ryuk | 53c35aeb28a485550cc4f4f3224b45ee0e57837ea3ad7cbe7a7a5029ae2468ec

Analysis

max time kernel
255s
max time network
296s
platform
windows7_x64
resource
win7-20240903-es
resource tags

arch:x64arch:x86image:win7-20240903-eslocale:es-esos:windows7-x64systemwindows
submitted
28-01-2025 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
Size

384KB
MD5

5ac0f050f93f86e69026faea1fbb4450
SHA1

9709774fde9ec740ad6fed8ed79903296ca9d571
SHA256

23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2
SHA512

b554487c4e26a85ec5179cdcc1d25b5bc494e8821a8899fbbf868c3cf41f70cc72db107613b3f6655d3ab70f4db94cce2589066bb354b1ed955098d3911b844d
SSDEEP

6144:f5yaXtrA/WSo1rl3ALrlHQpn0BwK3SBDmhYfFQC:fTX6WSofcZ+KCIGD

Score

10^/10

ryuk defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Ryuk family
ryuk
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Deletes itself 1 IoCs

pid	Process
2532	VBzui.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.txt	taskhost.exe

Executes dropped EXE 1 IoCs

pid	Process
2532	VBzui.exe

Loads dropped DLL 1 IoCs

pid	Process
1220	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\users\\Public\\VBzui.exe"	reg.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfigInternal.zip	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties	Dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGDOTS.DPV	taskhost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\RyukReadMe.txt	Dwm.exe
File opened for modification	C:\Program Files (x86)\Google\RyukReadMe.txt	Dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html	taskhost.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png	taskhost.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar	Dwm.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar	Dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF	Dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198021.WMF	Dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02085_.GIF	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml	Dwm.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\es-ES\RyukReadMe.txt	Dwm.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02450_.WMF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\RyukReadMe.txt	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji	Dwm.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0281638.WMF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143750.GIF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216540.WMF	Dwm.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00454_.WMF	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03241_.WMF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\INDUST.ELM	Dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00681_.WMF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC	taskhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml	Dwm.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado28.tlb	Dwm.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar	Dwm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107344.WMF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Elemental.thmx	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14539_.GIF	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF	taskhost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\RyukReadMe.txt	Dwm.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado26.tlb	taskhost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\it-IT\RyukReadMe.txt	taskhost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF	taskhost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar	Dwm.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7	taskhost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\TAB_OFF.GIF	taskhost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	Dwm.exe
File opened for modification	C:\Program Files\Java\jre7\lib\charsets.jar	Dwm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Interacts with shadow copies 3 TTPs 14 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
72096	vssadmin.exe
70060	vssadmin.exe
67620	vssadmin.exe
73596	vssadmin.exe
69520	vssadmin.exe
67052	vssadmin.exe
62524	vssadmin.exe
69228	vssadmin.exe
71160	vssadmin.exe
72060	vssadmin.exe
62780	vssadmin.exe
67760	vssadmin.exe
68868	vssadmin.exe
70420	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
57476	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	VBzui.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
19716	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	VBzui.exe
Token: SeDebugPrivilege	19716	taskmgr.exe
Token: SeBackupPrivilege	63724	vssvc.exe
Token: SeRestorePrivilege	63724	vssvc.exe
Token: SeAuditPrivilege	63724	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe
19716	taskmgr.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1080	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2532	1220	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe	30
PID 1220 wrote to memory of 2532	1220	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe	30
PID 1220 wrote to memory of 2532	1220	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe	30
PID 1220 wrote to memory of 2532	1220	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe	30
PID 2532 wrote to memory of 2284	2532	VBzui.exe	31
PID 2532 wrote to memory of 2284	2532	VBzui.exe	31
PID 2532 wrote to memory of 2284	2532	VBzui.exe	31
PID 2532 wrote to memory of 1080	2532	VBzui.exe	18
PID 2284 wrote to memory of 2880	2284	cmd.exe	33
PID 2284 wrote to memory of 2880	2284	cmd.exe	33
PID 2284 wrote to memory of 2880	2284	cmd.exe	33
PID 2532 wrote to memory of 1176	2532	VBzui.exe	20
PID 2532 wrote to memory of 1636	2532	VBzui.exe	25
PID 1080 wrote to memory of 71876	1080	taskhost.exe	39
PID 1080 wrote to memory of 71876	1080	taskhost.exe	39
PID 1080 wrote to memory of 71876	1080	taskhost.exe	39
PID 71876 wrote to memory of 62780	71876	cmd.exe	41
PID 71876 wrote to memory of 62780	71876	cmd.exe	41
PID 71876 wrote to memory of 62780	71876	cmd.exe	41
PID 71876 wrote to memory of 67760	71876	cmd.exe	44
PID 71876 wrote to memory of 67760	71876	cmd.exe	44
PID 71876 wrote to memory of 67760	71876	cmd.exe	44
PID 71876 wrote to memory of 69520	71876	cmd.exe	45
PID 71876 wrote to memory of 69520	71876	cmd.exe	45
PID 71876 wrote to memory of 69520	71876	cmd.exe	45
PID 71876 wrote to memory of 70060	71876	cmd.exe	46
PID 71876 wrote to memory of 70060	71876	cmd.exe	46
PID 71876 wrote to memory of 70060	71876	cmd.exe	46
PID 71876 wrote to memory of 67620	71876	cmd.exe	47
PID 71876 wrote to memory of 67620	71876	cmd.exe	47
PID 71876 wrote to memory of 67620	71876	cmd.exe	47
PID 71876 wrote to memory of 67052	71876	cmd.exe	48
PID 71876 wrote to memory of 67052	71876	cmd.exe	48
PID 71876 wrote to memory of 67052	71876	cmd.exe	48
PID 71876 wrote to memory of 72096	71876	cmd.exe	49
PID 71876 wrote to memory of 72096	71876	cmd.exe	49
PID 71876 wrote to memory of 72096	71876	cmd.exe	49
PID 71876 wrote to memory of 68868	71876	cmd.exe	50
PID 71876 wrote to memory of 68868	71876	cmd.exe	50
PID 71876 wrote to memory of 68868	71876	cmd.exe	50
PID 71876 wrote to memory of 62524	71876	cmd.exe	51
PID 71876 wrote to memory of 62524	71876	cmd.exe	51
PID 71876 wrote to memory of 62524	71876	cmd.exe	51
PID 71876 wrote to memory of 73596	71876	cmd.exe	52
PID 71876 wrote to memory of 73596	71876	cmd.exe	52
PID 71876 wrote to memory of 73596	71876	cmd.exe	52
PID 71876 wrote to memory of 70420	71876	cmd.exe	53
PID 71876 wrote to memory of 70420	71876	cmd.exe	53
PID 71876 wrote to memory of 70420	71876	cmd.exe	53
PID 71876 wrote to memory of 69228	71876	cmd.exe	54
PID 71876 wrote to memory of 69228	71876	cmd.exe	54
PID 71876 wrote to memory of 69228	71876	cmd.exe	54
PID 71876 wrote to memory of 71160	71876	cmd.exe	55
PID 71876 wrote to memory of 71160	71876	cmd.exe	55
PID 71876 wrote to memory of 71160	71876	cmd.exe	55
PID 71876 wrote to memory of 72060	71876	cmd.exe	56
PID 71876 wrote to memory of 72060	71876	cmd.exe	56
PID 71876 wrote to memory of 72060	71876	cmd.exe	56
PID 39556 wrote to memory of 39572	39556	firefox.exe	58
PID 39556 wrote to memory of 39572	39556	firefox.exe	58
PID 39556 wrote to memory of 39572	39556	firefox.exe	58
PID 39556 wrote to memory of 39572	39556	firefox.exe	58
PID 39556 wrote to memory of 39572	39556	firefox.exe	58
PID 39556 wrote to memory of 39572	39556	firefox.exe	58

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:71876
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:62780
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:67760
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:69520
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:70060
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:67620
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:67052
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:72096
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:68868
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:62524
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:73596
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:70420
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:69228
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:71160
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:72060

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Drops file in Program Files directory
PID:1176

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
"C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220
- C:\users\Public\VBzui.exe
  "C:\users\Public\VBzui.exe" C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\VBzui.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\VBzui.exe" /f
      4⤵
      Adds Run key to start application
      PID:2880

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:19716

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RyukReadMe.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:57476

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:63724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:39556
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:39572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="39572.0.197206139\1315489491" -parentBuildID 20221007134813 -prefsHandle 1196 -prefMapHandle 1168 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a92b973f-6406-4097-a348-aa4682ca4327} 39572 "\\.\pipe\gecko-crash-server-pipe.39572" 1308 e70958 gpu
    3⤵
    PID:49344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="39572.1.37639952\660575708" -parentBuildID 20221007134813 -prefsHandle 1456 -prefMapHandle 1452 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {65efaa55-ee18-4e5a-9a1b-08127562224a} 39572 "\\.\pipe\gecko-crash-server-pipe.39572" 1480 f447858 socket
    3⤵
    PID:8896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="39572.2.1461691743\737363832" -childID 1 -isForBrowser -prefsHandle 2032 -prefMapHandle 2028 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abdcfd9c-4960-45e1-a2e4-1d5932da6c2c} 39572 "\\.\pipe\gecko-crash-server-pipe.39572" 2044 19937c58 tab
    3⤵
    PID:10648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="39572.3.1296707057\1619794986" -childID 2 -isForBrowser -prefsHandle 908 -prefMapHandle 1032 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d71d3ce5-9adc-45d1-970b-87e4b2836d3b} 39572 "\\.\pipe\gecko-crash-server-pipe.39572" 2288 e62858 tab
    3⤵
    PID:36148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="39572.4.868364411\247030518" -childID 3 -isForBrowser -prefsHandle 2264 -prefMapHandle 1776 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2671e23d-3552-4dd8-bf03-b03a59d34f69} 39572 "\\.\pipe\gecko-crash-server-pipe.39572" 2252 1c8efb58 tab
    3⤵
    PID:34016

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:46316
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:43396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="43396.0.1038119240\53289089" -parentBuildID 20221007134813 -prefsHandle 1000 -prefMapHandle 992 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fd3bf9e-d9a3-4482-a719-d506cb29fb2c} 43396 "\\.\pipe\gecko-crash-server-pipe.43396" 1116 e9fa258 gpu
    3⤵
    PID:63224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="43396.1.1544023523\340566640" -parentBuildID 20221007134813 -prefsHandle 1252 -prefMapHandle 1248 -prefsLen 17601 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {916c0b0e-2101-4fdf-aae2-0db71aa123ce} 43396 "\\.\pipe\gecko-crash-server-pipe.43396" 1264 f842b58 socket
    3⤵
    PID:5184

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ShowSelect.mp4"
1⤵
PID:12072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab

Filesize
22.8MB

MD5
162b509cd245c924d261e3b0cd2ea443

SHA1
ed906df61082239dc7f2f5bc03086d96a6d15106

SHA256
42e505176765b8f7384c1ffd083f44687e5e5585e03405b475e8ff226be58725

SHA512
17c1e1ffd203bb17f9124e7c1eb7c9995ec899039fefd30a5944670b26616d4902a6fc88b34c825dac10ea3904e062781daef4922e1cc1f36567081981cc77b8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi

Filesize
2.9MB

MD5
64fd1b149a0c7cbae5efb6abffc4b673

SHA1
9caf1d8f55f9bde4c1ba4b20b653c008a2563cfa

SHA256
45315bbde261b99a44712f3211fb86d0d48d796eab668b14c36075ead5a58a36

SHA512
0ed91de6b174ae3e1f8c0911434a47106ac92d76c23678f9443cac8f9ef9df9f6f3b42e507cb811ffc3399b9383d3c02a265e3192c20640d74d68a022c2ed061

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml

Filesize
4KB

MD5
39c1c044c4863eadf85c9b04f2562aa3

SHA1
679945c33035672624946430cc3870348ce4d29f

SHA256
313eebda0c731e5de3dc11256bd543e160089856889a810da92c3f8c1b96b112

SHA512
6cda5000f247a08078daefe66d4b798475f97ac709f1b1438f8e2436fa8f11d2ab93b155bcbae93ceac161438679d55e41e29f1de90972509ee4cb4e31a93edb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi

Filesize
23.7MB

MD5
5faf299f61d856e282d6705b3f68c781

SHA1
08722ad6d323b5a44211a5843bcee5033716095f

SHA256
0992a3e060190c21e6559080e5f11409e50a4832a5dc516a08e67d3c95a64612

SHA512
f1bf81fe311c31f667de97b4ce4c7b3180d0092e3ab36f205267681ee4d208aa7b631060b017c49c418a7f53e7e6cc2cf4a3944c4f764a66eb9199e1a76a1357

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml

Filesize
17KB

MD5
80a321b3d7c5fce7534e50314b010df3

SHA1
18b31d3342ef1a2e09cf8aa635a273c4d2173525

SHA256
6dedb113977f33eb10114277dd014e1f61d2e4ebe3bd89d638f0b4d5b1922bb4

SHA512
d32110090c0cc4356e8dc2234e7a8361be94d8e57d60d8e7fbb7fc2a32b485755b37b168195a16a481e1f80ab88645ca03befc19e4f56858740326974cba8179

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml

Filesize
31KB

MD5
e225db5325d51111407693ecfda4f2c5

SHA1
be5f0554b7da1ba947dd3f45892a6d685b01eab3

SHA256
2b887c4a66d30e0a199d9c30f10fb8e3340d59deb11c863929c5f499fde67275

SHA512
745ba9a98fdf5622b564115b097dbf8ce03cdd823ba4916195f5ae3c11db71bb71b7519bd0f4b5c0854ad6b21219593706b76cc527bd47220b3a6d54aaf77109

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms

Filesize
699KB

MD5
4101d101df87873bfbea9657133bb1a6

SHA1
0e6e2eec6b4ac5953bc3393a88782632e9f0c73a

SHA256
af371de718ac69e5f31ae63506fc780d6eb9e13b67b8766a8a1b072faf318059

SHA512
3bf1bc1e6f34b0201517eebccf0f2eda9189840002e9c9c82853208763ffd7c06ade76eb1b22360982383f523506fb753ba711f6658a65947957c89e986d5bcf

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab

Filesize
16.1MB

MD5
f73bdaed53e98c182f96d21118da25d6

SHA1
1aee62b80ac63741a8f486971f3182d84648bcfd

SHA256
e41dc94d07cbb1bb3224299355d3c153ea9a7ab28d3d7baed69e7a26f93d41d0

SHA512
ffdc2d5afe3315afc422b40e8a2bb7b32b3eee4f7b8862f7279d8510e6ccd5165e83f6ec4a60852600572a7a89ac52e4a759842289d8eaddb25a17467f0434f1

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi

Filesize
1.7MB

MD5
21fe69638b3e66539b5ac123d2795f67

SHA1
d249289dd56ee612f80831cff98e4b1a1d3d05b1

SHA256
97a99383ac4cda611735a88bc1269f139554e4e5fa18a2376815d41900b3bdbe

SHA512
8d12f1314920177c0831701681beab5637aabdae736e66dd74b605ffe0f2dedfb445a300e28f368b9999c19b7349c6e18ec88108e6eddfd3bc6d2061b5e37c92

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml

Filesize
1KB

MD5
9c15601a2ee5faa5e40652c719aff808

SHA1
8f6f685cd4419d5b42541cc3b8680d891a34109d

SHA256
28b6a501b157fd82447428392c5193d8bda354e8c102a737e90fb6a533b41233

SHA512
918f0365311f940a1f24b544bdd536322b85043165ac150dea33368fb136a0450f6d8673c22ece75e81350b2cc601c67da65103b3b9a20322dc6660990c21c8c

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
0352e0e06936a2f80a21c657899dd75a

SHA1
3c987114d5fa745ba9e1224a3f566f683b470e67

SHA256
1c745ce00ff8999331998735d07026cbe60b7ad1ac160fd6e63ac601f8eb717f

SHA512
456c667582eecb0b36e2c0b7691b8eb2362f62c7ada958fbca8ba6361ce4042bc1785c1ac035401d5bbfcc4c517d50f01c199f8ec84e77c428c769fd0c4441d5

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi

Filesize
1.7MB

MD5
60941a071c9284062a830b4f8da6c2c4

SHA1
d6e71ef5adaf0031dc04a907268c53f6bb847409

SHA256
409cbee3cac071a8d8696c38cd56de99440141a547cacbe4de5de03d1624e53f

SHA512
8bf7c7afaf6a10e019a7b3a4a525b815afa00b1861ba0ed86debe8fd0080ddb4a531e0afb312a8113b11bd52f64a7dfae1d45a51f3019e28f1889cecc691db72

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml

Filesize
1KB

MD5
57d410f1bb7a36dac5802adcd26ce46c

SHA1
11c4c1936fe77537c6d55135e06d385fec3ddb68

SHA256
3c26d06d885d43b0d3554bebd5953db30afbc3f321bb3740a31488d6e9120a71

SHA512
f6739178ea81a45aa3d271a5f8d8b6b13292f140604e0ccf0ca8f80bc7b335b2cedb24066f9fe3ca884f5c44ded6fbbaf2c65063f1b8f4f3671f8e9d294348ee

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
52c0fddc7b52ec314c6faf61646739fa

SHA1
eb02eb5d83751baa8031d86db6dc46bc39939601

SHA256
e9ab26f90b27a00ceb0264455cefad2aad990eb620e034ffadd7fe2e0ff17461

SHA512
43561218106658ae4d2f4ddc8e796e21c0515f61cca037c3ec4202c5988be1bafa990d388df9f8265a4f0fd601baf27a7f7da2a54d880ca07e16d3f1aff7b3b3

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab

Filesize
9.5MB

MD5
170a3e8b5c0f29880fa7a142275cbedc

SHA1
18ec4c5cba31d5f2d4fbab4335884beb01d83834

SHA256
77d2407d5ab42a73a54f6522568497f516ec2cbaf0ab0054ba06f27bcc5feef7

SHA512
45bf7e2bcfceb49be7e30d81bd424e093e7d01c5a1aeb8c4c82159c828817aab78c13c96ce04d30c9178b88a9e65fdc174a318600aa58482b06925a81913fe5f

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi

Filesize
1.7MB

MD5
fe7fa27da5b1ce27fb96acbfb7f32871

SHA1
f3d9fe8d3a3a091dba329eddac64989363cab82d

SHA256
5173d09bba0d2345eafed62c159e5eb9c1e09f3c49cd88040734d809f927cdc4

SHA512
8f8905743ded4787c71a88c5cee5013c05719b3714ea8d1e49cfa1d2456370aef52dbb9ed3094daa982e3cedd2a4977ed2c4d6cec7d0314c9b074e3913f948b9

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml

Filesize
1KB

MD5
0e5ba497201548593bce9a9bc9914d5e

SHA1
268c497594e5a18564ab272d2064b6ca919b12f7

SHA256
37bc551a774b2e1f1c524d2b65f91245b6c5639c0652703b6efac44097d1fb7d

SHA512
edb054a8c54836f65b3ee729433d5f4d369d0dfbbc2dd4681e3207d975267b2e69f8376fcb1f51e416ab96ba3d6af713ddc883defe2b7562a2c2da25f4352648

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
1KB

MD5
1dc3bf8bb69f90c1e717125630260840

SHA1
48dfc3a2e6305ac94c580696200e157ce30bcdb9

SHA256
b2fc1b4cef351e0bbce8922b68c868a07eadb978b8265b4f60dd47ec49c159f5

SHA512
b5123045311a9549f4eb91c5d6ad76361a3ff2aa8ef208dba7df386a7fd232c2be1f455243177513b946d2feeb80fa5b3a110bc929a8916c2bbe3895639a55e4

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab

Filesize
14.1MB

MD5
6f159c178a0285c13aba7ac16f8101d3

SHA1
ed227da27ed92fae56b1064e65470d8265ae753d

SHA256
e9cf66ca8bb5130520f8d4ef4d2063e1de7a6d67e7efc308d4baeee2bb921dc7

SHA512
db766c4abe1472606512109a0639b17a460fcc6b65dc2e3afa8ddae370cb8539d7e81938431f19e69be9a6c54137879444f4cbfd3fc459fe0179c82f9cf2bb27

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi

Filesize
2.0MB

MD5
a96752bdbce3e587c67bd7e6d2eac7ff

SHA1
fe9c54125f7fd235210f690447807ae184162cf2

SHA256
4d45199b5ede4c57cf8af52824cb10d84914c3db391121727d09a84ecf5c907b

SHA512
ca73d6874693d27986f76dfbe87ced6f771c4053cbc2f94a7568e7f2d0d3b59963caecd3aa1962986f710ffec3f23bcae6de558df7e5982a9fb3ef114b0f018b

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml

Filesize
3KB

MD5
e0447096dab390f3d6e8201e333fe938

SHA1
65671c7673b1ad67203fc54043d02d06e454a559

SHA256
31a0fed581bced373d0fec4a63c385c6ffcacf6d012cd520759e8dcb9c2f0841

SHA512
1d1bc916b3b44e3e9dcb794b0ab8b3ec8e0231ae0e5632efb2030e7fa21fbc9cb8568802a53e1c78711b72387863f2c15a2fee132dba49b6c10c1c0fe6055928

Download Submit
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
4KB

MD5
60164b350fe55cb0a57f53186137295c

SHA1
7e275c75589a3511f0c38165dd06f56016513cd2

SHA256
9e0d859b247344529a64f4bbc10294ea9c2a3e50dd880c8f2a6642d703674043

SHA512
b376fa49eb50990ff1a1d148369c82fd8120fb06eeedb4a4eed310917071a71f5e6c21146c57e1c730ade82ebb5d6e5334fea65836975e284e7d194ce7265c78

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
6d0dda57ce1d96f731860b16d356874d

SHA1
e2e9ca3c419172e68647723bc38bec50e7d35d6f

SHA256
739164febd065c884eb611537d334bc51163c859cca1d2f133754d8275f1cec0

SHA512
2eb4c63471b273d407037826bf4f28ba62dfcbed8ebd6775bcfb4470a695f1202ba827b0d8a4055ec86c1069bc170103d2866922e702118e83d1803f0644df8f

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab

Filesize
41.8MB

MD5
3384805e157acc18d976af7284df125e

SHA1
04ed340e9da74679caad1034cc859ffd574bd906

SHA256
6b9c5868096493d41d65d97f7393933b0ce9ac9182c1934bf2098cf3ec78343f

SHA512
6c77d5956bad5b45965fce40f746d5a6d57ce12fe741f41ee0aaf5c6c3687fd6c2028ad5ceccc716516cb7462fc02179ae6edefe25b82a03d7e3f06369a79c19

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi

Filesize
1.7MB

MD5
0d13623fb9ab279a9f46a4b0c5375c50

SHA1
7b57eec0bb78bacbaf2e309746aae58cb1a5e354

SHA256
a57600f2595e402483fb6ec878aadbbabe728857c97b7ba7dd49a6f8200facb2

SHA512
6a65b0a07faf812529f8ede555a5a7fbe8b8b7ecefe43636db30141262303f8d6821a9e6e17392a5e49eed75592f360ba65f8e253b75c312f0ec91abcf8528e6

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml

Filesize
2KB

MD5
d49c392e340d98414450e5a29fae9fba

SHA1
b86afef1709a3d0ada4dca9944a71ad8f84d5b2a

SHA256
dc2fd2e89b41861ad0700fb97749a6b5d55a826acbf0bfc7503112222a20ded7

SHA512
0156f1be5a810833f5be195c337058ee20f3c895cdc2e93882383af6bf14921bb54bec405a722d429ebbe61b785731ae087f63137d126064c68dca27a7ed25bd

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab

Filesize
10.4MB

MD5
e6b8a046a4762ef2f2a821fddbe28ee5

SHA1
a8ffde54df1693ce1f84bbf71f36e7ff749d111d

SHA256
8447a791248e498da4fe2569c80c41a879b49bca888614aaa31aa1be2bdb2b85

SHA512
432c8ef3108998c3ec5b0d8a6d55211dfe667477a0e0701fc0b0fdd8e7e2ea98f80037f30eef9691d5697900c7201b43882f3ca232ddd290b210b5e504996535

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi

Filesize
641KB

MD5
42c9f546cdc84862f12b0f36c6f5dcd8

SHA1
ce6bd2a8b233586db2cfc182550e74bd1f00d9a6

SHA256
880d457b4f54a36dc5fb2607826f0f1db02ba7fa594f4a3be1f871c8c2488bb0

SHA512
76c81d28fc50faeff4329ff5379b461639db5fa89169aac4a75b6b2ef86da26ab46c840b3a2d213ef2c3d39a902e196fdb6ceda26e5eac617da83a6c5da33a9e

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml

Filesize
1KB

MD5
ace75e023f68298d43975a7adc09c72d

SHA1
3b0a138b53570380b3469a563c984fc7c99f3e4d

SHA256
561b3914878c27e7231eab31f70e041d27ecea5264c83fc1b998e355f52f9bf5

SHA512
b65a43cdbceefebeff0721ab5846a3030ae5fd0517d056287f41d21f590286a28da642704eda108d77dc0dec6a25e9d0338e0ec887466b10c50c6a37deee3e5f

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab

Filesize
12.6MB

MD5
a73ba649919a2d7c400113470b7036e6

SHA1
249745dd6507de5be3214741b03ea62934017630

SHA256
e5d250df0afd099b87b29fbaefd80afdb4ce024747ef06f48c7c072a97967498

SHA512
0c87f181a3c7eba9e691c4555399e36d3922589c8c8c4b5872b5f67a59753396b300018ced1443a38c849a9ea27fdb53d4b8c5b33f554a7bbce9b863c722671d

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml

Filesize
1KB

MD5
1dbeec4b8146685b844b9e1dda9ee2b8

SHA1
903a1710f96cf334f39abbe359d2d2a0882d11ba

SHA256
ba25a096d2d8ef01565b593e7f985d03fdf10cea8518deb276c6d5d4e96e0f3e

SHA512
be623dc9b0b9020f8f915bbef42761b3c0d3ce2ad359147c9b4e5fc3f5887d84b3ce0109e1c78e7a497d0cb19fac56502957b4d297ebb1f483eafe335da3d370

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi

Filesize
652KB

MD5
a61498f8990376f1df509cf7fd0abb0b

SHA1
4b1e8f538ebe0ba06622f85751d52414d7c55059

SHA256
0d854269044f442bf7d01dd7ed6aa0f0e981140eb1a6b401da2edb63e7d700b7

SHA512
53f427a376d854d3f375b2ebca3710e1adb8e605b26c08425b521831382c31558c1e20f76628c7ebd256d43731267d5b48177f675548578d51738db8ec65fa08

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi

Filesize
635KB

MD5
ec463a4b21ffb12660fc480687c20a75

SHA1
853600545ddf1b8141ed3051fe5d3b8e32a82b9f

SHA256
336e1cbb12ac500b5ec54699568ec2626f9090fa46c9fb746eb9393ab7bd368a

SHA512
a493006c5642877b194a6c87ccc889aae26c0635e48671521552f10aba32d82ffd05a78d56c7af590d5b9e8b1459a90fe99811eeba42991c439be10026b741de

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
6KB

MD5
f672b263971e83d7536d12f97ff528b2

SHA1
38537010b127c0924a92d3f622fff236fd07cf85

SHA256
3204e5b478c6ae6609f265ca3c6971864912bede5e07628d839725d69b32c661

SHA512
7058d041cd8cc03825c0603c5d5399783ab9f40a39997724f400ad8c93cc33ec1601cd4edebb0944b8965511b56707cd9173e1241d78bd5ce50ebcf3e24f73d5

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi

Filesize
2.3MB

MD5
0050aea7fa2a8d7c8b752d61f637a438

SHA1
f4b661abd3dd66de87e5fe071cae9da941b8f009

SHA256
3348f248cd93a2eab0a3ac3010c8f0aec7eaa1728e7e028523b79b498a407abc

SHA512
8ee3dc9372787cc37233112be47fff0d9895af6e767473d5966c2f19c56dadadb7310e5e1c100c05af6da8dee1a7401441e6cf3d7f7ef522583638b3d8a6b7db

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
e1bdc081cbf7af1dadd8a135bed6a6ee

SHA1
97f8666b3db84bf68b7ac7e158b3236dc75ad218

SHA256
200aed4194ed8d45e8c50221580d2d7906ec22d158f64ec48038a33730c65258

SHA512
78deceaf91f95547696208045794e8c825fc5f84533d2db9afd0cfa91875dc30a2bc923ef5bdb8fb43a5ff65e0cb7041bd1c2ee70bda4e638babb73e4180fe50

Download Submit
C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\directories.acrodata

Filesize
754B

MD5
c06ea5a6530e8bbf798e4efa8ef19c7f

SHA1
a554c18aabcf53176b67b6a0ac24d647246a1a34

SHA256
84ffeec66751bfa5fefebbb15723484ff4c5db713b667449db61d760146382bf

SHA512
6777c5ed94a355b5c4149bc16f65cd0acaa196e8d38c787cc2337fbe13141430b0bb46efe9530bd07ef80a76b431572b481b504cef697f0738f9f8347fd36137

Download Submit
C:\ProgramData\Adobe\Updater6\AdobeESDGlobalApps.xml

Filesize
562B

MD5
ca4c94c82bb896aa4fda7b970a6da8d3

SHA1
375c2ac3d9b9baf81fa62be5f1ba60a35d3ed70f

SHA256
a621db987f1a644d8c81601df846270ddfeb6c298caa01ac3a57a9fbe378325e

SHA512
5228305ea3cdd254f275469a4c89da0ca907dd29e85b10c471135b6a1eb8717b39adc4a89876930d16966ffe9c83f77db3ea3bce5982cd81c2ed0908eca09951

Download Submit
C:\ProgramData\Microsoft Help\Hx.hxn

Filesize
674B

MD5
5f46658b9c6e60e8bf9abdfe91f5185e

SHA1
b9d302cfeb2abf95d2ec8f508a5ce9de9140ce32

SHA256
ec32c87f6ff4258412ba80092a92c4fb4b9e95cbb3345bf381c4be440cfc470e

SHA512
436cd847db239fe6e311e4dff8a752b98ad09f54bf872673451e7878a3215a92766bf7df9f3c9430945a6d72ebac8f1c0c2d6e337ed825eeddf2b44e39026eba

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW

Filesize
13KB

MD5
2520429de8456e17364e544e3313709b

SHA1
9ad630778caab9c73353b5e99b485f98b1e131c1

SHA256
92944c2ac5f72fd3af1f8f4479a2d9fe5c66e96c882107d723f3727b9dea6e18

SHA512
28d27be9ef25a45e750e63a631321a75c8f8a71fbe6fee9d213a71e91cdddf8164f954d6636e164c754d6dda94bb92f15e1d8f463b3d378c4d0ee44efc95b13c

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW

Filesize
13KB

MD5
a888f0297ad87f4e46d5b71c7f4046a4

SHA1
e4f796797d4e9587f9340dc8cb5634fd111c4e40

SHA256
72efd3121f92988694c12c6effde36275c4de9c11920baac7bbdf01dd9e6efdc

SHA512
4d44ca747ccc72615c35cd8c1ca8a25c015a25ff080fd5da0cc7aa59685f4dd40e82f81d8816d7bc9dcc0b079b8f345249c099aeb41530805f0c1f8885363446

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH

Filesize
10KB

MD5
45117b70405dc2fcf77787bfb0db241e

SHA1
8f31617bab31975cf830fd3cac715d6e4644d276

SHA256
136b8cf28aa62a37d7934d300d8649d4de21815854e2f57f1a44b1dc203ae8e4

SHA512
f707771c1d4957f7c738b46d3edd3e035e307d020d3bb6b4c6fb83105b48032ddc32b61793f4cddc563ee71a4d3bb8c1bc2e2f146627040bb567c233ff005629

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD

Filesize
9KB

MD5
9e49d296a9de683e2303d9faf42969c8

SHA1
141d935b580c0537a97c8d53ffceb337084bacde

SHA256
7c64452d510e6a77434069ccc52f572fef84ab07d917f9e3e6b208db1064a189

SHA512
75dea7d2693145aa5b9d4d8aab6a5c77dcfab8e58a1d9377a2bb021834945ab4efbdc4358479ccc2918e8ec7c19f8a9a16f00223c01e69a29f5921fbd9c6e6a5

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

Filesize
626B

MD5
187a4feed01713420c55a8545f03ebec

SHA1
b100093481eccb19376745669baae72020d8ca2a

SHA256
1512386f5b6f59f0b83cd7057e0f947990a535ee1a771d6a6743e9383aa7688d

SHA512
f923b1b0085d96fd8b3b60a21401fb4cc98d039024c751b7a47808901dfea1308097917eb28da1d4b5b5d4bf1d9e34923df35cf3127afb42ab46678c4e96b2e4

Download Submit
C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn

Filesize
658B

MD5
44ea558c9f63e671538d2332bfea77da

SHA1
f3dd739c404013f8375302800d002d4ccdb7f0ee

SHA256
5089b93621718026d14236f23b174f9c5a1b393e4c9e68cbd43c5ae141cc8009

SHA512
b6bf4a7577226cdd5b96051be2912ed612059d477d2d8a319e697c604d0baba0a7a548c750fba248831346b6fa277114e9c34eccbddf09c844ca6350fe041ee2

Download Submit
C:\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn

Filesize
626B

MD5
aca8c393e5be49b1c8a2f2b68b0fc878

SHA1
3979b098f5c5c995d93f162a7334de8588be10e1

SHA256
b58a03476b5f2eb2ba7caade55e8f06a3e824b87260a4abab1233b537d8368d0

SHA512
78db0e64edeba45f820b9395ba34be1771400d85b146df4415dcbab1b7eb10d3fe4dc2ffb7d4dde6aef02cda4c6d06604ff1549f5a435d791a18e24706a9af9b

Download Submit
C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

Filesize
642B

MD5
4b644b049fb394fd0b2b498fe2d9c603

SHA1
91776b5040c57f2d351d5b68b617116ec77308d8

SHA256
6214c2e08d546bf869df81a778dcba34fa226ebef3b77ab3c917b95b256326ac

SHA512
f6d78654eddf4a9aa39ae573321f59b7bfdfcd232a75dd609e203750ca281f1a1ebffffe18a0c2c66079b66b339c4418e2bddcd47f8231cd792dae8188edebf1

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn

Filesize
658B

MD5
a7b243efddef9f1e7d000241fbdaacbd

SHA1
0d8ccc1513222fa79726c790b92c575ca58d8269

SHA256
fd639c3ef1fbeaa6ea490f9384607f8b5278b04dc2222f2f1c35f7dd3b389b40

SHA512
5aa4842a3faa9b247d1959f60ea3d9a874e4da69b82db1659dbd6f45ab725c70cb87bc7aa24049441527c570e596081ac4f9910f5c0cc47c3203b965d98af6a2

Download Submit
C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn

Filesize
690B

MD5
62dd228f9696bec2e6a1e46ef8a2594b

SHA1
32dce400041df6d4ba9f9b3be56ef7b273b890b9

SHA256
1078cc5869191b8db5fae56e1fd2c8cd4472724c57bf7ed6a351d164bd7b6b56

SHA512
59da033c0b25b3c1a454956dd85f790ca6ba56415044664a06fc45153a785708bca3a00a73899de2699b6b936ed1bb7358c4d4038fb8ac2190925732c6a1f3a9

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn

Filesize
658B

MD5
ac0a216c8d866bc1037c4dbc1bbdf67a

SHA1
d9aa534fb16ebd7e8f000d71d0e0662c4348fd97

SHA256
e88a4b668f64fc378dd10de3192af3342728c5eac6f0dfd063c9afea9cf36ce9

SHA512
ee7c04f7f0b486d9c99296677865923376e5f6b132a8a1062a3c9d28408a519ea187aaca39db67a86a99967c89a9b59f9864cd60d0b02b666db4c01e4811f3b3

Download Submit
C:\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn

Filesize
674B

MD5
61b9d1761da3740a8fa7742d6348a976

SHA1
df63e36d542c432ef36a78925aa652b66e5d37fb

SHA256
281f6ff69153acb0f18c120e306e73faae73e0502c68be2e83c70628b8fdfbbf

SHA512
ae846c4ac3f80cc87471aef8abbd9b3ea16218bb5aa0a9dff9b91670bcba4a39f56fcfcbfa2ef4acac44d2ce01b5074454e3e73cb689a3dcf08a26b3fdc24e79

Download Submit
C:\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn

Filesize
626B

MD5
2c11f40d664287791a8d811c768a353f

SHA1
02b00c149888b27a70d6f9e870d1d5feb5d879bf

SHA256
2adbd125f2c1ed479a618ea453914b2653d47c056e0ca3157884989eae53e8a5

SHA512
cec998afc8901722bbeae8440560272679ac5c7a47bb0f1982b81564df6b7c2c97a1d105a1837bbd85bea02382e46dc08000bdf06d0c3e85e122bc7d90240114

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn

Filesize
626B

MD5
9aa712e477c9c6aa5e177e55d7ee2b25

SHA1
6434372d8132644b08af14ade9add02dcb407656

SHA256
aa67e9ff3ce90585b03149a2b2999d09aac80b93ab35edcc3cbc24eef741b2b9

SHA512
eb79f8c2ab5dbb1457b3f053d8cc1555a5e1cb89eadff10cf702d8ce228a030905f65ea77cdd80c5117fdbefa8b01de3e273700606a1362c2d18db402abf89ac

Download Submit
C:\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn

Filesize
658B

MD5
a3b776dc6531903b67ed3551f9f5e794

SHA1
bbe5ac3e7c8290f4601b1285003c2c38865bbc54

SHA256
cea4bb71a309ea421f7f0a8e8c2612d44ce30b01ef64cdf6d994060789404e85

SHA512
847c8668e0b63dc4067b261b69337bcb21658d08a4d89467919d923cbd73a5d161164a560cf74d8249d54e930a3161a858b4a634696c46aa63a1552e543c691a

Download Submit
C:\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn

Filesize
642B

MD5
1749098a1a1ccc4f64076df1e44b5249

SHA1
1b089a161632d9396208023141569b5958077f88

SHA256
380bb7f1c94fc75265896550127bbc1a7e9b630756507a5b150f9f0c9757347c

SHA512
5cc50d24f1bc36f91a864c65104b8c2261daab61a2c0a12b1bc15f38a4a9162b04e81e3044148eb0af65f12588f9faf6680c45762fdbf37739faca67f841f739

Download Submit
C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

Filesize
626B

MD5
0666abe5d8a51534fe1e90930bc22655

SHA1
30a37231e181c8d096899e460fd90149317c9555

SHA256
d45909653cb9022153643a5db4c80534d44041b4b95df0b0b293503614328bd5

SHA512
3aee5f168c5ed2b1b9d98e8327925e9c9e367065ecaaa980584901d223b4033a254a508f73dfaf97871e65e134c9b00d0f47add448f5200d7f771de59a030324

Download Submit
C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn

Filesize
642B

MD5
ed7bbe4b198816d19a766d237fef2c90

SHA1
38801ef878884d26014d2ff6bf423e84bdb933fe

SHA256
d7ab98e8450d1720f1172cd995afda9e1d272d5fa64fef990da1b62d274aeb98

SHA512
584f3c9c650c59a7f4d59d4823e2ff709ce07357ebf068d7505f44cb92b392232992cebbce22dd2b94a7d329736f19fb209860db92ad3308146f4d40dccf8a53

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn

Filesize
642B

MD5
b3e6da6c9510ee78814b90d549b6caf3

SHA1
c678bbe1bc38c171f3cd73768ceb5039a8a87424

SHA256
5a7bc389d81674accc53fb790976ea60066605940c5b2e696d8a669f1e55c200

SHA512
44afa08fb3967fbdbc86ab4cae2b1212112d611a972af37f6e179fb4fae11cc445535f82df9c9a8e2fbd477c9dd5e92329bad7143a92e74b6dea3cbc6a6e6732

Download Submit
C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn

Filesize
674B

MD5
bdabe6001dc771fcba82e7c1fab2b197

SHA1
d94db286657aceb89d42a78f41c6f94d6f476445

SHA256
73811247da746525a07420c694e53d66fd72eb0aff4c4576eedce918cbe79e92

SHA512
c70a742cd6c8bd6b3acd8f38f2ba40760963c1017d81b4c751e3a2c6d0ef0c828501fa0a06b071a92c82f9c96da1328a62003668e108dcd752c30537e652bb0a

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn

Filesize
658B

MD5
5d3c615eee143ffbc68d53c9bc9f273e

SHA1
2c53cd02b8f641ae0174283603ff60afb77b793c

SHA256
f713504b5e5efdf12dca0e6019e2dc06bca67fee8474ac09c979e1912012d1f1

SHA512
aa990330e662b1047aef8c4f93867cf595662d1f50d7d2a908a75e1b8b883a591a4a6d46afbc1fd2a2e3fbe52edce56dd70d9fc64ddb69b0b9c3b8c5f685232b

Download Submit
C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn

Filesize
674B

MD5
901766cfa1459eab1361189b4a6ae0ab

SHA1
7dd50d4e14d581c48be1dd34d983cb60e277b3a0

SHA256
5e6b64fc9f971277b5edf2890eddfdfd9928176d12bcab2d502d3127848ecd97

SHA512
c6c89e84c8a8c01fc85a08e1ceef26803c28d9b32edfe31640e311206bffc4c8242926b606b366fccc4d3b34a4b47ae1dfb6e2317f4f3aa7d233ba5d37d021e4

Download Submit
C:\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn

Filesize
642B

MD5
573ab598e60f130ec8ce0972d7f9f4a5

SHA1
b1cdda6e680395cdfe193eb86b52d5d3fccae525

SHA256
6e5214470d63689273fedbb030694f744490ccb2c65c005847d4f7851ce53fc0

SHA512
ab2c8919f1b6195f7e995ae93e4ebe0b363de8aef66b8c3b5084e4507876de897b4b649c532aa729aeac3be07238a71900dabc25e1a2f28c8d4aeaf42efdfd9f

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn

Filesize
642B

MD5
68474180bb19ea3b074e39654819d288

SHA1
62e558896a4a88ad488a1a71af37adcb22958b7c

SHA256
6c45016b78e3176a514671696e809ea9001fa5e206a6ade904b0ddf52285bc85

SHA512
f717a077256628433dfbe4d08fffcf6a3c1edf96fa23431ba8a0642440ffc0b255c8d06e4ccf4e555e71704099752bd5ea36dde245995078979868f086d9466d

Download Submit
C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn

Filesize
674B

MD5
43bbb79b49fdb421a48931aedda8a9b0

SHA1
9bcf478404882abb803c2a650d80b1d45a247b05

SHA256
48dd390a0eaeec933fedadd70e783d0bd0ca69fec7233ef78a0741ed6b1a1087

SHA512
35252784991372b62978e69868baa9d88ccdc1beabce6d4b3f8de29fecae1174aa1ef4d090a0ffd1569cda7a6da6a17703095c6906df700bd30006da0a255def

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl

Filesize
6KB

MD5
5510895b3f02ab874a33460e7c50875f

SHA1
b7355390c986e895a162b131307dcbe8cf92fc22

SHA256
da6527b8e7c1ca63a413c032d5a0fed94bc5963a4e8cdf1882b992cf333818bf

SHA512
e89ec5cf66e6dde9acdd1eec553499e4546093d441d6fb28c8cfd000c0e7e8e71e8190cbbecaa6cb21803936b5143a5f11299678d069b6336b2d8dc924ca3708

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_CValidator.H1D

Filesize
12KB

MD5
9ff8e3291f42068b000f676766b3e96e

SHA1
902d589c998c3c61687aaa3ef839b95629c9c71c

SHA256
279c393c033fa982ab04a11e6aa95d0224fce395352db58bda5dcc0baa17e8f5

SHA512
a9277b3e45a524ddad4888477bac7f3bd232ce99db34045c9f6da4ad9175b525c03571eb6c5b469fa1fb1452b4a4633cd4754e0037c5578d85a863932e627075

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
eae624a6332511cbbb60875ca09234fa

SHA1
c01760e07253fdd2f6bdaa7b74a7e06fa9c72f20

SHA256
388bfa67ee6e55d9b077bc9b28b932b210741b0781caa67b1bcf4071720d9987

SHA512
fb5b02e9b4d338b1a1197d37ca9c22a3e217056c7f5e5a54b3cc48bbd88a90c4ea0869981784bb53ebcb8a5a325422baf7d56400b2b5f823df55b7e4e1795962

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MKWD_BestBet.H1W

Filesize
409KB

MD5
3f04c5492bfca843bb4704a2f931c2cc

SHA1
8131cc6cd7d2d7b015f092c28c9fd0f98f7db6cf

SHA256
3feabb30a3e6263cf0aa5275872250a7aa4d20671b1c0ce5dc39af15bafd4c49

SHA512
9a9759d92776135ae4c3ee5505c6b94afe58e197e6514764c15b1ebcd8ec2ecc0e55d31b52d7fa40d3cd328b2eb6d2b613b7b87ed429ab277ddbc785a74ae2dc

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MTOC_help.H1H

Filesize
531KB

MD5
e0e86550e76ef627c7222bef9418d1f1

SHA1
4ec406167ed3b225f3c88075d9fb620cbb540f20

SHA256
53c7aa14978988b2ed89cc563bcf4f74359b74d00f434685364aa423694aa430

SHA512
ae7ed7d90e73c116a626ea4c4f22895cb410ac424712e91cf2617843e0ecf275cb68bfed9ed8cb0645b07da82d530e72d99221ad74eef25e6fc04db92e870721

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D

Filesize
14KB

MD5
fe6e2a1b1163598a8f636bd1eaf4a9d4

SHA1
a95c696af458c63047ddb3d48af41ad0db332b70

SHA256
6524d24d9f23885ea60beb77595b0f1e703674181db872022ce6395d30ba6d39

SHA512
98470e770a129955aaafe98cedba5e022c9562b24752b6704dc6aee7d08a723bfcaa66c5d6b76821d76f815f2e25d3edd473a8fb1a127e87094aaaba4ccdc425

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q

Filesize
1.2MB

MD5
8b79db3c986488aab12232e73681f178

SHA1
b04ffc61823a1f3b5d5c2004319b8652e77deba2

SHA256
87b77ff56fa026cd5082c8ab57d24599d84cb62068caa403e44797cb0f444edb

SHA512
05f4aafff2fa7f455987e03120075334d24b1bb5ca184e78af18c3ca224b6d2edee6d8bbe6c8684d11a31d1bff676ffd3a4f9e6e3919a193ad9273f8d1f54b3f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D

Filesize
12KB

MD5
fd227974426de2c04ddc309c5dbf30c6

SHA1
ae6069b0bb4a31c29942db2782095e7dcdd7a720

SHA256
2b62b503426f1a2623a811f4a24f33547e3b1a7d6a9115f3f010885080bd08bc

SHA512
621dfabbb89680bca9fcb3d387021778af486447a3d76d5214111e0c780b48875add163427b17afbd28fcec49f5d6659773bb47c2bc6121643a245940224ca0f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
8ac363d57c5d981b6a2fa0b39b39a381

SHA1
f6a398aa091ad1d8ee85329035aa383e7769c5b6

SHA256
85e3a110a5d16e946062a6764b078c119375516bf74fd1feb7290782be2c3c9f

SHA512
3b6a77b21a05001a5c2785b977a97b22456c012e7d5fcf6b371008b2f79b18ec7bf08b03fd6d20ca7644ecedbbe3fc2f5f265b24d3029621f7b2f4b4a5d02751

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W

Filesize
201KB

MD5
a732a56e488b59743e6a73fb7a35e393

SHA1
3edbeb8fcccfc599736de00cc73bc7f2267a914b

SHA256
357a0e8ec308576de698a894a13772699a7506726522fb0985a9060a8db2bd58

SHA512
351ae83c5a8bada7949ed26cc7df2addf0ba5055b32f9ab822d952aadaa5cf6f29cec07ee1605de068e5a48956b68730975e86ef0161c600baf4621660d1e03e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MTOC_help.H1H

Filesize
491KB

MD5
b7f147e5df0b6a31259c85966cacf4f9

SHA1
ade9c19d9917b1dce248181dc5da29f8d4a2887c

SHA256
e9123b7f219650a98b5e219762989c7d3035a122c4047b8aefb1784cb4601d50

SHA512
66d7ccdf49b99562bb2b1453920cf17281964253df310f59affa071d8c33c011087de69be4286f3aa8c108b7bfbf53be3ebb006841ec08563b102b6f8bc9700b

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.H1D

Filesize
14KB

MD5
48c1e270a98732a6dbe2d58868ec0bea

SHA1
a3b99c1cbdf49ef9845101463e425be9e1180b36

SHA256
d7ce67aec7192352ee3f283eb79a29aaf42b8f480bf09441408255440e12d1f8

SHA512
5e8ba56562028342c6e56cd249c08d577593be71c2036bd737a4ef3f761c76b0b01f43445538813cb0ef837163f5a0641912d8fa7647fe22d4a9c38e5316b58f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q

Filesize
864KB

MD5
a35ce7501770fa854d20767d467d449e

SHA1
054884f332d2d256ac8d1234f4b002b518f709bb

SHA256
cf29645e77ff3b03e42855adc147d564fe6abb957fcc0c4ab4322556dccb0eb1

SHA512
4d2c74a5e4f70397fe777c26529ec750f99518ea06769d9c08f58e693e9ecad0fd96d68e6ea469cd0f6c02c584cc8d6016ed629fca982a3d186d1f189d674bb6

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_CValidator.H1D

Filesize
12KB

MD5
ce7d01de24801fcbff72ce2b528c6ac0

SHA1
ee7a6ccec295886c6d0bdf88eda2a3247ab84801

SHA256
aeddc144c9a5645d9cd60db00f31aaf673157ad8a8653ba992f81199d49a963f

SHA512
de70f30ff9d276da62e713f7988579229c970a7bf9bf25076aa51860e4609dc84d8ae0d1070ad3100e7256bb8928260a2c18a36c28dd58166a13bf6d7960ced3

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
56d30b3d5f75d3f65391b8176a9ed360

SHA1
00853547488695b18a6dd558b1214d5c5d23cb08

SHA256
c85a9156ee243c1ab689ea81292ecf962eedfccda8cf0917e6c8ffeae093d78a

SHA512
b5edfca70eabf0e4b6b4abf46d1f1dbd7180d39b06bb94ffd7f88f9c54d87eea1c013fd1d4555d76adbd5e3474fd78f7eb6273a3260bcded71d6bc0d8d004661

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MKWD_BestBet.H1W

Filesize
425KB

MD5
ef1388c192ee0bebb88c9690c35840c0

SHA1
2002b904471be9f190406b7575d3c31094386fcf

SHA256
e41044c072e846914d414123f9a8fb2ff78e74b5f90216dd6ca861c9fdb2aac8

SHA512
8d1d05622b06b872d6559a9685c2c07b204f5b9a0f99041940a491a6c0a869b33a2688d24dc45b8f04ff5a58285a10c6d1e79672805750b1e843f123deaf7f72

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MTOC_help.H1H

Filesize
531KB

MD5
e161e769560f399cc4545312802a273a

SHA1
a1d3755db54b96deb6147d1310128b67c68dea6d

SHA256
619e66b28eb405bbc870e735264eb06206e998d2ca3335951028870d818d55b7

SHA512
c65ac1eb0230f021f8fa1f373a8d9ac4956c5f54f4e4b6ed956b463e9075d58dda377116a4c720afa9d0a58d7bf1c843170fb6b45f2f7e93c0627dabf04f3706

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.H1D

Filesize
14KB

MD5
7b94e5bc251191fd96e64b546d054720

SHA1
6c07a983bc3beb02a55da798b1983ace6bec5b85

SHA256
893b43d02149ad6449f2643ee316a4972dab957fb57520027a19829eab2910d5

SHA512
cc6e56440df36ff02d0a8caff990520934974cfd9f85e2118515c4370430aacc37a978bc19fac5a641bfd0b301b5be5b6f8da533551e0158259f945e2ef077e9

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q

Filesize
1.0MB

MD5
9da91fd4ea872f1f8bb585afae72db52

SHA1
a3177964497579e77e389e337186bd1df59e7536

SHA256
ad7e394c51524f1c5cb6b4ff5de9d09fae14a81d44bcbdd01b7bd14011d3101d

SHA512
159662197b7a24f86514e1aaa048a148d6ee6ef5e5dd09fc531b179a248af08ec733cf7b27b5ea7322d45c0e1d61d4ab2c244f7ba97dbdba7355a06a7ead99a7

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_CValidator.H1D

Filesize
12KB

MD5
f3dcb23393f6480be89a04440f3aa65e

SHA1
9641c3a79403162b2fbe1989dec10300d64c0234

SHA256
29adc34de974ff7ef92ca641cf8bb3a984b21956edae68b3b590d6789531ad56

SHA512
a709f25bbd455ae29eb87fa549c44d6cbb45fdab7f00e866ef5d260d541442d4e0b67ef3e63fb79481fcce54550c69b8b5347a3bff530d2defe5b1fa3bbbd76f

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
3719a2d693a781ab6e81cd57157da555

SHA1
6ba8f45e3e1660bbf54a457cebe7308aecab41e9

SHA256
6b673c9f935c542fd7da4eb8b59007bba41dbaafb1b2df0b2f1696a4ae3a303b

SHA512
d7e3546ee71b76ff11952149a19a493c14ac7fb758d55ca219391e10ffa2d234bb77ce91aa4de663cef490ef688e0c9de4e615a75f06a5d583e90a83f2ad8ca1

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
2951f844ac9294a6d27237a7b8f6172c

SHA1
7dad2322913184c92a9e799133356d9d6159bfb0

SHA256
3586f41eadaed7f34a8d68efc8e8f0f0b782a282cc8173f6d3bafd83a4a356b9

SHA512
d07e288533b8e91a99a7801a7984d5bb78fa20f3d801816b3e1dea500e4b8cbcd52954cee596512f0c8309f0539554cb3e7b18e563dc54d58925b21b5fdd6c06

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MTOC_help.H1H

Filesize
546KB

MD5
17e3b944b60a7f49e18d29d953fddd37

SHA1
66da7959c26cd60d092b503139412d10861dc942

SHA256
a7f1d51d5770e403d9774504e9dc503355a78b03efdc96a70be05b87d23cfd26

SHA512
c9ead9108505b68e3f4347edfa589f3d979660d734065344000b97c075b9e1774127c23d60d12cb8d0ad38e744b9fb5aef9c572f29cfb76bcc3537c6a21cf496

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.H1D

Filesize
14KB

MD5
a605382d2f0b0397a02bdb4aec862ae7

SHA1
1fc678357dab85bb29743da058350b08689fb750

SHA256
8c66015b7303619c88d9ee3faf996a829fa82ccb8a043bda212037fee2652fc5

SHA512
bd401699191b078b17dd45d8493377b207db3ef0b16c32f07b91629d768e9d15ce083071620dd2528b37b6ea4b870c76b3089d3765f6ace81873a1c74abb5904

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q

Filesize
1.1MB

MD5
17b6e57a4ef6b6d3ec81534dd02554f1

SHA1
3ef8745582af9ca0287476129694e4449ce7f90b

SHA256
660cdd5a494960d4c21e7378e38dae13a92009b49d18df1a918529c561a02957

SHA512
00668d98f56bc398282683eb9c04de3062d5b660b6e18270abf44fe34ef5b1ea7d04f6847fa083adf0e3ed4185f9428311a0140571c0b4ceab744afa94adf18c

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_CValidator.H1D

Filesize
12KB

MD5
b19f66446b19ee392f05752f2fcea7e4

SHA1
53a6fe8438a0f66d51ff142878e9126d62f195b8

SHA256
886fd18ad20d12a879d243eb50853341fe8d8baccb80d7c6e41ffc4aceda4477

SHA512
2e371813b9e3a2c235575b81595b9d0c4d663af9c5b8e99b3071fb03528fb6d531e112ec3201f575da0dbd570a2077642aeb328c8a70827d2b08c43afaee6ae0

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
198eeec223b6253fc64390abc180b04f

SHA1
d31cb939c84956ffa0e333f39793b447b1f7d56d

SHA256
92a999bf0d901470eda089c3dd92c81f6d26d80b969769ba57e4c94bdc370927

SHA512
3c47ded03691b58c00b5b01e1e4f37b470826f3a2c0d956754bcc00ab259170260f56a8d39b78cbf29469be5a033470f8286b889f65b6943b02415306887b068

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MKWD_BestBet.H1W

Filesize
421KB

MD5
55a46b63c01ccb16f41e3a079b668dde

SHA1
95266721734fb0583254a4bbde8bfadff5bd595b

SHA256
0b196a16366e906ed7782eee0149bc64e899806f53b8b66a3156ddd041e050ea

SHA512
2f30e2cd229ec347f7b1fb319e16f06e949a717931f8a8a324ffdf11d46585afd240d33ce2d763679bdcffeece99b5234653ebabe54ec8375e8c3a9e4c3393ea

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MTOC_help.H1H

Filesize
530KB

MD5
dc1d85af179d07f94f894fce72ff6d9f

SHA1
f778fa7871083f803f44f2c4b85d4531ce0a52c2

SHA256
214baec472002584e60a73004a982aeb327b98ecd56f87cdbe414a5e5a9e8797

SHA512
bd34b5da47531881ef039e5717080ae494fdf84c8107e499bd41cc60b7654f85105dfa80e442b97ffeef00bb7a56137235cd1d72ba073f24171a6435c1b42987

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.H1D

Filesize
14KB

MD5
0e975841a07c48aa5bf1dcc64b462538

SHA1
8e8f253568fac733db6e33a5ae6672ca48a2f157

SHA256
cdb5053779bd20fe4f859ca4ed95e66edce924f8cf6ac22fe38f7cee9e1fca10

SHA512
6085901a512d45efb5c1b10a7caf5758977014d484fa36af712e6b2712e6ff1841d34059e1e11e208a345e5ea4e2f7bdfc5829b65bdc082f454889438bf27e1e

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q

Filesize
1.0MB

MD5
c272be4bd9431665d7b902dab90ff508

SHA1
ee3b27ddfdbc3f38c233592effefeefd54cd7942

SHA256
1438aaec080323b9a8a008ab0513a8f553b7b59bb17710317eb5475184ca7e8d

SHA512
d6db8ce1eed57d1b2e1ae92a8cb71e181cc0455eabc4f051c338f19ad4610dcacb423290c052dc7fa87d8c67b41056a32c7c29c74ca68ebfcfe3e3a7623b0be1

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_CValidator.H1D

Filesize
12KB

MD5
9f5ceec241d79824ce469d52af4a659b

SHA1
33aa43329e4d6210cc63269283fe2c87541a08cc

SHA256
330a57592994cd73e4cd3aeb1f986a7a39efe77f8af3ab1d01a3c780c237ded4

SHA512
8f7dd01df8270d68be676b298b8db47578563f8d8eb5e0a2036e4f388fc8a1ed47fa07b3ed746dd4a7991c3f7de220cc6f8e1ff773d8e5c0866219264944c1d9

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_AssetId.H1W

Filesize
229KB

MD5
4320a3e8d1b4449b79052070cca9ddbd

SHA1
61f865403d214c3a19b9b47ae2d52e2db869811c

SHA256
9a05a7f9453cc0273dd1690bde719d014544460e9ab9b325ef773e9000a4e645

SHA512
43075bc18cc15057ba04ee4f99906184c0c44e81281e85a3f7f20878f159fd7e57e97fbe6faf21d842ce4b55fcb83f38885502f09d6dc608c94fc117d082e7c2

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MKWD_BestBet.H1W

Filesize
357KB

MD5
5379ff9095416cdcc28de1a33cf64d63

SHA1
9d8bcfe97af4c28d45fa3e463720285cb6d2f5ce

SHA256
581de50e71e98202161bf826d3ceeb3e8e006fe2dd20e592cde1bc63968b893e

SHA512
bb10c05b0fc84503945df14242243f526dd5d25e8338d50b8c628eafbfb8633225e1f1da26f4618e3bc6f352a641f6179567b70f0cd1dfa4a4fc879e3624aece

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MTOC_help.H1H

Filesize
352KB

MD5
5f18dcf6f5de5982d8988c147878458e

SHA1
f53fa8f6ea5b1e8f990e6b7e29bd8830586b1b6b

SHA256
5de2d9eb3f8efa509e7643bfc11d84598b6e5a89e0363c3030c9a9f5a26d40be

SHA512
f3903d61c10a1a591a85ad31106da742653db54707e43ea0f172a1a9579642c103a82ce258bcf26543d2526559b53e533ff9e3842f13176b6e3d6b1e882635dc

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help_MValidator.H1D

Filesize
14KB

MD5
f5fa0db35b6110294471089455e60a24

SHA1
a0cb925b7b1591495fcb36ad1a98fc9f3864bb8d

SHA256
faa3630dc3862d458d034ce55246b2fc7fabf4988ae0bb3e39b1ec2ff5f459fd

SHA512
9d6f7ab5f8fc4b442da615cceb1c89e2ad2b70934f24c361004300ac0c7bd5e50a3eb80d3d0150f690452084fdb7abe73ae48424d944393d749f3b4c40954b77

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q

Filesize
1.2MB

MD5
ce924935e2b8b0de92e45c4cbb4cb2d7

SHA1
e3b28ce63f54b7ffb55b677638101a547820f010

SHA256
07491839057d0b7661224d63db0e49adedd71a67ce1d739aff9b3edd8705d9e2

SHA512
0100faeaa8a88831ec2b6fe4c0b9b579ddd5bfb3b280f16e4b682314a3a84e08327a900ab82a2b4dfea5f50a34dd52982be13c578994820e02d8ede5aa376188

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_1defa0c0-fc04-4155-83bc-b490dbaa3679

Filesize
338B

MD5
966c677c0d97a9e21204c434c092cd9b

SHA1
a6448e5609f29d11a25ae04415317e3792162218

SHA256
d396ae2e6c590b6e26d9cebf1aa79ce1b82ee88fffebe7f1dff455a17404dda2

SHA512
b7d6ad889cb333143d322f6af00dc2ca484ab6653cfbb7ae7c8554cdc6795473ba06919bd5adccfd89f5102417a02367023f57ea0a712c238f69e032107dda9f

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_1defa0c0-fc04-4155-83bc-b490dbaa3679

Filesize
322B

MD5
f39d4ec63d71b72b59133ef68e16a09c

SHA1
fc82c166d0ffa722a8493e3f38e31f98659eb3a4

SHA256
4f79fe2c2eaf84173e1b9efb89d07424dbc86f3da4399da88ea02aafc819ac4a

SHA512
9fe262721a88e07370157abaa4005a3d67f51d255529f14750aa33549030f334f3c10ea3972480973530d1ec5ac242d73de95a5605ee48cab94fcdcb628e8568

Download Submit
C:\ProgramData\Microsoft\MF\Active.GRL

Filesize
14KB

MD5
60a6eec5269f71e6058dd75ff73f0d41

SHA1
7b7a75e2b5b6cc7ce9b38c171a0ff6471268782e

SHA256
cca08466be4e964a58a12a91213c0478f08be81778b04dbb3dff055e6a2f678e

SHA512
1935d1e279703b8f5aaf39381726e3c38025dc1293199a465432cf1b14b051e1eda28813d5a0abc914d3072641181343cd6f1cb77b5c2aeb72865e017435a01c

Download Submit
C:\ProgramData\Microsoft\MF\Pending.GRL

Filesize
14KB

MD5
53a24df9d58242b58b732907bbf82565

SHA1
0ac98c394b78cc70fada75bbea10a0e49797c058

SHA256
29f7d0f1518712e17fb0e22b4a79c4b59a82806141a36556ae6f299e6a5fed1b

SHA512
b4e9bde55f1de1cc01a28274f487c8cbe216cddf5270071f7be3db2cbd338151303672fea7595c51530508696a3386667224b167c25b0e2400f8756e75ba9eeb

Download Submit
C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico

Filesize
5KB

MD5
4970aad4bdfdcb6ba02cae3c0c75daee

SHA1
e795042da7281e4e90cd08b8b95492665adc8870

SHA256
95724f8bc243f0fd311ac12919b663f6e72edf88decb799efc5ba3c44e16911d

SHA512
a31154d52e3f48dbf6537356dcf223470ae653f0a055fef53a286a9bebcd56b17bb1126bfd2a5590dd1160243f923457b941577e077abbdd1f676968162dd734

Download Submit
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico

Filesize
24KB

MD5
6471ef70b8a03ef08fb4aceb0cd17b53

SHA1
17021e26286b363da33cbabdb0387abcbc00f814

SHA256
2f5b80f0820f1e99726c0f24cedd20399a5c7def87136d58e04284fdaf9328b8

SHA512
7fc5144eb2503da50bfc8547f550f6aa0424757d7aede1cbf90772d8287f19e4941b98da36a09ac1df4b0e3359cc9e57d51b4d99cfcd1616d0121b7c305fd7ef

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico

Filesize
341KB

MD5
eafe2fd4d62e01a82a2adafcb498b9d0

SHA1
e1ea1c9bfbcc3c4b0efee164949177228d0fae7a

SHA256
892de5f6d96cb6c0fc12e845942ff3103bd2abde0f05114a824f77efb7e11384

SHA512
d3320bf8c617e001ca92f7c2533c4dfcb1c760346b6414db4b52cb9c8971036a7558ee6690e366d8cca9dc324d5deecef603f9bcd9bd5da850d842f263fd6b10

Download Submit
C:\ProgramData\Microsoft\OFFICE\MySite.ico

Filesize
24KB

MD5
0312f14a6f1b11c640f005cf5ef9babe

SHA1
3d4856ce0dc573c8d141f030b7ccd04f11916607

SHA256
0380210074caa188e7b31eb8d21e9c8142c105aedf5613a944812dded51585f9

SHA512
d8adc6dc70478c90b4617f378cb8381f7d91e9d4939da086dac3ab9f7f5fa9b34c1deb7fe5362e5782ac5395f4c1d267abf7cc09c1e225433620c9b8d9af3d75

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico

Filesize
24KB

MD5
bebcc57ee0cd15d7956e049b25a07197

SHA1
ba37789e5e5f15bf08b0132db71d31a3d175e1f8

SHA256
2632894dff6260cebdae74384a8320858edfbf14016a28ce5a0c23f05a36fa10

SHA512
06e2b0c3abe6681a519faa7f9c11fb280e146cae6f82eed3c9a74c1dcd790ff8ad7ff0794792a53852381703148729eb8bcc2b39d0a3bd292397548b894e382b

Download Submit
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico

Filesize
24KB

MD5
30e51986cccfbda7e645e3c8bb2fd5e9

SHA1
a3ac85cce9eda14d0cc4a937a450c89c76ad7013

SHA256
cf9ac29ecb07278a89ab7fc16e8bc7d331621bb84bfe5e81aab84bffef564481

SHA512
6c55b8f3548b2a0a5660a6ab015855c3fcaf85ea7642aeb5db9b63b46e10fb593a3c800ec62bc68620881c71ca24af0172047376a1037e46946bc826c92b9019

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp

Filesize
48KB

MD5
287af704b36b8c0ecf0af45c60a42160

SHA1
bb0df5dcf7c3afa15af76a68f969169db7a31582

SHA256
7614222b8601f2f9971c43c09a30d7db050611a3327ad95bd9c3fc05e69d655a

SHA512
0b9afad308088fecfdf57fbbaeb9bfdac3d2a9a501b4e60fc82372d75c508509822177b91ee54149c3d317ca1a8f73b4254c48a19899703bc9be69d176cb8166

Download Submit
C:\ProgramData\Microsoft\User Account Pictures\user.bmp

Filesize
48KB

MD5
39d0f247b731a5227c179cd824de92ce

SHA1
d7e21ffb065305fb1fe3bae809e0818580bcd4f2

SHA256
972325cc0e5fa6fab7002e5a6ffb80b206b41338755397cc572645368c4ddbc7

SHA512
2342bf19d219750069ca86e1a9bbba880d435ce251f442e81d9b39bb43eae072d2209ac1e988199d4d1cf56f5116d38ff6a92fb53a30d5d177284b781095b383

Download Submit
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm

Filesize
914B

MD5
3e07ad1c4f6adec26cc1ae063eae8460

SHA1
a9f0bc37d9fdbc42bdbfe04d451ba3de3c554948

SHA256
84a4b62358234c50f44d5a121da10081914f8b441022f615cfe27d9e32d5ee3c

SHA512
fb0e3f2974a499223ff110f931036f988e439644ed331de6b3ea6eeec0b3ea398992d50886a74bfba1c07bc56bddfe49a11e39580b8ed74fb97bc4ba2f2bebc1

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.5MB

MD5
fd696b532443314ffbe48918d5b4a859

SHA1
15d4932b24d8b5cdd5701bae1ee640638da62fb0

SHA256
315d12ebbd96bb8630797a031b8d6fb2b42e44fa207c9d21b77d9de6cf03bb94

SHA512
570add0d1201964285797879797c5ba9aab620653af244c1e3697de66dbe80e356511485554b5ae97deb7aec259a52dcf95ef1fb31777787d873cc2682dc9496

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
148KB

MD5
8eae5ea9c124ad0f1d24d23279a2c255

SHA1
6780be3d02630303c2675bb31f9b60c602f3abfe

SHA256
fae79eeb557bccf68864b79a00ad1cda646faacc681551e5989bc3986350385b

SHA512
a3d08ab3b48f07c24c165a39e6e6f9385c1981e4d8cccc7884da59a56a785195603b4868af69c984eb34d0e0742fb6893bbd5066c5642ebada01893eaffddfc6

Download Submit
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\state.rsm

Filesize
1KB

MD5
13f66c0fc61f2d782e33cd085d40ebed

SHA1
387c903a23651aed04da2838e0f8e9542d855b68

SHA256
248e7211eb3bc437409aca7817fac9e81bf65c290d291d0afc8522781c2312b7

SHA512
94561ec81cbdab00256b87c3b3b2864b37a76cc1f385870676a78ead546f7221b5e8956c4b933ab948585c6f421c31357b755117df44d1660e493d9c89e4be5e

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.3MB

MD5
ef6c2613929b89e086f8293591de9207

SHA1
35fac98517f3bb04111e5eee09e7eadb3719fe9c

SHA256
b2b8eda97f94a3be02dd78a1bc7e37c8f1a0984c4f7c8df07bf9ca6ff7a48ac5

SHA512
034571f1607169088c54f7e790ff12c7dd2e5331231303d4ac36f0694701782ccd1b2c0f30aac0fbb37a88f56801409a16860d0a73657657c46905e33599101c

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
140KB

MD5
e3228d69b2cbf2754a1c7e508ab3c405

SHA1
6eabef8a175a06d5c48c5af78dfab13e48c617e9

SHA256
af28a7fd2b402962bdfdb8f248dec45432026dafc7078a464552b1645d7f8ff4

SHA512
0da4ac38e4c2dc55e3cca5be46c375d784b01473d4668fbc78eac91db688c1258725de2e26d237f611a43d61246adc8b8c44dc80c71c3fcd0e62cd56684a8ab4

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\state.rsm

Filesize
1KB

MD5
b05d713a1f5181f2d8ea141b3108e80c

SHA1
5a98fd303d72d10f1363b47062fdbed8675bf05f

SHA256
817df30524a6ea3c161312952f17eefcf40b5b701372ef1c79d0316cc6095ddf

SHA512
cfa1ce0f668c67805e7116bce1b819aacd4577738376a01522ee26b5979ca109fe28be951858ba0cc6c8a0441a33ef8c5a1764b8ac4b1bde115d34f83b89d92b

Download Submit
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm

Filesize
930B

MD5
7547a4c1c8430debf0e72e75effa99e3

SHA1
6895cacd1bf51d62d04014623745a8f87f74bc1b

SHA256
284ffe07e70f22b41912e3f028c6c193943f59a0557736e5c0ff4143ae8ab3a7

SHA512
dbbad14fa296d6d74c7d43321c92d321d878f169b5b84fe1ca91fa07b17b44e722aa9851750bfd6f389cd43a520f2713f82018b629c58fc6cb3d0922318a2557

Download Submit
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
870KB

MD5
4bee8a609d9efd435f33489b7b213dbe

SHA1
6ea1500d5a32ab118c6aea4650281a18599f915c

SHA256
acb74600018f6fed231316b635d379ccb8dbe9ee2ce585510b7268dfe0a8d81d

SHA512
cc16266e6e144470c2d11c39041b522edde50415f5fc4dc8d054df961ae1aa9c74b267158958c6210cae0eb0e7e2f3ba43cc2c90fde9c6f99872ad2ad9164515

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.4MB

MD5
347e6be671e9b01836ca6068275ad412

SHA1
63874437cef43edd4a3f737a1340346d10531097

SHA256
67fc0e587067d3b347a9f94ae6ea5d61d2db43a5182dad46c5a2e731c441c23d

SHA512
a67d849335bc6f7fd52afcd435bf76f13132b4d7cbc73e908abffcd366a80b27588ffa452dfd7fe8f64967c1fd1e76a7892152cadf5c9b71b80e3cf25997def9

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
180KB

MD5
9fc6ab275e8e5e8cb816225f9ca38229

SHA1
a870b3dce9c6874393aaf699d01b282e2e823a56

SHA256
e512c14e264bb41dec072cbb2e595be9dee716bf8b6a36a5b1b6a7641b096c29

SHA512
d3d25acfa33d72fc07e665b561992785cf12be708560a139a8846125f21a9cf76188e16e08c26ffc2c291a2e4e47841e5ec4581ed0cc967bcfeadcba41cf93a8

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.7MB

MD5
03cd5a900a95cce2f70cfd8d62382a1c

SHA1
8a376a272fee266d11b3bf9f8428d59d18f440b0

SHA256
7ce5bf550761adfe1a9c1ed6400f4719ea6f64c08a974a793a9309d705fbd119

SHA512
2553a41fcc65981f7a9880ae2de4d969533cf7858b664611ea8e1af896d2187592bc4c2dd4efc09cf7b6faf3d222001b6d2de0ed426b0abb907fecd4fba41122

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
140KB

MD5
3fa916a9fd935a411a416999b1a88e44

SHA1
7f852153671fff29ebaef386c6f79b746bf58da2

SHA256
ea8fd7847355e7d04fb3b104f4fee4b3a3175cf062d3a473379c7f44493e15fd

SHA512
a3dd4574ee06e508b032b6c1f810e3b382bdd95ff1d9888a28a3f6936b0534a7f200caed9a61c575a3c3b92b8daa33df115d3369744b13ddfe4ba7ac41e757d6

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
c196676b52f0745f199704f7450dfd1d

SHA1
155a378a784eb8ea2d8be0c48fe5ecce5a6c8bc9

SHA256
425bbdca888312a79d1eb6705aa7107dec6ae772ca037330f24768edfacf6ca2

SHA512
b79bc9ab7125ceddf6b3435517496bdcd10a6411b3bfa620f06ee022f929eeca050560847f5963a47dddf39faf8af1e5341727a040bfa338367d1fee59a02cc8

Download Submit
C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
148KB

MD5
0e8099fe31b909da332e0db4e53ed610

SHA1
45abf03ef6060cf725c4042bbaf7234faed7c83d

SHA256
e5e3c7ea11a0464c23def723348de2efeead035446a44cba5056c5fb36b34f85

SHA512
d6d75f6e2959d59f8d192b69d096340a951be9693a27dd5432cd351f63ee5dacf9822862eeea87d4e96bdd6fbd8885fb3c16e6749b8a7361d0700a3b14153c74

Download Submit
C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
802KB

MD5
fe57b5afc49ea36bc0ef8561d32e308a

SHA1
e230d3e9ca644cec339a2293cba8626412e83713

SHA256
1d246026dfbb5e6265b5e54e4318f6d86f4609ad9697a0b4718026220e8deaec

SHA512
38997519630a59dff9bc0b1245df799e507de8132471b5c7cd4706cc97fce59cec28c9ea94c83c40c2f93119b900a526ea48ef6734e3e99bc5876b6adfa27186

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab

Filesize
4.9MB

MD5
64984b95f88efc0b5c66dbd39cc793c6

SHA1
3eade2ab919b24166e996bd09bc46086b5c3fe96

SHA256
733ba662a39bf14f54831a7ed133da6c48bfd9113ca00e2d1c23f58f3003420c

SHA512
ef6edb8c3330bb77d093091f6ea60afd8c3c1d0274486524e5cd10bce54856d06c4964a026de94be7290a411e2de7d5f718a7b137eb79b4c88730ed2666599d4

Download Submit
C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
180KB

MD5
b0abdbc43f33070121d4af42510ff411

SHA1
3621c57aa7e01c152f5fa25387ee8034086fdfe1

SHA256
3ed1fd0af48fd22df4fa91763251d89c30faee3aebbcb9598f8583f2914ccf84

SHA512
48c7fd9d9d9afa503638457c4353e94271b7e7507210a97b9d79aaa9e40c11f989040b76a1431e6ac5a909fccb9fb834c373353c94a9c6bc0f38d7a34c1cdbd5

Download Submit
C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
1010KB

MD5
bd54a35bf1a8d47e10354545702c20d7

SHA1
1a8f9e2dbed56a438ee76db92f30f8cd4ac4ef89

SHA256
53afe5241ff2dbea85f66c25fe2c2f5818337e1415ed1472fd68af07761a4a6a

SHA512
d256543ccd72438e8af410c08d6c9768aaab7153e88c3e551b5d03e5b8c78bbe840a9199c101e5b522a9cd609c18a3cef52982ebe47f7a3e7165de0a240b301f

Download Submit
C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab

Filesize
791KB

MD5
478a279f24d3731152a168e31df54e60

SHA1
b774acf7fbd5ee53383269926bb89fb0d6ea523a

SHA256
ca89adbaa88d8b4cb0379b55c22d12330ce5c8c24eea872705fc61d81f691afd

SHA512
fdce4a4bab10c1c6f02a59ad462df4d1d3a7d192ccc861e55a294afc9803f2eb471b3b1b9801d73659e07565d6cac6f5181f66e69ba3467c0c268c5f9a44759f

Download Submit
C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
974KB

MD5
c12c88456eba656b49a7bcd2c5c8cc48

SHA1
07d579b880dcdbd2b85c52e0f45c1695ac4c4d42

SHA256
72a8e6cb8b8fba495a818c3c30bdee6932439daa2d7b235569c38425a01a81b3

SHA512
90b118899c3244d60e5e657ec4689787759fc8049b6b8c3cd5537ac7304f7676e60826ef2dd8e37fa665e31e5e3a9107f2bcea06efac02744b98aba629bc5b8c

Download Submit
C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab

Filesize
742KB

MD5
9200ec89ffe2805d4347495de672c26b

SHA1
86102f677ca354e7205f0ce6a1dc65e28c9579c0

SHA256
70ee72df3670b5c53816e4de4e0c565782fef5f7caa84e8d5243a5f2f5aa9b02

SHA512
0c8e7b30b46edd9d6155416f0bb2034d88fa442f6cad47658c54e0dcc99dbeff2ac1701d01b53f6b71f3d418683a192fa5175ab83ec5f211bf030f50ceb2e0f7

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm

Filesize
914B

MD5
3b2f96c216c8477736a2438249b7eaf9

SHA1
f5f0b57333e4d269b32f6c3676bcddc09d69b309

SHA256
7d6450bdb70b61bd67e15da427d79683d3f03f4dd9387a52eb0eb4d3596895c6

SHA512
3ddca8eda477c21487f8aac3172cea82217f4c21db39e44484b2f3051ef123a45a925c6052d146fa1395e7fcb7a013bbdf0c9230045ec5df688a6877402c7c87

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm

Filesize
930B

MD5
82a0608ea49eaabf9612435bd54dc4a4

SHA1
5c359b74114cd660c669aed22939955c8e5e4b47

SHA256
7a8ed2e0dec02ced415645bbd6b0d42ecb2858bea4c0ea0d60aa8f2f69cd3264

SHA512
294c70cdb09ead8a91adc639ea3d69f885386f4281ca3f071657ef0d65713b5feea232d48cc4eec49d145f55545e5701ce05d21cc90b2b9166f767b7fa6419a9

Download Submit
C:\RyukReadMe.txt

Filesize
804B

MD5
cd99cba6153cbc0b14b7a849e4d0180f

SHA1
375961866404a705916cbc6cd4915de7d9778923

SHA256
74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

SHA512
0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
077671ca9f151070ad3428bd90053c32

SHA1
129ac25d101e96dbf0f8a923f687a05df2109776

SHA256
75bc9978d18addb8b6aae66cc244fd653099d6181af06c363ca37d9c232a7a14

SHA512
87e9d11886333a3ae326f06e6848ed6ed762d1786c1036a356c1f635dec22aecb0bf51e6d4d233a9cd532504eae497e27ce016625506b5a0e16c898beb406a84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\11e70660-fb11-400a-9a54-dcda8717cbfb

Filesize
10KB

MD5
66fb57e5369904d2c15a23df8edec0da

SHA1
8e3c6072c365d27e3088e40b0136bdaad8146158

SHA256
70b128415ad3ab0d08a531ae734d683579cbbb534b8c3631e00cacc96ab019ec

SHA512
5bd918a0ffff8ca3c9504a2988f8c320190475c098124b57cdd1d4452a3b2fb871059087d713c87230f0e162223671097d8a2ad1603f2a61eb3ace8898af964b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\datareporting\glean\pending_pings\3a63d74e-992b-405b-876f-6197af1941f7

Filesize
745B

MD5
82168dc158f7e68ce57b7690db4f0e8d

SHA1
9977e74028fe0547e6d97750f0fd9dacd3ab89f0

SHA256
90c519e41ca1e34486ee2dfbb6d68c440abd8ccbfa2b6e847b2c623aae2dafe9

SHA512
32e09349871bc5b774acaf30d9e83d2470a2ce77f61cc362ded7c83eea61a39eb99952c3626b0b85d630b0420557ac208ac7d502bf5f2ccfb4f8e2d9459f82c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\prefs.js

Filesize
6KB

MD5
7c10acbcc999cdf4e805e91b6453ec91

SHA1
6a6d610398fa4a4c05500d2af42a998227ae4f55

SHA256
5feffcaa201f40666141db77d661adef7029e55b6f633c3459559db968fe2430

SHA512
6418b6b3d863c2344f8e1019341c1981337b75335b22d2ad714219c3a742b4d9dc872b8255a55e89c8ce025cf43c74c1255862f781960b8c61cc4109d6760a52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
954B

MD5
2cd5859ca3b84af437638dbfc7999327

SHA1
3238b4ef5eb37a75278e80f69efd17c405633431

SHA256
794906553c193ba23ce4c7cc33484e30a2f60a5433edbf3c98ac62f2edb026e6

SHA512
d08129c5eb62aa54c7b9eaff19a2b0d2977e05f1b266687b6128dcceea62efc5d3843374fc668428fae0931b5334ab81b60015b1dbdcf5f8189ffadb1e57376c

Download Submit
C:\Users\Public\VBzui.exe

Filesize
170KB

MD5
31bd0f224e7e74eee2847f43aae23974

SHA1
92e331e1e8ad30538f38dd7ba31386afafa14a58

SHA256
8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d

SHA512
a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249

Download Submit
C:\users\Public\window.bat

Filesize
1KB

MD5
d2aba3e1af80edd77e206cd43cfd3129

SHA1
3116da65d097708fad63a3b73d1c39bffa94cb01

SHA256
8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

SHA512
0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

Download Submit
\??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak

Filesize
12KB

MD5
cdff647faac7dae2f2597759b4bbaa97

SHA1
4e8aa732154de60e6e62e1b910610937f54e6608

SHA256
46020393fcae71101d36e27b0d08f28442c20d48cde3b9fd99e87daf54513a45

SHA512
b2d3e43da05e4de473492303b84451cc7eb7b771cd1e82d24e433ac3c3fabce16abf0b95646cc4fa6c716a350f59c63cb2b49370bedd822ff70902387093746e

Download Submit
\??\c:\Users\Admin\Pictures\BackupSet.tif

Filesize
504KB

MD5
9b6968cd5e0a1fb188502f6435ccdd0a

SHA1
87774bb857a12de31ccca1b4bdd55ea8465fb6ae

SHA256
c861835a63aa7134e381f0671e0429f01c888d1603fdfbbf286d687f1faad5d7

SHA512
642d9ba9c74354a42627d4c8d4f7ce73d21aa0a1d1333a2e9789fd9d14a05c1ddb018fa9c13aad6c941d176737270d82775569486fdd4eab81637be3faa71b24

Download Submit
memory/1080-50-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-65386-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-7-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-5-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-8-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-25-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-37-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-42-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-44-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-26-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-29-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-28-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-27-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-68-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-39-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-38-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-43-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-36-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-33-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-32-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-45-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-681-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-114-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-99-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-101-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-103-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-107-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-108-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-112-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-31-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-51-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-113-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-109-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-53-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-57-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-87-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-59-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-61-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-63-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-66-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-67-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-69-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-71-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-73-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-75-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-49-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-48-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-30-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-77-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-79-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-81-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-83-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-85-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-89-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-93-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-95-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-97-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/1080-91-0x000000013FFD0000-0x000000014035E000-memory.dmp

Filesize
3.6MB

Download
memory/19716-18724-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-25501-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-23581-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-22333-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-24333-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-22632-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-24334-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-16018-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-16021-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-16557-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-16558-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-18055-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-18062-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-18059-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-35876-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-23580-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-22629-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-22322-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-19214-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-19220-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-20053-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-20052-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-20636-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-24965-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-20635-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-21178-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-21179-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-24964-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-25502-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-18727-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-35875-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/19716-18058-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download