Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4s
  • max time network
    78s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 04:35

General

  • Target

    RyuSAK-1.6.2.Setup.exe

  • Size

    85.7MB

  • MD5

    c3f7aee30a8a374ec9d34e175b4e00c3

  • SHA1

    a5c9ac0d289adbcafd1fff10647a40115f164d44

  • SHA256

    16a3f436db1c927959d14daf75cf80bda4d583f429d50dbf72a5203415fa78df

  • SHA512

    63ee86604a2d067fe2059b79f1e0ba87759493d31c9fd481404ba616d1a114b7a1131fb70cc25859dfbc391ada566e776614687f143f6ef9d312cba5003493e2

  • SSDEEP

    1572864:DONVsmiT1o3Hn6SXrjbtJIgGMSmbCF5HE2lYAk9Os6e08p62EkWERZdjvu14ZTuk:DWFiB4H6SbAgGMSmbaHLlYDn48pNndbJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RyuSAK-1.6.2.Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\RyuSAK-1.6.2.Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      2⤵
      • Executes dropped EXE
      PID:4708
      • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\Squirrel.exe
        "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        3⤵
          PID:5052
        • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
          "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --squirrel-install 1.6.2
          3⤵
            PID:3032
            • C:\Users\Admin\AppData\Local\RyuSAK\Update.exe
              C:\Users\Admin\AppData\Local\RyuSAK\Update.exe --createShortcut=RyuSAK.exe
              4⤵
                PID:4344
              • C:\Users\Admin\AppData\Local\RyuSAK\Update.exe
                C:\Users\Admin\AppData\Local\RyuSAK\Update.exe --createShortcut RyuSAK.exe
                4⤵
                  PID:3712
                • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
                  "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1792,i,228330342890028415,15380112850732162868,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                  4⤵
                    PID:848
                  • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
                    "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --mojo-platform-channel-handle=1924 --field-trial-handle=1792,i,228330342890028415,15380112850732162868,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                    4⤵
                      PID:1296
                    • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
                      "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --app-user-model-id=com.squirrel.RyuSAK.RyuSAK --app-path="C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2256 --field-trial-handle=1792,i,228330342890028415,15380112850732162868,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                      4⤵
                        PID:3304
                    • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
                      "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --squirrel-firstrun
                      3⤵
                        PID:2940
                        • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
                          "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1672,i,9965649475638038624,15077007987123438127,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                          4⤵
                            PID:4152
                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
                            "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --mojo-platform-channel-handle=1852 --field-trial-handle=1672,i,9965649475638038624,15077007987123438127,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                            4⤵
                              PID:3080
                            • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe
                              "C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\RyuSAK" --app-user-model-id=com.squirrel.RyuSAK.RyuSAK --app-path="C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2004 --field-trial-handle=1672,i,9965649475638038624,15077007987123438127,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                              4⤵
                                PID:4112
                              • C:\Users\Admin\AppData\Local\RyuSAK\Update.exe
                                C:\Users\Admin\AppData\Local\RyuSAK\Update.exe --checkForUpdate https://update.electronjs.org/Ecks1337/RyuSAK/win32-x64/1.6.2
                                4⤵
                                  PID:3152

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log

                            Filesize

                            1KB

                            MD5

                            fcc4a55e80568c4693f6d2eff7ef757e

                            SHA1

                            d24958d197482557722f616507d8b14dbeadebd8

                            SHA256

                            1f5a1b10b49c35bff02f63ebaf8cd3faf74b51bd131d3dcfb952590c8bcd5eea

                            SHA512

                            67de4502abff297c90eb2cfbb3d03bfbef3400d6ee19b3cbb47b3ed9bad4b795946406a6975564321edff618d1a589076b57609c2ca38efc5650899a8483a271

                          • C:\Users\Admin\AppData\Local\RyuSAK\RyuSAK.exe

                            Filesize

                            72KB

                            MD5

                            52eb1ec288565b55272a29d4399c0e42

                            SHA1

                            f93af598b7b9352eaa891099f26c8516bac3f8d3

                            SHA256

                            790214af3b8e68901b51f69c57dc5f6fe2da5999a9d4fb15740cffaddbe56e32

                            SHA512

                            f717968673cff0b4bfaae2a7f6175cd72f2a244a85ccad0ae0251392f8a6a045e83ea411efea0ae79e165d653523d3459417ba3a9bd7bacb6413613c831e68ba

                          • C:\Users\Admin\AppData\Local\RyuSAK\Update.exe

                            Filesize

                            981KB

                            MD5

                            d4ba7eceaf2a3da115a94436c3a7dc26

                            SHA1

                            c796b04fb2545a1f41f6c5c68ab2917de43b2f46

                            SHA256

                            0c067ce1cd6df8ff45d59210377e69c6c92f58485b61c1ed23fb7786dc769f49

                            SHA512

                            5313850916eb4cfe4f9f098a0e3eee9c0d19337c7769ff0954f29a5aa8d3deecd760afdcb3958cec1877bb252fea0f6fbd39deadc684a7bd17b46966d7288f88

                          • C:\Users\Admin\AppData\Local\RyuSAK\Update.exe

                            Filesize

                            390KB

                            MD5

                            d57ed0b04c8cc74df825158e16b04cec

                            SHA1

                            f79cebec9f6d87e9b22062b6bc5402714e65200d

                            SHA256

                            48b43f68b136f37cfc39171fa221310035ed609ecbe4f071974f5e9edfe9e259

                            SHA512

                            16427d4eae279af828756d304d8c59d295486258e65a58780eadea520b1555ed462da684bc3f4f4197c20cce85bdad489fdedcc648a93d724d32c4b0a57bf329

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\D3DCompiler_47.dll

                            Filesize

                            329KB

                            MD5

                            cb21d0952c617e1f26a0d8f8ff355dc0

                            SHA1

                            f2d5a0ac54da43e375eac2f08d17381949397bc1

                            SHA256

                            4229de079bc163c84da641696db1177cc775847dc330705af029ad70a7754dfa

                            SHA512

                            13a6d8d0c016b87391e8971d3c283b312bbef8f349e474183b920985d0ac55a2c169dd92e24e284582f56dbda69ab9ee0de6fc0a587039ff505909091e1fd1a8

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            713KB

                            MD5

                            3b388656a5aaad70bca9bbba5edd97f0

                            SHA1

                            b5b963794cbd30fe0d063363673619f2f26d227f

                            SHA256

                            406d9aa8f006db61a209afc01a617fce6f472d9dc461e653c320b8887c995384

                            SHA512

                            a1612f99cde72c33ea3c33954c9e0c0a4f1778cd44b0fe0e9dc4e3a53631441d08ce2419bf22da9157f875527c2000250fc692a3d3a3a18f76f2e1e26264a276

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            1KB

                            MD5

                            54b0ca87ca4618cee04751823c675fb4

                            SHA1

                            a3f8f51bfa6953b18eeced4b59234acb4d3136be

                            SHA256

                            40481014a49d8025a631b22f3378d77dca4273f9df67bef484fa0ae29db32147

                            SHA512

                            529b95b1c787f1633191908e6cea1267d080c8c5167895ae87ad8b23521573e29ceb413dc483ba791da9da7223a94aae10f5ed1ab91b08a2f10b12040c007774

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            785KB

                            MD5

                            b1f9e0bb198f67536ef7490dc036b87f

                            SHA1

                            e5c9ad0f4f13643ef54c8999ae680814b5393d1e

                            SHA256

                            a3ebd313d6d8d034e7bc524b1d4dcf2bd1092112b6e8a37dc6fb1367c9007d46

                            SHA512

                            11f137b7fcd89aeb165e78dc61c5cfd4f29f440cc6078d96b687a46787f7425a1e689cdb0ccd9f452db4e580c6103a24fccc25fca32fb5bd32e95227cba5bd09

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            854KB

                            MD5

                            89a17409e88fa272630eacc74e54e619

                            SHA1

                            c00747c1752b99228ddd866e261a24e929d09e82

                            SHA256

                            7a53abdcb4a78db162dafd8377277ef406dd79f2483fc42f655cf5213f873315

                            SHA512

                            36eee9d6069db3a2fcd778f6f783417190f9e7e205ad72881d1ef12103dc1b6974f3b9326aa554ff60b9ea57201cfcf825b4a65e145631f64051c4bf859f1857

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            457KB

                            MD5

                            8f51f4dbfa6e347ec062f74a3e42068b

                            SHA1

                            048d01e817802c78eae9259748cfc8d241210bcd

                            SHA256

                            e8749ab4eccaa51dc748ff119774f46441fd6b56f0fb3c36e5c8be53199ee63e

                            SHA512

                            1f102162c32bd97e87241398a39471eef564e199c199a8f83731811eae93b39d636c1aa40e6563b3922fa15ead5dcc486464194c584c0768c21fcca5fe27f1be

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            592KB

                            MD5

                            d99a216b4bdd2f3343544f6f3cd81fc8

                            SHA1

                            eccabbc262974680ba8f304c4d57619409be0d39

                            SHA256

                            34c5dae0b64c2b13f90b0e6dabd921a26319164d9ccfe473e2c8fcc22b956dda

                            SHA512

                            a87ccac28a3913e813f6a75fc4b7c50f8ee93cc9a058dc09bc81038e9779747cf2b749ea51d157d0f792364cd6993ae3d4b8dfb61c5023d4a27104149410196c

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            92KB

                            MD5

                            e51da0e9c777ec8dba9d08d4fe55c0c0

                            SHA1

                            7185385443859ac6b0479e91a9d1671b13e739e3

                            SHA256

                            c113562642d6c8a0d1d9052b10195e566e37bbc2d693ec3a4854f0b0942f7a9f

                            SHA512

                            6497dc7bb97c401b809fff5b55ac86214259186940cb560e64c99f5c1ee772b88e24532671e91e7e26b8a70904bc927a4e9cc0d29a8cb42e834cb50960463475

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            511KB

                            MD5

                            fe52b8a5f786064def6de3db5191d0c0

                            SHA1

                            8d40246cd0a2ef9bba02015120ef94ac5165a46d

                            SHA256

                            4fce0ca74ca54b57e190488028d96aab0ade07477708a27b6f1ece0badee1e4d

                            SHA512

                            bc5025b96425ab3ff2c0e92e10d6e8450e0d536f3e59d6044efd6b80cb6d154b6e36b12828e35e5c7fa1d1b4363a58e4af210b332348ab1e88b3ee7db817ec46

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            380KB

                            MD5

                            4a3c05804962cf0c9a77f54f0a6dfc4f

                            SHA1

                            0645b0fd9d33e39ee4da0fb5b5aae0503e8845e0

                            SHA256

                            1f453939bfcbdde1f8705dbb221426adeb758db2bd8df3817003503ecd9ad5ca

                            SHA512

                            8a07483cbf8a4aef202e1bda3b1ffb20173b0a7636bf511225b532e90d5ee1ffc7b221d955d8bf91974db8f8a80f48184d2d34da00fe03409e0487a1c98825f1

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\RyuSAK.exe

                            Filesize

                            257KB

                            MD5

                            948657d9a24f69bb85ea0e236c13855d

                            SHA1

                            56bb0e7957a7c949d27f731ea147ed70017f4297

                            SHA256

                            45b33d5493ee30e9d2fb342f7c1a5cff4d0b1f33be948af1b7b39501ddf0751c

                            SHA512

                            639c54a544deff5f7067cb7c67ad3dac812d864a7b8a19d8671968a72e40ade48b87d9d3cfc4089ff771ebb01eea7a3ab69191b5437c59b57cd1d311ab5bf65e

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\Squirrel.exe

                            Filesize

                            192KB

                            MD5

                            e6c4dc45409dbd97325cfecd2a5769b3

                            SHA1

                            6f15e14887c6a946226ef471e861b7d80a23caef

                            SHA256

                            b4637b8fdd74905697741c03b34c11bcf73de9f25ef7285ac727f44d485011ed

                            SHA512

                            8f5d5f212dc12c5f86bafd51adf31a382ed36ff355481453eaac15e18a28efd3e1594caaede43666608290bdd27f15710bb097ca95a11d99b0d48964872f313e

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\chrome_100_percent.pak

                            Filesize

                            145KB

                            MD5

                            237ca1be894f5e09fd1ccb934229c33b

                            SHA1

                            f0dfcf6db1481315054efb690df282ffe53e9fa1

                            SHA256

                            f14362449e2a7c940c095eda9c41aad5f1e0b1a1b21d1dc911558291c0c36dd2

                            SHA512

                            1e52782db4a397e27ce92412192e4de6d7398effaf8c7acabc9c06a317c2f69ee5c35da1070eb94020ed89779344b957edb6b40f871b8a15f969ef787fbb2bca

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\chrome_200_percent.pak

                            Filesize

                            214KB

                            MD5

                            7059af03603f93898f66981feb737064

                            SHA1

                            668e41a728d2295a455e5e0f0a8d2fee1781c538

                            SHA256

                            04d699cfc36565fa9c06206ba1c0c51474612c8fe481c6fd1807197dc70661e6

                            SHA512

                            435329d58b56607a2097d82644be932c60727be4ae95bc2bcf10b747b7658918073319dfa1386b514d84090304a95fcf19d56827c4b196e4d348745565441544

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\d3dcompiler_47.dll

                            Filesize

                            352KB

                            MD5

                            b5009b95dc868fac9cefe25277c4d79d

                            SHA1

                            db09ec64150df17c12a79660a57b481cb0af617b

                            SHA256

                            00937d846f60e0b7ed15ee89709762708b344187a9793eb627cd48c7bf40e4b1

                            SHA512

                            dfe75c06a22d7625da9dd0ced9965b556197bec21a91f14e73a35b022619658a3c451d9ca86d9aac2da7d0eaee5730c80ba00a23b3d4c5ccd86334e5745ffbc5

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            5KB

                            MD5

                            e969b23d89afe3253bfcae94cc62b41e

                            SHA1

                            6c3ec7a6b1e45f30d61698392c6b0571ce28aba2

                            SHA256

                            59d9afe7b23d159b1a03acfaae93f25c1fd59cd68c67c6e380050f04919c8ae3

                            SHA512

                            df97b0a81cfbf43139cc4ead88bf84622077f8f1c0e38cadde52c283b7c9cb1d8338c491b69073de14ace7779905d0097207990784242b8a3885ac6fc8a054ff

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            73KB

                            MD5

                            a200ce9a4dfe96543eeaff2a54028921

                            SHA1

                            019c1f811b99f907bf813ae283d83a82791de983

                            SHA256

                            d7baa54c7f9f83de03044d1ed0af1656e560205db045359ea7f951bb02cf160e

                            SHA512

                            60a3fb06cb2582779bcf39cfa8c169f647587c87850617b28b1b0260fa0aed6b6eacb0adc1d36ac9ee089895e128fa6fdf3e888ffba3488d75817d83ab101c39

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            562KB

                            MD5

                            f96af8f2555ab20afcb11e325b1a1a4e

                            SHA1

                            3819cc6f8a7d1cd938ec88554c3b8a5868274b2b

                            SHA256

                            91a46effc310d412aff3ebdcd0a2eb5e53b8614121d2f104ffd2fc8042d9f377

                            SHA512

                            e3f7ecc518d66c9b5727f393fa5e1fb939fa940e3518d4b2be5f7f9a40dd9e24f94d284ea0edb37c6e8c55c0c2bc85522f991c56a7a8282702ce5160450e03d6

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            716KB

                            MD5

                            f48f3d5e9514aa9c73459aadc3e8c43f

                            SHA1

                            12fa7dfd7d09a8800a76c4a6e3eb94d4b02ae071

                            SHA256

                            2d86f30055037d64438041775d1e23977a0b80c5664feacec1270349dd902055

                            SHA512

                            3e6ae4c094df6984f8199eeb9d6b653451ae43f5e4e7114d64ae6ab33e9c6d08e7e8379ff1596b8655e915d1ab62cea7811223915f76038cc7c024b414e94c80

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            585KB

                            MD5

                            12bb8929f11a8be7c9360654e38114bb

                            SHA1

                            8951a9a886a3e8ae91ebcd76277e7f5ff1ad7ff9

                            SHA256

                            9ef451ac7cc7aea6f96e3739161431897bd04d214b42465fc933e95858c78fd4

                            SHA512

                            b0762a77587d48a07e466bfa00fccdc13533550f332714ded7f0a95798eb4758aff4857e3ce06ae153e877778480277689cffb149749056c150bb3c7c3d43235

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            70KB

                            MD5

                            a593ccb0ca43355283606f7486e413e7

                            SHA1

                            644d9238cd0fac97b87da82b4be05f80be8ca285

                            SHA256

                            d5f11eea6ac1a1ff60fde21ece646ca5978c432774149542dea8e2757818c771

                            SHA512

                            0b2f1b2d1a6ee7e743c6b48c1e60f4ef5a3ab265bc056c2393a20f4226aaf526dfe7aef852c92b27bbdb0c5174c020949e0aebcbfdccd706caf20174c53dbfd6

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            316KB

                            MD5

                            5b588056113c5e12c303f1b55bdb0f42

                            SHA1

                            33bef0410a194d48883382fbe3b3c9dda70e6d5a

                            SHA256

                            409f8c8be67254a24480b583034a0d8d57a09e4c24e06225f19134ed84893400

                            SHA512

                            9ae057ad2f19494392df282e8e1f57610fe00e045de68f7506b32928ba91a3ce21674711eae68ac3f38909c0a8bfa01d3ea09400754cad9177e1e532702b247d

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            383KB

                            MD5

                            d3709ae7cf14106a200b6366df78f7db

                            SHA1

                            9241fe99395d697660c697173d71d8d9401b2aa9

                            SHA256

                            b8ba2583c3e2889dee84937f615fa8dbad4b90afdaaf2966908f7cfc271a72ee

                            SHA512

                            ce250dba7d8228b82d082d4a364540c319782bf6e4dde7276e26f53241239453fee8c2b9317df675355583931aea52592b299dd1e887a3b09286c610288102de

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\ffmpeg.dll

                            Filesize

                            292KB

                            MD5

                            44f17dda96b19fedd01a1360501079e9

                            SHA1

                            d9c9a5860e986c99bb5aaa2d0043948e62c189da

                            SHA256

                            d9ab04eb48895a2581adf17329d5051d695c8a272b2820992a778b333e124c38

                            SHA512

                            5c3402fe8e3b73c49d99e672de9042d0b30aa7f5c7beaee6a8df00305ec63ac6e8787148d5ef60a907c40975ed9910457f6cf6ce802e7d4c2886c90f5e24e94c

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\icudtl.dat

                            Filesize

                            64KB

                            MD5

                            b0ab693caae1e71bd817d8e27a8419de

                            SHA1

                            1f639174782d349d5831da3b66747e28b0bec7b5

                            SHA256

                            8de589bbd84fc04a54d6256e40ecba6de891baf9ac35c3a3aed0708cafe3c9dc

                            SHA512

                            4c04ce6b860e7453e47c76a2555e5674eedfd770b52c583355156d0bd2c4b11ea136ea72405df76d2e5128e02a777ff1ab57b0bbb09ef1a1ec08dec952865344

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libEGL.dll

                            Filesize

                            150KB

                            MD5

                            771623a1cc1c119e61319938e8806432

                            SHA1

                            5b4c8f5ca42ed4c7c86dc8b8205d1eab9a51a093

                            SHA256

                            136947a19b78623f41dd264f44355e284fa177cf5b052a065a9fa9230a928257

                            SHA512

                            473c5072c0fabe9ef92ad89d6637a578d38d27f14cefd9501af1ae97482debb6f3cb5581e920daed92492b7faf4f9e17742b88fbcd4741712a22a5e1d1eabe45

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libGLESv2.dll

                            Filesize

                            239KB

                            MD5

                            07d3c1d1c8376e832e879207c9ab3c24

                            SHA1

                            da7e7faec1bb4443ed81ae32322d2dddbdb63127

                            SHA256

                            6d37e1c6e0106c53905bfcb8fa096ed4e14eb8e85dbf7c38c4df021a5bb68915

                            SHA512

                            1eb744fe810e77f36f37fa3e67fc4ea31f004b4df0acb6666080f4f8ee4ea69993eb593524beffd7b0e6e0bda8e68c1697e2e8ce5023a7ad0c941d96bcb45683

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libegl.dll

                            Filesize

                            297KB

                            MD5

                            70fb89c5b701c0ca9503158884b29aa0

                            SHA1

                            cc505ebc8b515e1db5ad6d26d36c1a2d0024ee22

                            SHA256

                            a697f0918e2b50a4a3600337a2dedb73d813b8b663b93ad9af8606f11a78d1b3

                            SHA512

                            2bcda0e251bf0c7a9b358133ba2bdad45740d94801a58cca7b92d2404e97709fae68dd315af808504a509f173c026f2a6cc4bba334677924a9a7ae9ec13fddc6

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\libglesv2.dll

                            Filesize

                            229KB

                            MD5

                            edc833b47c2da0dcf1d52113a4337bac

                            SHA1

                            1db601086f44bd52690796a625ca8de3ad2c9bcf

                            SHA256

                            fb438f2317f55f670c0dd6b83d75454b6969007a63eeff99aee0e816c059e356

                            SHA512

                            5b8576c1d74f35823cad902527064f04a0a32abb3d8ff9f1414b7e2a4eb6618047f215059f59c43a637c18d0a8318a99bbc491b4ea58782dabc250ad2524f449

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\locales\en-US.pak

                            Filesize

                            114KB

                            MD5

                            88b9e849c0035cb100d031fa5e3fa0b4

                            SHA1

                            3576e0fa589e53ae36d2b75937bd3c5c0ab8dbfc

                            SHA256

                            25462802f57f52581d34d67df00f7a4d62cb5ee5ee0e5e853f48ad9caf04dd89

                            SHA512

                            99e8cf196cd9098adf74f569d06043809454860f8f3de9e942f3ce3c2faeeaa3d6bd0572503cb6c2a6b932aff9aa7e4542501731693ec6a015cc7282af388e8b

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources.pak

                            Filesize

                            310KB

                            MD5

                            c1aa39906b163f9502438b1c612d1abc

                            SHA1

                            47e8e24ab385ad3b23aae2bcda3cfad0b3063598

                            SHA256

                            58476b81b33991a771bfac96c16b21f0a7638222ac56b625443100ba82433301

                            SHA512

                            a1ed64086874f0316276d951653dd604ec0227d73c7b5b9d8a45b46f56f9df3a0edede57a2cb451fe7b2d8d1f4ad7f000687bb550806e80d9a2d2ccaf1561f75

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app\.webpack\main\index.js

                            Filesize

                            346KB

                            MD5

                            625283321cbb8aa24646dd79c956247b

                            SHA1

                            0f82bfefd1288bca467f5e22d6a9f303f5d4a7a6

                            SHA256

                            c6a2e1e1bb0ad0ae96b2ae6b549949bc091be0c75a04d265b6870d40cc0cb4bf

                            SHA512

                            028bfa8ba4e98074b5096b6cf47bded660a2973a04b1bb5c2db1f874dd2d6c658d69429c4fa4db1ff6339e1b6c2b1e8c240b9e24e840314935ff91afa3b33eef

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app\.webpack\renderer\main_window\index.html

                            Filesize

                            2KB

                            MD5

                            67e6093f6b62c6d017d33d28036a3166

                            SHA1

                            4050fb2c190321d318601cd204018d46b7e453d5

                            SHA256

                            e50a7f99e87068a8a36487fd6214807f6df6680992142f01bda05c3af3f2bcce

                            SHA512

                            91cb4eea426a583762c0285641fe0faa879a6215a4489da02ed9b441e642dd58405bfcdccfb26dc2855228b940908f6709dd922a1878099fd80e254fcef9a982

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\resources\app\package.json

                            Filesize

                            580B

                            MD5

                            4148561ba39bac1fbd00ad66737a65cf

                            SHA1

                            8cacbf61b46f0906be91d3780d78b82f55f8abd3

                            SHA256

                            d69c70cd8fd705110c82953921123c1512ab371461ac42968343f1c62455d0ca

                            SHA512

                            a825c8de2499cabe80e04e0e7f2de16edbf88bd010b486d43ae40dc1f20a105d3dd5fb678bdf483849009856d850e8650ab90066502031730c5f96d722c44f1c

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\squirrel.exe

                            Filesize

                            304KB

                            MD5

                            f276d938c4adf9c01a8187a906a340cb

                            SHA1

                            7231ad26980575c48dcbd99bdd7db328c776211a

                            SHA256

                            4cccdba7f8bc3cbe8938017f694856ae1f5211c068e7328cd1951d7cb301724c

                            SHA512

                            4c26412f5e0dd273356ded4158bda1684b5f6bb14e2dee364f25a8478fecfd6cab270eaf5a3db4f4cad0de66af0814b301357aecb0a857b30d9601e0d23b14cb

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\squirrel.exe

                            Filesize

                            307KB

                            MD5

                            b92eae34dde9a543627e411ba4bda834

                            SHA1

                            cb4c81b4f0f36050c1c078c8fff92567ce6cc927

                            SHA256

                            bf34ddf7399e23d0c3d3fd166135381e32e717c38e68e42b027301c1beda9336

                            SHA512

                            025d8dd661fc5133725fa21f4c4e69bd299475d7a97a8fe14f09a07f454761102ebda5e92c89041730591ab8a46146b6c7555e0d1c611a110c057c023f0a2280

                          • C:\Users\Admin\AppData\Local\RyuSAK\app-1.6.2\v8_context_snapshot.bin

                            Filesize

                            57KB

                            MD5

                            c9d2fa5ee927605b515471ce677e229f

                            SHA1

                            9adf41b8dfed62cd83f88f26a6fc6fc75ee09e70

                            SHA256

                            63636af7dd88a783cb243b2c9a8143dbe06e689ff1b7185041395ac2220b7494

                            SHA512

                            2e274528ad5eb294356220ff443a89d9818f07fea6bcf97175e5efedf06f2dcbeac91e68b8482f28029497739721b91c130590c5ec6ef4f8c0807604930c2554

                          • C:\Users\Admin\AppData\Local\RyuSAK\packages\RyuSAK-1.6.2-full.nupkg

                            Filesize

                            415KB

                            MD5

                            3dd2af558dbc2ed67fdfcf77a8e88950

                            SHA1

                            a0f36c966d55eefe702d460c58262dc2db9fafe4

                            SHA256

                            9d230201e578d18ad754ee7c204679270d8e287acf7ac997dfbd407b91d693de

                            SHA512

                            7675bb3977496cf4183b92d7c746c619aee20cab6b1b07a74cac2fb47c11765ce925ec87db33361aaa2c5dba8443a79019e94b77ca1407f4c0ec42a3b0e8d943

                          • C:\Users\Admin\AppData\Local\RyuSAK\packages\RyuSAK-1.6.2-full.nupkg

                            Filesize

                            939KB

                            MD5

                            36aec254168f13abaf58ade1c1c646c4

                            SHA1

                            bdb9c476d96f402a99e2e137e772a19fbd5d292a

                            SHA256

                            bda5fdd7c9355540bd2ac2db3e5c0141476b87a57aa53a98b4d5085cf369e25f

                            SHA512

                            34bc34579af8fcf804b68562655cd44aa8affc63e3c352705ae703b6bc94728f27e7af5910149b71c396f7ac58b3d8211f296fcfa8c433879b121305c489febc

                          • C:\Users\Admin\AppData\Local\RyuSAK\update.exe

                            Filesize

                            1009KB

                            MD5

                            b45dcb0275d4182223c641f65950f2c2

                            SHA1

                            9d5f5660f20c4d291a23c308dfc1754de4abaa12

                            SHA256

                            9de7eb8200a3e5905f685251466ad8f361fabcff186a70d348b5154731f6d0f1

                            SHA512

                            a1e90611643cfecb06fb7afef4721524e35df84debf0abe3d6340379530616108135b03029cbb650824f3f636066d51ee53b030741cde57744572ceac02f798d

                          • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

                            Filesize

                            76B

                            MD5

                            923a27e130ba04644aa4dda3d5076743

                            SHA1

                            bfd471cc7e25efb2033654fcd97ef59a85c4e361

                            SHA256

                            b483e74dab632b12e8c8a109a122e0a052f2bc837f0fff7a7e6e81397026606b

                            SHA512

                            949166d552c3dc16fa71fd2de2d8a645d54ec571067281abab9e38caf06ae169f2d7866dcb6a2f8aa03fe560c7adfc9ee5b891993c5c894fbc1fb8d6cecc0d08

                          • C:\Users\Admin\AppData\Local\SquirrelTemp\RyuSAK-1.6.2-full.nupkg

                            Filesize

                            834KB

                            MD5

                            4b6e08c20c514be12c64c4fbbe68f10c

                            SHA1

                            d0c338f7ff8a27acc20b7802669d1354cb65abeb

                            SHA256

                            28ea73dc6cf2338945a8d872c486deb0325d05614d0c91b6acd95a446c3b42a1

                            SHA512

                            386435f8bc0bcd19fb98cd815916f5ece94a7c9ac5852a9a0af82b4643bb515cee66f8b02a7a39257fa58029d0b0a9a0d51d31414e96ff4dc82dab3d4612406d

                          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

                            Filesize

                            164KB

                            MD5

                            29be7b4553b50259806d25fbfa32f8a6

                            SHA1

                            18eb16ccce34070ec97942f7397900d7a73dc3be

                            SHA256

                            d6b0facc5b74f50a70658f25c9a76d489e5ca47700ed6c5f567d4181eb0424af

                            SHA512

                            a616b92bd2a0f73d8a64905b5b768f89499d6f50a06ef8fd55c28d03d7e00a082dccd9f091f5d1be061cc9723e19838f361480b3128220ab5f635c1e40e9a963

                          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

                            Filesize

                            136KB

                            MD5

                            20f4550a39d358c2dbb7f6b3e78d531d

                            SHA1

                            81238e9c34938efa57a0a9dba7f3d569fd0a25fb

                            SHA256

                            b41df3491e4e94633494204417b0f0de9bc42830af08fa8cc8b8b338f1b1876a

                            SHA512

                            d32c580a420f39ab45fa95cedabab605d21b5d79f0605394de90a7b155b6e5a8bacbc62868cbe226e15ee1cd8b839eb4def74de434742b0c4e9e6b051d3c045b

                          • C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

                            Filesize

                            43KB

                            MD5

                            b5a42ecde0b058b3c4e661e0ec84400b

                            SHA1

                            7e2bfc653c5bc6997553c150a0823daae372cd99

                            SHA256

                            ce636d201ef86ffbf4ee8c8762b4d9dc255be9d5f490d0a22e36fe0c938f7244

                            SHA512

                            b7f4a7bddb226066f7edf23dfb9bee658c30ae03dfe727ec739f51fd98c63831f732343c14a6ca080f31baed38bf9064cdd57c9d1daaf4c42c029fe83d846dc0

                          • C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico

                            Filesize

                            197KB

                            MD5

                            bb75cb0c041e4060c0db4ed0c5d17c96

                            SHA1

                            637aa5403144639923cb41cc7a8b26c28b66a439

                            SHA256

                            92a5dad587f1cbbcddb9c751177b07590bb1b32b91e97dfab3b05858ea5fc387

                            SHA512

                            4b033661d032010feb55814379f740992e0278297d856478346af9489e341d0615bb85f9124d87b641c5260b0ad7d5b758c650fe2ea27253a4a30c5bec8c29f0

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                            Filesize

                            2B

                            MD5

                            f3b25701fe362ec84616a93a45ce9998

                            SHA1

                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                            SHA256

                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                            SHA512

                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ecks1337\RyuSAK.lnk

                            Filesize

                            2KB

                            MD5

                            94f906f3dd86c7b40c9a54b5d821d5e3

                            SHA1

                            45a50102c6e4924634ae95d72276e6395b514f5e

                            SHA256

                            a1f450282856a88415948aa3210db538a654de5339a35e31cf2a38b861a4851f

                            SHA512

                            fa059ff48e061df5f3525afc86fe73721c94742253c1786074c4c09604550deb474a95f0eea3d1eb10f8625b2e63d260ae9041751fb0236225c72fe7569a2e9c

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\Code Cache\wasm\index

                            Filesize

                            24B

                            MD5

                            54cb446f628b2ea4a5bce5769910512e

                            SHA1

                            c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                            SHA256

                            fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                            SHA512

                            8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\Code Cache\wasm\index-dir\the-real-index

                            Filesize

                            48B

                            MD5

                            9f9e440fd40b42947ef2c6c51d76e1b9

                            SHA1

                            1ee24f3ef90321a934981d4d90fb5c6584b061be

                            SHA256

                            cf9475e9e57d4f28cf91261a2cd59c5787f578db9e10961d702a7282f4b38d14

                            SHA512

                            6359db0307ae2e97b6dcfb1e1b8bc64d34a778e1fbd30f9d07fb2e90496894c4a7f00510a3685095d26bfbd9049deb4a67c4ea3aa166a46421ad8045818e6c75

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\data_0

                            Filesize

                            8KB

                            MD5

                            cf89d16bb9107c631daabf0c0ee58efb

                            SHA1

                            3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                            SHA256

                            d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                            SHA512

                            8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\data_1

                            Filesize

                            264KB

                            MD5

                            f50f89a0a91564d0b8a211f8921aa7de

                            SHA1

                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                            SHA256

                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                            SHA512

                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\data_2

                            Filesize

                            8KB

                            MD5

                            0962291d6d367570bee5454721c17e11

                            SHA1

                            59d10a893ef321a706a9255176761366115bedcb

                            SHA256

                            ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                            SHA512

                            f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\data_3

                            Filesize

                            8KB

                            MD5

                            41876349cb12d6db992f1309f22df3f0

                            SHA1

                            5cf26b3420fc0302cd0a71e8d029739b8765be27

                            SHA256

                            e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                            SHA512

                            e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\GPUCache\index

                            Filesize

                            256KB

                            MD5

                            783d1cc347ba4e45e725c0bb55ce6e63

                            SHA1

                            cbacad101874fab506df1dbfb94b4cfe0c5190b7

                            SHA256

                            74da1aec6d8aa877e4b70bdd9ee74af257b4b44230e7720cf891cfb6ef4ae2ea

                            SHA512

                            616c918e61483d156a944e682e18c3b5cc6af4df71204d7d9f951036d5a003cbe985229e4c1af98b6afaf25a0da073fefe73268a59f7b0d68d41d74e0826ade7

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\Local State

                            Filesize

                            389B

                            MD5

                            f081f19ed68900e8ddb5b13ec055664d

                            SHA1

                            da1b08980294f1c212e7a5cc914e9a899e0e6ad7

                            SHA256

                            79ffc5f5b5444c48a88a19f5e3448894ab7ff68ec86dd6f2b86de124de5e1b3f

                            SHA512

                            fd9ddda0844a2213c4a609c549a808e85bce985b2d7d33803f0dce92881fcca1d5d697f89bc7f97079af151af5823974ffc61d5a2b213b42ac36f34da37bc36d

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\Local Storage\leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\Local Storage\leveldb\LOG

                            Filesize

                            245B

                            MD5

                            2c7f4424b04ac3e029f9250b1107d149

                            SHA1

                            f725d969f73a87648227f76342f8f93189d7c18a

                            SHA256

                            7569f876ced5bdba93b0f6df953b7c0b305e42349907f8785a166f44d38b0fac

                            SHA512

                            3b88fc59ef80bbc26baa4cf1b024b5c4e0a45d40336f5d4a7da5857bafa39e155e642271f4d0b49cbf2792178a4a49d56e90263d0fda7317393f32c30f74666c

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\Local Storage\leveldb\MANIFEST-000001

                            Filesize

                            41B

                            MD5

                            5af87dfd673ba2115e2fcf5cfdb727ab

                            SHA1

                            d5b5bbf396dc291274584ef71f444f420b6056f1

                            SHA256

                            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                            SHA512

                            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                          • C:\Users\Admin\AppData\Roaming\RyuSAK\Preferences

                            Filesize

                            57B

                            MD5

                            58127c59cb9e1da127904c341d15372b

                            SHA1

                            62445484661d8036ce9788baeaba31d204e9a5fc

                            SHA256

                            be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

                            SHA512

                            8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

                          • C:\Users\Admin\Desktop\RyuSAK.lnk

                            Filesize

                            2KB

                            MD5

                            ac8fc5d2d6fd2bae5e94d9b51f2d45a2

                            SHA1

                            912d1103096de742ab5a7d71e6b3f088956961bb

                            SHA256

                            5e9cab6db2510881101eff7e73aaba251e4f00b606e3653790d3aa6d6c5ca81f

                            SHA512

                            890209d20ac2505b9bb0dcaf8a736da84a3ebd3c971ecbcbfc7b4f41509931f69520db5ed11a499579d8422e6ea875e5e430b8bcebe5aad0316f636b695ce71d

                          • memory/848-194-0x00007FFF27C10000-0x00007FFF27C11000-memory.dmp

                            Filesize

                            4KB

                          • memory/3152-329-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/3152-324-0x000000001D920000-0x000000001DE48000-memory.dmp

                            Filesize

                            5.2MB

                          • memory/3152-322-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

                            Filesize

                            64KB

                          • memory/3152-320-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/3712-176-0x0000000001710000-0x0000000001730000-memory.dmp

                            Filesize

                            128KB

                          • memory/3712-170-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/3712-250-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/3712-192-0x000000001BB80000-0x000000001BB90000-memory.dmp

                            Filesize

                            64KB

                          • memory/4344-251-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4344-180-0x000000001BE80000-0x000000001BE90000-memory.dmp

                            Filesize

                            64KB

                          • memory/4344-167-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4708-10-0x000000001B240000-0x000000001B250000-memory.dmp

                            Filesize

                            64KB

                          • memory/4708-317-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4708-202-0x000000001EBE0000-0x000000001EC18000-memory.dmp

                            Filesize

                            224KB

                          • memory/4708-9-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/4708-231-0x000000001EBA0000-0x000000001EBAE000-memory.dmp

                            Filesize

                            56KB

                          • memory/4708-8-0x0000000000410000-0x00000000005E6000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/5052-321-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/5052-149-0x00000000002B0000-0x00000000004B8000-memory.dmp

                            Filesize

                            2.0MB

                          • memory/5052-150-0x00007FFF0ADE0000-0x00007FFF0B8A1000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/5052-153-0x0000000002460000-0x0000000002470000-memory.dmp

                            Filesize

                            64KB