I've seen those same Windows ISO sites push false 'known good' hashes and to make matters worse Microsoft makes it almost impossible to find an easy to check source on hashes unless you are downloading the U.S. version nor do they avoid so many sub-domains that you aren't really sure if it is or isn't an MS site/redirect. Foot, meet Gun.