Overview

overview

10

Static

static

f130530949...le.exe

windows10_x64

10

Resubmissions

20-10-2021 08:57

211020-kwsc4aggf9 10

20-10-2021 08:46

211020-kpcdashgcj 10

Analysis

  • max time kernel
    552s
  • max time network
    360s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    20-10-2021 08:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample.exe

  • Size

    170KB

  • MD5

    1bd7d1b87c5091a9653fe8005892b784

  • SHA1

    3dcf19b833266a3591fd97c93e5b9bca4ac2c21c

  • SHA256

    f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703

  • SHA512

    4c13373a150b1e3bd12fdd9ad5c379a43e41c59ba5b6dd6982c79599839128bcbde30d7083a810d66604382f4d5aff24c22b504fdaab03f6743a7dc263d85651

Score
10/10
ryukpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at WayneEvenson@protonmail.com or WayneEvenson@tutanota.com BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe
Emails

WayneEvenson@protonmail.com

WayneEvenson@tutanota.com
Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 12 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 54 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of UnmapMainImage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:78760
      • C:\Windows\system32\vssadmin.exe
        vssadmin Delete Shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:78816
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
        3⤵
        • Interacts with shadow copies
        PID:3572
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
        3⤵
        • Interacts with shadow copies
        PID:78548
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:78540
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:5096
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:4704
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:78768
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:3284
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:2404
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:34744
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:3592
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:4580
      • C:\Windows\system32\vssadmin.exe
        vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
        3⤵
        • Enumerates connected drives
        • Interacts with shadow copies
        PID:1020
      • C:\Windows\system32\vssadmin.exe
        vssadmin Delete Shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2392
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
    1⤵
      PID:3224
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      1⤵
        PID:3752
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3752 -s 812
          2⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4536
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
        • Modifies extensions of user files
        • Drops startup file
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        PID:3488
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
          2⤵
            PID:2164
            • C:\Windows\system32\vssadmin.exe
              vssadmin Delete Shadows /all /quiet
              3⤵
              • Interacts with shadow copies
              PID:1980
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
              3⤵
              • Interacts with shadow copies
              PID:1860
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
              3⤵
              • Interacts with shadow copies
              PID:78532
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:3800
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:78824
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:3184
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:4788
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:3300
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:3584
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:43140
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:3532
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:3516
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
              3⤵
              • Enumerates connected drives
              • Interacts with shadow copies
              PID:3404
            • C:\Windows\system32\vssadmin.exe
              vssadmin Delete Shadows /all /quiet
              3⤵
              • Interacts with shadow copies
              PID:2156
        • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
          1⤵
            PID:3236
          • c:\windows\system32\taskhostw.exe
            taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
            1⤵
            • Modifies extensions of user files
            • Drops startup file
            • Drops file in Program Files directory
            • Modifies registry class
            • Suspicious use of UnmapMainImage
            PID:2444
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
              2⤵
                PID:42856
                • C:\Windows\system32\vssadmin.exe
                  vssadmin Delete Shadows /all /quiet
                  3⤵
                  • Interacts with shadow copies
                  PID:29460
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
                  3⤵
                  • Interacts with shadow copies
                  PID:41560
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
                  3⤵
                  • Interacts with shadow copies
                  PID:47336
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:67408
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:78860
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:78940
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:78912
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79000
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79072
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79144
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79184
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79220
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
              1⤵
              • Modifies extensions of user files
              • Drops startup file
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious use of UnmapMainImage
              • Suspicious use of WriteProcessMemory
              PID:2316
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:79076
                • C:\Windows\system32\vssadmin.exe
                  vssadmin Delete Shadows /all /quiet
                  3⤵
                  • Interacts with shadow copies
                  PID:79124
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
                  3⤵
                  • Interacts with shadow copies
                  PID:79164
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
                  3⤵
                  • Interacts with shadow copies
                  PID:79200
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79232
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79264
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79296
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79328
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79360
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79392
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79424
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79456
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79488
                • C:\Windows\system32\vssadmin.exe
                  vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
                  3⤵
                  • Enumerates connected drives
                  • Interacts with shadow copies
                  PID:79520
                • C:\Windows\system32\vssadmin.exe
                  vssadmin Delete Shadows /all /quiet
                  3⤵
                  • Interacts with shadow copies
                  PID:79552
            • C:\Users\Admin\AppData\Local\Temp\f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample.exe
              "C:\Users\Admin\AppData\Local\Temp\f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample.exe"
              1⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4024
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample.exe" /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:416
                • C:\Windows\system32\reg.exe
                  REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample.exe" /f
                  3⤵
                  • Adds Run key to start application
                  PID:4320
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /4
              1⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4328
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:20236
            • \??\c:\windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:78624
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Enumerates connected drives
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:37136
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\RyukReadMe.txt
                  3⤵
                  • Opens file in notepad (likely ransom note)
                  PID:30724
            • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
              "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
              1⤵
              • Drops file in Windows directory
              • Suspicious use of SetWindowsHookEx
              PID:39892
            • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
              1⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:40312
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
              1⤵
                PID:79584
              • \??\c:\windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                1⤵
                  PID:42636

                Network

                MITRE ATT&CK Matrix ATT&CK v6

                Initial Access

                Execution

                Persistence

                Registry Run Keys / Startup Folder

                2
                T1060

                Privilege Escalation

                Defense Evasion

                File Deletion

                2
                T1107

                Modify Registry

                3
                T1112

                Credential Access

                Credentials in Files

                1
                T1081

                Discovery

                Query Registry

                3
                T1012

                Peripheral Device Discovery

                2
                T1120

                System Information Discovery

                4
                T1082

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Exfiltration

                Command and Control

                Impact

                Inhibit System Recovery

                2
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Boot\BOOTSTAT.DAT
                  MD5

                  819d4a41854cee506f9b0cfc5a5c538e

                  SHA1

                  cf1ad33b7661c4f292a37512ef79378cdb70cae1

                  SHA256

                  b0db9a6c45054b7720e2c3516edd4dd2f686b83e54306d09eb6f4f8cca10b194

                  SHA512

                  8762bd096d17675ff18f7e871d13217e05f04af3b04c5f2c6a52406a67d7ca16ad0cf067a1cf9b5306339c58e5b26664d72af00d49ed12e1d2eb28a4693b56b6

                  Download Submit
                • C:\Boot\Fonts\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\Resources\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\Resources\en-US\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\bg-BG\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\cs-CZ\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\da-DK\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\de-DE\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\el-GR\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\en-GB\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\en-US\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\es-ES\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\es-MX\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\et-EE\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\fi-FI\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\fr-CA\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\fr-FR\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\hr-HR\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\hu-HU\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\it-IT\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\ja-JP\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\ko-KR\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\lt-LT\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\lv-LV\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\nb-NO\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\nl-NL\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\pl-PL\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\pt-BR\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\pt-PT\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\qps-ploc\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\ro-RO\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\ru-RU\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\sk-SK\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\sl-SI\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\sr-Latn-RS\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\sv-SE\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\tr-TR\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\uk-UA\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\zh-CN\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Boot\zh-TW\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Documents and Settings\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\PerfLogs\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\7-Zip\Lang\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\7-Zip\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\DESIGNER\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ClickToRun\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\Program Files\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_2c818d6f-6b05-478c-8ce1-9d49a3874096
                  MD5

                  3c1d317da4e850f8e2be3c1e90347005

                  SHA1

                  f0159ce8e2835a0b371c335875372129f596c614

                  SHA256

                  d23c10f67c81520a126007c77f22887269e635715290544bf841bb49d1492249

                  SHA512

                  970f3643d3c42801e8c0f90e57030e34ff1a7cbc4427238558c67c0992d0a2d4456c0ca14a1f23f9907b2fba567e261f3a9245b4abfc54588e7eda8df1c60861

                  Download Submit
                • C:\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\odt\RyukReadMe.txt
                  MD5

                  cd99cba6153cbc0b14b7a849e4d0180f

                  SHA1

                  375961866404a705916cbc6cd4915de7d9778923

                  SHA256

                  74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                  SHA512

                  0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                  Download Submit
                • C:\users\Public\window.bat
                  MD5

                  d2aba3e1af80edd77e206cd43cfd3129

                  SHA1

                  3116da65d097708fad63a3b73d1c39bffa94cb01

                  SHA256

                  8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

                  SHA512

                  0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

                  Download Submit
                • \??\c:\BOOTSECT.BAK
                  MD5

                  dde993c92d8efccd4e037b025ed90ccc

                  SHA1

                  52c179e1cbec1a04c90e47206dae43e45547e716

                  SHA256

                  a0b69d8f94916748588b86cc026bd5163b56dda9b1bb9349d53dc8de1d87ce81

                  SHA512

                  f41169015d22af59c9f6b675c61a8759c4ccc91b183ed0da27dfa56b5d3e2037bab8c35be7d258c12ebed9a2fab654c5de1ab29a05577118edb97dc53b108f18

                  Download Submit
                • memory/416-115-0x0000000000000000-mapping.dmp
                  Download
                • memory/1020-132-0x0000000000000000-mapping.dmp
                  Download
                • memory/1860-230-0x0000000000000000-mapping.dmp
                  Download
                • memory/1980-229-0x0000000000000000-mapping.dmp
                  Download
                • memory/2156-242-0x0000000000000000-mapping.dmp
                  Download
                • memory/2164-228-0x0000000000000000-mapping.dmp
                  Download
                • memory/2308-117-0x00007FF6CEA60000-0x00007FF6CEDEE000-memory.dmp
                  Filesize

                  3.6MB

                  Download
                • memory/2392-133-0x0000000000000000-mapping.dmp
                  Download
                • memory/2404-128-0x0000000000000000-mapping.dmp
                  Download
                • memory/3184-234-0x0000000000000000-mapping.dmp
                  Download
                • memory/3284-127-0x0000000000000000-mapping.dmp
                  Download
                • memory/3300-236-0x0000000000000000-mapping.dmp
                  Download
                • memory/3404-241-0x0000000000000000-mapping.dmp
                  Download
                • memory/3516-240-0x0000000000000000-mapping.dmp
                  Download
                • memory/3532-239-0x0000000000000000-mapping.dmp
                  Download
                • memory/3572-121-0x0000000000000000-mapping.dmp
                  Download
                • memory/3584-237-0x0000000000000000-mapping.dmp
                  Download
                • memory/3592-130-0x0000000000000000-mapping.dmp
                  Download
                • memory/3800-232-0x0000000000000000-mapping.dmp
                  Download
                • memory/4320-116-0x0000000000000000-mapping.dmp
                  Download
                • memory/4580-131-0x0000000000000000-mapping.dmp
                  Download
                • memory/4704-125-0x0000000000000000-mapping.dmp
                  Download
                • memory/4788-235-0x0000000000000000-mapping.dmp
                  Download
                • memory/5096-124-0x0000000000000000-mapping.dmp
                  Download
                • memory/29460-216-0x0000000000000000-mapping.dmp
                  Download
                • memory/30724-214-0x0000000000000000-mapping.dmp
                  Download
                • memory/34744-129-0x0000000000000000-mapping.dmp
                  Download
                • memory/37136-197-0x0000000000000000-mapping.dmp
                  Download
                • memory/37136-198-0x0000000002B50000-0x0000000002B51000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/41560-217-0x0000000000000000-mapping.dmp
                  Download
                • memory/42856-215-0x0000000000000000-mapping.dmp
                  Download
                • memory/43140-238-0x0000000000000000-mapping.dmp
                  Download
                • memory/47336-218-0x0000000000000000-mapping.dmp
                  Download
                • memory/67408-219-0x0000000000000000-mapping.dmp
                  Download
                • memory/78532-231-0x0000000000000000-mapping.dmp
                  Download
                • memory/78540-123-0x0000000000000000-mapping.dmp
                  Download
                • memory/78548-122-0x0000000000000000-mapping.dmp
                  Download
                • memory/78760-118-0x0000000000000000-mapping.dmp
                  Download
                • memory/78768-126-0x0000000000000000-mapping.dmp
                  Download
                • memory/78816-120-0x0000000000000000-mapping.dmp
                  Download
                • memory/78824-233-0x0000000000000000-mapping.dmp
                  Download
                • memory/78860-220-0x0000000000000000-mapping.dmp
                  Download
                • memory/78912-222-0x0000000000000000-mapping.dmp
                  Download
                • memory/78940-221-0x0000000000000000-mapping.dmp
                  Download
                • memory/79000-223-0x0000000000000000-mapping.dmp
                  Download
                • memory/79072-224-0x0000000000000000-mapping.dmp
                  Download
                • memory/79076-199-0x0000000000000000-mapping.dmp
                  Download
                • memory/79124-200-0x0000000000000000-mapping.dmp
                  Download
                • memory/79144-225-0x0000000000000000-mapping.dmp
                  Download
                • memory/79164-201-0x0000000000000000-mapping.dmp
                  Download
                • memory/79184-226-0x0000000000000000-mapping.dmp
                  Download
                • memory/79200-202-0x0000000000000000-mapping.dmp
                  Download
                • memory/79220-227-0x0000000000000000-mapping.dmp
                  Download
                • memory/79232-203-0x0000000000000000-mapping.dmp
                  Download
                • memory/79264-204-0x0000000000000000-mapping.dmp
                  Download
                • memory/79296-205-0x0000000000000000-mapping.dmp
                  Download
                • memory/79328-206-0x0000000000000000-mapping.dmp
                  Download
                • memory/79360-207-0x0000000000000000-mapping.dmp
                  Download
                • memory/79392-208-0x0000000000000000-mapping.dmp
                  Download
                • memory/79424-209-0x0000000000000000-mapping.dmp
                  Download
                • memory/79456-210-0x0000000000000000-mapping.dmp
                  Download
                • memory/79488-211-0x0000000000000000-mapping.dmp
                  Download
                • memory/79520-212-0x0000000000000000-mapping.dmp
                  Download
                • memory/79552-213-0x0000000000000000-mapping.dmp
                  Download