ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Resubmissions

25-12-2024 03:42

241225-d9c21axjdn 10

25-12-2024 03:39

241225-d74ryawqfw 10

25-12-2024 03:37

241225-d6fzgswqbw 10

25-12-2024 03:21

241225-dwt4cswpdj 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Size

321KB
MD5

04ba14a9828b000add142d0bcb42ac2d
SHA1

928a705a481384dee3aa9985bb2a9e1e6827902f
SHA256

28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33
SHA512

2fc56d6fdf360c0435f76822f3d99288c3b31462931eb128c7ed895bf93d88b00663801c1a5394b1ae5bb081ac76b004deaf46fdf2b0b9c027b2945a7c030909
SSDEEP

6144:ba4FsUiep6JzvI74kZO/+SJtwOW8HFBwK3SBDmhYfFQ:ba4Fs/7IfO/+SJFW8HF+KCIG

Score

10^/10

ryuk defense_evasion discovery execution impact persistence ransomware spyware stealer vmprotect

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Ryuk family
ryuk
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral11/memory/2784-1-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral11/memory/2784-0-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral11/memory/2784-9-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect
behavioral11/memory/2784-30861-0x0000000030000000-0x00000000303DF000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"	reg.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02356_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Inuvik	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\ja-JP\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\BASMLA.XSL	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.JS	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\PAPYRUS.INF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198226.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302827.JPG	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OUTGOING.ICO	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0233665.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR19F.GIF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME18.CSS	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\EMAIL11.POC	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBCOLOR.SCM	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0281640.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WING2.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04385_.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107150.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296288.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\RyukReadMe.txt	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198020.WMF	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUDGESCH.HTM	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Interacts with shadow copies 3 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
74604	vssadmin.exe
72164	vssadmin.exe
74488	vssadmin.exe
74708	vssadmin.exe
74572	vssadmin.exe
74516	vssadmin.exe
72140	vssadmin.exe
74544	vssadmin.exe
74632	vssadmin.exe
72040	vssadmin.exe
72076	vssadmin.exe
72108	vssadmin.exe
74408	vssadmin.exe
72184	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Token: SeBackupPrivilege	74432	vssvc.exe
Token: SeRestorePrivilege	74432	vssvc.exe
Token: SeAuditPrivilege	74432	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2880	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2784 wrote to memory of 2880	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2784 wrote to memory of 2880	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2784 wrote to memory of 2880	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	30
PID 2784 wrote to memory of 1048	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	17
PID 2880 wrote to memory of 2892	2880	cmd.exe	32
PID 2880 wrote to memory of 2892	2880	cmd.exe	32
PID 2880 wrote to memory of 2892	2880	cmd.exe	32
PID 2880 wrote to memory of 2892	2880	cmd.exe	32
PID 2784 wrote to memory of 1092	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	18
PID 2784 wrote to memory of 1556	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	25
PID 2784 wrote to memory of 74376	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	35
PID 2784 wrote to memory of 74376	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	35
PID 2784 wrote to memory of 74376	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	35
PID 2784 wrote to memory of 74376	2784	28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe	35
PID 74376 wrote to memory of 74408	74376	cmd.exe	37
PID 74376 wrote to memory of 74408	74376	cmd.exe	37
PID 74376 wrote to memory of 74408	74376	cmd.exe	37
PID 74376 wrote to memory of 74408	74376	cmd.exe	37
PID 74376 wrote to memory of 74488	74376	cmd.exe	39
PID 74376 wrote to memory of 74488	74376	cmd.exe	39
PID 74376 wrote to memory of 74488	74376	cmd.exe	39
PID 74376 wrote to memory of 74488	74376	cmd.exe	39
PID 74376 wrote to memory of 74516	74376	cmd.exe	40
PID 74376 wrote to memory of 74516	74376	cmd.exe	40
PID 74376 wrote to memory of 74516	74376	cmd.exe	40
PID 74376 wrote to memory of 74516	74376	cmd.exe	40
PID 74376 wrote to memory of 74544	74376	cmd.exe	41
PID 74376 wrote to memory of 74544	74376	cmd.exe	41
PID 74376 wrote to memory of 74544	74376	cmd.exe	41
PID 74376 wrote to memory of 74544	74376	cmd.exe	41
PID 74376 wrote to memory of 74572	74376	cmd.exe	42
PID 74376 wrote to memory of 74572	74376	cmd.exe	42
PID 74376 wrote to memory of 74572	74376	cmd.exe	42
PID 74376 wrote to memory of 74572	74376	cmd.exe	42
PID 74376 wrote to memory of 74604	74376	cmd.exe	43
PID 74376 wrote to memory of 74604	74376	cmd.exe	43
PID 74376 wrote to memory of 74604	74376	cmd.exe	43
PID 74376 wrote to memory of 74604	74376	cmd.exe	43
PID 74376 wrote to memory of 74632	74376	cmd.exe	44
PID 74376 wrote to memory of 74632	74376	cmd.exe	44
PID 74376 wrote to memory of 74632	74376	cmd.exe	44
PID 74376 wrote to memory of 74632	74376	cmd.exe	44
PID 74376 wrote to memory of 74708	74376	cmd.exe	45
PID 74376 wrote to memory of 74708	74376	cmd.exe	45
PID 74376 wrote to memory of 74708	74376	cmd.exe	45
PID 74376 wrote to memory of 74708	74376	cmd.exe	45
PID 74376 wrote to memory of 72040	74376	cmd.exe	46
PID 74376 wrote to memory of 72040	74376	cmd.exe	46
PID 74376 wrote to memory of 72040	74376	cmd.exe	46
PID 74376 wrote to memory of 72040	74376	cmd.exe	46
PID 74376 wrote to memory of 72076	74376	cmd.exe	47
PID 74376 wrote to memory of 72076	74376	cmd.exe	47
PID 74376 wrote to memory of 72076	74376	cmd.exe	47
PID 74376 wrote to memory of 72076	74376	cmd.exe	47
PID 74376 wrote to memory of 72108	74376	cmd.exe	48
PID 74376 wrote to memory of 72108	74376	cmd.exe	48
PID 74376 wrote to memory of 72108	74376	cmd.exe	48
PID 74376 wrote to memory of 72108	74376	cmd.exe	48
PID 74376 wrote to memory of 72140	74376	cmd.exe	49
PID 74376 wrote to memory of 72140	74376	cmd.exe	49
PID 74376 wrote to memory of 72140	74376	cmd.exe	49
PID 74376 wrote to memory of 72140	74376	cmd.exe	49
PID 74376 wrote to memory of 72164	74376	cmd.exe	50

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1048

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1092

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1556

C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
"C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:74376
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74408
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74488
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74516
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74544
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74572
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74604
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74632
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:74708
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72040
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72076
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72108
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72140
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72164
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Interacts with shadow copies
    PID:72184

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:74432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata

Filesize
754B

MD5
6fe7a5942b28a6fa7f676c2d6ce44f58

SHA1
64cd2cee1788cee0994d8cded5ff0da4088c9432

SHA256
66299ab94910117b05b43d6c7f23de49f670f9db8e5f8972265b88ba63fd6496

SHA512
48d7458206580879adbb6a1386ab063be0161af8713eff0baf7ebc9f7ea1330ce1632e234231623c5df6cbc1e22d70989aeef85ec7a2178d922177b0b0d82651

Download Submit
C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml

Filesize
562B

MD5
efb74342d4d49b40dd3815022b510e7e

SHA1
337136146df599031b7c477c34fc87d7be2d7172

SHA256
3068dfd3f4de85842475e1f2cabfc5210af371cc6b8a11bb116a515a794b6a45

SHA512
df189bbc0f0ebdeaa32f9e558796d544900a4aa18c9f611769dbc79eb58b5ef31a0a118b0956afcc4d9e3538184286510e52215e6c8458637ddc2c2ea36d70c1

Download Submit
C:\ProgramData\Microsoft Help\Hx.hxn

Filesize
674B

MD5
f762fc4b9efb2a11073747eadc102177

SHA1
5e3f09254029507aee3d54797bb46cb9f5c6c339

SHA256
0cd264a4cf78c47ffb12c2919331ac737b55c48c6a8e6002b3ef6ff13053682d

SHA512
0a10da71c1e44f64b8ab246346d2eca326060d662255cdc861f4422e2a139257b08099fced5f4bfb89cc211116658741ec038ee831f2c722cab276b2cc10d8ce

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW

Filesize
13KB

MD5
c4a021c48fac3efeef8ff8ceaf55f936

SHA1
f896e3b4ce65bd9b5a24937a304cc014437fc8c3

SHA256
c6da1b8971b36d7a96c90dddb1f47620253915065c25ab247a0c51cca131b9cd

SHA512
2b0088ed83386d5ae861c74de1141bd3ee4bfd1564b5e7cb3875b593d1b5da4f1d16aedb7f0c5f7b14efd35a961c2a0f8d18fdfe0f81bb0ddcca3de818b5dc24

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW

Filesize
13KB

MD5
6d4f373c59f5e46a1d54f79cd802ee31

SHA1
11824dd857c4c4195a30e82c60a6b0f277aae43c

SHA256
f7112be659345757b4f7643ed926c82c8bac73993b3544e32138b910e2c72938

SHA512
854abf52695bdb79390c81cf4d861edae863490fbe1005ead776e586ccba3057e90bcd91e86eb0c76f5524b941c9e3218cb72413a0e81683a7d75e5c1c06a2b0

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

Filesize
10KB

MD5
e6348319d96c4630d411cf76a85deda0

SHA1
e6d8a36c3f368aa59e36f74ccbcc0760189ac615

SHA256
e78780ee23aa32e969d1321abfac95319d0cb33f0ca3fa22a64acab58ad23220

SHA512
d219faff51a28ee525740058a593eeb81b47468ae16342b6688edf0cfb91d8b7db01b59a96a2a5d291377091a74174bec08555f1c3facd47508193aecf759dc2

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD

Filesize
9KB

MD5
b0bbc1037b5efc401e8750a55fa42404

SHA1
1ef79c43f3293848b17461609ed87bb8f1cd3e0f

SHA256
4a9aa77838efacf052ab3422371d668fed5bfe3fad83ad766c15db3ebdf437f7

SHA512
425b3d7bd90399cb515b7478184a88d78ff0b1cca6c62a55ea310501fbca4faa7b7deb7d4221c65fb1cf0178fcaef1673941b8324749837ac705fa1ead5e0ed4

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

Filesize
626B

MD5
2df4c20cd9339f0d78e29f3317fd21e6

SHA1
46b55adf8045f09db6cb5af0203b959afdf43c3c

SHA256
e939cd1024d6bf0f4403f06639de8a610641657989eee5389c0276275106de2f

SHA512
57fffb336ac339344750fe9c3433abcaff0a251878c94ef74b18954c65e0723526f17ad506d76f1b317076c9657f52c781c8aa5960f1241f902fee5215b20540

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn

Filesize
658B

MD5
3eb61978b2576d1885beccec83949216

SHA1
304d4ec15d5ed7ae495abb80eaff101db662351e

SHA256
82b1c3486421ed7c6cd5664de1d215a66c514bb5b69913d577c16d184f86caa8

SHA512
7dfb2bdae427084cf8238a668220df183bda7ddf26fb6101f095789d7ea31d17e67f68b58a008208747864fce94b3bfd9a02a28a88234f644f9ff2895bb29e4b

Download Submit
C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

Filesize
626B

MD5
8c9433166a4d6d980f6d27990d779bb0

SHA1
5433146a06a255db2ea0b689071cd00f5ecae3f5

SHA256
9617f31f64e8ebd4e75542221d81c1345ab15c2f052de6088aa6e6c9ac3711ad

SHA512
ca4ce660e3467307ba2f1c24cf10b40f5403131a6517619933178e1b6a029a4aba9ca61adf4eb32013687b40a80eb565b3142d85dd00e22311f46a3755867b01

Download Submit
C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

Filesize
642B

MD5
b482538322b08ceef54736a1984b1ca1

SHA1
658bc46ec950d541bb30685bf758782d1cb83bd9

SHA256
eea697efba4c7563e4fc3211ef73a11cfa6c6cf3754137fdddf5f03f0890cc99

SHA512
a32a8846ac89e6e5dbf399f2b77fd689a967ff12f5ebc42ebb5d97e2528a1dd89e32888a739b00fbf60de201cc011069da47531e9ff03b2a4c6f187d90822d58

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn

Filesize
658B

MD5
2df039d54b9f0bd0ac0e74833c115b05

SHA1
ca101b8bd5f9811003499946314a1da1ee0c7e79

SHA256
af18255292439b9f5907350d7589abab5f045be6b8892a66dc6a1ac0dafaf195

SHA512
f5bbaa6bfe8e012859ad27908f0cfbc146b4d2b3a2a1787d1381af5f0803e9f860b2f7b40ddcd5ed0ad6dadb84d5eb335dbad77b7bfd21da8d2a0a1dfaf86987

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn

Filesize
690B

MD5
da78e95f8dd72e105494b25b2ffa03e1

SHA1
71d39634a80aece0c4d5498518fdf3aeeba8a7ea

SHA256
d2e02e74919552c4224ea822e1b3c11c971d6e345302909198e44827db46b2c0

SHA512
c8018c6854bdf445e5203eefc451fdccc161f29bce175cda8d3848e12c65c105c90e8f9f2095fa48e08025ec5780960faa8b3440a5089153c1d37a9b179a33fd

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn

Filesize
658B

MD5
4c1d824a7ba662ef283a6e224c48a5b9

SHA1
ad6335b035c34f2fbdada876e3908e0e90965a00

SHA256
1578c19b203804b2f253c9854e03587d89ebd29ba8a12a0a9b2deff6a43f5047

SHA512
5d2542f6c6b440ebd81b1bd5fe3b27e31f117b51102f4d0251a1f22a751b8235c32591834efb31c2a49afbae8af164713231f7fdf553b23c674d91c3f4c38c9e

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn

Filesize
674B

MD5
a9c3d2dbbfb04df2fc5ecb5eca95cb39

SHA1
550749827cd2483e7cd3685475881fc568b8f487

SHA256
d717b8eb4c1ff94fce800caed51195ac71562e60b841f482505020df9451713f

SHA512
6e0740ef67e5d4b235c7a54a644a291da3168cee6bf20248d5843a4a7f5c0193e4a46a1c95870cc047c338e9244656d4a6539ac05fb48e247d0a33a8edc1a093

Download Submit
C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

Filesize
626B

MD5
31e90296ca5030d8a0f719ef562ba7fe

SHA1
f1c8a4494fbf1f938f5b93054b1b7ab6a7cc3f8a

SHA256
0eb57bff57af2c5955f4e6a3b8dca0ff4fb60c020219db7067613d7e8fdfb3f0

SHA512
23d500dd8a3e0748d75ce4b235bd3f1c4da6c00a775c8ed5ba5f401386cc72bb40463aab766d75406bb3328a1ff699018eb466f7bee84774e11583ba185da695

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

Filesize
626B

MD5
78e221fd4ff68897c0fd35c81f4f4e0b

SHA1
65e321b982055c8e49d62cf0cb1758983c05e159

SHA256
6d48274abc81493b4d2a973da2a33fe2b8049d5bc3e9c9e32614d8089c2fc889

SHA512
c5b1dc206031587aed0454f1573664d858e8467c93b2f7de3562a69bc47af9589df25036e3e86317116b26afab460ea24d6f1245633ce7356688d3edb8c395e2

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn

Filesize
658B

MD5
3b479e85818b5e58c19fd4c1a13103c8

SHA1
7769e17639abe13f36fa613083799cf4d538b184

SHA256
986c61b4785e729a2857501c98f49d571a1418e00fdac008e58d8650ba73a41e

SHA512
695e5a74a3a15233ab1db0eefc5f76f79b59eb649495fb7719b17effbd47f8e3e3853d1a0b8b5910bc87f3851dc107ba793ed1cbd5fee49d3f7ce17fa8fd2466

Download Submit
C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

Filesize
642B

MD5
4d2d4bc00e6c6de89a33e29d6ec11222

SHA1
b320bcb97ded0ce265af2910d769e4e149f44330

SHA256
73aba002c26b7d9a53aae9401f9e6bc0699f088730bf182f2130256ad1f79b80

SHA512
58a91d435b5672d149642a133f330f636f26ebd0f26086df7033b5c98e57d9e89e89aa10c895eb63a28610af6123267c4a6117816c0dc8a2ac53b17e51ce8ebd

Download Submit
C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

Filesize
626B

MD5
dc3c4b16f1374cfdd2f49c793ee1eec9

SHA1
93dcdad43ac8c2ade499f55d6d7ff39854b24073

SHA256
89bc7c7e17af8d48985573a73b8b7a713791fde01b04f78243883bc69236d03d

SHA512
5e93465e667cbe5b5cf8c5ff6001503c5e5298b2e30920284c7ec7d0aa3c90e8e794c7ca7916816be1f8a8fd7daab8a51c0bf94f8dc968ce2c0a68852394478b

Download Submit
C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn

Filesize
642B

MD5
f14f9a802152694450702c5f445ee583

SHA1
aaa919310f1d658eb6167399d977da15c85eb1f4

SHA256
2e275bcf71dcffa596a582adfd1a275cf27633b47bfcc1911c9f875b646680d1

SHA512
d00ebf5c93dfafaf2d5570d9eeb4f0b31368490a0623083477b7f4a1e80633e812b68681c2a2f86c1509e50b317bf04a545116cac6937263b54b1484ae77530b

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn

Filesize
642B

MD5
b7d496a799e0f9128928078f4b79dc94

SHA1
44cd144bbaf008ddd751ca07745dde2ad6b7cb87

SHA256
cb2aafea70b8d028a32af9a143a9138ab25ff6016ddc90e78b75b28b91af241b

SHA512
4eba47cb90a2df45eca3a612043387d35ca3451d3cabd2c7975a4c98ce9bf8c88c93c0161abb7538e52a6c17b4900fad98196d9556e9e9918acadfa28c6a5199

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn

Filesize
674B

MD5
f165fa9c9743554d09a22336c3664c03

SHA1
de7bccf0e1cb60e2c2a87b311032b4ac792940ff

SHA256
c946ba2aad7988624da66a4d1fc8f1ea78119d2cfd97f322d22bf891603bcb71

SHA512
42a30d55d855c999fcaa33674d81b26243be64b1399796377306a3b21e2712a1bc35bbb03394439451947297fd50f7527f3b3a951ec9896536e15aa0135848c4

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn

Filesize
658B

MD5
37cfbd4f83e9fdff49ea82880e926b9e

SHA1
5fbd17312b9c28cbc342836c2fb7f2147f9d8208

SHA256
e5db1eb02e67670c3eb3d2245efba52c6e18a357cd52bad124abfba82471898c

SHA512
b65f53ad234860bd8963e7f1c4a6de5b154c3b0c8b73f4d8375a3bc92d615db9ab9c59c51c1b476ee2107bac7ec786de5c8d389d5cbd1fd8c5a5af969e20de30

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn

Filesize
674B

MD5
18f4e3d14c05110422eaccefcb2ebc98

SHA1
ba02c35483e310e7b137d3a293582921ffdc1f85

SHA256
5fc9d903e18a7d888df8b218e6ecb107636fce5dae6e965e320e1add89663e38

SHA512
cce9c46c85fab17708600538c5d57543f0292e6af482e291e270daf2361885b66a1ad76b238ac11d8fcca77b02742dd5cb1ce2d2da8659c0160601e9187ecd70

Download Submit
C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn

Filesize
642B

MD5
815aa9af0a2cf4215e86bbe3a06df821

SHA1
f345a42006afe155088322a90d8de69aeb888bb1

SHA256
c621e15dbd73c4e739db533f076cfc77e6029ca942dfdfc43dfb9ede8b210a04

SHA512
10b7faf833e5fff31658bb104bd7a1eb2ebe20d9793a6d1a01a242463d7e7d1536d0d1639ecbb6a048b517e827ff1dc9d1b877420a23b5af72707e78f8cf1430

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn

Filesize
642B

MD5
2ed1f252823efaf936ec03f603b73605

SHA1
7fb5c5289159a5890b6860d302078f88112768f3

SHA256
c347c063a3577bd0853eebcc30edecc1c6d99c4bbe0959712226268b5631dab4

SHA512
fea44300492ceac6f9cb5bb1fee83c1300ceee94ad0a26842052802396adbcebfa5dce9aa9434df2b35ec9d68709ff4e4331e2fe8ae9df74ead6e2a3236a2334

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn

Filesize
674B

MD5
a392fc325d206eef6b65c87375022c32

SHA1
35b52247c4397872fbd0c5e4044dc1cdb394ddf1

SHA256
578eecba2d97948c4f3e6390e2c6efb2314bf57963510c30a068cb30640b080b

SHA512
b66e0761c4b0602c5a51898754b24efd8b13fe1b73059cadc3eb0de4aa02f2fed698ffb8419ff1e36e37c9724b0ce133e4627919ee26cf898d8d09d27d8174c7

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl

Filesize
6KB

MD5
479b57d77e7babe5664b16911d9e8e62

SHA1
0c194c39b94fd6805c29d1cd86a5722d5698a95f

SHA256
b34e226cf907cfe56d918e45009ce43552b60a379d29d012272045e00f2dabee

SHA512
06a8cfd1658e0c17be364739e8c55fb1cdecf10c7e9e14b32caed956b981dbf80def87f8265477694618464e3b7010059ccb58bc3480b51756f0cac8026a19c0

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D

Filesize
12KB

MD5
0d0176c29be77b14efc265b8a86912a7

SHA1
c3495e0ac9a80001bdee4d37a749a9b19bf803ab

SHA256
6a08ca6bdb6309f5e67166ffb6eea065d3bee0e7fae262e22438b180b5129473

SHA512
07665cfa545c44af987d7ee164ca63014106f9ffcd9b088a27411715a6a638a4263d7a68fdaf6e3ef88d19379f818b014d4c2c0b418aea7d7d1cd6ec602fe3d7

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
259387dcdd1f1cbb681fd23c1d0f3274

SHA1
469cb24941864eb3f84221b9950e548f5c597021

SHA256
93b900f0e509e88c5e78fdc0f4f1fed88962a7309ce80238ac135817c0dad558

SHA512
01dc0052d7c8ec5dfc424f0d8fcb1acfb20d8edafb40f2649446c774cac9a1711208f72e10f0009322e8354892137c24c38eb56679792c3386119db9d0327fb4

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W

Filesize
409KB

MD5
69be310c63d2ce561ee517f1c063a89f

SHA1
61503660ce359f7011b7a706491ac347f47d03bf

SHA256
5eaadbe3aec817ee9351a9bc2f05dac8113887efe8807204207faf8c1f0e1774

SHA512
00c69ddc7eac466f0b408e574b992225369a8a01fab2b03d3b2a72e0c7f98d163b34c8007df52f797c80f09d27c9f90ea95b52c3e0181a803947130f482a9b6a

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H

Filesize
531KB

MD5
aa5fe7866dbd9321e7e45ddde32a7a80

SHA1
4809067875240e30c0735972540396c1406b0046

SHA256
4349b1d71e3d46083cefa9fe95e59b1689a06fb02ce4d163399782ef8475ad33

SHA512
00c0d473dbb74b5c8095c25ac2bf242d53d9c7f907325895ff29881353505c427f4e90d9596b8fa7880457f81f4671c982284e748988e973b2e3e51fea825bc3

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D

Filesize
14KB

MD5
da4a7771df2ef7e1c398f3bba11a2fe2

SHA1
f45b5e1faeb7259618bfe0d1200b47da4186ed83

SHA256
82e43af4df148778b97290c7b621755cb39d8c32389fd19f76572d9eed47a00c

SHA512
997880d0d39d15a536c11dd8876691fbcdac5b6f2de03ccbb033f2dab698052de54c60be6373ad62bd5ed8cf4912efb34d70fb332f4475ae13cd5c2c5a0da96b

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q

Filesize
1.2MB

MD5
89ddbc49f30c74186a307515ef5d3805

SHA1
44bc12440078d213f3399e9ea696c25ca40db70b

SHA256
4787246272f737a89c17b2489dd7f3830306a383fa18403e9ff43129d86be4ec

SHA512
94cb0e8b1818e160f328184f775f5f726ab80ff36021b0131637b521377e62330c510a9a697f1c3467d13f9b609e035a5fc57a712ff2493dd6f41d5191da5df8

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D

Filesize
12KB

MD5
fb147f880b92b0d06ccf6c05ee9d35e1

SHA1
821871f7f9bc5adb580358cec2d99091f9c07d0d

SHA256
648b9cc212df08337220f06bbd3cb0672a58d2009f9c247cf10f022242b2b034

SHA512
8c644a57aea89dc3ca164c7af4c325329b8eeb5026b80f4e5c3ab2ac0dacaec5634680a2553ece3de67b2a897a86a585ec6219cb78b33288c299738916032f37

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
74e49682f5cb697297ca5c10706f743b

SHA1
c8e53685868752496ad43e48cee7ff1e8f7eba67

SHA256
cb29199f4548b6bbd0f68eba565f68ec45d05e054f816ba05b9767141efcb97b

SHA512
56b6a7ff199e9e4efa0c91d1fd28b68555311d0ca68fb98376faa179d01a5d43a36bb52215fa90833e488c25149ddb4c2f576de6734f2393308c990cbafb2a6e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W

Filesize
201KB

MD5
bb5817f44a772861b9d57acda414dd3a

SHA1
06ab04e5a26d4222b87d0d039cc10d730f697b91

SHA256
3de71fa6b0803a9455fcf06b2865b3754706f08781c5baac4b3078e99afb4f49

SHA512
e1483ab128c7b496023d853d4e1ad52e9be07e03dd85698a4054d96394f67e6821b32698f980db264b6daf3f4fc016cfb3acb9c0960d86efe5ef30c925f1753c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H

Filesize
491KB

MD5
625264bcec60bc7ee335e40a9121da33

SHA1
e7d83976926071a4ba055b355fcff3dfd5a00978

SHA256
988bcc7ccf22aabf3771d6af7862374106be6aa67fda6d013f4f3b1ee5b093bc

SHA512
68adf785fa8bc094ac270e1e95fb133ddbb7b66c27d7c83a25e0586142152b9c67ad398d8ae187569e9a7f375efcb59d30a76de295c62ca5d58264a0541c3c56

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D

Filesize
14KB

MD5
75c863a42cad7b0dd8bbbe7885cd1e20

SHA1
58d624a642ba33b0cefc2da6ae6d816292795311

SHA256
afe491f3a73351635fd966cf6e134be0d6d62090cab6bc5fbe87526e47a852cd

SHA512
c4bb50d991125cec89041f87d1b1c8e64af79025a4a2d8361dbc75ddce4899fd449c995e4cd8f5b73db0044030622d998e5f81f5bc70d96dccc638d7543012f2

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q

Filesize
864KB

MD5
e26a2092d7c4512ff3ee51c89b8550e9

SHA1
0443a01f62d03ffd22edb8bfd51295da293fbd78

SHA256
4cc47e9ac27e69e42091da305fb77b3a25e48f8b8c1017005dd89a052cbaa3fe

SHA512
1b25bd1c47e018c73b75eaca17d34b5c39ec8fc611e172b88c0e64a5bf06b1fc9f50b4105f9ee03485b7c4d9902d936811920311089d2c80ceb8de7084f2742b

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D

Filesize
12KB

MD5
0c47b5952cf4d93b24c9c05e2c98d049

SHA1
f82700c426b654a2f7804c834cc971c3a0936893

SHA256
bb9db6f3698a4535f977b87609ade011dd309013e978b38e948df88841cf571e

SHA512
5a6cc728990bbffc30e7ae36e76db9676a002fb9133917d5dff2d83344a403e67e34c0b80a3b5d39398d8d00246f4ba733d799d0aa8ff826f3af40a76f6c058f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
1e838fd9f30f3e93237259222c5acd40

SHA1
3ee2639369ad43c4ac92e9e4ab736ccf1a67364f

SHA256
71c6242e2f8a92864f4e4846b27f69ba940625bdf8fba6c93dbbb5d05c271919

SHA512
24cb5c47717a142b754461e8b06c09e1b7828bbf9a4d06a154a43caf358aeb92c07e453791e44a7869af72f1ae9c30166fed52ded306497330d04807af76d600

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W

Filesize
425KB

MD5
d01ef657d416ef88749fb29e8c4cd0f4

SHA1
79ac47009fe34186ce449d90196227552dfa763f

SHA256
00fb6ee66e97460ca50589cc245b8ccc1a9e6b34930f64bd2fdd219d32099446

SHA512
2cc8c18725896cab3f89696ae7057ec44bf0188a3ffe711f65034824dd523412d4532d5539ac5705fc5b6f8410ef35f02c29d90f9e4924d418cb2bd9991464a3

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H

Filesize
531KB

MD5
2b1598ad94234d88ad219a7014afe066

SHA1
e892b550298522cf64aaf79a14d93b0ce0ee8af4

SHA256
da2ce98532e7ab66dfe0a6b85f1938013154f4715691229436e3bfb98bcbbec7

SHA512
bea7318c757d2756b67f7aad9e118cda890695d8f2af7726692f98b64eb71e83aa0b039f316d7cbdfbb5d972144057c8784e7f7f0745ae62fe3b9fae80935ce2

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D

Filesize
14KB

MD5
a6bf2511b069a797e3d6d00378c28d3b

SHA1
86e7c3478687935342d184f020b7fd35370e1469

SHA256
916e363a524b8d39f562072a1dc0651ac31ac529cb855f244ca7ef8bf7818711

SHA512
4ecee44f5567ccfd24d7334975c5ecbfa433f883abb96b105b8e3f6da92080b3ba8a674621fa703d7c64033eb4bf5a70ad860c3c7a01c2178c2ca1f6e4291c1e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q

Filesize
1.0MB

MD5
2441befabaf0c26bbb9bdadc5fd15ef2

SHA1
411e5b0f687ad9225232483a65c420d6fa5bcfa0

SHA256
9f4e9da16d388e263cad52af1c8bacb55791045590337b9c9120c7342790b368

SHA512
8ad30606cc7ec5a4efa6aadb6c0d7e6197eeafb78bacd8a82356efd21657f726916fc39e5c68c451adb3363d9b0dd1cba4448d2ad61ef820f8470ca77aca1a9a

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D

Filesize
12KB

MD5
d99a2d60ca7127371439e8b0be9a1861

SHA1
41c70c170eab37fd4ee76a4b4d1fde5b744a735e

SHA256
01d44beca124d1027ae67f52196fd693e30757b01b463da660664a083fff058f

SHA512
02a3aada4ff46ee7a9a84673e9ed5a781c792ce017213f9f87bd5154de280b492ad8741cc0152ce3418fff73e03004adf70ba580b25631ba638e3623fb5da7c3

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
04b8269d4a82f99eda7b69b9ca9b1b46

SHA1
d1adadb474eb89df3a494f91bacc06a50be04d0c

SHA256
ca2a901abdb4adc41394a2dc856cd6f62bf3a5948657aa2f67155c6a9c98ff5b

SHA512
099b760b1d04e1c252ef758bf6afa11c7f915604e45a5533ef94e729faddf69ef866d23e810243db70ab12b5fad9dc1be337a98ab329420b59bd2302ad2f65f8

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
01d9943b7034d3bde8c8a9df11477048

SHA1
7dfbc96383aba0efc34377fed757648f95eeeb09

SHA256
54103006f29559ba29c811220cb4e31546c2db2abc08424f54e2502f94f35ece

SHA512
55f34c3dcacef8c34cef9c024e85368be62909e9fa6bc189896030599a2932866337981ee21506d6acd65a26347d928c3a4b736a19bc65751719fe18da87483c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H

Filesize
546KB

MD5
ba70b9ac9e2b8b7f93652bc9b6a17f11

SHA1
bf8c8c45040bf5417542cbebfcb4ad93e0c3607d

SHA256
ccde0a3738970f2292a418a6db5a47dafeb0dba9ed7e4047f2a6608eb341b669

SHA512
d2ead3a0e3427f06f3df34229c85be122c704d3c5d1c756baa31acaf812390ed5c97f6b19f4917025ab7044cdbf115d1ef65760c46ff94f58a7e53ee26ff6dab

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D

Filesize
14KB

MD5
6aea7ce53649bbd12b78226173f8095d

SHA1
0358a84d9b4ec8dbddd3afa45c1d88348984166a

SHA256
b301edc48d764543948d127c84298a8b2a24c4629f9be934cd054d8e59598459

SHA512
408968bca8d90e4402625f939eeefe188ecfcc312b6dcc30e7a52435a01f910259941ab2be700bfc5f6ec3551b06e453842a966a7d8a264a43fc1d3d1122fbcd

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q

Filesize
1.1MB

MD5
46ebfb89694794597cb528b31ee01d3b

SHA1
7638a5ecafb097710c0d0307f7f723faad586676

SHA256
84172385eca7878ce6ca9d999dbb4172e38cbb72917086677f108961a21cfd62

SHA512
67a3ec45017431a439375235df74cf36d3322f28898de785253965e67f44999096289fdff1d0c61cb1b58736ceb561cca69aa6fa3d79c83029d367d9a1c907ef

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D

Filesize
12KB

MD5
e943da59e3cbfc78ca890b0d74cb3fd3

SHA1
9bf51941ce3c8b6c64e909b8eac89ae359221b20

SHA256
9dad62f930d4ff04d5e60a3e2920e2e07b11a2c510b86707cb12bf1fd0f43501

SHA512
3e6556b900e588935c8a810f3517fc0dba112916a877caddca913268de913501a9ac9310c88728faf39b4a8ea8ffa5d2b9b91e7d5f32729936416a015a56cb45

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
3e79080ec33b5de9de43e06b5537698d

SHA1
ed7c1ef1c7bc3201affd8ea2756866549103baec

SHA256
0a4e1c4828509014ec597b55b57b245314c6a73329575742db4c2f2baa704706

SHA512
5c079ea79017b30351730f7608873269aea8016ad256505c5e6ff9c8fa2bed0f69ac250f3550815be4bc4008a197e0a773647fed8cdcaca871acd04c565f1491

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
3d750c4bf5cee069986de789ab63ab5b

SHA1
215b7703920f250bbb9deca883d33b5515e8f51f

SHA256
a9bc82e6aabd4723187ef97e82e9bd8aa09669781ab8c4bf7236991bedd657aa

SHA512
c37dba230ef703ad65e813cec0c7978b637afa3521b5f1c043d703c614c1f7f866ab6340e948be3310430d4f7eb4b43ddde2a580f331c12a4c92f430eef00e9c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H

Filesize
530KB

MD5
5c638a71867ca8ac59035ea3231417a2

SHA1
af49f5a9e0d78c312d9e4247fa88dbda04dcf331

SHA256
8d6593f637108057e28b7cb4e65033f4b8d5955ab68a8a197140026dc045eaf5

SHA512
0cea72ed31b7ac5614a4a5072c8cce8171b301304ae5aeb1e8cb1b9daa043d282c563c7dbb354b7cb0d4fee04a5e73bc33cff72286941cb6259ccf40375b8ef7

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D

Filesize
14KB

MD5
94071a10448d36369befe541b13ec97c

SHA1
e30e21579c749a6094cf27e939a3994436a16fe5

SHA256
7a372c2ef3a4d95739f98e4cdb9928163c522b779e68ecdff77a09aa9888b514

SHA512
707ea2b2d8e018ae7eb73efba82049c51ca42b2b14b6ba64eb77df75174fd002b4ced86d989b3ff741871a4d793f78ffe60a7cb774389df97a1e4a11e4a1c92c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q

Filesize
1.0MB

MD5
5c87280e18e25fc5488ae4bbaa8dd65f

SHA1
c35d8b8942740417be98fa00b123cc7e0d8f5b27

SHA256
f97526bc17b3966cccaeb24c05550914ae93a82f6ebcd9eb31af5d4a461d6862

SHA512
e9f3ed2d55eefa70be85f914d41a26a86d0da0bab92a5c5d6ae5d102737775a9d2c1fa8f01de14b0875669878f336db9a9b032593e8c510a14eeb598af0304f5

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D

Filesize
12KB

MD5
662dec594aa725aa6506a2ee906a4530

SHA1
cfc0dcb0ffc65bcdbe2b5f38cf4ee74cbc00beb0

SHA256
dae37d8709623d25f19f067b91dc93e8a04d58e035c2f6206dad96a0720ddf6a

SHA512
d02284672fa53a53d453daf3ef9c61d415aac8667251c521aa5902a46f93db828672818a141c5d43cddae6d4c9f0780950bfd4e414d77eb49f8f23ad55500ac6

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
5b9181b38e1b6e04d6e471d1105b5f72

SHA1
74cf94db38a2609224d84bda9be850164b06814b

SHA256
e967dd58beb9ccb075d5bd0237bdebb23146df0fb35286c904f59aa24b9d06b7

SHA512
154b15310079dc1241825181307daec5e16c9cf0b3aadbb0d64098db539ce24ac5755a9bf7cf6c3b965333be77083f22e4b195b35ddbfc88daa03d7ef501ed95

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W

Filesize
357KB

MD5
f03c633eff11bd641d1b7ab33276849c

SHA1
9d11ff17a875a75993d2db366dbe67a1e20639dd

SHA256
183418f059f9453e0b123cc5a9d69d415531d6d519838faa25903f0d67c708e0

SHA512
6b92cb0ea5edd4e58f42d55d3d8cd3f38a7a6759a9b5e5f378139a3375da543eb3936489971272deba921de542605d357414b42d3516941b730668d7bfb7f768

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H

Filesize
352KB

MD5
a2cdb21105dc5e7d7f951f14bdcc4a82

SHA1
e332b55ebc524dd5a50a97fb342ba9851e56bd0a

SHA256
9cbb205a84cae1235e6e3eac741c0ed03d9ecf2c0a1b0c2fe8961c9d96e88647

SHA512
c01d8cb42c5a3b929d0b91d4531d0742c4bcc8756ea6db825cb4db74ce1088259db612f0b0c89dba2498bc288296a10e6c2c792af63d35c73c33828b3ea30d3f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D

Filesize
14KB

MD5
19bee52f265e12061f4b27ca12a22bd2

SHA1
c80a2f0499d8df0c51dfd1f8f65dd7c232000bcd

SHA256
59f1c6ccfe40ada0caadac1f712f52a7494b863ad734d4b658a7a6886cfa1874

SHA512
191b8b7dcdf5f2f2b51475850329387d1acd5e52d8e0eeafef60e3623e7744343b5645b39b13d63bd0275d0fceb724c8cbd6bde535d8d3ef8d6e2f8025da260b

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q

Filesize
1.2MB

MD5
c3124d15b808ba1a4f69704450696199

SHA1
237850fe69c1e3a59af239f975b76b3a072d8553

SHA256
17cbbccdd5c8039fdc3f4cf4e1482d023b16f21a571ad240f470e2f07c5f2402

SHA512
95320f29996ecda68a88a2e935b19a96750ca8c28f07b4814c3b4aadf1b23d9c018aa03f3334ba6698c18be8c0d2f6daa0ba38695d1312b5c16d198f9577a829

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_bf99bef1-312f-4726-8597-70228ef05e99

Filesize
338B

MD5
05ee7e0398975c7b0b30e9d50515e402

SHA1
730fb30c49c3675801318cfafc590cd7229abc26

SHA256
5f277782a00074362c8f5feabb856f8a3bf6ae41550e1e5fa03ccd507c6f7cf4

SHA512
25cd1762cb71d19cf998ff56b2db4d734542060d99f15b810658b3b1bbd6f095a7c1663c5ff40167cca1c26667bb81c6c254a96b7e7da51e449d64ef4b30c643

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_bf99bef1-312f-4726-8597-70228ef05e99

Filesize
322B

MD5
ec176ffcb796bbd1b075a0cc3cf489e8

SHA1
9a3e5fb841e38f3a1bdc52fb4f90da2d8ac7f49c

SHA256
0005b692b0402d8879e6f770aaa33ec2826504f6ad2cc82d641119e8b1eb9ef2

SHA512
b5047dbce0b34ade73464b1454d725742e169450813d81c3da9d96e13375a079f930a8a65cf7068e4312215f6a3e09e5de9b7f3b893695c05454d77f0d0b209d

Download Submit
C:\ProgramData\Microsoft\MF\Active.GRL

Filesize
14KB

MD5
3ec0b8aec0b9eef5ae7d05219bd34aef

SHA1
4dd3a59030152ece55a70b4bc024629d2e32fde6

SHA256
1ef6fa8d3fef8f8d8133292d7b026284c3b3e3bf23f7d90810bcca100cb24a8b

SHA512
d3ee44028759a7ac97df17808ac530926c20c5e3bee64c976feb9deb0263fa21b16e85ccb509b189a6f8a0dc124ce5b2fc51f2f4d15407c68f7b7caa19aad4e6

Download Submit
C:\ProgramData\Microsoft\MF\Pending.GRL

Filesize
14KB

MD5
69d3a2fb69ae366856d26e5693bab6bd

SHA1
dc1f5a3a91137d61ba1f204da6435b988d527efd

SHA256
7777e92b14580b7d9ca3651601dc7e6934145f34edff22ce25cda11070313ba5

SHA512
bf454c91f7cc867e3f6b97044c0046d993983c27fa44123b5fac8fd43a83ae538e2345d38f8d6fac23e142ab6342530fa7fc721ffd8970aee5f92dd2622de648

Download Submit
C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

Filesize
5KB

MD5
d096a76cf46934195c0e68b23535c475

SHA1
f75ae96ba33f7edd942444725f0f1d62a3ac885e

SHA256
af49e35bf2c0166be603c168cea48cc350a6d8e9d6da7e68e5c3e457bfa33c50

SHA512
c09d66ee0a39309214173d16e780820f46923548b01895457b41a0980c491d1fe87af2b441cc3a94f2ef37c94fc9c4e3499ca0a13769c445ef576b92b23e9966

Download Submit
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico

Filesize
24KB

MD5
d4a90491b47be1887a75f99af3c915b4

SHA1
9df26bc9703fdc5785b4f8f73f2ed67b742e1fde

SHA256
2f32e9e05ae144a82fb09a2e32f4ce3b5b5bb0b76a74c6741e96c3edf6f65b96

SHA512
63d0fa27929ad55f573b7bfbbe1fb7952c1f3c5a9d0616f3adbed84ca1155ee442c5ad497feb5640baf24a53258fc01a0bd081cd010af40f7d2713ab5e6588ce

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

Filesize
341KB

MD5
f5dba573e0176317e7c66057e129d909

SHA1
d98ee4c5c1bf23b2f81b0267e38fe464a7c77cc0

SHA256
d381126242011899a21e2a839d489f960d09df0715de8a1504813211069863e8

SHA512
68fb8ad49ac701f1edc33872cdfd3866312ddc72a66e59f0ae20b758d67738e646f0ebd33aaf6fd3641516139eed39333d509cca6569182fa0fe5c62f9ae6846

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySite.ico

Filesize
24KB

MD5
ca45ad57bf10979172f11664eddaf913

SHA1
cfb26e26aa31c66b2bc3e59e15c551152e734e7c

SHA256
61c695e521959fd61c120bdf6bd7b9049502113d3163750a83ba07061def95f8

SHA512
bb9247c68c93ace1da2bbaaf1ec94dcfa254a4dba693001ecb90fb396dec86afd0fa52d92255a99725c1dd1283e006619d0a21ce40ec7568ee98a9d44bacc9a2

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico

Filesize
24KB

MD5
ccb748b3d856b1f76bca8fcecd03adf9

SHA1
44061a16616e13702db434401df901f39fd22a9d

SHA256
bffa9b025afe927e5e915d683b50a795e959297cff97aefd700ae2a9965d08d1

SHA512
6678aa817f7a45cb7f6ebb17c5fa9dfe6427529f95d758c362f20e808f7ab889b542b759f6ba08af24dd95ccd40ebb4a6115f1f38370ee5a76d00c5ac3b253dd

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico

Filesize
24KB

MD5
dc5d6e3d7e8bcaa80da9725f6bd82351

SHA1
64e9d3955169d873014ee7732c92366e69351fb8

SHA256
aa8f32a15bb20b578c7c1a422886ff186e7f33a46a2ba51604a2166adf401500

SHA512
6b928722897ea80a0df7588eb555289ca5eb3b3821b62d4169d0f28bbe075b1eefd6a120254513842c9c9492224199ad55da8b695b9554a86bd4a411f9487ae2

Download Submit
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat

Filesize
31KB

MD5
a8ca915df59c1f5e6c926678a98393a0

SHA1
706b824bdffa4d5744690bf20de0611561486614

SHA256
536a22ff667e6529be1d0f1149c8f033205e796156442a7d295025502e401285

SHA512
6a8d627971b638ef6b4bb1138d576d244c0d1fcec75eb271d7130f334d4ef1a3453848250d4d78fa00d3b4f51a98d069128d8ddb17c4cff5d67150d899f87b2a

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp

Filesize
48KB

MD5
14c385cc15499d7c012cb97d1abff7d9

SHA1
b8cfc5c1cd7416510b3dd119a9a9a66f5c8672f7

SHA256
7106d3f6d552bec089271c5484bde08e0051da96c25b1837372b0cb7deaf2178

SHA512
8e8c0415024a3f2b6fd59e38292be7e6259fd7e606c5c5a4f4e1c0fb5a710791ee462a6b38bb14d1fb89ad8165e14f63cdd7f98993c6510eb0ba4888b7beee9d

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user.bmp

Filesize
48KB

MD5
2afb41c1f452077108e31b7f24164617

SHA1
f32fe33b02ac5bf06c1498155a7ecaf068ac52ac

SHA256
9bfbb22b3dc3c5b617c4b19d8cf6c3c57325299a1dc9b5fa51209f319918de2c

SHA512
181f454f6a1f95d895fc38acd0d6ead00ce38ad429d0e5b063f1512fc76c268ddc758fa391788cba600dce77f4a649ce031a54a808f5076f85a5a65c86017bb0

Download Submit
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm

Filesize
914B

MD5
50c1e2ee8a757f89c9b6845398b9ec88

SHA1
80e9089d569ea9edce9c52cfdc1998847cc3d625

SHA256
c4cdbbf554973ff2a28e4c70724d77df9db47072b3be3f67168e888419404793

SHA512
f6c688915bd7fcc7402742ac3f40eab8f9fe16b538b2e910973c19889bf19c1053da9ea73caa9ea0abc10bb8ae069ec04f2b79164c05551f31ec2859143ac665

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.5MB

MD5
af1f51a9d6024729fc1bddb73cf30720

SHA1
7d55d1832d8fc2d86d775a683e68c8aa5127ed3a

SHA256
a9b3cf462ccf193a4d9ff431ca33fd86dcfa1f7f907f56a3a16af3df1031c03b

SHA512
6702d731ed25eba1e8f5a5d3c5780f5654296a4434b56360e497e6a1d62263885ddde897d0edf8644861f8841a389eb0940b10d928ac09dc157954ecae6a1265

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
148KB

MD5
914229adc6ce33e02241f08b30aff2ca

SHA1
d0cae1a523d3875010d3151d47c497405a117074

SHA256
f9b859c1f734627084fd14921f62ad11e7cf7b6ec94fa5988f599f0562be46b0

SHA512
9e18db061464948b1a352b6412e4809f3503b808feeec5d291a1aa6e573fb9da41162852c399d6738cfe7cbba52e0e0449f3d9a7b0a61eb1e92ff21c3771d2cf

Download Submit
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm

Filesize
1KB

MD5
703108339bf9d4bd8883d61a907af029

SHA1
26596ba58e86406705329d7978fabffa82db8064

SHA256
f0f35bdec4a5a8e01f01d61d506522d583315e6dc75653ab0a12c1c3b2a36c12

SHA512
d526510bb20171b50354ed6c95e05e03bec6c6c736aca5146e8b1d54dbf361e1bdbb3c32b934d02aed93adef6b0890f4be8e2c69ec38e432bda7c3d8a040e071

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.3MB

MD5
35f1884bb9281d8e4cf7c734b1c12ede

SHA1
53075e5e595ce61d2b6f46d61380e9ec24f94810

SHA256
11cc7c14f2991cc9a185fd62b3368110bc69f17db031fa8c138b202324d77133

SHA512
83662b4621536c957c5420e00d5811c59568374f02a200098f24f2389ca3c61dc28a4c6726ddcfff017716c8b87bd643a27629c546867524da1d725d7f2791f4

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
140KB

MD5
37d0ec990ddbb18f238775735660dd9a

SHA1
86e35190e8d7a597eec5af0c2fbf37e647692d50

SHA256
a729bba92743a76af9030cd20a4e07db86f14fc79aef39c32b890fab7e3fe341

SHA512
a57d1b1a92de0a2e65468f724b9b4db5fcd5e25ff0046d4c7e5a50deed8e5fb3cc2196a8bdbaedf422cb48937ba6ae2b15daadcf972fbd5a3c300d4bbc92a930

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm

Filesize
1KB

MD5
ec17ce9e369a4f88c99a545b21ba07e8

SHA1
2bcb34c4f12a377ea70b64801688e821a33c3859

SHA256
ceb74bbc76e434e3ae4a2f5d352a736a94cff33e894dfbd5f561dc466e2684b6

SHA512
aa4d37a6632001f92acdfa796450ade57f1fc07689a9669ae0719f02eef877ff033a58257763fd18dd8bbf594a318e58a9b5d3649a286ff9da2aae6c61d9e52b

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm

Filesize
930B

MD5
df76b207669ffc5d19c0af647995f798

SHA1
5064ea4940690daff240e03f1a5e20e10579bccc

SHA256
54568c624e5af9f0455acf23669296dc50c93e032c889659f7a89938abdbdf74

SHA512
33174ff4b169c1498239c880ae80a28206499e26e09f541cf5bafe6beaec5aeb0920cfda8636f997edeaed2453ccd9a377c616104d7cd0a5365fbe09272ab891

Download Submit
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
870KB

MD5
b87d8ff8eb68d28e135e93665672100c

SHA1
8e7ac020af484478de0fab64bf71e6474ef6dbe2

SHA256
258bd97021c128aa6045db1b49653021b1aa7c0f87c56467bde39ff4072bd329

SHA512
1ce8d1edaf7322a1904b592cb30f35e8c3998698b37f508e8b4d64318000414ee948df4a271b3d8ab098704e20ddc4dbf491b01e22b679f064819a2a18f50178

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.4MB

MD5
ddf58a506833ae7869daba42a0a00f06

SHA1
6170dd21309887cae8f7cb42d3cc5b82296f0b8d

SHA256
117dd7038d6ff6cc4277f204bd95b6539d3b34e8aa7607449453bc9c64991c82

SHA512
f9d3ac405779c629820a3ce22be75394ad9f0c036d32667bddbdf8387226318d483a0f7078af74a44b5cedcbba96cbf3a759fd94bd6eff47ac65c600de484956

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
180KB

MD5
c9ecf11225d080050ad3814096bf6497

SHA1
c57e23888737951b8ba1e552ca369f65d0325420

SHA256
dc5f68ab768784908ee7970229843d727f5450f99a5806f3e34ae7d57d3dfd5c

SHA512
867662c66b4233d35ba61ed9d7f0305003cc9d857ffdb35e823e2a37888e463a99acf111e71e438dc04d62d62c7117ec9cfd53ea07a11f4859f908bcbc0c37c3

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.7MB

MD5
e1c6447aad590cc21416a08302dc765d

SHA1
a5bf2431cf74b2d18fc3dd0d07a7d34573103f96

SHA256
fe773178cba0ccf9ef55c2775d2d3ade4a60b1b9fe4f53d88524ed920da13759

SHA512
3aee265dd900723f3290215d1fd2b02f5e9fcf314a654c948281081d40b32ae614c3b0a8742439b2d30a85e2219b46a622fa9add98609f7772de1e89ee214dab

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
140KB

MD5
1131e15c8d4aecd3f4530856f547aa07

SHA1
e20c7b2afa28c36843c0e3224add93ce8352fc05

SHA256
37431d9976906c612bae9543465f0d12890e663e99af349b6164d188e5962ddf

SHA512
0a4fe881b73bc664bfefef6a633a0e79eb97319e08eacea5176ac8abcb75da387ea89f37b7660c115de4c7aa2d5924ffec349affab217859feeba30098e7977a

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
39d0a3a15c795b5eb1a752a219c5aa04

SHA1
0fefa1023631202f78b2bb67b4b112f846d8d644

SHA256
be482db9340a1ff8e1fb204efb6b84cff966dd2070601a93cd0d773b04a07861

SHA512
58ac37153323dcfc89636c4dda7e37bda43b4b205637623c51b79216f9e72b6d76a73cce32b7be972131d82f70a54092f2b644ed25a8f988a85ed915232f694d

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
148KB

MD5
084c8a6c620501dac77828948ee24fa4

SHA1
0d9fac808c643bd3df7faaf3dd84b11728905f08

SHA256
9ff1e18adf630f11d62f759453995e78f5fb6cf371fb83245ccda8b16dd1bcdd

SHA512
88d04b22111a5ba2e6984acb0e002292a50403d2270cf2265a2dbd378b03087c7136e24df4311922d38ef564f8111396774f2e224e9a565fae1a3a076f6c8509

Download Submit
C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
802KB

MD5
2e4b0a17009def8611f11a1629e14b4b

SHA1
a00c3c3b19cdc881a8ed4a3458826d1967b0ea5a

SHA256
a489d05fa5dfab80d4a21bd4721d1e9065a8e6653145e9153ad4a69412845664

SHA512
c6f1c95f645dc7dab00d99fa21ec9a93e1de90c00010ffdf0fb26e18ba6115e20d5e97dd8dd36ba8db5ecc9cc086d2e9e7fe31e6176734ccd1c25933ef2e48cc

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
fb932a8a37a0ec70461a56354fe7d34e

SHA1
edbb72ced71e0749d9ef3f3ac4fec1b86a4fd497

SHA256
a9c47496dd1cf11f8a51077914423606f957c7c3f89537b58cf068e860191910

SHA512
1d780da637874182aecf9ff350b6f2659f7dac7b27757841eedd5f9944e6cda6bdb12f2ff86fa9a1706cc07c6e61d5cd72b646a5ce5f202a916e522547ff00fd

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
180KB

MD5
2b83600d4b1203507f71cc206ebd1a81

SHA1
5507bfeab875d0fc89d2716f3e85668547520a47

SHA256
0085b718d070b9da8e9afee7e7cbd5ea0dbd954c5d58c655d0351ff389dd188b

SHA512
fe4670f751958c5ee804adbf322a2c29310d57e3cddfccfc678899c0fcb7f75a90ca0f0491d78bc117ab9fde06aad19da55f121893cf4723e9bebc6ee79d61a8

Download Submit
C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
1010KB

MD5
4bf5e508ce525045cb5b486d2e6648f6

SHA1
8f2a36fe97a1bc1fc4a8518e3baf7b40f50462d7

SHA256
a496f3f5e77f5b948e1b7664bbd7ce78be0acd2bb8e72ffd2b0a60d9309b4516

SHA512
2d295837e55d597a74cd3a08f7f7a3bdb5d63f4247d50785f81010ff28c1f791a121d9dc4fed9ee8fafb3a0d179d5c477a532ac3fc08419833fd66a856513fc5

Download Submit
C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
791KB

MD5
b8f10a4fe1573814254ffe14e7add071

SHA1
49768859f8f625a2abd691e1bc6e2551baf45ebc

SHA256
af0fbca7a4503a3dde77a4c1cc5767ac98e65504332714fb08b53d662ff030b3

SHA512
bfe4966d5c0e62570b28ead1f6d29d1120a3293953e0ceba548703b0d19d72eb762cf3c12bf0edf1e25bdd4db7d58e63a2b1f524c90dfb8c88fb59f7c0c76199

Download Submit
C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
974KB

MD5
49f64afef1e9b95d1136db9f7693619d

SHA1
ac88fc9f4b330f56f33f84434b7a74f238800318

SHA256
fbb28f419f3e888d5ea3e0313075e4e7e8fb826ca9b2415b7b1e59fd3bd10e63

SHA512
f713453acf03dc97d5e6e54187df3081ec5c97175a631f8e678924495856b774db201bd6ea93e910e0cc9ed77960238780ee7014b3104070ba52d0a59bd1dbc1

Download Submit
C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
742KB

MD5
95de5442749b64205ff030c3be77487f

SHA1
f98019b254d351992f5367f613c62aeb4946b80a

SHA256
f2ddcda1403a1298f0c19aa6808aada2f40a72cad3ced96ccf9477f6d7b17cde

SHA512
c24f031596fcf4a029921ee8075ea15d18c7ebd5d15ce8846168cf5398c9d250ee7eae06f83c3b929da9453ed6760dfcd1e8063ed6c92037ef2ddd15aa1dbe50

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm

Filesize
914B

MD5
8c86655ea39f4ae47c0731b5b27e6d96

SHA1
a6c13ea6e4b7a2597316cf40d0e337d556acc8da

SHA256
4e3a52d688a727e550d658a766a10da1f0872e191e23355366520bd7729fd561

SHA512
11c29ff84ac80407e1e6f8ff9be3b89cb9c57dddcfcf00c3eb6dc23740641c97458b51be287fda8f0692c544a53518d205a02891ef8bf3d487f5189a811e4be5

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm

Filesize
930B

MD5
0e1755a5cc60399b2bfe85da79febc59

SHA1
cfcb727517c3ae4f609eb8a80670ce2e8d698064

SHA256
433c68eee00ae20d95e41ff162636cec5adff2dc5ed6caddb5f691217490597b

SHA512
998a5a2864eedbc3946788bfaf29e4067095c2f526fb4f296d8554581f4f29374abd491408f189b9ffd4e76267c0e9668ca0ece453a75f073e8f7d9749055411

Download Submit
C:\RyukReadMe.txt

Filesize
804B

MD5
cd99cba6153cbc0b14b7a849e4d0180f

SHA1
375961866404a705916cbc6cd4915de7d9778923

SHA256
74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

SHA512
0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

Download Submit
C:\users\Public\window.bat

Filesize
1KB

MD5
d2aba3e1af80edd77e206cd43cfd3129

SHA1
3116da65d097708fad63a3b73d1c39bffa94cb01

SHA256
8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

SHA512
0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

Download Submit
\??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak

Filesize
12KB

MD5
106ec131ef0b6f5214176a7643bc72a1

SHA1
2fd2d605ecd3d925b1bf46a99bc7b85bc5cb198a

SHA256
595ae92fae73740777f016e76f9de05792fde5f0451fbc548d47a103d8fb0081

SHA512
bc905fa98daa36d6251445ddd5b5c3ee7196d7b227ca80a6a1746cc1bd24371a6cab34ed8d1e35353c608dcd37e993dd46156fe656feff159ad4b5487b9fc259

Download Submit
\??\c:\Users\Admin\Documents\BackupPush.mpp

Filesize
518KB

MD5
020e15565b6ed6760c89b6bc869d11d4

SHA1
23ce80e133da49d4b2f72e9c11e9260b3b4dec39

SHA256
dfa5fe2f5aafd954ba9e3b9630e147574b5ce969dd67816b43e1bfe583a91029

SHA512
8ee2c88e501ced4f0abe0d51549c2cdd199afa29e916222ed9a0bdb7d5ea47d4c6d1563dc9dd8453585dae71b55a26897a68ab458b76205b056254563d29542b

Download Submit
\??\c:\Users\Admin\Downloads\BackupCompress.aiff

Filesize
560KB

MD5
3d2ea8c3dfbec52ecd87126a336767b9

SHA1
9b58f9f14515a2685d6b21672f05952bf799c06c

SHA256
a5fe027f578872a37b239350d0ecb152c4fb99448efbe759d1a7624ea497047c

SHA512
e7a9c164fb831f7802a7034c6e0a2543e0a38f4dcbde566aa16d08e9ba30b69cd7bfb4f6620b0842ab6ef87463bfac58f20541d78268aaca4b15d4352878624f

Download Submit
memory/1048-3-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2784-30861-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2784-9-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2784-0-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download
memory/2784-1-0x0000000030000000-0x00000000303DF000-memory.dmp

Filesize
3.9MB

Download