Analysis
-
max time kernel
47s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 21:01
Static task
static1
Behavioral task
behavioral1
Sample
Salwyrr Launcher Installer.exe
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
Salwyrr Launcher Installer.exe
Resource
win7-20220812-en
Behavioral task
behavioral3
Sample
Salwyrr Launcher Installer.exe
Resource
win10v2004-20220812-en
General
-
Target
Salwyrr Launcher Installer.exe
-
Size
46KB
-
MD5
38633bfef3c1fe505a39a688b5c31828
-
SHA1
4e053e5ca9e8bfcf372b4331b18c36d637332bbc
-
SHA256
413a460fae724b972ab9c52aeab029552245555c7df5b79eb2a6529e1dd7a090
-
SHA512
812ebfa26ff63ade8ab4851230fe47c0ffb797b5a8c48d6ab7ad3293a4995c088bedb8ca7ad6c48a63b3c7f60cdf5b2b318b39dc232ef2096721aba7734ea8f7
-
SSDEEP
768:PE55gC6d1VepljbMBMxECL67qtjMGF9TtgmAtugTtyKr:svh6dTepljLEf44u4mMuAyKr
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 12 IoCs
pid Process 2316 netsh.exe 5076 netsh.exe 4656 netsh.exe 4676 netsh.exe 1060 netsh.exe 4016 netsh.exe 2856 netsh.exe 4328 netsh.exe 208 netsh.exe 1420 netsh.exe 2600 netsh.exe 4780 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 2144 javaw.exe 1712 javaw.exe -
Loads dropped DLL 24 IoCs
pid Process 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 2144 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe 1712 javaw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1500 Salwyrr Launcher Installer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2144 javaw.exe 2144 javaw.exe 1712 javaw.exe 1712 javaw.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1500 wrote to memory of 208 1500 Salwyrr Launcher Installer.exe 81 PID 1500 wrote to memory of 208 1500 Salwyrr Launcher Installer.exe 81 PID 1500 wrote to memory of 208 1500 Salwyrr Launcher Installer.exe 81 PID 1500 wrote to memory of 1420 1500 Salwyrr Launcher Installer.exe 83 PID 1500 wrote to memory of 1420 1500 Salwyrr Launcher Installer.exe 83 PID 1500 wrote to memory of 1420 1500 Salwyrr Launcher Installer.exe 83 PID 1500 wrote to memory of 2600 1500 Salwyrr Launcher Installer.exe 85 PID 1500 wrote to memory of 2600 1500 Salwyrr Launcher Installer.exe 85 PID 1500 wrote to memory of 2600 1500 Salwyrr Launcher Installer.exe 85 PID 1500 wrote to memory of 4676 1500 Salwyrr Launcher Installer.exe 87 PID 1500 wrote to memory of 4676 1500 Salwyrr Launcher Installer.exe 87 PID 1500 wrote to memory of 4676 1500 Salwyrr Launcher Installer.exe 87 PID 1500 wrote to memory of 1060 1500 Salwyrr Launcher Installer.exe 89 PID 1500 wrote to memory of 1060 1500 Salwyrr Launcher Installer.exe 89 PID 1500 wrote to memory of 1060 1500 Salwyrr Launcher Installer.exe 89 PID 1500 wrote to memory of 4016 1500 Salwyrr Launcher Installer.exe 91 PID 1500 wrote to memory of 4016 1500 Salwyrr Launcher Installer.exe 91 PID 1500 wrote to memory of 4016 1500 Salwyrr Launcher Installer.exe 91 PID 1500 wrote to memory of 2856 1500 Salwyrr Launcher Installer.exe 93 PID 1500 wrote to memory of 2856 1500 Salwyrr Launcher Installer.exe 93 PID 1500 wrote to memory of 2856 1500 Salwyrr Launcher Installer.exe 93 PID 1500 wrote to memory of 4328 1500 Salwyrr Launcher Installer.exe 95 PID 1500 wrote to memory of 4328 1500 Salwyrr Launcher Installer.exe 95 PID 1500 wrote to memory of 4328 1500 Salwyrr Launcher Installer.exe 95 PID 1500 wrote to memory of 2316 1500 Salwyrr Launcher Installer.exe 97 PID 1500 wrote to memory of 2316 1500 Salwyrr Launcher Installer.exe 97 PID 1500 wrote to memory of 2316 1500 Salwyrr Launcher Installer.exe 97 PID 1500 wrote to memory of 4780 1500 Salwyrr Launcher Installer.exe 99 PID 1500 wrote to memory of 4780 1500 Salwyrr Launcher Installer.exe 99 PID 1500 wrote to memory of 4780 1500 Salwyrr Launcher Installer.exe 99 PID 1500 wrote to memory of 5076 1500 Salwyrr Launcher Installer.exe 101 PID 1500 wrote to memory of 5076 1500 Salwyrr Launcher Installer.exe 101 PID 1500 wrote to memory of 5076 1500 Salwyrr Launcher Installer.exe 101 PID 1500 wrote to memory of 4656 1500 Salwyrr Launcher Installer.exe 103 PID 1500 wrote to memory of 4656 1500 Salwyrr Launcher Installer.exe 103 PID 1500 wrote to memory of 4656 1500 Salwyrr Launcher Installer.exe 103 PID 1500 wrote to memory of 2144 1500 Salwyrr Launcher Installer.exe 105 PID 1500 wrote to memory of 2144 1500 Salwyrr Launcher Installer.exe 105 PID 2144 wrote to memory of 2656 2144 javaw.exe 113 PID 2144 wrote to memory of 2656 2144 javaw.exe 113 PID 2656 wrote to memory of 1712 2656 cmd.exe 115 PID 2656 wrote to memory of 1712 2656 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 1a"2⤵
- Modifies Windows Firewall
PID:208
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 1a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe"2⤵
- Modifies Windows Firewall
PID:1420
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 2a"2⤵
- Modifies Windows Firewall
PID:2600
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 2a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\javaw.exe"2⤵
- Modifies Windows Firewall
PID:4676
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 3a"2⤵
- Modifies Windows Firewall
PID:1060
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 3a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\javaw.exe"2⤵
- Modifies Windows Firewall
PID:4016
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 1b"2⤵
- Modifies Windows Firewall
PID:2856
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 1b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\java.exe"2⤵
- Modifies Windows Firewall
PID:4328
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 2b"2⤵
- Modifies Windows Firewall
PID:2316
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 2b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\java.exe"2⤵
- Modifies Windows Firewall
PID:4780
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name="Salwyrr Client Java 3b"2⤵
- Modifies Windows Firewall
PID:5076
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Salwyrr Client Java 3b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\java.exe"2⤵
- Modifies Windows Firewall
PID:4656
-
-
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\.Salwyrr/launcher/bootstrap/jre/bin/javaw.exe" -Xmx1G -jar "launcher/bootstrap/updater.jar"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr "3⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5c4b9c07f7e2a1e6a51ca118d4905d34f
SHA1262da9282cd102f16f36465029b15b219fbf384e
SHA2566fdde68c5eeb93eccf9c4f95250168a08395af699341f75974e8bf61baaae6bb
SHA5123526c02d595cb95534d57dafec3697cd2c73dd42b12e5e478fc51ce32b5cc579e9d411d9747ac1b4c9d221a4946ced0f7dc656a83cfad7b616d4572334a2e601
-
Filesize
1.5MB
MD5c4b9c07f7e2a1e6a51ca118d4905d34f
SHA1262da9282cd102f16f36465029b15b219fbf384e
SHA2566fdde68c5eeb93eccf9c4f95250168a08395af699341f75974e8bf61baaae6bb
SHA5123526c02d595cb95534d57dafec3697cd2c73dd42b12e5e478fc51ce32b5cc579e9d411d9747ac1b4c9d221a4946ced0f7dc656a83cfad7b616d4572334a2e601
-
Filesize
1.5MB
MD5c4b9c07f7e2a1e6a51ca118d4905d34f
SHA1262da9282cd102f16f36465029b15b219fbf384e
SHA2566fdde68c5eeb93eccf9c4f95250168a08395af699341f75974e8bf61baaae6bb
SHA5123526c02d595cb95534d57dafec3697cd2c73dd42b12e5e478fc51ce32b5cc579e9d411d9747ac1b4c9d221a4946ced0f7dc656a83cfad7b616d4572334a2e601
-
Filesize
289KB
MD5b6fba6ae22db9079096a5587dd7a2c97
SHA1a05b98bb1ffc7b90748e41466fbad25ac922175c
SHA2565b402482eed87c163f2baf9cd152553419c2d43f64160f9b16cd8d24c084a713
SHA5129a57ed46201c250e1eb55693f2c0f8b02b32a927894e860166c9c654a0bda9dad15c9820a1c31e420c65d13934481e1780a40493314130a053ac9eb7bf6d8abc
-
Filesize
289KB
MD5b6fba6ae22db9079096a5587dd7a2c97
SHA1a05b98bb1ffc7b90748e41466fbad25ac922175c
SHA2565b402482eed87c163f2baf9cd152553419c2d43f64160f9b16cd8d24c084a713
SHA5129a57ed46201c250e1eb55693f2c0f8b02b32a927894e860166c9c654a0bda9dad15c9820a1c31e420c65d13934481e1780a40493314130a053ac9eb7bf6d8abc
-
Filesize
289KB
MD5b6fba6ae22db9079096a5587dd7a2c97
SHA1a05b98bb1ffc7b90748e41466fbad25ac922175c
SHA2565b402482eed87c163f2baf9cd152553419c2d43f64160f9b16cd8d24c084a713
SHA5129a57ed46201c250e1eb55693f2c0f8b02b32a927894e860166c9c654a0bda9dad15c9820a1c31e420c65d13934481e1780a40493314130a053ac9eb7bf6d8abc
-
Filesize
668KB
MD5277e4785d870b09c0db6a8f64ecbef38
SHA13887ffb67275ea6fdccd5a08a26cf319b4c19fcd
SHA256f9a68fade97385cc9b1a09cc6f223f16db382ef2e27002e5c0e0d3b4f77f7b25
SHA5124a9769d15dfec8219bfce6bccad11cf9b85329ce75f44071edd86f2894c26b277303548919c22b233062a99cfba840ecfa5ddd4db67dc4047de5007ba45ce90c
-
Filesize
668KB
MD5277e4785d870b09c0db6a8f64ecbef38
SHA13887ffb67275ea6fdccd5a08a26cf319b4c19fcd
SHA256f9a68fade97385cc9b1a09cc6f223f16db382ef2e27002e5c0e0d3b4f77f7b25
SHA5124a9769d15dfec8219bfce6bccad11cf9b85329ce75f44071edd86f2894c26b277303548919c22b233062a99cfba840ecfa5ddd4db67dc4047de5007ba45ce90c
-
Filesize
668KB
MD5277e4785d870b09c0db6a8f64ecbef38
SHA13887ffb67275ea6fdccd5a08a26cf319b4c19fcd
SHA256f9a68fade97385cc9b1a09cc6f223f16db382ef2e27002e5c0e0d3b4f77f7b25
SHA5124a9769d15dfec8219bfce6bccad11cf9b85329ce75f44071edd86f2894c26b277303548919c22b233062a99cfba840ecfa5ddd4db67dc4047de5007ba45ce90c
-
Filesize
160KB
MD50c4673c6d3fbb7b62b9d83b41893ee23
SHA1516a489686d0fab9f3223414969b347df79b3b64
SHA2568163acdbca856f15f8cb3d532cf79d906d94b4d58250911b0600fbed8b17fefa
SHA5120278fe0487a04d12f2c3745305506812e4d8e28c3a2d90f060e417a43129437a28809a081e371978a01499cd932497ef7e1f0c6c9675acb541ea2c5225fe32ba
-
Filesize
160KB
MD50c4673c6d3fbb7b62b9d83b41893ee23
SHA1516a489686d0fab9f3223414969b347df79b3b64
SHA2568163acdbca856f15f8cb3d532cf79d906d94b4d58250911b0600fbed8b17fefa
SHA5120278fe0487a04d12f2c3745305506812e4d8e28c3a2d90f060e417a43129437a28809a081e371978a01499cd932497ef7e1f0c6c9675acb541ea2c5225fe32ba
-
Filesize
160KB
MD50c4673c6d3fbb7b62b9d83b41893ee23
SHA1516a489686d0fab9f3223414969b347df79b3b64
SHA2568163acdbca856f15f8cb3d532cf79d906d94b4d58250911b0600fbed8b17fefa
SHA5120278fe0487a04d12f2c3745305506812e4d8e28c3a2d90f060e417a43129437a28809a081e371978a01499cd932497ef7e1f0c6c9675acb541ea2c5225fe32ba
-
Filesize
223KB
MD568f55ca782ebe9bb2f932e3a3d6ffd8a
SHA10f13e8e11ce24123bacf23a8b116bc777a0ac072
SHA2566e6517ee65b753af161608be59bafc72ba3f670e4c48a8eb7e30170b0f0ef80b
SHA512f6cc93e8b6f9f9ca72c870f2a1711c41bcba8d7ec7cd5d1003fb96e77f7700b1627738ed83493b863424edaba6e3821818b7977252edad3481bb4404c184c76d
-
Filesize
223KB
MD568f55ca782ebe9bb2f932e3a3d6ffd8a
SHA10f13e8e11ce24123bacf23a8b116bc777a0ac072
SHA2566e6517ee65b753af161608be59bafc72ba3f670e4c48a8eb7e30170b0f0ef80b
SHA512f6cc93e8b6f9f9ca72c870f2a1711c41bcba8d7ec7cd5d1003fb96e77f7700b1627738ed83493b863424edaba6e3821818b7977252edad3481bb4404c184c76d
-
Filesize
223KB
MD568f55ca782ebe9bb2f932e3a3d6ffd8a
SHA10f13e8e11ce24123bacf23a8b116bc777a0ac072
SHA2566e6517ee65b753af161608be59bafc72ba3f670e4c48a8eb7e30170b0f0ef80b
SHA512f6cc93e8b6f9f9ca72c870f2a1711c41bcba8d7ec7cd5d1003fb96e77f7700b1627738ed83493b863424edaba6e3821818b7977252edad3481bb4404c184c76d
-
Filesize
645KB
MD54e38c42ff10a1689cf277eadc895d374
SHA16e4934c413ff2943ab535c2f7590fda1f4ecf1c2
SHA256bdd61f3ec686965716c4c6048aa4ef46088739c63d6f314f37f691ef13fd22c3
SHA512b7e309e3c69a678793465af1c3041bd66adb88cc8c03362bf4b3941881d9f19905ede7fbb8e2fbc2ce0c05495aeef9af99ae17364f37661d0c635310c1b805bb
-
Filesize
645KB
MD54e38c42ff10a1689cf277eadc895d374
SHA16e4934c413ff2943ab535c2f7590fda1f4ecf1c2
SHA256bdd61f3ec686965716c4c6048aa4ef46088739c63d6f314f37f691ef13fd22c3
SHA512b7e309e3c69a678793465af1c3041bd66adb88cc8c03362bf4b3941881d9f19905ede7fbb8e2fbc2ce0c05495aeef9af99ae17364f37661d0c635310c1b805bb
-
Filesize
645KB
MD54e38c42ff10a1689cf277eadc895d374
SHA16e4934c413ff2943ab535c2f7590fda1f4ecf1c2
SHA256bdd61f3ec686965716c4c6048aa4ef46088739c63d6f314f37f691ef13fd22c3
SHA512b7e309e3c69a678793465af1c3041bd66adb88cc8c03362bf4b3941881d9f19905ede7fbb8e2fbc2ce0c05495aeef9af99ae17364f37661d0c635310c1b805bb
-
Filesize
944KB
MD5e9c471b35f7cb4eeccfd7bea873262ac
SHA15cd7885b5e81ac9d2fed4015b1080799ead0d384
SHA25669968e25a8f5554e7b09423a6da659ad6175a2c62725b0ae42a70c99f424cc69
SHA5121a7351cf3f205f804eb796b57cbcce49b4bcd8c0edc9c62af130df0d3f8b61d56663b51bf1caccce8ea1862dcc1b61d85dda36ab9fd2b6eb42d7d4d550eca2ca
-
Filesize
944KB
MD5e9c471b35f7cb4eeccfd7bea873262ac
SHA15cd7885b5e81ac9d2fed4015b1080799ead0d384
SHA25669968e25a8f5554e7b09423a6da659ad6175a2c62725b0ae42a70c99f424cc69
SHA5121a7351cf3f205f804eb796b57cbcce49b4bcd8c0edc9c62af130df0d3f8b61d56663b51bf1caccce8ea1862dcc1b61d85dda36ab9fd2b6eb42d7d4d550eca2ca
-
Filesize
944KB
MD5e9c471b35f7cb4eeccfd7bea873262ac
SHA15cd7885b5e81ac9d2fed4015b1080799ead0d384
SHA25669968e25a8f5554e7b09423a6da659ad6175a2c62725b0ae42a70c99f424cc69
SHA5121a7351cf3f205f804eb796b57cbcce49b4bcd8c0edc9c62af130df0d3f8b61d56663b51bf1caccce8ea1862dcc1b61d85dda36ab9fd2b6eb42d7d4d550eca2ca
-
Filesize
102KB
MD59e754437b50f98f5f6da016a0d9cd777
SHA134f66b933b1b0788b8099b58acb2e6381548df79
SHA25669192f419278bb0564494b398973d902124e216931cf118dcffb97d012ee9901
SHA51275353d17353881acffa57d1fd838b6aa95d0ad3437c784ed4ea0983139ee05565105293e38ccd630930c1c74144ea91e3971e01b63248b4cd9b87792cbdb1ab9
-
Filesize
102KB
MD59e754437b50f98f5f6da016a0d9cd777
SHA134f66b933b1b0788b8099b58acb2e6381548df79
SHA25669192f419278bb0564494b398973d902124e216931cf118dcffb97d012ee9901
SHA51275353d17353881acffa57d1fd838b6aa95d0ad3437c784ed4ea0983139ee05565105293e38ccd630930c1c74144ea91e3971e01b63248b4cd9b87792cbdb1ab9
-
Filesize
102KB
MD59e754437b50f98f5f6da016a0d9cd777
SHA134f66b933b1b0788b8099b58acb2e6381548df79
SHA25669192f419278bb0564494b398973d902124e216931cf118dcffb97d012ee9901
SHA51275353d17353881acffa57d1fd838b6aa95d0ad3437c784ed4ea0983139ee05565105293e38ccd630930c1c74144ea91e3971e01b63248b4cd9b87792cbdb1ab9
-
Filesize
65KB
MD533ea2c174aafe22daab1cb8682884140
SHA1864b69412d924c88b8460da66b07aa3db4652d67
SHA256f5d36bef73c1387049fc215a131159ff62a34118f9171937d3a0859a406b8300
SHA51293cc93cfba35e7c7998f47bbcb1b01856d17cfac4436b1fa0db6152c7989bdaed1beb49120a3e2fa223c82ede15fcf8b08b334620904b7fd06e091e1a9e06453
-
Filesize
65KB
MD533ea2c174aafe22daab1cb8682884140
SHA1864b69412d924c88b8460da66b07aa3db4652d67
SHA256f5d36bef73c1387049fc215a131159ff62a34118f9171937d3a0859a406b8300
SHA51293cc93cfba35e7c7998f47bbcb1b01856d17cfac4436b1fa0db6152c7989bdaed1beb49120a3e2fa223c82ede15fcf8b08b334620904b7fd06e091e1a9e06453
-
Filesize
65KB
MD533ea2c174aafe22daab1cb8682884140
SHA1864b69412d924c88b8460da66b07aa3db4652d67
SHA256f5d36bef73c1387049fc215a131159ff62a34118f9171937d3a0859a406b8300
SHA51293cc93cfba35e7c7998f47bbcb1b01856d17cfac4436b1fa0db6152c7989bdaed1beb49120a3e2fa223c82ede15fcf8b08b334620904b7fd06e091e1a9e06453
-
Filesize
8.4MB
MD562fffae8a5d1fc7cf105ae5cf0073ca5
SHA1bf4fcddf4551a36a211670581897beeeda898f9b
SHA2561689d8a76fd30487f63a1227a2a47d4f017a8eca0045eb4b04d06a876155e4bf
SHA512737324142c2c0d53bd7ac4f09552241c770f58051189397b59996688a2751396209df9d8c5f442a60858728b7e31a5885c011d74733f86301b3f52573bec0d86
-
Filesize
8.4MB
MD562fffae8a5d1fc7cf105ae5cf0073ca5
SHA1bf4fcddf4551a36a211670581897beeeda898f9b
SHA2561689d8a76fd30487f63a1227a2a47d4f017a8eca0045eb4b04d06a876155e4bf
SHA512737324142c2c0d53bd7ac4f09552241c770f58051189397b59996688a2751396209df9d8c5f442a60858728b7e31a5885c011d74733f86301b3f52573bec0d86
-
Filesize
8.4MB
MD562fffae8a5d1fc7cf105ae5cf0073ca5
SHA1bf4fcddf4551a36a211670581897beeeda898f9b
SHA2561689d8a76fd30487f63a1227a2a47d4f017a8eca0045eb4b04d06a876155e4bf
SHA512737324142c2c0d53bd7ac4f09552241c770f58051189397b59996688a2751396209df9d8c5f442a60858728b7e31a5885c011d74733f86301b3f52573bec0d86
-
Filesize
139KB
MD5a0990f0a1d3bd9222f7f97f3d9786efa
SHA163bc9c4ed285e977ae80e909a42d243ab873fa5c
SHA256660d0b884e9daf7ba050caed8e63f076336aafd8799ecfe1fbd9a95ce0df02f6
SHA512e5311eb8691561d45c4adab1ebcfd71baa66140345a70926709f28cf55d48577aceb37751412b6a29abc417da45f5a86f310e4c0fa6b68a8e0fabd4cc0b62a4d
-
Filesize
139KB
MD5a0990f0a1d3bd9222f7f97f3d9786efa
SHA163bc9c4ed285e977ae80e909a42d243ab873fa5c
SHA256660d0b884e9daf7ba050caed8e63f076336aafd8799ecfe1fbd9a95ce0df02f6
SHA512e5311eb8691561d45c4adab1ebcfd71baa66140345a70926709f28cf55d48577aceb37751412b6a29abc417da45f5a86f310e4c0fa6b68a8e0fabd4cc0b62a4d
-
Filesize
139KB
MD5a0990f0a1d3bd9222f7f97f3d9786efa
SHA163bc9c4ed285e977ae80e909a42d243ab873fa5c
SHA256660d0b884e9daf7ba050caed8e63f076336aafd8799ecfe1fbd9a95ce0df02f6
SHA512e5311eb8691561d45c4adab1ebcfd71baa66140345a70926709f28cf55d48577aceb37751412b6a29abc417da45f5a86f310e4c0fa6b68a8e0fabd4cc0b62a4d
-
Filesize
54KB
MD5e550fce5ee668230ae0b71bf702fde82
SHA18efbe790a626d70ec59f28ba907eabd9f13e7932
SHA25696cbf775c060744cf158d811b0f45c4abfa9a89d7ff9920ab1bbe05c283e8224
SHA5127a5a1270391a096a81c868e8c1cd9fe2cbb0dfea53c388c636c7e5c4012b13ebc7eee1b54b563b6def263874784b57c5b131757b393a1e5831958e3f18313106
-
Filesize
54KB
MD5e550fce5ee668230ae0b71bf702fde82
SHA18efbe790a626d70ec59f28ba907eabd9f13e7932
SHA25696cbf775c060744cf158d811b0f45c4abfa9a89d7ff9920ab1bbe05c283e8224
SHA5127a5a1270391a096a81c868e8c1cd9fe2cbb0dfea53c388c636c7e5c4012b13ebc7eee1b54b563b6def263874784b57c5b131757b393a1e5831958e3f18313106
-
Filesize
54KB
MD5e550fce5ee668230ae0b71bf702fde82
SHA18efbe790a626d70ec59f28ba907eabd9f13e7932
SHA25696cbf775c060744cf158d811b0f45c4abfa9a89d7ff9920ab1bbe05c283e8224
SHA5127a5a1270391a096a81c868e8c1cd9fe2cbb0dfea53c388c636c7e5c4012b13ebc7eee1b54b563b6def263874784b57c5b131757b393a1e5831958e3f18313106
-
Filesize
84KB
MD514eab665f7878d3de543e381cd6b1c59
SHA1b8495257225ca855a38edb88111b6a5a6c457e03
SHA2561ede94dd6c5521fbd22796ce171164c2712604eacaca0179112f5f0b93959c20
SHA5129058133e890678246bf9249dbfdf7020e3ba069e4c4e0b368e4e2fd06606ce975e6011d3370a95b7ec3527885b53d37fc87b405e7714a77352ea32e6f7a91a2f
-
Filesize
84KB
MD514eab665f7878d3de543e381cd6b1c59
SHA1b8495257225ca855a38edb88111b6a5a6c457e03
SHA2561ede94dd6c5521fbd22796ce171164c2712604eacaca0179112f5f0b93959c20
SHA5129058133e890678246bf9249dbfdf7020e3ba069e4c4e0b368e4e2fd06606ce975e6011d3370a95b7ec3527885b53d37fc87b405e7714a77352ea32e6f7a91a2f
-
Filesize
84KB
MD514eab665f7878d3de543e381cd6b1c59
SHA1b8495257225ca855a38edb88111b6a5a6c457e03
SHA2561ede94dd6c5521fbd22796ce171164c2712604eacaca0179112f5f0b93959c20
SHA5129058133e890678246bf9249dbfdf7020e3ba069e4c4e0b368e4e2fd06606ce975e6011d3370a95b7ec3527885b53d37fc87b405e7714a77352ea32e6f7a91a2f
-
Filesize
149B
MD52ed483df31645d3d00c625c00c1e5a14
SHA127c9b302d2d47aae04fc1f4ef9127a2835a77853
SHA25668ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
SHA5124bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da
-
Filesize
1KB
MD5c60e77ff5f3887c743971e73e6f0e0b1
SHA19b0cfd38ec5b7bd5bd1c364dee2e1b452a063c02
SHA25623f728cc2bf14e62d454190ea0139f159031b5bd9c3f141ca9237c4c5c96ec1d
SHA51207aca3de1a03a3b64b691fd41e35e6596760baf24c4f24e86fca87d2acf3a4814b17cd9751adc2dcd0689848f3d582fb3ee01d413e3a61d1d98397d72fe545e9
-
Filesize
4KB
MD50c68ed96d63206e174c469eb79f45623
SHA1427e91bfddaeec48ca2c4e1f1ee2476e932fa8e7
SHA25617a6f94438730f76215a54d635e792da209ed2e73a7ecde68480df4acd67868d
SHA5126cb60dee27e1c624f70e66afbd13a8f34be00c2e1070ceac73b19ed136261f4b9185705f239ea5f73a6643bfacc04b6bd5eece9016d7078c78288157eabcabcb
-
Filesize
9.7MB
MD58cc3d2ae8bd584aa50b3c2cb31d41296
SHA160a52c79669b6190fb64d303f43ecdee2febddfd
SHA2567901fdc730540b39636317efeeb3f73a632b068077ac43100c928a288719e349
SHA51218473bd6e365aca2390d68e8127ecc756b69f09d68e760e627e56f9037568b61fbd5dad81b6a12b48f1cd2fefac555d11cbf23a4fd22445f3aa74cf22be8d21f
-
Filesize
729B
MD5c13d39595f3ab17500d6963b323558a5
SHA165e8806bdc09e1433e0c9c4ccbce759a3db0df98
SHA256f3c5b6ec18f23aabcb3c33ae6972c5f65fc3220196e4a3081e25341ce530cf64
SHA5129e5821660a85337ad94a7d8dd488ca400e58046af7ab0785080b257c35d22462304b59d157579c3d79315a9d51bad3970988a8e45f34d8d741265f6e3ff202d1
-
Filesize
37KB
MD5d18aeb8c2924ecf099a595784335a2d8
SHA1b85c9bb17fc2c04e33e627f3c7ad7de0f6d2f093
SHA2569d40bd263a740d757848caa677014b26feca781c06c037abedd05bb84e6671b6
SHA512e71dc069b3e7c07ab65231eaed76efb70cd4fae71958de3a81ac54dba2399118842501ee414dd4e24a0e9fba536574f044d8a71e44e4344e44533d6a08d7e5be
-
Filesize
269KB
MD5796ebd3d14059d7c8522516a11fe2bfd
SHA19e4f18fdfcca7c15cf0b003e2bdfb66849b8eeb8
SHA2560d37bffbe2995cc5810a10e87244137d2f9c3cdf4577203d194be56507a48213
SHA512be0e9022ba85b93c17041067e7fe80399af62bfa7f443117100033dba1fdecb26ce023a7034a51b26dd5f58f01c79dde604c301fc93b19b30bbb137dfb23a141
-
Filesize
3KB
MD548b8858d27494a66594b59695d6dc60b
SHA11d3bff1e17ef6b5563cbd0762c2867b36fbdad95
SHA2563f1792188ae901eca47b64728776d35095dc0220d5c929d0da99a2427877c3b2
SHA5125d814990cff9f787723c629e22b30a2abfc9c8df0a712c2a7cb7b11ec52ddb083cb67c2158eeea2cc03d763aa308c9a271ac7cb7c88a96e4e4c029dd95b7656c
-
Filesize
94KB
MD5370320b75a692da11c577049511d72f7
SHA1c82d11222c0d90da62471f2bd5035190a66af591
SHA256b0c1d61a8cc03193020349653216a482b5924fb0dc3310a0fdb8f00261d3a194
SHA512fbcd5428a90cb809b80f7b53c94a960948799559ef5ca42812742460204bed87aee1fa03a124686085d9c3bb4e3ef767eb52aa3be883b0b51137edf3a18d725a
-
Filesize
868KB
MD5a5baca209f6b3e144e44029aee4ab71b
SHA1419586d970faed52472dae63065c3d7ccc4d27c0
SHA25658b290db3417a178c4e1d33bbfdd05f89981e328e70a83d98cc1fc91f8e7d911
SHA512c855fdd1a1836913a07c9d1353a62d00d6e5d88f4701fdf303877a7faa59074c525e8da59a9af0072455657069bda9e51f452d6b56c34faec1c22a35aabffa5a
-
Filesize
1.8MB
MD507bb3c71f1c17925da6309f088cdd3a3
SHA17e248490e7913bdfe5a8adca0f63cf2e8bb7f690
SHA25601ce4ad1ca12b28b6d8f415444dbe63637ca6c4ee6370ec4cd563c50aac8b2c4
SHA512667553e4fb35a1ffd40a94ea56e6c2fdd652e85c588a51d67e22c25964e6ba690b8fc5194b0ebfd774f5cb6f551551d01119cb5c6b8ade6017441b02acf882b4
-
Filesize
1KB
MD583964354d8e8e69dfc1001f01682bd70
SHA11f2012a464683ccc1c284d51b20778811641b2ee
SHA256dff270e76bd7d851cbcf79702aebd71122c3a9e93836ae4e9f650234a754b5c3
SHA5124be6e0c8ed2bd2f59286bbfa5041676f352e32731e070d7c26511e1e570bd8d6940ff2cc59b0e1656c9c8b3f86186a34709dbf19c303d80840307dacc39d9956
-
Filesize
5KB
MD58bc6628d01bad30798440cc00f638165
SHA1fd9471742eb759f4478bb1de9a0dc0527265b6ea
SHA25631ce7ce29c66a1696a985a197195b5e051b2c243ea83e9d1de614f0c4b4f7530
SHA5128da3439774a07a6309f985d1a29dda5383975bbdf6b8e2809bab69a2c44f65d3de2a546231ed6e183864193f834c9a7042fdcc4ee10181d0bd3891363032c242
-
Filesize
3.4MB
MD508d82a80c0c8b2ffa3269d57bdf2913e
SHA1b28954deffc8695b4837ab50c0e46f71378e70de
SHA256089c004ed032d33b43d70fb3a7d83f551037df37a4d59569f550f58626fc1f47
SHA512cef66b28dfdcc399751bf0082d7c216c76e945be269db8fb0e2573d45bcd4a2ded0aebe2eea584fccca1fb3d740f7f5f743d6a4f22855db1df062cceabafa909
-
Filesize
60.2MB
MD50070af149ddf6e36268ae49ccbbb9a65
SHA164dd548ece5f88717b96a2bdc63d1d40cf6192ce
SHA2565233b5c2ab1da4cba5bf180b38bfc07f086fd0228621e71f73d6e0b5fa8db85e
SHA5121c2918114d9ae3c5ce3117168c16c85b2a877f7bf5cf734806246c254dae21f00cdf179181c7290b79be71113d5415d2b37d39ff0db195e951d3282c34e68134
-
Filesize
53KB
MD5f493af6814af8e96ca9837ce371cc23d
SHA18e5e6a29534ee0f6d7722ad902906b8cb2371788
SHA25616193caa769dec20886a57b3863a431a17de7374a8a13c4a342207be191ab40a
SHA512fc8ab5b239e565840ad56fbfddb355153b2b4b41891b85c7be6cbc1f59a8d630be042e21f96434d630cb57e439c95bd057efe721fc2c469ddc1f06781ec9e9fe
-
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\security\policy\unlimited\US_export_policy.jar
Filesize619B
MD54cdb7e49d67539088cbf4b32693d67c3
SHA1dcc2adf5dcb0ff71af1c3b84e5669c5552d1d47e
SHA25604f4fc5ce823280af75a28bcf9b6fb8c2993dc84a533b45e4b9ee18d1093eee1
SHA5126923b8a46f3e9d25019c42a1ba4c2a762018669763fa519b91a2400f27d82ab60dbb9ab8d646da27e960ed5da6094b722b22be5c799159fa3416400229f3f92c
-
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\security\policy\unlimited\local_policy.jar
Filesize637B
MD5f806291db11e776452ccecf758baa9a9
SHA1fe361d784a529ff865a82f4a25a2b73f67781937
SHA256e854c3f944227acd80ec4753b845cf633cf94e59c936fbe949f4602255933286
SHA5129ea508ee6cc335982b70333c86aa3c1099c957cf613987680b1cfcf9c8a2350b7c77983b98d86b2e78ed94d0421bb901c3a6cd06f406e16bfbe249cb08b4213c
-
Filesize
104KB
MD517208383ffe68cf141246532061f735e
SHA10b43a496dc4f589212e983bbbf05d9059de72c82
SHA2567a6e97bacf6077760c3db41a21d8688876c36ac3350ba2a40f39dd094a0609c4
SHA512d01f59a5970e99567fb654073dc57ce4074b0dd048b46c35b0902740bed5d76dc3a4644548cc34b1cb5d6b977a320f9603aa272480de06125fe5f86107088721
-
Filesize
9KB
MD562bc9fa21191d34f1db3ed7ad5106efa
SHA1750cc36b35487d6054e039469039aece3a0cc9e9
SHA25683755efbcb24476f61b7b57bcf54707161678431347e5de2d7b894d022a0089a
SHA512af0ddb1bc2e9838b8f37dc196d26024126ac989f5b632cb2a8efdc29fbce289b4d0bac587fe23f17dfb6905ceada8d07b18508db78f226b15b15900738f581a3
-
Filesize
807KB
MD5a616e898ea735980492f41da00f88f39
SHA16de46eb8ddc768bb6652d45fe59904371e153c5d
SHA256f018c09f5f093f5aa02fe54efb36d2c79382da298bdd16731f22a51ad69bf240
SHA512130337c5738e9cee84dff629c5d4a34f9b2bbf587e7b0eaa518075a76a8086854e7604c9ae23455eca239fbbf36c3c1472b477d306a347a1dba9b1c63c61ee3d
-
Filesize
3.9MB
MD5a7cae50be0f0efbc4b2615679ea0a4de
SHA1ec466e117fd221170f2d7ac8b7966d2fe314999a
SHA25681ab6677e3b37fb3d1a1dad4bb7ce7026d532f80985839376e5d00f8d6b7f8cd
SHA512300b0108507a7e775faa1f6c161387950f542431049aeacd5b4dc0e18b4d748342882612a3df07f32e5188789e50090ea5a440bc55ea359e5798a80a69566031
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2295526160-1155304984-640977766-1000\83aa4cc77f591dfc2374580bbd95f6ba_4b401a7f-b7c1-4c1c-a9cf-2b1aa260545d
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd