CRYPT_E_HASH_VALUE (0X80091007): What Actually Causes It

Cause #1: The File is Corrupted or Incomplete

Nine times out of ten, this error means the file you're trying to run or install got mangled during download. Maybe your connection dropped. Maybe the server had a hiccup. Doesn't matter. The hash stored inside the digital signature (the expected value) doesn't match what Windows calculates when it reads the file. CRYPT_E_HASH_VALUE is the death sentence.

I see this constantly with large installers—Visual Studio, SQL Server, Adobe Creative Cloud. People download a multi-gigabyte ISO, the transfer gets interrupted, and they get this error when they try to mount or run it. Same thing happens with self-extracting archives (.exe files that unpack themselves).

How to fix it

1. Redownload the file from the official source. Not a mirror. Not a torrent. The original publisher's site. Use a wired connection if you can. Wireless is flaky for large files.
2. Check the file size before running it. Right-click the file, go to Properties, look at the Size on disk. Compare it with what the download page says. If they don't match, you've got a partial download. Delete it and try again.
3. Use a download manager. Browsers are notorious for crapping out on big downloads. Tools like Free Download Manager or IDM handle retries and integrity checks better.

If you're getting this error on a file that came from a CD or DVD, check the disc for scratches or smudges. I've seen bad optical media trigger this too. Rip the disc to an ISO using ImgBurn and mount that instead.

Cause #2: Windows Update or Component Store Corruption

This one's sneaky. You're not even downloading a file—Windows Update tries to verify a system component and hits the hash mismatch. The culprit here is almost always a corrupted component store (SxS folder) or a broken update cache.

I've seen this most often on Windows 10 21H2 and Windows 11 22H2 after a failed cumulative update install. The system's metadata gets out of sync with the actual files on disk. DISM and SFC are your tools here, but you have to run them in the right order.

How to fix it

1. Run DISM with RestoreHealth. This repairs the component store image. Open an elevated Command Prompt (right-click Start, choose Command Prompt (Admin) or Terminal (Admin)). Run:

   DISM /Online /Cleanup-Image /RestoreHealth

   This downloads healthy files from Windows Update. If your network is behind a proxy, you might need to add /Source:C:\RepairSource\install.wim /LimitAccess pointing to a local install.wim from an ISO.
2. After DISM completes, run SFC.

   sfc /scannow

   SFC repairs system files using the now-healthy component store. Reboot after it finishes.
3. Clear the update cache manually. Stop the Windows Update service, delete the SoftwareDistribution folder, and restart the service.

   net stop wuauserv
   net stop bits
   ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
   net start wuauserv
   net start bits

4. If that fails, do a repair upgrade. Mount a Windows 10/11 ISO (matching your edition), run setup.exe, and choose "Keep personal files and apps." This rebuilds the OS without wiping your data. I've had this fix hash errors that nothing else touched.

Cause #3: Outdated or Mismatched Cryptographic DLLs

Less common, but when it hits, it's brutal. The error fires because a crypto-related DLL (usually crypt32.dll or cryptui.dll) is the wrong version or got replaced by something sketchy. I've traced this to two specific scenarios:

• Antivirus or security software interfering. Some AV suites hook into the crypto API and mess with hash verification. McAfee and Kaspersky have both caused this. Temporarily disable the AV—not just the real-time scanner, but the whole service—and test. If the error goes away, you need to update or reconfigure your AV.
• Malware infection that replaced system files. Rootkits and trojans sometimes swap out crypt32.dll to bypass signature checks. Run a full offline scan with Windows Defender Offline or a bootable rescue disk like Kaspersky Rescue Disk.

System File Checker (sfc) from a repair disc

If your system won't even boot, boot from a Windows installation USB, open Command Prompt (Shift+F10), and run:

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Replace C:\ with your actual system drive letter (might be D: or E: from the recovery environment).

Quick-Reference Summary

One last thing—don't bother chasing registry hacks for this error. I've never seen a registry tweak fix CRYPT_E_HASH_VALUE. The issue is always file integrity or system corruption. Start at Cause #1, work your way down. You'll be done in 20 minutes.