9f12729ee5223d2d655e23075a123b45af7cad769030740ed3ae1634645edea6f69b0ef9a8494b2b2850b3b802a64c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W

Filesize
425KB

MD5
39669d251a8bcd539f183466084b7d26

SHA1
d7b62e13f4a677453aef90ef3c8284b985289be5

SHA256
deeeacd652b42fa0b9cc5b47dcd5a3d3b9fe74e102133da3f7fde7300ff34aef

SHA512
4e1c176596852fec6bc059ffd9e0574060211f6a94bee843e8fccd7e403cafe8c42d4108f2c5e94a367e28fd26a4e6117ea3cc4800e553195fbf81508e7ee894

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H

Filesize
531KB

MD5
ad7cc1babf5d0f416ec7aff8ef0f8f93

SHA1
2a5047f76b00d3ed2bf5179e3dbf596805876c97

SHA256
84dbccdfee458786155c15a85e81d96dc2f1f20d3ac9aae8425e8c712d0df014

SHA512
c656cd39fabf0ddb14b6b18029d7ca98a5ed09d314bb8d8fe8ba1c0f78c586100e338cf594abdfdc812e20ea238f607d0d32613415207e4249d26631ec863651

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D

Filesize
14KB

MD5
1dea9beb0af43e3bdbe643901d2aba76

SHA1
afcbd639bca9fbad38902bafbd0b256cde0f95f7

SHA256
9dd0c1db639abfbc7507f6aae2634f02c8fac9e1e774a7f5cebb7d83a9471625

SHA512
93bd3d91eb3517a10270eb0a58ddbed0d902aa58bdeb4b4dd5760057ddf1f96f765a065bfd67493abd973a549758123e6e9dd2cb3df3b7d13925adfb1f526b5e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q

Filesize
1.0MB

MD5
7d9022cdf752e6bad459d4be84f9324c

SHA1
1bdc94b2c40290ca3e0cee23d842fad79663b7f8

SHA256
8457b442f6b2ae2ee90ca9bc011c5bd59842d4a7f0335d11e29b819bb5864960

SHA512
28d596951ad4a45354862a113831244f94a9b03f7c3555a44fd22bd78a8b3e6cd8f3e93d33ac79510096ca7540f7a219690385ea88b30cd12fced89870a36770

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D

Filesize
12KB

MD5
936c98e52e17dc774384edb6bd1c10af

SHA1
de1dd27997dba5683113090545a7d8d52b51a483

SHA256
06f9c0648e8bf4c5ee767a262d3fe2c1fe5df1c9f91ef7032a2614dcc852b11a

SHA512
7c95fc8b0dfed00c7a5cfd061aa70a1e905c628727b470ae9f0bb513514345015565d8bbdc0d44d0d4fab3db9034544b4f4acdcb1012c48c9baca5bb48f3ca95

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
705f0d32e74c730ae44c8f46ed8226ca

SHA1
7799918ac9164a75ec39f41e6041038eeacae423

SHA256
d148389a1b6770a96b49da898e49052f23a2b881273d1ae2c130b0dcb0184273

SHA512
196218fd1e9352727f1745e50e796fb40362b17e11c74dc9e959530f6d408780fbfd1fd7fe2b258d9dddbc293ecfad6b7bfa7458aa74794c37e1188266a88789

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
f6fcc7fd90c973203e71b44097f6fcbe

SHA1
7bc706342e9f3379807d3d25dd0d94422aa53226

SHA256
671822f60a26750469a5983ee03982d75a6758092746730eda454c1cf492a7b6

SHA512
ff17556e836e5341a97ff3b83439651e5066bc8499ab432aa8e95d7a0a604103bd8686c7196a160b42aafc6b711e2135f8abc5312d112667d3808a8c9850bb7e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H

Filesize
546KB

MD5
0f08a2abb55387f9a6836aede429abc3

SHA1
803c1ddb7995a2d7513a02c3ea9a6cf74219f9fd

SHA256
60ccf80cb621913a5d069437ba1e6efcdf199bc2960ff95f5b93adcaaac0fdac

SHA512
1d7bdfeb37504207ab10ad7039c9ce07a91c3daf282ab87d2849432780e8bc75d0f556decfeedc2ffe829f990f6b556e8653de19c5c56919c8bde8b49719cc27

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D

Filesize
14KB

MD5
80ef45c4589afec782e4bc4bbdaca77a

SHA1
6da08031e8827e941cc3b7ae391c7b485c2c5de8

SHA256
abb0012247f86eb72cf9c50d1277389a8b0960c7eb143e8a8f0063e9b3462cf2

SHA512
d6b83193a60489c60fdbdc45f77da86e3170937d790a546008fbdd959c20cc01b327dd72be0503e5f6f688c81aea000a333b5ca39739ce551ba9e7b5e7860a21

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q

Filesize
1.1MB

MD5
205ff5e7ece37aa1ba0ca62d3b244564

SHA1
df1489b0f4ad668cec970b184b66ade68ad42ee4

SHA256
fbed2b6db9f842e2d27bd6a12fa4e3a6702c10cbf40cf5fec22566a154dc8154

SHA512
1d52e465963f411bca3f392b2fb883ec6ef6fce0af25a7b682ae9c1448efcfca93e1459977c35658583ee7d303efad7b157d896720cb00b02de6b24bbaadc306

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D

Filesize
12KB

MD5
00ba2c10978453fac9488e24856d56cc

SHA1
9c865d1d49d68488908c41120c32d83462d48312

SHA256
622b9a94802f54529df83af427512c17d0499bcbd2842139cacb773ccc5b8be5

SHA512
5e196310a7da51baa20185c1a6e5bcac2d56945fb809332113628f2871c8f6602747b4b325f92f5b84cda2a43ed0fb09db6d1907a26ea07c970cfeb47086c225

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
b28d946abb0707b019c84b97d140201b

SHA1
18f00e36e84a62c572ef614a002e6b5abbe6e778

SHA256
65ea657d8138bb500ecb40797cc649e96a7d21dd59e93c01b9f7bcc7d63b2678

SHA512
d2d39cf6748e3e1338c56c8537cd4f9a3852a2158f6cb26550ef98823b3fda6c7485114ae8b49932a2818403269528bd1a56c2cb31d78b0fe5ab7644103c7915

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
bcd878950ec63d9759f6e1da505c6a33

SHA1
01b1a3cc8dea1758bc60b75d30a2e514bf6e7637

SHA256
f0c9965843ca1c31aa54416d36cd64d67b9981e04b5b2d3c05bda596e0258c52

SHA512
e46769b82aa85c53e9e54e796513446578cba6a0d3f381b5cf5d40f00fe31f78ad73ed8b2e7951210fda38cba6b4d80ac6f460edfc5e8b3fe83a103ab3b3aa24

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H

Filesize
530KB

MD5
86213a995c680a0047b1d94f3a093ce4

SHA1
c0c7d5a3502a6b5fad5d06945def5e92824e32bb

SHA256
7c66ed5ef8bcca3e7c4de31243095410b75778b1fc737c9bd6a6bb2891b7513f

SHA512
14f71be98df5f1e3f2b2094af6229d246c4b4d7ba1ed92485c70bd2c996e3a259287d61504c92b15d5a4b1a53a2df5dc621ab2d0fd65b14265984d100ff671d7

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D

Filesize
14KB

MD5
8948453bcc4e0a1812d6a64137c5ef0f

SHA1
be0d37cf7d47ac5c49e78e5e606cc4bcb3ae4860

SHA256
8d043f058c3d42e88cf5ee93b70524505a1a9fbc47092050f3fcac3aeb9e1961

SHA512
2e4854b5726f82bd7975c243d0161a8e91f0a2ea14a8820fa5747f20bc69e325f2cd932e3ce53b55ec09af60d42576cb64b0e1c32817a418e69381de1acf6c87

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q

Filesize
1.0MB

MD5
7268de71b515b76f07752cd1d3944733

SHA1
d218624454809b12e24d332fb434dfb9ef8499d2

SHA256
54dc600be2446a814a28263a96b0baa8e13b277b2435b37ab64ebca8801c4637

SHA512
7f3a5707c2e1b5100b55bad83cd00c3eb23a251ba3ff9c5cfb72f486501a7a9f469da57d3e6b16a17bd267e48c6d1a9f7ba4e99351b8d60cb0d0427e506806f2

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D

Filesize
12KB

MD5
840b35cbfebfb2026906901bd31b0195

SHA1
8356b7ed76e362d31a3b3f005e505701f8744486

SHA256
72f75a45e1c88e3583e8514c04541b179b0e4344f3fe204f5818fdc5c473fe50

SHA512
26a16877c204ac57e1e4aa76f494011549267c97eb86a64bcb4a83c5dd968a2874307a6ad5450beec205b2b9029c35fab2ffeab7d9a2b9713b232dcdc8691992

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
51ec387943dee2abf8f324925eb60021

SHA1
c3346c7fa983db2d485ed20ba661ed5b7dbab10c

SHA256
d70c1fae542dad2976061cd9083deb3f820012cecd7ed66d3ba6b64476e8a38d

SHA512
e47a7ef1ff29fb50de995d3e271326b3a1ea0c6183db7843c8abeba862ee9912092b6f6211e2251e32982ab9f47933c6b638f5c80c7c9f264fbf3451a4783438

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W

Filesize
357KB

MD5
8d05b495d32b4fadefd99b488232bc57

SHA1
f0b6722f60bfd4e042b4ca6badad28e2507fbfcd

SHA256
527fefa80dd90d1b9a447080c7f6f11325bf9979695c5e225790af4a24986481

SHA512
c2c107d63c758733b798ef0ac5e75c29c909cfc975c82b73670bcf4416720ad8b29a7d7623936ce600038a9ea5d2fcf37101efc7fba820ee2df839b1d12f1364

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H

Filesize
352KB

MD5
010ee7783e0a9a206fc33aa9e2b9e16f

SHA1
d94703eae159cace0a2d8c319d4aad0d1235739c

SHA256
3d25b3f80263283626059269b44907b20b95d9944f85ae7880ba7d071d518379

SHA512
69a0c22eb9aa1e50a2d509b5f6e09c51bb6032d0f64d94c3ab4c5690af2e51fbe8c7a7ec29e4fffca959ea4e90864ee6a77c511d53354d5db05a18c380556c72

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D

Filesize
14KB

MD5
309f92291f9568a73d7ee7f015dd2d87

SHA1
24b043e1c90a2b7154d30ab6fb7a1c4b8119b44f

SHA256
ad55245bc6127469828d8e20eb7e66684bc918bfbd29c9c60f3fe262356abc37

SHA512
5a6f47d20d4091e7cecd55bed0ff6e4259cf84db2ec2f73230d59680a60d1edb822d2e29e99dda9f0b48f0492baab7dcf93f3a923687dcabe3929db5dc0c0c31

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q

Filesize
1.2MB

MD5
93027de10cf49ce9fd1c4599b612752d

SHA1
433454a3b2fdb83ccf863684c45bf0904729b9a1

SHA256
c4908e10b3cf6b005e8d53f9bb6c8ffe4a4a6891c996d70572a00de8cecb1d20

SHA512
9df3123763aad065d01c159747bcb9d3f0a2104b97c4558f64ab6e70b798bd361b21a3d5b076a807ecdaaeb19ff8616595130162a18aea1a0c71082d5468d9c2

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_5a410d66-f84f-4a6b-9b29-3982febe58d9

Filesize
338B

MD5
8f175874b377da6c6d9cfa833fa73f29

SHA1
817e1d58ec0917e7c1769e7e1f91a167fd512dc9

SHA256
315a5981a7dd11b8dbf18f5d4e9750b552422c2fd097855d5dd783a52636d0de

SHA512
4dbfd577b43932f1f29604a931adb2052c39a804b241d2eba0bd6c940e768ec1abb06cd826d0a218afc9f06a68926e44fa1e0cae12f52ae757ab78c19d70e700

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_5a410d66-f84f-4a6b-9b29-3982febe58d9

Filesize
322B

MD5
c0bc4f9b62a69d60879c8f7b4aba2041

SHA1
5f42e80fe4c1c80c442d4a23d8a7c39f7182d94d

SHA256
7c1410cf52f5e62467bf8f210d978ec490733f2a906365ed76ac7786117eb9e9

SHA512
d2daa408d62a21b3b2375883af1b7263ec25cceac76c8658e64c5b500c9b65c8b792bdfda7020064f9eb71bf75d7fb3e2d584dc7342558db54ab798e139cacbc

Download Submit
C:\ProgramData\Microsoft\MF\Active.GRL

Filesize
14KB

MD5
1f592245bf6ba099c28a401a17d064ad

SHA1
25fdeec32cd62b16f50d7f3e68ecc74e3597cb37

SHA256
8864bafba402d56a4ddae1eaa5a303c19a0f26d3e7d3ef34c77f1430aac766b4

SHA512
9a23f92912e3f25d9b08442a5c856e0507c7e6b01550cbfa7e0585847fc1ddc645dfaf29ea007afd1127e16b7023a7225d9efbd324228175532b7d52f533a0a3

Download Submit
C:\ProgramData\Microsoft\MF\Pending.GRL

Filesize
14KB

MD5
c97d716e44ba0707cfa01d68343a75b0

SHA1
d15bc647dcd4f29110732058dbcaf1276792ae53

SHA256
8f35034a70fd116a5fcf218cb6939188e057ca1d008bdc4f4f0d4b4b4b7a386f

SHA512
a81b2cde94d5ffa41dc320388f0891778dc2aa510615d4f998fcff3f1b05607e57f0258f7208eed790f5bad8cab82294fb36ed41c32d7cc0f3f37971237fc543

Download Submit
C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

Filesize
5KB

MD5
9c43c737400ce311e610f5adde29e3a9

SHA1
1f1e7132fe474c245fa4585c7819d372a0dcc2e4

SHA256
2c101691f1f8ac25c13b060a0b104ea3dd4ee47df6fcdec317928520f5fff885

SHA512
117a6e62e5bbfb009a8320b45b5b4f53ee5adb96165d5cda17c02335da362de5b6443864424d9ee4d862b60896748115f5399b16b7a22999438b5e393a168bb6

Download Submit
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico

Filesize
24KB

MD5
67c4d3efc4767e8adb8f2b0e3d655d5a

SHA1
269031c1a085ddc2b2ec958537b1ae5d5bd03c58

SHA256
df39bf66cafec9ed637982ca55beae57ca05cde86fe49c635b4ce5e20907252e

SHA512
f4b01b5460f81ff48b52bd4b03075975023068619ff5150987ebae5a36f7c5737f7eb44a404c22778b3f4a98a8180624c7275da88ea8422a4d8900646da09b4e

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

Filesize
341KB

MD5
ce1463b3e76c5c5c3f825f870d8120cf

SHA1
9c335ee508421de7c7f84ad8212f617aebc10755

SHA256
97aa8a2ba394de6b983e2920b52e276810231aae1d05e363a457a798786dc494

SHA512
a818683e4e8a6650c5b3f769a3081f6e38f387d4ef9f3b633f6e9d8bbc4ece2a6b1002f8c703724a19c5ad4bd1358652c144b3e5537849689501af7b0303deb7

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySite.ico

Filesize
24KB

MD5
077db34ad54def9072c053d7da3dc1b1

SHA1
a0bdbb79bac277d457c56db52daf4f9fb34f5268

SHA256
3ceeee4ab4b62fea7f4756b15644a6753bddc34e719fa9caf3e180a531037f67

SHA512
f24b6a555bfeff7f332f4c0c81fe11e00b72a432c87e3f3e8cf8e4a14f4892d74dbad068b9480177807565c1aa5fa4c724daabbdd19a6a277d1599c5fa6e2fe1

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico

Filesize
24KB

MD5
c43f84e5a3c4e6390f0f9814aad2f4e7

SHA1
e7c945fcd4389d69f8726883255a9589d155336d

SHA256
35d9ea5fd22c5dc035367584753904701e4efaa20b28f53f3114353732489887

SHA512
74966219423803e332cd4306c003d48db18ec4abebbc12cf682e28c293c3da63491eed5bc005f8f30b968ec1f7e7b3f4b02e14eae171613235bb77e0860cee42

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico

Filesize
24KB

MD5
984b9b6b5db889f0322f28913ac47202

SHA1
9dfe4a617da3245d38a59a148b472da7c5d92b0c

SHA256
26ba21efa7c4844419ec28c381d239c5cdcb3268f6fbf97e39aca4f5469d98b9

SHA512
571dd9e5a4c75663412c20be908415768aed4c409092e4b851d8146f522b71711caac49eb9d6f10b6ab134740645f4266256fbd672f04bb8fd0490c723add37c

Download Submit
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat

Filesize
31KB

MD5
1e0fc2c4cbd4ce2f71597d25ed4841b4

SHA1
e172e3022fab42dc581e3d7932c41e18bf5bfa2a

SHA256
ae0ab43aa90d0532baf446deb3d8e81a90ef6eb85cd46e4dd0c08ce4f7439b64

SHA512
10c360b635a9ad73bae89196eee92889692109342dda5737507f6be9fe1011cd26e5ea4c734b1db3113f1aeb4a991325679faf57a2a8a79cbc8048938bbf16ba

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp

Filesize
48KB

MD5
f6fdef20f4189a6506369d109455637a

SHA1
f3620ede7eaab213f02d4c19599ce6883bb0a1fe

SHA256
34f23e102038ec4c05bbcc109dac6107b47e54be84495ed37a735579115d968c

SHA512
e6f28c67f07e807e0d62fa3c9020e4b61aebe0b150c67173f5ad7fe1b0e6fb5394851fbfd309e043797d44a4943d80664ef1f2ec26679b526842c56c1b03dab9

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user.bmp

Filesize
48KB

MD5
d140328717a38da120cf2f6b0377045e

SHA1
d5b43e8ee0dcfa03c2d0bd5c791d2d9b77463a07

SHA256
36ca3af87d51617b3b7b9ceaf151e57b2354ed697652933d32138306ec158622

SHA512
ec71e7f68bd2be840820de9884c3b7b633b44c167549aacb1ad8bdfc3cf1c10ee6aeb97bc14d0f4bc415dd9bb9c8200092a83a839347f352c85a2bf677d7177f

Download Submit
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm

Filesize
914B

MD5
e1be6c64dfc04a248370de2278c8f78f

SHA1
bfb672efc2e5eda07ca318171a332efa2a1449d1

SHA256
3b1dcbed68b79ef078dfa37379a2a9d612ac1ca8a91ac9814b2971e2d7035fe3

SHA512
8125bc5c8d621a718ec256d524ff8c72eb592b54f461001d9b23ee91fb6a24dca9720221a4c9aeaac389e413ceb3d74d7dc299cb31458efb1521104e6f017cf9

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.5MB

MD5
19fe446548366ebf00f8527efbf74eac

SHA1
41da8d86e1a8d96e29ef18880640e4146c6b68fa

SHA256
85b0eed7e6f4150ad6e40f8616604393bc77846e05143f212f5f7de9b7f2470f

SHA512
2b3cc3d2baddfa146388e615f0a6a6b910ddd374be76afc69bc86fdb17f71d5e9fe37228285f7fcbf6f722dd26e457f7baeb3dad3a13c6975f9fd333deb229b2

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
148KB

MD5
eeb264af6c5fee6ccee81dd8ccb2d11e

SHA1
4146bb5f13df213170d911bdbfdb3afbd65de9bd

SHA256
96ea41bbda2a8f1fceac26abd9dfb0bb260a53a57291d0cd1f9d32c033f7766b

SHA512
7e60c7a65eb04ebaa22fecb99cfe4c6160d8e6fb5de83323bee6c9910fb8436b01089a6ab8036447c6df67a8c9a175e2ffe1b9c64ea002e817c15d53b556bd0c

Download Submit
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm

Filesize
1KB

MD5
3ac7a6b143204915d9862b8737666899

SHA1
9c81b4c7f7d1e413c35af000b0ec8e538391af02

SHA256
3a23f811c077b52df67a4d5329187fbf78d73343e82f8eadf96c36498f9ceb72

SHA512
48e878b0595eb950549d3b8b622e86aadc5fa7cff49337b4bfce62ffd546132854819e5cbb870a81efe2d562549a018d7755ef986f2637e017cda3ecece9c0df

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.3MB

MD5
c89d4e4a02a271fa059f03d8a1fc109d

SHA1
6c899ea9117aba735c37fcdf9077c7c9a1af8aa6

SHA256
cdbc1af89c53eee3f9172243f16a32cfb355f48fef5836d064c0409d1204bd93

SHA512
d27610e2a93353653341e0ca0f1c0947bc30736faeb60900a55f0bea889bf464efc0ec3621d0edb595d6cba138aab6c284b06d292c41a02d025c281658f7780b

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
140KB

MD5
14dcdd02d610b4286702fd28537afe2e

SHA1
7737eacca6be54a4bfbe31e671dd35350b1d2fb4

SHA256
41c34916bcdb0090d4afb4521d6b40b8aa70de0c9dc957b3d4b1edd72be83107

SHA512
fc0b02468f220bd28f10041f3d8cf75507e37970ffd3419b1803224a3328a77616405b1997ea2ec0817ad18aa0503727b0c09cb6521b96b9254f351a8552a5f4

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm

Filesize
1KB

MD5
e9c5ee92164ea9e52a1ea366c548c8a5

SHA1
40c0cf9ca9c4bffc480b796427247f103c48e9cd

SHA256
92dd311319b66ec12ca3ff92b0c5998615e8d01984b1c7a8989a96d23460f3e4

SHA512
889cdecd1be1da7fb65c6e7f47cc961f2faa9fdd43059a742486e3a696c9bf7cf71849dfd2bbcb2757598d6c2bf7bd948c0f775b91ebd62826c31e943f5e4fb0

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm

Filesize
930B

MD5
bb0ebf677385778cccdeb1ae170b997d

SHA1
17ae6249d30798611923bff3eb781209d03c2ec4

SHA256
272dac3e39d95e93be1a315db1da4006fe1b30a4253ac30ce3f83edeb2b94078

SHA512
556f574cb6f9f9dd0c5d2d8e16994424254a472f3b78a05b9ca130e80348e31eee39f1bf16098bd07749ac2757d965af7d01abf7c751bfa7dd7f196ca4b7a40d

Download Submit
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
870KB

MD5
87e2ccf6ccd0336ddbb1ae7fd5d8014f

SHA1
d41e89ff721bda862fd37cf000a76dfcd730ef38

SHA256
4aa2429d6c33a67e3ba868718e14bd933d2c8b0eb280d50df2d6eeb5063eab0a

SHA512
1b342166c60eea2969677c9c6dd8764263166325bf77e715f2a0fdb32eb6c903efa618867798dda7c997bd13b8ab7634dd086d5960b521b43d790c1732ed5cb4

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.4MB

MD5
c761e9cd65200790b14e51039e6ac483

SHA1
82034321503ab784faca7889aa9eab619426233f

SHA256
ab9743c76929dbd1edb36b590f14f4c70fc270a1faf1dfd74a3e60d92a33765f

SHA512
aaf48cf86cb8562fc3514626afe32d9492027586ba47f5b00f3ea1c016df49e4024dab175a4b0af1e2830aa45883d56da289c8dfdc1bdf6219ae63ce4d2af4d0

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
180KB

MD5
6563cb2d89261ed22f5aeac387700d33

SHA1
2fe1d23efb415d5114eab407983e128b6dd6e72e

SHA256
9eeaaf5f82e69d9c435d49cc0d189c2fa6d1a157a5a6ef11ec85230ecd6465bf

SHA512
0608b572e254c634c6efff69a3490dd7802c712c2d8f744754a853f22e29a5ae6af39b91beb387cae521c57e5f3a1e83f48a4ddd5b5cf1c2965169ea13da66a4

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.7MB

MD5
66e855e885d1dda05db9601ff3d59b6d

SHA1
19636f45cbec861e9d1d4c10cd8ae6854dbe8e2b

SHA256
9458825aecef2017b3e3a463b8e91cba15e147cecadc89f2c393594a41b52580

SHA512
cf2a6d8ce3f1b5f60e01ec0073f55e5cac091041e172c7886cc03815e07ea685dbeace4512c2ba70132f35ec9f20c981fad9559f7e9d672b679876f05858469c

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
140KB

MD5
1d668a15d55d7aca20c39943adea2e65

SHA1
43e6e5c0518d297a8a280e4f758cc280ad1e3a1b

SHA256
d8426e7e3c7857aad79404123b96e9bbf3c4fa6bd51d8abeeb45c0d3b2f6dc96

SHA512
dc71b4d6d35b6abbd778c8ef927aada483c422575b5709ae68af15551802bc03e8f5a71ee6dc2c1fc80586600aa803d09536cdd32d0a0d09daca704880092c81

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
34b80bd02b7c7a21bd560b32bf14efd9

SHA1
a0bd9e7a0f2f985bf73ce5382e420598b3f9540f

SHA256
febcabc33db2f71bc8ef656b2c0c481510d4545b0509ded7878d9bd3a1810f1c

SHA512
cbdfe1d433cf560f226b985a16d25b99b33068ed286cd8d68695bb1c9c41d65f3e44321abaf8e122f808ec06efc6baced84056cb421859d66120ee885477624c

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
148KB

MD5
8ea1aaa5aa6f1221508351d74247a840

SHA1
2bfc05b8be0944e535b1c84d56f3b3227aaa5d20

SHA256
582f8920a134a78d912ee1f3b9aa1af4918021d16ae4213f9e3169f9f8ccacc1

SHA512
80c342abe76e642110329448b9a2d133cf2f25130ef2852726cff43832ac4bb30f18fc8e429041d58bf5ba7c3c8923b1ba35ec2e8c77bc34a665243bab50821c

Download Submit
C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
802KB

MD5
9c1bbc2518fd9719412f02f67a80cf9f

SHA1
bca8ae7bdd0d42f594b3b80d7be98ca1300c348b

SHA256
bdfd5436bbf7611055be4810ea26a4e676faf6f6ae4559a93ab3b7853bf47150

SHA512
190a5c9fbb7bde8c832b5397ef9638bd2e4c5125ed8dc911357fe9ac4ba5f1d1b9db8eb5add756e508854f01ae78878b24d1788dd7468982ef3fab207108c33d

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
95cd768cf77469389847e0c66c45c66c

SHA1
a1b63547d260329e85e5cc49f85575ddfb22ec15

SHA256
0dd766ce0930339edbe2e5dca68ab071bd6fe7cc60b383b51fe0dcaaa42da507

SHA512
21b961c2a00e60e4354a9df0839cbb9bba7a477a211bed6e9c8ab8f3abc36a706df2d6baf2b5b987e6a28d946c4d5b77b35309d80fa620b71f9ae2d4b433bfec

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
180KB

MD5
26521dc46ab732acda3a0626f871b561

SHA1
a31a4b3ab0373f4a327981edab3ddc21f57dfafd

SHA256
368766bbe56881c1570afcb126c19a02faea69f1f4975f3f794d71e2e6d5b79d

SHA512
eeea97937b3a3ff83ad2417ec9a1855b9be1e20f2596fb2249b1d5f3e921de3e8776b706c568c50122242168cc83bd85c9fbbc29ed6411e9d3bac951f46c48f4

Download Submit
C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
1010KB

MD5
e3dcdec7cac12f28b5ae9405a1098178

SHA1
a7595b8de7352f0f03e3529e7aedd60dcd2d2b9a

SHA256
251bcc19ce896ad32b08bb4c1939c5fb4b70433674fd59c8aa9616349c50324d

SHA512
304522f66d8adadeebca7f6070bd11fd34679c836fe5a8b215190be14e23c27a71656f3544a6c99020a1056ce793a3aea2224105a8d53891a90a929511f6d8e9

Download Submit
C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
791KB

MD5
75e1574a29ab79903c028a2699076aae

SHA1
02f731fe6fa34d0f07c2f8be63bd2ba2bdda4ec4

SHA256
3d38a32a43d0dd05b4712c76565989b0b4104517cc27802f7a7fb7b809a1359a

SHA512
b0c715e51d69b4bfd8b1fc6663daf2aba3129ddea650d99e3fa2ad56a8f4a14bf6d44c0ccb2f990ce11aa8c7dfb42f51b6f9cf26da8202b3a6ef86debf73594a

Download Submit
C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
974KB

MD5
c57c555542daf9a8c87002ac3daa044f

SHA1
fa94b9523edec54ee344d56bac298e7bd41435c8

SHA256
62b5095ea6590ebbe81d8c010dcb8ccf278e93163794aa4cd62e4e519b5f2542

SHA512
e20218699bca741e5b6552398d1f3680789b31f62b30f2d4262f41f8c1adf66771db42ccb8e1ff0105bba638a32144dbaa3bee3772442c4fc246a8124fc96507

Download Submit
C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
742KB

MD5
8a0f6f09675fa4842192c88779812766

SHA1
e58619672dcae5427855c017b86317fe659395fa

SHA256
e9ffe0793434b072c7b85303cf3fd1938b13551f9f1742fa61fe5d7202abf18f

SHA512
ab79678579a79eb42506aebc2eea0b7d89ff8a1c790499fe3050f5f7b4a2d027187b80e3f7286a96768c068e740300b82c43590b74bb22aa7ca419d435eb124d

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm

Filesize
914B

MD5
62f2bca78b129a3f5641f68974d9a0e4

SHA1
0f7bff9e0294cb2780e758582c982f8bf23e79a5

SHA256
d74a26c04d02c33330276d573bddf901fdafb13a230101b8e383decfc9ae7e35

SHA512
2ed8e327293600c21f72481d9611d8e389a823de23f4d10d2abcbccac28967a3cf12fad1af7e1871699b089aa53adeba135ec04b2f3be5c600635b8fcf52ec78

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm

Filesize
930B

MD5
e6ba12137484375497a366202234eeba

SHA1
d632ebd33af0a05ec292ce02981067fd4706d665

SHA256
9231bc28ba730d26ddcda701224ac60f96ad0b1882811808b448eb593f396ace

SHA512
105d18b36140035c6066dbcab11a162266fce327049040f18365a151193e0bc017c8baf3d5e004b2526df47ca756c11688ea64778b64c67510fd0a3f9bc0a9e6

Download Submit
C:\RyukReadMe.txt

Filesize
804B

MD5
cd99cba6153cbc0b14b7a849e4d0180f

SHA1
375961866404a705916cbc6cd4915de7d9778923

SHA256
74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

SHA512
0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
c88b88e198f11423895d947be8d64710

SHA1
86d76eb7063070550a73f18e4e3c7b033ca13b4a

SHA256
b96c78c6cbcd26e9d0c0fc69a47e64b0efcd0fc4c60c13ce61459d014a1077e1

SHA512
a0ab9af5a21fba35961225dec9fdad4f891c9e71727f5b4237aa57db3729f28d7c91d746d567400f66b7e98f9d0ffd17aeee65a748cfc81e5d1a1c509283cf41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
059c215e52dbdee7b997101927d37cb1

SHA1
b83a6abb3c48b8b6a13fc515547b46a946ad4770

SHA256
2d8acc0a5e025f991c31087763e280a124ef5b07878a0ef5d086c6ac48309c2d

SHA512
21c83b5c1e77ee83bbcfd0ea5d11b50bf2d0fa18d183ffc60c6e8e9c9c8b29add249594b5b5bb54394d2f7b62b1349906a43ab68d0e4d6d7dcbdb08e54d6c64e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
90a2e7e0dcaac86a9f8b85800c5fb8a8

SHA1
9f7a6040e39869cfe64219c82c80b382d5787a59

SHA256
6547a5b79c4fb00d9544284e2c0007ca7050d0f4ccb2a2be090c12efeaac80ad

SHA512
61726e0939f202753e62e534819e59e2e65e7cdeb61cadcd5f876a8c575e39c654c3f07476787ab98a7c4c0dd6e23f2e723331e10c3437993ed63eb5cb1be724

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e40dc30-5bd0-4e35-ac0f-0097749ada3c.tmp

Filesize
203KB

MD5
e50be1f5d0bf33fadf7895dded4b3523

SHA1
7141f3d7042c5a8018d903e4f8b72fc00d025f4a

SHA256
750b11aceebf2679a6acf808201cb69eee7a285302dc2e596bd9e5153ada09f0

SHA512
f806065a47c8b7da9169fec9e3056d818e9f727ee55222f3c5c98fbe4f319bfa2df1fe5116d642a7e2d86c63fdc739a10fc70e5a534add4f41016ea266b57975

Download Submit
C:\users\Public\window.bat

Filesize
1KB

MD5
d2aba3e1af80edd77e206cd43cfd3129

SHA1
3116da65d097708fad63a3b73d1c39bffa94cb01

SHA256
8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

SHA512
0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

Download Submit
\??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak

Filesize
12KB

MD5
5edfe3ca9505d5252c93a7d139310782

SHA1
91d7d8c0ebea0393750c8e6cd4b114d59e5daa64

SHA256
09dc7381bde13b14a01c77dfda756cc85d5e16e12d4e5a4ae17b14d1f5f8c1d8

SHA512
4ac5edcad9e9f210dd83be2f679d89934cffcf560e2256b96ed5096c15827c740a61d4c163a4c30a147cfc6e25d867a57f3dfc983e11be660d6cfb69b5ec7e17

Download Submit
\??\c:\Users\Admin\Documents\BackupConvert.vsx

Filesize
830KB

MD5
084942c3f54d5d10fb102b06c60d8918

SHA1
210dc0fa5255dbe0523df97b1bc0b12a58131264

SHA256
10c1cda07320153b0e672e1e7cd0e63e016717ecc2e820e7dc525fd2fc277e27

SHA512
0ffd662e5751a4c0b311a3487087dae0575201d212fdd469f7faea0c33e333591bf94136392f79745e6eeee25bfdb691844f08e8177f463d26b04b3fb7b9cf5b

Download Submit
\??\c:\Users\Admin\Downloads\BackupUpdate.vst

Filesize
675KB

MD5
29a2560e055b213e672e4a914f411972

SHA1
6f8b2cf8e7e5a2106d10db616ad06df539330c18

SHA256
a655388a25189a649c98494883c1076dedd2acd99ed59e0fb79ee045ebaba93b

SHA512
933866a3c4a417961c43e81c45cbae455c1896267c70b7c6a4e9a40bc55faaf4d52cba9a45fd0dc4a97605751fa953bd2d63d1167a60b05bae297a29d7d7741e

Download Submit
\??\c:\Users\Admin\Music\BackupSend.mpe

Filesize
257KB

MD5
ca2763313a326ab8f695624af03d6832

SHA1
9707deef9c638df7417c3b5f6aa864c727d108ca

SHA256
55aab337b32471bd21dfd43eaeb9d87ff13477072c9609be82d8d788d7cc07e9

SHA512
c0337745bd4c323af326113fbbce15c7dff8212ca8295aee5c3cf4f898bbf1f9ed2f05561432f981be46157920b95a7e81c1b4a7e7ef89ad589eec5ef62409f9

Download Submit
memory/784-9-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/784-1-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/784-30950-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/784-2-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/1120-4-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download