16a3f436db1c927959d14daf75cf80bda4d583f429d50dbf72a5203415fa78df

Analysis

max time kernel
6s
max time network
18s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RyuSAK-1.6.2.Setup.exe
Size

85.7MB
MD5

c3f7aee30a8a374ec9d34e175b4e00c3
SHA1

a5c9ac0d289adbcafd1fff10647a40115f164d44
SHA256

16a3f436db1c927959d14daf75cf80bda4d583f429d50dbf72a5203415fa78df
SHA512

63ee86604a2d067fe2059b79f1e0ba87759493d31c9fd481404ba616d1a114b7a1131fb70cc25859dfbc391ada566e776614687f143f6ef9d312cba5003493e2
SSDEEP

1572864:DONVsmiT1o3Hn6SXrjbtJIgGMSmbCF5HE2lYAk9Os6e08p62EkWERZdjvu14ZTuk:DWFiB4H6SbAgGMSmbaHLlYDn48pNndbJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2900	Update.exe
1820	Squirrel.exe

Loads dropped DLL 1 IoCs

pid	Process
1920	RyuSAK-1.6.2.Setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2900	1920	RyuSAK-1.6.2.Setup.exe	28
PID 1920 wrote to memory of 2900	1920	RyuSAK-1.6.2.Setup.exe	28
PID 1920 wrote to memory of 2900	1920	RyuSAK-1.6.2.Setup.exe	28
PID 1920 wrote to memory of 2900	1920	RyuSAK-1.6.2.Setup.exe	28
PID 2900 wrote to memory of 1820	2900	Update.exe	29
PID 2900 wrote to memory of 1820	2900	Update.exe	29
PID 2900 wrote to memory of 1820	2900	Update.exe	29

C:\Users\Admin\AppData\Local\Temp\RyuSAK-1.6.2.Setup.exe
"C:\Users\Admin\AppData\Local\Temp\RyuSAK-1.6.2.Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\Squirrel.exe
    "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:1820
- - C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
    "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --squirrel-install 1.6.2
    3⤵
    PID:844
  - - C:\Users\Admin\AppData\Local\RyuSAK\Update.exe
      C:\Users\Admin\AppData\Local\RyuSAK\Update.exe --createShortcut=RyuSAK.exe
      4⤵
      PID:2508
  - - C:\Users\Admin\AppData\Local\RyuSAK\Update.exe
      C:\Users\Admin\AppData\Local\RyuSAK\Update.exe --createShortcut RyuSAK.exe
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
      "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1020 --field-trial-handle=1200,i,14210741349706495944,1989596432218473210,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:1320
  - - C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
      "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --mojo-platform-channel-handle=1364 --field-trial-handle=1200,i,14210741349706495944,1989596432218473210,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
      "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --app-user-model-id=com.squirrel.RyuSAK.RyuSAK --app-path="C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1520 --field-trial-handle=1200,i,14210741349706495944,1989596432218473210,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:1304
- - C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
    "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --squirrel-firstrun
    3⤵
    PID:2548
  - - C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
      "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=984 --field-trial-handle=1164,i,17586814714825726572,13633037577224803403,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\RyuSAK\RyuSAK.exe

Filesize
370KB

MD5
e36e4bc4cd7dd5fd5cf11120cafbe9dc

SHA1
932710d3ff08ee42384ef592d642aa5a25cb29ca

SHA256
2ed56db62668f0da700f294047eefe5d516dd40b1af151524d210b4feee74882

SHA512
7b40089b99e43b4aa193185b79cfecc1c725a8fdb990af5d05aeb72f3d1b6b940e6f62de3b20479f896dfbe153db058922cd43ae5e214a1160940e346a084e87

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\Update.exe

Filesize
470KB

MD5
d1f77f47898c8c4d55ba99b1ac6df4da

SHA1
107d385b34bf34cff99ed31c93d396e7b3c0c69f

SHA256
725647222cc228ef55648c7f829501fcfcafd81387e01557061698b8e25287ae

SHA512
cc3f66c472a73e9a2ea214b3bf46c18a59a76df594eb11a7ecf5838ae9c12574476ae2bffee08956f82fd1ec537df0904988248856df2875d45b259725e9bdc4

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\Update.exe

Filesize
219KB

MD5
a26456e3b3176575c256d5f533e6f1dd

SHA1
4459f3ad4076d24606ddc1f8e747778545b14f32

SHA256
68e096de5961bc827db92a5a00d44fb626ba32229888e6828f479c58ebc74a27

SHA512
d82b4f6f813515052f3e07f75a48615cdc936b0a951c08cee12fbd26725e72d1641699913eafd411a28d2f1a23959ff4cd63ae4816b220ff95b1afcf8159727c

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\D3DCompiler_47.dll

Filesize
39KB

MD5
703ba55e3d06beb2a6aac5a30b884c96

SHA1
675d2fc9484179813f0b5a7b5fd8751278d9ed78

SHA256
6871afe03b776742ac99b26f3401eb6333458d41129d443db0e109decb17ba14

SHA512
13be806af01686ad58ed63a75d556d2389576eb7fd2794fd19d98cc6cd7fa504e1855e69dfa89676aca8aefce73bcaefcc5613c4fae549ab49da534dc9196a27

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
379KB

MD5
33ef486de85b11fa89ba1317c0f5bd3e

SHA1
f69e9da16016f7c2cce96207470b9bdb3f221231

SHA256
ad21a12b52c02abd9664082978daadf8fa7166ff4bc991abc7401c1a5856b657

SHA512
47f0674eabf95d2a5275a9885b50192e1377de252d1e73b28194bfb5a9882caf9c353e4d521fc9b74a3644eb77def5082d9328cd2abec25eb6133a0223f6bb5a

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
391KB

MD5
a511806bfa934dc6f564ae919151f453

SHA1
616aa054a41c6d3aa0b68ddc00419da21592bdaa

SHA256
5bafc1f08c6945a1f9e1c78bd0a0c22507e4bfa41bf0f4fe12ee01ccfb65f410

SHA512
b88031a64ead72d69e14486080b288954d87bbf7968eb6fe2471b9f161e467f36210f37bddd25b191eb77569b1602fd479ea960955ca665a217431c7734404e3

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
477KB

MD5
574e5e147956ae6beeab19bf9f6c7ccd

SHA1
81fc201a928f2404cdc23e9e4c917bcb0dfe2439

SHA256
ddb1a45573a6c5fe40553735518c266f661e54640f2fddabcb8a71bc9e239b45

SHA512
92d1643342441be4f273b8705e76f349f7c178a3c8c2df9bb0d1c816e0448c2da18ffd7c70952e23a6f3fc3c0b79c2734d4f38ccb4c6c52741b1b0701a4520c4

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
465KB

MD5
0506fde38adc26406cea36a5db08eb4e

SHA1
da33e3828364c6823448e7314e71760ed47d7db3

SHA256
672f62dc81f19a2456f9d6350a3ef50ae83cd95f0f7528f038c2885bdb73f4c4

SHA512
1352de1a873984c8a79a823a6eb17118d81f4390a39583e5a2d44f953a6549e394e044ceb3c39ecb482b142ded4aadc07f71263025df78ba9550e5a7f7823ccf

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
374KB

MD5
9ab537f2c4e2203e0c121d4e021d998e

SHA1
be3c3d0c835d0b1a3506944ef88f3ba8eb8ab2b4

SHA256
06c15b8e9c8dd749af6501eabbbb1c0a2f185ae68dc4bc38e77861f21e694e24

SHA512
ab77868e5c814c9db7fea1ea371431b21ba7b25cc211248e0949e8f44a89e0da6311d0333121f1a0f03d54746029941843cd8760d993ba6febcc6e7e6ce88458

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
138KB

MD5
68518280a937e135b75c78289d0cf258

SHA1
3289d34f02f29fe06082b5e0f86b7cb61dd555ab

SHA256
f17c26bf7dad8a9ae4553728faa6c92f9b778a5914b88d834a09803fa7e4011f

SHA512
5d9568487cfdfb406493cfecdff5e7dcce10145c5d2aa1fe44cd990e2997926dc44df9633eeb4cddffc310b173c43f481ad02060aaf239b476b81321e88c5a59

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
228KB

MD5
d92da02cd2bdec7f48b0999935874593

SHA1
fe54e0213d093174e7e20a62493a3232b64d530a

SHA256
edff10679fe45b5f6a0ec6ffe2a0de1e4842ea1537c4d1e7ce34df74d90311fd

SHA512
86f91056d851123a571eecd9c0e3823bde99ba6504d75636da20a4ba0a9ca0a76fa4642bfe55116f357a510616e633bafd5fb92ca17efdfdab7e111affc2a331

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\chrome_100_percent.pak

Filesize
145KB

MD5
237ca1be894f5e09fd1ccb934229c33b

SHA1
f0dfcf6db1481315054efb690df282ffe53e9fa1

SHA256
f14362449e2a7c940c095eda9c41aad5f1e0b1a1b21d1dc911558291c0c36dd2

SHA512
1e52782db4a397e27ce92412192e4de6d7398effaf8c7acabc9c06a317c2f69ee5c35da1070eb94020ed89779344b957edb6b40f871b8a15f969ef787fbb2bca

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\chrome_200_percent.pak

Filesize
214KB

MD5
7059af03603f93898f66981feb737064

SHA1
668e41a728d2295a455e5e0f0a8d2fee1781c538

SHA256
04d699cfc36565fa9c06206ba1c0c51474612c8fe481c6fd1807197dc70661e6

SHA512
435329d58b56607a2097d82644be932c60727be4ae95bc2bcf10b747b7658918073319dfa1386b514d84090304a95fcf19d56827c4b196e4d348745565441544

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

Filesize
690KB

MD5
cc63f87fe292f907707616c790cfc154

SHA1
3e74983cbb0d207bdae9b86f29aeb5905d5b9c64

SHA256
d88edfd4648a0547301a25ea95d0f109f798e6796a304feadc63700162cbe80f

SHA512
b2278500f2666f734da46628f46c7340382e0d3bf171dcf51beb41a6f8dedeb605c6e50110607802a4b2071f866209947727630de6d9a5cff87949bea89dea5b

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\icudtl.dat

Filesize
695KB

MD5
1b3538bc010a739f9199cebbb2b454ff

SHA1
32125c71344b03c5f7a5ceb3051ee34b689f9d71

SHA256
0716f793d6047bc8fc378e325ed4dd00d23aa88928865794905f29cf89e35356

SHA512
9b49e42466cc92dd4317f779f598bf7e6095e3a0391260f364e9c423b36fbdac79934ac31dccdcc8e2083c421339a15c356d78925e42cff1941c07e978763005

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libegl.dll

Filesize
254KB

MD5
0fcd45a70cb077d370a465bea2f95844

SHA1
6107393ec568418158b8626deec573361d27fcfb

SHA256
563035d2ff3bc0748487db9393aeea84344cb047399b7f2231fd565fe912f9a7

SHA512
1565e3a217e7e20d4f35d6495fa7c87bbac75548868261863ff6eb3370f114743112388851837a4c5ea2d2e480b956f1da46209df0bcda90180e24e9bda4e244

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libglesv2.dll

Filesize
384KB

MD5
8e3c47ea422294df050bda70cba1e338

SHA1
7c30783b82fd4f11d90cae8535d6d614f5cd2ed1

SHA256
f5e595996f7769889642835dd1193e46ee00c261d5719f0675dbbd030699a607

SHA512
bdc29124fd761e7ffa97e08cc8cd998fe75b796ec86a9a2ef0c32e98091d90620af5be7a92192843c84e03ea1c67c25b61c1da4fff0311841bf9be7b43889236

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\locales\en-US.pak

Filesize
114KB

MD5
88b9e849c0035cb100d031fa5e3fa0b4

SHA1
3576e0fa589e53ae36d2b75937bd3c5c0ab8dbfc

SHA256
25462802f57f52581d34d67df00f7a4d62cb5ee5ee0e5e853f48ad9caf04dd89

SHA512
99e8cf196cd9098adf74f569d06043809454860f8f3de9e942f3ce3c2faeeaa3d6bd0572503cb6c2a6b932aff9aa7e4542501731693ec6a015cc7282af388e8b

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources.pak

Filesize
130KB

MD5
da6fd9fcb9d5c7175c3b8e4c07f61ec7

SHA1
f38a04c65e238a83ca621517505965060a50ed4e

SHA256
2ffde7a262b86492dae48c97fd46c3ea5ad59b2ae769b11710851ba18473b316

SHA512
d9f4cb57a57dee9f53ccc202fad635b159ef11e606ecf30d2e71551589dfe0c93d2e10c9a45999922b3369124033a43809081a8b7c728dd0cafd62fb3b243a21

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app\.webpack\main\index.js

Filesize
163KB

MD5
b5abd2687696b08ba4d4fdebab84f6f4

SHA1
9bd89f2358c4c5a9ca54b211090d9e86ba89f0fc

SHA256
de358566ff12466d623c935d26336b219f87ea67b947431f4ba39d12d7d3ed03

SHA512
c448da5a20546d5169e004d5ff234fc4cf31c401a2aced4cc9c5c5504744daf3dce24431474faa6d17848a28fd0bcffc2147bfee1d67ca3bff9d1115547de24e

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app\.webpack\renderer\main_window\index.html

Filesize
2KB

MD5
67e6093f6b62c6d017d33d28036a3166

SHA1
4050fb2c190321d318601cd204018d46b7e453d5

SHA256
e50a7f99e87068a8a36487fd6214807f6df6680992142f01bda05c3af3f2bcce

SHA512
91cb4eea426a583762c0285641fe0faa879a6215a4489da02ed9b441e642dd58405bfcdccfb26dc2855228b940908f6709dd922a1878099fd80e254fcef9a982

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app\package.json

Filesize
580B

MD5
4148561ba39bac1fbd00ad66737a65cf

SHA1
8cacbf61b46f0906be91d3780d78b82f55f8abd3

SHA256
d69c70cd8fd705110c82953921123c1512ab371461ac42968343f1c62455d0ca

SHA512
a825c8de2499cabe80e04e0e7f2de16edbf88bd010b486d43ae40dc1f20a105d3dd5fb678bdf483849009856d850e8650ab90066502031730c5f96d722c44f1c

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\squirrel.exe

Filesize
2KB

MD5
553d3a58dcdd1672f5a1f44a4086cef4

SHA1
a1ad4b0a5cccc1927c2129de14de21372350f221

SHA256
d129eb1ff5defc7484d47fcd77976ab2be6dca5c76dc245148a414884d2eb713

SHA512
e82f8fbcf40fb1ac953e3e6bf2810d7e434e6058f25dbbe0dae879a6ca198f0bae196e21740e7b1993ab3386bdc6413c381ca6cd2d9725bc4d6e4a95afdf7dec

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\v8_context_snapshot.bin

Filesize
373KB

MD5
5333f7a34fb06b45dabf49fcbd5cf7d3

SHA1
a0c0583a4240504e60f181e25b69da439b888128

SHA256
267829c7f3581ad87697e817d4876c9f2416e56820c472e8822af6514fb08a70

SHA512
259d50f6801d8739c199ca6b72810b9dcdd198fe0a82a9d3a65e3e38edbc8d058a6a86ea59810c69947e7cdb6574ad2e770320999becab96913af0884ca6eac1

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\packages\RyuSAK-1.6.2-full.nupkg

Filesize
186KB

MD5
c6e94abe1730751ba5607780fd791ace

SHA1
d0c7be941adf7193147f0c013bab2019bc3887c1

SHA256
7050c85645afbbfbe94387607f6e292f7a5080482cab66753b56ffd7fc6ac72f

SHA512
436c160cdf724fb83562e1e43c39af8a2fef5ab70b01347e010b43d48d7f8037294c6e27fb273424e5a1b2ae0e41100b1d95fd214a66effbc4854bf2707b54b7

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\packages\RyuSAK-1.6.2-full.nupkg

Filesize
471KB

MD5
0d6e7229385ed5eeb35c85d144dc4654

SHA1
32634bcd60e098f07ff70d2801d689719170a52d

SHA256
006a0d66fa250ec278cb4b6c4a2befbb5295a5f447cac550dbd544f21a50dd59

SHA512
efd2869437cd378fab23d78be05932c02f17645c9c46458457fa6d199dc6cc3c8f50eeedc9e531ab2ba1c36eff6f80ff44a6aa6c80c33c31ed598c727be44b23

Download Submit
C:\Users\Admin\AppData\Local\RyuSAK\update.exe

Filesize
235KB

MD5
cdbefb6cba7c7f071e78bb51535b4e28

SHA1
e16b37eae229f7c3707564cab383c1c34b7091b8

SHA256
448e4ff5d017df95d9790f59f4fa013012a88668d6bb21b4fa7a158f0fc50cd1

SHA512
73b81b8a611f4ec8524035e8af4aee053846a4f6eb332863a80f3160bf36c99c107031a54c7010862bac6c4d05724e00c4bf415bc26b5d97eaf245b81a6050d5

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
76B

MD5
923a27e130ba04644aa4dda3d5076743

SHA1
bfd471cc7e25efb2033654fcd97ef59a85c4e361

SHA256
b483e74dab632b12e8c8a109a122e0a052f2bc837f0fff7a7e6e81397026606b

SHA512
949166d552c3dc16fa71fd2de2d8a645d54ec571067281abab9e38caf06ae169f2d7866dcb6a2f8aa03fe560c7adfc9ee5b891993c5c894fbc1fb8d6cecc0d08

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RyuSAK-1.6.2-full.nupkg

Filesize
23.6MB

MD5
7c2967d3d46603f4003da142e89bd6a3

SHA1
ee33383dac1704813b4921fc8d72662fba4d0e54

SHA256
279bea0a01758bf203d4b3e3cf9cc1322a63a55b8b428474d9ef9f8a3b43afaa

SHA512
17fb06dda6c1fd59174a45d5d39998efd0f3ab5aadc376cfca105cc5f2dd33f83609f521610e7b025bbab8a08930a42b4b803c9622ab080db7d301b5614a7561

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.6MB

MD5
aaef52f57960e288d163d5a3e896d80d

SHA1
be083f0da03ca05b712045105354481fcbb2fe31

SHA256
1c3bf44b4d537d051ffc33036e43ed71de21dbd08f930be7016c743759614aef

SHA512
12fa52d631dba06c46efbe866b2018b9ae502683a745858cf17667405154c6a5684ec75c1da40bb938f1d4b3f1d715db4d27bc74fcf2de74f104ffe1bea8d165

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.2MB

MD5
d8d7d32e4bb7e338c2c6db8ff464c246

SHA1
0e180475810d05efadddc44e31c93c746284a234

SHA256
2f34fef9d224492a77f99d3abd4be97ed64ed08f415a0848a68f0e1e4462f48b

SHA512
8de4cd7e189b7ae5bc73a2e91ce85d767728b73e1828487178153743bf9975d8a87666160e29e629dcb32b1262bed1b1f63670fd54832b80fa8a01573825e727

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
43KB

MD5
b5a42ecde0b058b3c4e661e0ec84400b

SHA1
7e2bfc653c5bc6997553c150a0823daae372cd99

SHA256
ce636d201ef86ffbf4ee8c8762b4d9dc255be9d5f490d0a22e36fe0c938f7244

SHA512
b7f4a7bddb226066f7edf23dfb9bee658c30ae03dfe727ec739f51fd98c63831f732343c14a6ca080f31baed38bf9064cdd57c9d1daaf4c42c029fe83d846dc0

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico

Filesize
197KB

MD5
bb75cb0c041e4060c0db4ed0c5d17c96

SHA1
637aa5403144639923cb41cc7a8b26c28b66a439

SHA256
92a5dad587f1cbbcddb9c751177b07590bb1b32b91e97dfab3b05858ea5fc387

SHA512
4b033661d032010feb55814379f740992e0278297d856478346af9489e341d0615bb85f9124d87b641c5260b0ad7d5b758c650fe2ea27253a4a30c5bec8c29f0

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a43d71fbb8e0803588f741eb838230c3

SHA1
8a7f7734ed0a2562556753492eb521b90bfa0315

SHA256
7784001623c8cefe8795097fe2a0c89b5505635c730dde0e7aa7e511a85eb91b

SHA512
f1e94358069a4c9f342f1d600b7c20957d44aca616fcd9f986244f60b75e3730bf0233a14c00f2aaab7726c133bdb162a5df187a106ae7a054e240b97d13306d

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
c1d25db7e05f3aa26f209eff82fb0d23

SHA1
8d2471fe1794cdd37b39481199437cea13a15a9b

SHA256
090128786fa8447d65306cb477edefaf31f719742813c0fe260226da170206e4

SHA512
93ff0db72fa32e388838bad41ce9dd9196fb3c7669a2178d12b4cdf1f1a202c5a12e2c2d0e7822b693d36bc76c74446581cea1523f89d7040a67b3cc5285a446

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\index

Filesize
256KB

MD5
8981722863b09e3bb8b44eb458d0c959

SHA1
ad929e1962e50bc5daa82c3b3372f995f590b13e

SHA256
ebf396f087fbef9e203c75821666706b3b054ea3b5e45824ac37b158efaccfb3

SHA512
0ea01613b1ef561065c7364ea6d6740c952b940ff94c4ebd03cf59ee5042cf21d8dad2cb81e6f2cea94b91e4228a1ad59b13c7906fb3e29dd3cb74bc68b6616e

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Local State

Filesize
389B

MD5
1b3c150ce1a94465e694a8a8aa6706f4

SHA1
15d2f210213269175acbae6a9ab6d14a4ea71270

SHA256
c13d9c839f10e19a73a7caf2926130625c07134b19b0ffd12e8dd355cb4e44e6

SHA512
fb198f451e5cd19e10b69119b23124db63d50137fead3b3aafa8dbaabf72a38682025c09f9921b0c7f97d041b1d909dabce8ebd6752f86b24996fa28c2ae18af

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Local Storage\leveldb\CURRENT~RFf763c26.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Local Storage\leveldb\LOG

Filesize
167B

MD5
9909325bb91336c981a0d3f51dbba267

SHA1
a14775a857026e6e3e62b4c6fc47fbd28dcbb0ec

SHA256
3033e5f02df23ef5b6080e9208525d5cade7f9eedc545055d505901b0a92e8ff

SHA512
fea2f9110f580c0b5810932c30b837195f8ca1d3da66d27d18ee3499255fb2685a764aa1ddf30ce97b71bf72214534a9f7fee1a47b4d9da2d8336f32edcdc384

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Local Storage\leveldb\MANIFEST-000002

Filesize
50B

MD5
22bf0e81636b1b45051b138f48b3d148

SHA1
56755d203579ab356e5620ce7e85519ad69d614a

SHA256
e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

SHA512
a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\RyuSAK\Session Storage\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\Desktop\RyuSAK.lnk

Filesize
2KB

MD5
58f8843215ca5b8404329d2948fc5bc8

SHA1
f2eef8e87f96cae7ced487f62ba5e5ad1b40134f

SHA256
e0d03463cbcacc661e1e9b1e3d89904c6828428e468086a99864e13a455b21eb

SHA512
862ea76b464113aa1aa5ff84d381e80333fc3924483636e3f959d51ab1d98f7f89211599724693c9c07f4f35e83c9c8bc09bf92c697b845e65a2a7182690181b

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
796KB

MD5
e93ab1d6c97cea189a24752a08dda2d0

SHA1
12bc9dfdef1ed82ae60e6d9d20a9e8431ff26c0e

SHA256
ec63a5b1197f26ba50b023cce6b85cb39a21c844aa16b4548552957fc7a02785

SHA512
aa567aa462ceaaae5a34c855a0c2309709be75a5cb2be5c07a5797b06d7fb4f084ccc0756919a35264b5be1aec0f71f8a5acc0fd2b0f2af2f87bc5dfd702019f

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
571KB

MD5
9a2f52980ebaf9ca4c99b1f01b3b7bbe

SHA1
ae664e79db3dc0ee9559ffe5efe6b9864ee795ff

SHA256
da52c8d8df86525c01dfdd89604b6a40f7e549b74b2fffc3a6e309a09ff1ab82

SHA512
faaca72f92fed8546a522326f6daab14ecd5bfc53ec880cba406a7baa4e348b466aef40a2ac4418b68b0dc2ea208eae24f6bdf574d0dc6cb4f8d4f31514a9bdc

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
631KB

MD5
7c7288f6c3a56dd674708d401d97e770

SHA1
623a0e07f6893d0e1a68a6b048c1020fc3cb0a2b

SHA256
4641e2dea3903d1aaf8a461eed116894a3b86ae723dd7469e82bf646faf01f65

SHA512
db31e5b451f8a377ae95630baffcf6e8214e1e600457ad2f2af504f42e6404d0b666cc0909f0f153593f81ecda4ac0125eb13f782e9de00c738df2ffb3522356

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
455KB

MD5
b78f4b915c24f341bc69477aa7a22e5e

SHA1
afcfc5397939e29d2f8960df48e075676196ac8e

SHA256
114f13bb6417820fb39ce22103cfb15a633da383466c6734bf451c3e509386dd

SHA512
138bf3c7c9a0b627b3d3686b6907ab4247cd489f7be3c1329aec20ba57af97c4332cc2cbfee07ea7805df8995b59b87ee5a53b1d395e9e01dbc22d70a6b97730

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
448KB

MD5
57c49414a52be67336d6ae3ce447d408

SHA1
3cce10e84a57bacad6f0a1c19727f835276e2121

SHA256
2efe52265dca78df3331da7b8cff16ce9fe82e21e05a59795258193d278c31b0

SHA512
9fb5384b326f0be08c00ed2937663bb969ff8908b5635b4ff72d6f2e86e01ce77e087c45637b939ce23970096017cd3c2fc686e3a9970fe710848d6f59bf4003

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
60KB

MD5
662379c0a7bef57451e7dcdc50c21879

SHA1
1451042446520ae599720d2487b8f173a3318f4d

SHA256
7ede0c45c19bbf543efa153276c42e4b8223fbd2777d31faa02ef40f2e2f63b4

SHA512
11f64d4851614549984892d430e103aed198c20a817c79858a90b019c60a57ae25195738ddcc5664e13ab5252590337c621a45c674ec72f9c9b587c434abe5e8

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

Filesize
20KB

MD5
5b0bba8dd89ea49f13b97a70b8e72e0d

SHA1
716ac8bb93247ad8c81acbea4cfbd2349035aec6

SHA256
74dc78de75787b4f17bc379c0c7f0af56c43efbd4aba1620b5b99b34c3189426

SHA512
4dc54049f37df5fb1a2235b0ec0b0d66886f39e084349c9c17211439a8a745f8cafb6a5a60264931ff78d9ed0f3baf7cce2cc3db65ee98452bd4da347384cd0d

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\d3dcompiler_47.dll

Filesize
73KB

MD5
5c36a5eca9d79e5df5910794c1c68256

SHA1
546580500dc358375729df1bfc9407cceb03f721

SHA256
a63996355962ee938c5f7d996f43f4fc680b7d62de3db54567076c0f11e6e902

SHA512
3efc621c3d10a150212231c7755be21601f82856a55890fa534da6a3d8bce34a0b4e00e7d4f5b008391e44059b13332a4c0e32c7cb524a3e3cb2da0852eb77b6

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

Filesize
559KB

MD5
2ae4167e6eaf87324e3e389a3d2ac825

SHA1
e09612c0f4d92023c3a171aa25247af7a06e6282

SHA256
c9d19c749032ffe5164340dc2a5992887c2e7e86bbe6ce2c1585b0a2f1804e2a

SHA512
680e341937413569c80eb9b7ab2dbf1d44c93691ddae7039910a6e16df6d6c07945f4328bd7c6c68aa51b893cf3f7c9089d83dcf3e5209e370f42af084a3f7d4

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

Filesize
382KB

MD5
5353f5350a7ded66ef05eaf878987b35

SHA1
717b675c49c26921d39991ad073a7a5b1cada987

SHA256
098cc0f97df5b71c208bf67dd61d5b1abf7fbd7002501797b63dfabe52033a61

SHA512
89a81540d2811769754949477adcd30e370bca57debe0194b5845329d2b08b911a08f41afc8845a10e12ab6a7b857dabf21aab51a353ab69a2e6f8e656e09380

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

Filesize
378KB

MD5
557dcc007162e858a603c97c42badef1

SHA1
70d1bf7b0129d37fa1253820945096fc8172beaa

SHA256
8c864d4f44f02fbb4d1466375fd27b69367dc5c0cdf85771f8e0ea23b92a247f

SHA512
34addb1c29dfdda9bdab082e67f7b29fac854fbcea068146ad97180edd9bade02bb3dcac43c2746cbf9be2dd96853ed573c39478dbbcbea089ce4a7154158c6a

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

Filesize
61KB

MD5
068c3aacefc09c53123d7352b4cede25

SHA1
d390eb971042c5c15d77be757edba2f630d7f670

SHA256
f9ed8ebd3970523e7d197a6eeb8f4bc36593e861a92b2f7b35243bfdef128751

SHA512
c8c136a4f042bb08b6e0e2a02c89dc270e7b967149bb2c2b6c8916d722485095299506a8e8a6b235584eb8d6dc291c38330ed019887635134cb554e7d553f205

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

Filesize
335KB

MD5
573a4321e446b6d983ce9ecb98181802

SHA1
b88d47f187b0c570490e974f67e52aa44f495723

SHA256
795b9bfadd8cf42b1410931296466599f05a84af53c8ccc8eab5af8f9ecf397f

SHA512
d38290ff7e6614804e810e323e113f7eb1b3c8461a7919b2a340940859384339f2f55b6b01361ebfabc40e743f125c360fbe1cd1286f39f8cd67db6cb2e5ac16

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libEGL.dll

Filesize
361KB

MD5
897979631b08e80cbe0e9f186403c1e9

SHA1
a24a027b1dceb344bd1e0a22ed26c550658f3bf3

SHA256
9d5f03402d1fa65731dd0e070e8517186bf20f6115cacfb6bb506b5cc5f84a8f

SHA512
70723fcafffd25c4bdc3a259f3e5e16c5edafbf181f27a958f95b8ca3173d85cb7933e54e2d4e7804cdeafdd039c9e08872b5b0ecb8c228fdddb9d21d21c94fb

Download Submit
\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libGLESv2.dll

Filesize
220KB

MD5
6ea76b50b69c7a8cc77e328f125c6c36

SHA1
389a144102241ec43bd9c3830632a38a0931ada8

SHA256
c878ba8477963964560c6867de66345b6134523ad01cee704272dfc9623786c7

SHA512
d103c314420f9bc912764fbabb998fce7c5538afe8bec1d84b809d83d6ee8d1f69b39ebb6a7c871e7b8243ca1906fe92f60c88236c718026c388ce20cbe0309a

Download Submit
\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.6MB

MD5
3679fd4945b045b4911434d1b354c212

SHA1
009bb9096d392eeeff29b00425e3f44f98cb2989

SHA256
f2b1b0dafa731ff43c72a19f6fd183a5cb1c96f5fb446a859c8d9d8b62bffadf

SHA512
792c4dde6bd86cb2a16fcc21ca277c518b72b5021edd8ac1604e0fc83b0357dfcd764e1a735ae9cc0db551015876eb1c1ead98413f0931a79884d8414b42f793

Download Submit
memory/844-222-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/1320-209-0x00000000774A0000-0x00000000774A1000-memory.dmp

Filesize
4KB

Download
memory/1320-177-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1820-337-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/1820-145-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/1820-144-0x0000000001380000-0x0000000001588000-memory.dmp

Filesize
2.0MB

Download
memory/2508-295-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/2508-166-0x0000000000890000-0x0000000000A66000-memory.dmp

Filesize
1.8MB

Download
memory/2508-175-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/2508-170-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/2548-324-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2684-251-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/2684-179-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/2684-219-0x000000001AEF0000-0x000000001AF70000-memory.dmp

Filesize
512KB

Download
memory/2900-159-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download
memory/2900-12-0x000000001B830000-0x000000001B8B0000-memory.dmp

Filesize
512KB

Download
memory/2900-10-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/2900-160-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download
memory/2900-9-0x0000000000C00000-0x0000000000DD6000-memory.dmp

Filesize
1.8MB

Download
memory/2900-325-0x000000001B830000-0x000000001B8B0000-memory.dmp

Filesize
512KB

Download
memory/2900-334-0x0000000000760000-0x000000000076A000-memory.dmp

Filesize
40KB

Download
memory/2900-323-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/2900-333-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download