413a460fae724b972ab9c52aeab029552245555c7df5b79eb2a6529e1dd7a090

Analysis

max time kernel
206s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2023, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Salwyrr Launcher Installer.exe
Size

46KB
MD5

38633bfef3c1fe505a39a688b5c31828
SHA1

4e053e5ca9e8bfcf372b4331b18c36d637332bbc
SHA256

413a460fae724b972ab9c52aeab029552245555c7df5b79eb2a6529e1dd7a090
SHA512

812ebfa26ff63ade8ab4851230fe47c0ffb797b5a8c48d6ab7ad3293a4995c088bedb8ca7ad6c48a63b3c7f60cdf5b2b318b39dc232ef2096721aba7734ea8f7
SSDEEP

768:PE55gC6d1VepljbMBMxECL67qtjMGF9TtgmAtugTtyKr:svh6dTepljLEf44u4mMuAyKr

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 12 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2500	netsh.exe
4528	netsh.exe
1408	netsh.exe
4264	netsh.exe
4996	netsh.exe
4548	netsh.exe
1972	netsh.exe
4004	netsh.exe
1460	netsh.exe
4104	netsh.exe
1120	netsh.exe
5084	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
5012	javaw.exe
444	javaw.exe
2884	javaw.exe
2080	javaw.exe
4576	javaw.exe
916	javaw.exe

Loads dropped DLL 64 IoCs

pid	Process
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
5012	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
444	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2884	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
2080	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
4576	javaw.exe
916	javaw.exe
916	javaw.exe
916	javaw.exe
916	javaw.exe
916	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	64	WerFault.exe	77

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	Salwyrr Launcher Installer.exe
Token: SeCreateGlobalPrivilege	4256	dwm.exe
Token: SeChangeNotifyPrivilege	4256	dwm.exe
Token: 33	4256	dwm.exe
Token: SeIncBasePriorityPrivilege	4256	dwm.exe
Token: SeShutdownPrivilege	4256	dwm.exe
Token: SeCreatePagefilePrivilege	4256	dwm.exe
Token: SeShutdownPrivilege	4256	dwm.exe
Token: SeCreatePagefilePrivilege	4256	dwm.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
5012	javaw.exe
5012	javaw.exe
444	javaw.exe
444	javaw.exe
2884	javaw.exe
2884	javaw.exe
2080	javaw.exe
4576	javaw.exe
4576	javaw.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 5084	3624	Salwyrr Launcher Installer.exe	85
PID 3624 wrote to memory of 5084	3624	Salwyrr Launcher Installer.exe	85
PID 3624 wrote to memory of 5084	3624	Salwyrr Launcher Installer.exe	85
PID 3624 wrote to memory of 4548	3624	Salwyrr Launcher Installer.exe	87
PID 3624 wrote to memory of 4548	3624	Salwyrr Launcher Installer.exe	87
PID 3624 wrote to memory of 4548	3624	Salwyrr Launcher Installer.exe	87
PID 3624 wrote to memory of 4996	3624	Salwyrr Launcher Installer.exe	89
PID 3624 wrote to memory of 4996	3624	Salwyrr Launcher Installer.exe	89
PID 3624 wrote to memory of 4996	3624	Salwyrr Launcher Installer.exe	89
PID 3624 wrote to memory of 2500	3624	Salwyrr Launcher Installer.exe	91
PID 3624 wrote to memory of 2500	3624	Salwyrr Launcher Installer.exe	91
PID 3624 wrote to memory of 2500	3624	Salwyrr Launcher Installer.exe	91
PID 3624 wrote to memory of 4528	3624	Salwyrr Launcher Installer.exe	93
PID 3624 wrote to memory of 4528	3624	Salwyrr Launcher Installer.exe	93
PID 3624 wrote to memory of 4528	3624	Salwyrr Launcher Installer.exe	93
PID 3624 wrote to memory of 1408	3624	Salwyrr Launcher Installer.exe	95
PID 3624 wrote to memory of 1408	3624	Salwyrr Launcher Installer.exe	95
PID 3624 wrote to memory of 1408	3624	Salwyrr Launcher Installer.exe	95
PID 3624 wrote to memory of 1972	3624	Salwyrr Launcher Installer.exe	97
PID 3624 wrote to memory of 1972	3624	Salwyrr Launcher Installer.exe	97
PID 3624 wrote to memory of 1972	3624	Salwyrr Launcher Installer.exe	97
PID 3624 wrote to memory of 4004	3624	Salwyrr Launcher Installer.exe	99
PID 3624 wrote to memory of 4004	3624	Salwyrr Launcher Installer.exe	99
PID 3624 wrote to memory of 4004	3624	Salwyrr Launcher Installer.exe	99
PID 3624 wrote to memory of 1460	3624	Salwyrr Launcher Installer.exe	101
PID 3624 wrote to memory of 1460	3624	Salwyrr Launcher Installer.exe	101
PID 3624 wrote to memory of 1460	3624	Salwyrr Launcher Installer.exe	101
PID 3624 wrote to memory of 4104	3624	Salwyrr Launcher Installer.exe	103
PID 3624 wrote to memory of 4104	3624	Salwyrr Launcher Installer.exe	103
PID 3624 wrote to memory of 4104	3624	Salwyrr Launcher Installer.exe	103
PID 3624 wrote to memory of 1120	3624	Salwyrr Launcher Installer.exe	105
PID 3624 wrote to memory of 1120	3624	Salwyrr Launcher Installer.exe	105
PID 3624 wrote to memory of 1120	3624	Salwyrr Launcher Installer.exe	105
PID 3624 wrote to memory of 4264	3624	Salwyrr Launcher Installer.exe	107
PID 3624 wrote to memory of 4264	3624	Salwyrr Launcher Installer.exe	107
PID 3624 wrote to memory of 4264	3624	Salwyrr Launcher Installer.exe	107
PID 3624 wrote to memory of 5012	3624	Salwyrr Launcher Installer.exe	114
PID 3624 wrote to memory of 5012	3624	Salwyrr Launcher Installer.exe	114
PID 5012 wrote to memory of 1304	5012	javaw.exe	118
PID 5012 wrote to memory of 1304	5012	javaw.exe	118
PID 1304 wrote to memory of 444	1304	cmd.exe	120
PID 1304 wrote to memory of 444	1304	cmd.exe	120
PID 2884 wrote to memory of 4992	2884	javaw.exe	128
PID 2884 wrote to memory of 4992	2884	javaw.exe	128
PID 4992 wrote to memory of 2080	4992	cmd.exe	130
PID 4992 wrote to memory of 2080	4992	cmd.exe	130
PID 4576 wrote to memory of 5088	4576	javaw.exe	132
PID 4576 wrote to memory of 5088	4576	javaw.exe	132
PID 5088 wrote to memory of 916	5088	cmd.exe	134
PID 5088 wrote to memory of 916	5088	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher Installer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall show rule name="Salwyrr Client Java 1a"
  2⤵
  - Modifies Windows Firewall
  PID:5084
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall add rule name="Salwyrr Client Java 1a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe"
  2⤵
  - Modifies Windows Firewall
  PID:4548
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall show rule name="Salwyrr Client Java 2a"
  2⤵
  - Modifies Windows Firewall
  PID:4996
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall add rule name="Salwyrr Client Java 2a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\javaw.exe"
  2⤵
  - Modifies Windows Firewall
  PID:2500
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall show rule name="Salwyrr Client Java 3a"
  2⤵
  - Modifies Windows Firewall
  PID:4528
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall add rule name="Salwyrr Client Java 3a" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\javaw.exe"
  2⤵
  - Modifies Windows Firewall
  PID:1408
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall show rule name="Salwyrr Client Java 1b"
  2⤵
  - Modifies Windows Firewall
  PID:1972
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall add rule name="Salwyrr Client Java 1b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\java.exe"
  2⤵
  - Modifies Windows Firewall
  PID:4004
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall show rule name="Salwyrr Client Java 2b"
  2⤵
  - Modifies Windows Firewall
  PID:1460
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall add rule name="Salwyrr Client Java 2b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\jre\bin\java.exe"
  2⤵
  - Modifies Windows Firewall
  PID:4104
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall show rule name="Salwyrr Client Java 3b"
  2⤵
  - Modifies Windows Firewall
  PID:1120
- C:\Windows\SysWOW64\netsh.exe
  "netsh" advfirewall firewall add rule name="Salwyrr Client Java 3b" dir=in action=allow protocol=any localip=any remoteip=any program="C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\java-runtime-alpha\bin\java.exe"
  2⤵
  - Modifies Windows Firewall
  PID:4264
- C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe
  "C:\Users\Admin\AppData\Roaming\.Salwyrr/launcher/bootstrap/jre/bin/javaw.exe" -Xmx1G -jar "launcher/bootstrap/updater.jar"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c ""C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe
      "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:444

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 64 -ip 64
1⤵
PID:3588

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 64 -s 3388
1⤵
- Program crash
PID:1536

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\updater.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe
    "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2080

C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\updater.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe
    "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw" -Xmx512m -cp "C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar" fr.salwyrr.launcher.frames.Main --salwyrr salwyrr
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\awt.dll

Filesize
1.5MB

MD5
c4b9c07f7e2a1e6a51ca118d4905d34f

SHA1
262da9282cd102f16f36465029b15b219fbf384e

SHA256
6fdde68c5eeb93eccf9c4f95250168a08395af699341f75974e8bf61baaae6bb

SHA512
3526c02d595cb95534d57dafec3697cd2c73dd42b12e5e478fc51ce32b5cc579e9d411d9747ac1b4c9d221a4946ced0f7dc656a83cfad7b616d4572334a2e601

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\awt.dll

Filesize
1.5MB

MD5
c4b9c07f7e2a1e6a51ca118d4905d34f

SHA1
262da9282cd102f16f36465029b15b219fbf384e

SHA256
6fdde68c5eeb93eccf9c4f95250168a08395af699341f75974e8bf61baaae6bb

SHA512
3526c02d595cb95534d57dafec3697cd2c73dd42b12e5e478fc51ce32b5cc579e9d411d9747ac1b4c9d221a4946ced0f7dc656a83cfad7b616d4572334a2e601

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\awt.dll

Filesize
1.5MB

MD5
c4b9c07f7e2a1e6a51ca118d4905d34f

SHA1
262da9282cd102f16f36465029b15b219fbf384e

SHA256
6fdde68c5eeb93eccf9c4f95250168a08395af699341f75974e8bf61baaae6bb

SHA512
3526c02d595cb95534d57dafec3697cd2c73dd42b12e5e478fc51ce32b5cc579e9d411d9747ac1b4c9d221a4946ced0f7dc656a83cfad7b616d4572334a2e601

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\fontmanager.dll

Filesize
289KB

MD5
b6fba6ae22db9079096a5587dd7a2c97

SHA1
a05b98bb1ffc7b90748e41466fbad25ac922175c

SHA256
5b402482eed87c163f2baf9cd152553419c2d43f64160f9b16cd8d24c084a713

SHA512
9a57ed46201c250e1eb55693f2c0f8b02b32a927894e860166c9c654a0bda9dad15c9820a1c31e420c65d13934481e1780a40493314130a053ac9eb7bf6d8abc

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\fontmanager.dll

Filesize
289KB

MD5
b6fba6ae22db9079096a5587dd7a2c97

SHA1
a05b98bb1ffc7b90748e41466fbad25ac922175c

SHA256
5b402482eed87c163f2baf9cd152553419c2d43f64160f9b16cd8d24c084a713

SHA512
9a57ed46201c250e1eb55693f2c0f8b02b32a927894e860166c9c654a0bda9dad15c9820a1c31e420c65d13934481e1780a40493314130a053ac9eb7bf6d8abc

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\fontmanager.dll

Filesize
289KB

MD5
b6fba6ae22db9079096a5587dd7a2c97

SHA1
a05b98bb1ffc7b90748e41466fbad25ac922175c

SHA256
5b402482eed87c163f2baf9cd152553419c2d43f64160f9b16cd8d24c084a713

SHA512
9a57ed46201c250e1eb55693f2c0f8b02b32a927894e860166c9c654a0bda9dad15c9820a1c31e420c65d13934481e1780a40493314130a053ac9eb7bf6d8abc

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\freetype.dll

Filesize
668KB

MD5
277e4785d870b09c0db6a8f64ecbef38

SHA1
3887ffb67275ea6fdccd5a08a26cf319b4c19fcd

SHA256
f9a68fade97385cc9b1a09cc6f223f16db382ef2e27002e5c0e0d3b4f77f7b25

SHA512
4a9769d15dfec8219bfce6bccad11cf9b85329ce75f44071edd86f2894c26b277303548919c22b233062a99cfba840ecfa5ddd4db67dc4047de5007ba45ce90c

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\freetype.dll

Filesize
668KB

MD5
277e4785d870b09c0db6a8f64ecbef38

SHA1
3887ffb67275ea6fdccd5a08a26cf319b4c19fcd

SHA256
f9a68fade97385cc9b1a09cc6f223f16db382ef2e27002e5c0e0d3b4f77f7b25

SHA512
4a9769d15dfec8219bfce6bccad11cf9b85329ce75f44071edd86f2894c26b277303548919c22b233062a99cfba840ecfa5ddd4db67dc4047de5007ba45ce90c

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\freetype.dll

Filesize
668KB

MD5
277e4785d870b09c0db6a8f64ecbef38

SHA1
3887ffb67275ea6fdccd5a08a26cf319b4c19fcd

SHA256
f9a68fade97385cc9b1a09cc6f223f16db382ef2e27002e5c0e0d3b4f77f7b25

SHA512
4a9769d15dfec8219bfce6bccad11cf9b85329ce75f44071edd86f2894c26b277303548919c22b233062a99cfba840ecfa5ddd4db67dc4047de5007ba45ce90c

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\java.dll

Filesize
160KB

MD5
0c4673c6d3fbb7b62b9d83b41893ee23

SHA1
516a489686d0fab9f3223414969b347df79b3b64

SHA256
8163acdbca856f15f8cb3d532cf79d906d94b4d58250911b0600fbed8b17fefa

SHA512
0278fe0487a04d12f2c3745305506812e4d8e28c3a2d90f060e417a43129437a28809a081e371978a01499cd932497ef7e1f0c6c9675acb541ea2c5225fe32ba

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\java.dll

Filesize
160KB

MD5
0c4673c6d3fbb7b62b9d83b41893ee23

SHA1
516a489686d0fab9f3223414969b347df79b3b64

SHA256
8163acdbca856f15f8cb3d532cf79d906d94b4d58250911b0600fbed8b17fefa

SHA512
0278fe0487a04d12f2c3745305506812e4d8e28c3a2d90f060e417a43129437a28809a081e371978a01499cd932497ef7e1f0c6c9675acb541ea2c5225fe32ba

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\java.dll

Filesize
160KB

MD5
0c4673c6d3fbb7b62b9d83b41893ee23

SHA1
516a489686d0fab9f3223414969b347df79b3b64

SHA256
8163acdbca856f15f8cb3d532cf79d906d94b4d58250911b0600fbed8b17fefa

SHA512
0278fe0487a04d12f2c3745305506812e4d8e28c3a2d90f060e417a43129437a28809a081e371978a01499cd932497ef7e1f0c6c9675acb541ea2c5225fe32ba

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe

Filesize
223KB

MD5
68f55ca782ebe9bb2f932e3a3d6ffd8a

SHA1
0f13e8e11ce24123bacf23a8b116bc777a0ac072

SHA256
6e6517ee65b753af161608be59bafc72ba3f670e4c48a8eb7e30170b0f0ef80b

SHA512
f6cc93e8b6f9f9ca72c870f2a1711c41bcba8d7ec7cd5d1003fb96e77f7700b1627738ed83493b863424edaba6e3821818b7977252edad3481bb4404c184c76d

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe

Filesize
223KB

MD5
68f55ca782ebe9bb2f932e3a3d6ffd8a

SHA1
0f13e8e11ce24123bacf23a8b116bc777a0ac072

SHA256
6e6517ee65b753af161608be59bafc72ba3f670e4c48a8eb7e30170b0f0ef80b

SHA512
f6cc93e8b6f9f9ca72c870f2a1711c41bcba8d7ec7cd5d1003fb96e77f7700b1627738ed83493b863424edaba6e3821818b7977252edad3481bb4404c184c76d

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\javaw.exe

Filesize
223KB

MD5
68f55ca782ebe9bb2f932e3a3d6ffd8a

SHA1
0f13e8e11ce24123bacf23a8b116bc777a0ac072

SHA256
6e6517ee65b753af161608be59bafc72ba3f670e4c48a8eb7e30170b0f0ef80b

SHA512
f6cc93e8b6f9f9ca72c870f2a1711c41bcba8d7ec7cd5d1003fb96e77f7700b1627738ed83493b863424edaba6e3821818b7977252edad3481bb4404c184c76d

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\msvcp120.dll

Filesize
645KB

MD5
4e38c42ff10a1689cf277eadc895d374

SHA1
6e4934c413ff2943ab535c2f7590fda1f4ecf1c2

SHA256
bdd61f3ec686965716c4c6048aa4ef46088739c63d6f314f37f691ef13fd22c3

SHA512
b7e309e3c69a678793465af1c3041bd66adb88cc8c03362bf4b3941881d9f19905ede7fbb8e2fbc2ce0c05495aeef9af99ae17364f37661d0c635310c1b805bb

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\msvcp120.dll

Filesize
645KB

MD5
4e38c42ff10a1689cf277eadc895d374

SHA1
6e4934c413ff2943ab535c2f7590fda1f4ecf1c2

SHA256
bdd61f3ec686965716c4c6048aa4ef46088739c63d6f314f37f691ef13fd22c3

SHA512
b7e309e3c69a678793465af1c3041bd66adb88cc8c03362bf4b3941881d9f19905ede7fbb8e2fbc2ce0c05495aeef9af99ae17364f37661d0c635310c1b805bb

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\msvcp120.dll

Filesize
645KB

MD5
4e38c42ff10a1689cf277eadc895d374

SHA1
6e4934c413ff2943ab535c2f7590fda1f4ecf1c2

SHA256
bdd61f3ec686965716c4c6048aa4ef46088739c63d6f314f37f691ef13fd22c3

SHA512
b7e309e3c69a678793465af1c3041bd66adb88cc8c03362bf4b3941881d9f19905ede7fbb8e2fbc2ce0c05495aeef9af99ae17364f37661d0c635310c1b805bb

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\msvcr120.dll

Filesize
944KB

MD5
e9c471b35f7cb4eeccfd7bea873262ac

SHA1
5cd7885b5e81ac9d2fed4015b1080799ead0d384

SHA256
69968e25a8f5554e7b09423a6da659ad6175a2c62725b0ae42a70c99f424cc69

SHA512
1a7351cf3f205f804eb796b57cbcce49b4bcd8c0edc9c62af130df0d3f8b61d56663b51bf1caccce8ea1862dcc1b61d85dda36ab9fd2b6eb42d7d4d550eca2ca

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\msvcr120.dll

Filesize
944KB

MD5
e9c471b35f7cb4eeccfd7bea873262ac

SHA1
5cd7885b5e81ac9d2fed4015b1080799ead0d384

SHA256
69968e25a8f5554e7b09423a6da659ad6175a2c62725b0ae42a70c99f424cc69

SHA512
1a7351cf3f205f804eb796b57cbcce49b4bcd8c0edc9c62af130df0d3f8b61d56663b51bf1caccce8ea1862dcc1b61d85dda36ab9fd2b6eb42d7d4d550eca2ca

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\msvcr120.dll

Filesize
944KB

MD5
e9c471b35f7cb4eeccfd7bea873262ac

SHA1
5cd7885b5e81ac9d2fed4015b1080799ead0d384

SHA256
69968e25a8f5554e7b09423a6da659ad6175a2c62725b0ae42a70c99f424cc69

SHA512
1a7351cf3f205f804eb796b57cbcce49b4bcd8c0edc9c62af130df0d3f8b61d56663b51bf1caccce8ea1862dcc1b61d85dda36ab9fd2b6eb42d7d4d550eca2ca

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\net.dll

Filesize
102KB

MD5
9e754437b50f98f5f6da016a0d9cd777

SHA1
34f66b933b1b0788b8099b58acb2e6381548df79

SHA256
69192f419278bb0564494b398973d902124e216931cf118dcffb97d012ee9901

SHA512
75353d17353881acffa57d1fd838b6aa95d0ad3437c784ed4ea0983139ee05565105293e38ccd630930c1c74144ea91e3971e01b63248b4cd9b87792cbdb1ab9

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\net.dll

Filesize
102KB

MD5
9e754437b50f98f5f6da016a0d9cd777

SHA1
34f66b933b1b0788b8099b58acb2e6381548df79

SHA256
69192f419278bb0564494b398973d902124e216931cf118dcffb97d012ee9901

SHA512
75353d17353881acffa57d1fd838b6aa95d0ad3437c784ed4ea0983139ee05565105293e38ccd630930c1c74144ea91e3971e01b63248b4cd9b87792cbdb1ab9

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\net.dll

Filesize
102KB

MD5
9e754437b50f98f5f6da016a0d9cd777

SHA1
34f66b933b1b0788b8099b58acb2e6381548df79

SHA256
69192f419278bb0564494b398973d902124e216931cf118dcffb97d012ee9901

SHA512
75353d17353881acffa57d1fd838b6aa95d0ad3437c784ed4ea0983139ee05565105293e38ccd630930c1c74144ea91e3971e01b63248b4cd9b87792cbdb1ab9

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\nio.dll

Filesize
65KB

MD5
33ea2c174aafe22daab1cb8682884140

SHA1
864b69412d924c88b8460da66b07aa3db4652d67

SHA256
f5d36bef73c1387049fc215a131159ff62a34118f9171937d3a0859a406b8300

SHA512
93cc93cfba35e7c7998f47bbcb1b01856d17cfac4436b1fa0db6152c7989bdaed1beb49120a3e2fa223c82ede15fcf8b08b334620904b7fd06e091e1a9e06453

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\nio.dll

Filesize
65KB

MD5
33ea2c174aafe22daab1cb8682884140

SHA1
864b69412d924c88b8460da66b07aa3db4652d67

SHA256
f5d36bef73c1387049fc215a131159ff62a34118f9171937d3a0859a406b8300

SHA512
93cc93cfba35e7c7998f47bbcb1b01856d17cfac4436b1fa0db6152c7989bdaed1beb49120a3e2fa223c82ede15fcf8b08b334620904b7fd06e091e1a9e06453

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\nio.dll

Filesize
65KB

MD5
33ea2c174aafe22daab1cb8682884140

SHA1
864b69412d924c88b8460da66b07aa3db4652d67

SHA256
f5d36bef73c1387049fc215a131159ff62a34118f9171937d3a0859a406b8300

SHA512
93cc93cfba35e7c7998f47bbcb1b01856d17cfac4436b1fa0db6152c7989bdaed1beb49120a3e2fa223c82ede15fcf8b08b334620904b7fd06e091e1a9e06453

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\server\jvm.dll

Filesize
8.4MB

MD5
62fffae8a5d1fc7cf105ae5cf0073ca5

SHA1
bf4fcddf4551a36a211670581897beeeda898f9b

SHA256
1689d8a76fd30487f63a1227a2a47d4f017a8eca0045eb4b04d06a876155e4bf

SHA512
737324142c2c0d53bd7ac4f09552241c770f58051189397b59996688a2751396209df9d8c5f442a60858728b7e31a5885c011d74733f86301b3f52573bec0d86

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\server\jvm.dll

Filesize
8.4MB

MD5
62fffae8a5d1fc7cf105ae5cf0073ca5

SHA1
bf4fcddf4551a36a211670581897beeeda898f9b

SHA256
1689d8a76fd30487f63a1227a2a47d4f017a8eca0045eb4b04d06a876155e4bf

SHA512
737324142c2c0d53bd7ac4f09552241c770f58051189397b59996688a2751396209df9d8c5f442a60858728b7e31a5885c011d74733f86301b3f52573bec0d86

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\server\jvm.dll

Filesize
8.4MB

MD5
62fffae8a5d1fc7cf105ae5cf0073ca5

SHA1
bf4fcddf4551a36a211670581897beeeda898f9b

SHA256
1689d8a76fd30487f63a1227a2a47d4f017a8eca0045eb4b04d06a876155e4bf

SHA512
737324142c2c0d53bd7ac4f09552241c770f58051189397b59996688a2751396209df9d8c5f442a60858728b7e31a5885c011d74733f86301b3f52573bec0d86

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\sunec.dll

Filesize
139KB

MD5
a0990f0a1d3bd9222f7f97f3d9786efa

SHA1
63bc9c4ed285e977ae80e909a42d243ab873fa5c

SHA256
660d0b884e9daf7ba050caed8e63f076336aafd8799ecfe1fbd9a95ce0df02f6

SHA512
e5311eb8691561d45c4adab1ebcfd71baa66140345a70926709f28cf55d48577aceb37751412b6a29abc417da45f5a86f310e4c0fa6b68a8e0fabd4cc0b62a4d

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\sunec.dll

Filesize
139KB

MD5
a0990f0a1d3bd9222f7f97f3d9786efa

SHA1
63bc9c4ed285e977ae80e909a42d243ab873fa5c

SHA256
660d0b884e9daf7ba050caed8e63f076336aafd8799ecfe1fbd9a95ce0df02f6

SHA512
e5311eb8691561d45c4adab1ebcfd71baa66140345a70926709f28cf55d48577aceb37751412b6a29abc417da45f5a86f310e4c0fa6b68a8e0fabd4cc0b62a4d

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\sunec.dll

Filesize
139KB

MD5
a0990f0a1d3bd9222f7f97f3d9786efa

SHA1
63bc9c4ed285e977ae80e909a42d243ab873fa5c

SHA256
660d0b884e9daf7ba050caed8e63f076336aafd8799ecfe1fbd9a95ce0df02f6

SHA512
e5311eb8691561d45c4adab1ebcfd71baa66140345a70926709f28cf55d48577aceb37751412b6a29abc417da45f5a86f310e4c0fa6b68a8e0fabd4cc0b62a4d

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\sunmscapi.dll

Filesize
42KB

MD5
73369292dd8fd350da1f9cd298896103

SHA1
f3d794402aab2cfe31c229ce759c237ba35f4eb6

SHA256
f465e578387bb1662cbd46ff6000e29b0c03c16d88c1ef2d228eb6c6e67445ac

SHA512
cb8fc44903d0bec4298f5e6a21ac3f4ebeb7aec7e5ac823b1d3f5e83d12800dda0e58ff54ca6dd7e8c560d617487bd4757109cbd4c62bc3cb30ba6a73998abb5

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\verify.dll

Filesize
54KB

MD5
e550fce5ee668230ae0b71bf702fde82

SHA1
8efbe790a626d70ec59f28ba907eabd9f13e7932

SHA256
96cbf775c060744cf158d811b0f45c4abfa9a89d7ff9920ab1bbe05c283e8224

SHA512
7a5a1270391a096a81c868e8c1cd9fe2cbb0dfea53c388c636c7e5c4012b13ebc7eee1b54b563b6def263874784b57c5b131757b393a1e5831958e3f18313106

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\verify.dll

Filesize
54KB

MD5
e550fce5ee668230ae0b71bf702fde82

SHA1
8efbe790a626d70ec59f28ba907eabd9f13e7932

SHA256
96cbf775c060744cf158d811b0f45c4abfa9a89d7ff9920ab1bbe05c283e8224

SHA512
7a5a1270391a096a81c868e8c1cd9fe2cbb0dfea53c388c636c7e5c4012b13ebc7eee1b54b563b6def263874784b57c5b131757b393a1e5831958e3f18313106

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\verify.dll

Filesize
54KB

MD5
e550fce5ee668230ae0b71bf702fde82

SHA1
8efbe790a626d70ec59f28ba907eabd9f13e7932

SHA256
96cbf775c060744cf158d811b0f45c4abfa9a89d7ff9920ab1bbe05c283e8224

SHA512
7a5a1270391a096a81c868e8c1cd9fe2cbb0dfea53c388c636c7e5c4012b13ebc7eee1b54b563b6def263874784b57c5b131757b393a1e5831958e3f18313106

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\zip.dll

Filesize
84KB

MD5
14eab665f7878d3de543e381cd6b1c59

SHA1
b8495257225ca855a38edb88111b6a5a6c457e03

SHA256
1ede94dd6c5521fbd22796ce171164c2712604eacaca0179112f5f0b93959c20

SHA512
9058133e890678246bf9249dbfdf7020e3ba069e4c4e0b368e4e2fd06606ce975e6011d3370a95b7ec3527885b53d37fc87b405e7714a77352ea32e6f7a91a2f

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\zip.dll

Filesize
84KB

MD5
14eab665f7878d3de543e381cd6b1c59

SHA1
b8495257225ca855a38edb88111b6a5a6c457e03

SHA256
1ede94dd6c5521fbd22796ce171164c2712604eacaca0179112f5f0b93959c20

SHA512
9058133e890678246bf9249dbfdf7020e3ba069e4c4e0b368e4e2fd06606ce975e6011d3370a95b7ec3527885b53d37fc87b405e7714a77352ea32e6f7a91a2f

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\bin\zip.dll

Filesize
84KB

MD5
14eab665f7878d3de543e381cd6b1c59

SHA1
b8495257225ca855a38edb88111b6a5a6c457e03

SHA256
1ede94dd6c5521fbd22796ce171164c2712604eacaca0179112f5f0b93959c20

SHA512
9058133e890678246bf9249dbfdf7020e3ba069e4c4e0b368e4e2fd06606ce975e6011d3370a95b7ec3527885b53d37fc87b405e7714a77352ea32e6f7a91a2f

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\accessibility.properties

Filesize
149B

MD5
2ed483df31645d3d00c625c00c1e5a14

SHA1
27c9b302d2d47aae04fc1f4ef9127a2835a77853

SHA256
68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf

SHA512
4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\amd64\jvm.cfg

Filesize
1KB

MD5
c60e77ff5f3887c743971e73e6f0e0b1

SHA1
9b0cfd38ec5b7bd5bd1c364dee2e1b452a063c02

SHA256
23f728cc2bf14e62d454190ea0139f159031b5bd9c3f141ca9237c4c5c96ec1d

SHA512
07aca3de1a03a3b64b691fd41e35e6596760baf24c4f24e86fca87d2acf3a4814b17cd9751adc2dcd0689848f3d582fb3ee01d413e3a61d1d98397d72fe545e9

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\currency.data

Filesize
4KB

MD5
0c68ed96d63206e174c469eb79f45623

SHA1
427e91bfddaeec48ca2c4e1f1ee2476e932fa8e7

SHA256
17a6f94438730f76215a54d635e792da209ed2e73a7ecde68480df4acd67868d

SHA512
6cb60dee27e1c624f70e66afbd13a8f34be00c2e1070ceac73b19ed136261f4b9185705f239ea5f73a6643bfacc04b6bd5eece9016d7078c78288157eabcabcb

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\ext\jfxrt.jar

Filesize
9.7MB

MD5
8cc3d2ae8bd584aa50b3c2cb31d41296

SHA1
60a52c79669b6190fb64d303f43ecdee2febddfd

SHA256
7901fdc730540b39636317efeeb3f73a632b068077ac43100c928a288719e349

SHA512
18473bd6e365aca2390d68e8127ecc756b69f09d68e760e627e56f9037568b61fbd5dad81b6a12b48f1cd2fefac555d11cbf23a4fd22445f3aa74cf22be8d21f

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\ext\meta-index

Filesize
729B

MD5
c13d39595f3ab17500d6963b323558a5

SHA1
65e8806bdc09e1433e0c9c4ccbce759a3db0df98

SHA256
f3c5b6ec18f23aabcb3c33ae6972c5f65fc3220196e4a3081e25341ce530cf64

SHA512
9e5821660a85337ad94a7d8dd488ca400e58046af7ab0785080b257c35d22462304b59d157579c3d79315a9d51bad3970988a8e45f34d8d741265f6e3ff202d1

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\ext\sunec.jar

Filesize
37KB

MD5
d18aeb8c2924ecf099a595784335a2d8

SHA1
b85c9bb17fc2c04e33e627f3c7ad7de0f6d2f093

SHA256
9d40bd263a740d757848caa677014b26feca781c06c037abedd05bb84e6671b6

SHA512
e71dc069b3e7c07ab65231eaed76efb70cd4fae71958de3a81ac54dba2399118842501ee414dd4e24a0e9fba536574f044d8a71e44e4344e44533d6a08d7e5be

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\ext\sunjce_provider.jar

Filesize
269KB

MD5
796ebd3d14059d7c8522516a11fe2bfd

SHA1
9e4f18fdfcca7c15cf0b003e2bdfb66849b8eeb8

SHA256
0d37bffbe2995cc5810a10e87244137d2f9c3cdf4577203d194be56507a48213

SHA512
be0e9022ba85b93c17041067e7fe80399af62bfa7f443117100033dba1fdecb26ce023a7034a51b26dd5f58f01c79dde604c301fc93b19b30bbb137dfb23a141

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\ext\sunmscapi.jar

Filesize
42KB

MD5
969787108a9b47977d40f3e7e431ab74

SHA1
063a035a03070d1e19c3a22d2689af7096709943

SHA256
7f6b84fff6a2f8d07e4da58ad2c079bcd8d7d76dcfd71ba771674bbb75c36c4d

SHA512
dedc617f67cf49ba9cea9279bae8eb6eabc56e6176652dfaa794a06431d3ef94e3edd16b20984cb5695593979f946c107859be1f16e57f7d5ffa82e8247a4a30

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\fontconfig.bfc

Filesize
3KB

MD5
48b8858d27494a66594b59695d6dc60b

SHA1
1d3bff1e17ef6b5563cbd0762c2867b36fbdad95

SHA256
3f1792188ae901eca47b64728776d35095dc0220d5c929d0da99a2427877c3b2

SHA512
5d814990cff9f787723c629e22b30a2abfc9c8df0a712c2a7cb7b11ec52ddb083cb67c2158eeea2cc03d763aa308c9a271ac7cb7c88a96e4e4c029dd95b7656c

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\jce.jar

Filesize
94KB

MD5
370320b75a692da11c577049511d72f7

SHA1
c82d11222c0d90da62471f2bd5035190a66af591

SHA256
b0c1d61a8cc03193020349653216a482b5924fb0dc3310a0fdb8f00261d3a194

SHA512
fbcd5428a90cb809b80f7b53c94a960948799559ef5ca42812742460204bed87aee1fa03a124686085d9c3bb4e3ef767eb52aa3be883b0b51137edf3a18d725a

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\jfr.jar

Filesize
868KB

MD5
a5baca209f6b3e144e44029aee4ab71b

SHA1
419586d970faed52472dae63065c3d7ccc4d27c0

SHA256
58b290db3417a178c4e1d33bbfdd05f89981e328e70a83d98cc1fc91f8e7d911

SHA512
c855fdd1a1836913a07c9d1353a62d00d6e5d88f4701fdf303877a7faa59074c525e8da59a9af0072455657069bda9e51f452d6b56c34faec1c22a35aabffa5a

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\jsse.jar

Filesize
1.8MB

MD5
07bb3c71f1c17925da6309f088cdd3a3

SHA1
7e248490e7913bdfe5a8adca0f63cf2e8bb7f690

SHA256
01ce4ad1ca12b28b6d8f415444dbe63637ca6c4ee6370ec4cd563c50aac8b2c4

SHA512
667553e4fb35a1ffd40a94ea56e6c2fdd652e85c588a51d67e22c25964e6ba690b8fc5194b0ebfd774f5cb6f551551d01119cb5c6b8ade6017441b02acf882b4

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\meta-index

Filesize
1KB

MD5
83964354d8e8e69dfc1001f01682bd70

SHA1
1f2012a464683ccc1c284d51b20778811641b2ee

SHA256
dff270e76bd7d851cbcf79702aebd71122c3a9e93836ae4e9f650234a754b5c3

SHA512
4be6e0c8ed2bd2f59286bbfa5041676f352e32731e070d7c26511e1e570bd8d6940ff2cc59b0e1656c9c8b3f86186a34709dbf19c303d80840307dacc39d9956

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\net.properties

Filesize
5KB

MD5
8bc6628d01bad30798440cc00f638165

SHA1
fd9471742eb759f4478bb1de9a0dc0527265b6ea

SHA256
31ce7ce29c66a1696a985a197195b5e051b2c243ea83e9d1de614f0c4b4f7530

SHA512
8da3439774a07a6309f985d1a29dda5383975bbdf6b8e2809bab69a2c44f65d3de2a546231ed6e183864193f834c9a7042fdcc4ee10181d0bd3891363032c242

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\resources.jar

Filesize
3.4MB

MD5
08d82a80c0c8b2ffa3269d57bdf2913e

SHA1
b28954deffc8695b4837ab50c0e46f71378e70de

SHA256
089c004ed032d33b43d70fb3a7d83f551037df37a4d59569f550f58626fc1f47

SHA512
cef66b28dfdcc399751bf0082d7c216c76e945be269db8fb0e2573d45bcd4a2ded0aebe2eea584fccca1fb3d740f7f5f743d6a4f22855db1df062cceabafa909

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\rt.jar

Filesize
60.2MB

MD5
0070af149ddf6e36268ae49ccbbb9a65

SHA1
64dd548ece5f88717b96a2bdc63d1d40cf6192ce

SHA256
5233b5c2ab1da4cba5bf180b38bfc07f086fd0228621e71f73d6e0b5fa8db85e

SHA512
1c2918114d9ae3c5ce3117168c16c85b2a877f7bf5cf734806246c254dae21f00cdf179181c7290b79be71113d5415d2b37d39ff0db195e951d3282c34e68134

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\security\java.security

Filesize
53KB

MD5
f493af6814af8e96ca9837ce371cc23d

SHA1
8e5e6a29534ee0f6d7722ad902906b8cb2371788

SHA256
16193caa769dec20886a57b3863a431a17de7374a8a13c4a342207be191ab40a

SHA512
fc8ab5b239e565840ad56fbfddb355153b2b4b41891b85c7be6cbc1f59a8d630be042e21f96434d630cb57e439c95bd057efe721fc2c469ddc1f06781ec9e9fe

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\security\policy\unlimited\US_export_policy.jar

Filesize
619B

MD5
4cdb7e49d67539088cbf4b32693d67c3

SHA1
dcc2adf5dcb0ff71af1c3b84e5669c5552d1d47e

SHA256
04f4fc5ce823280af75a28bcf9b6fb8c2993dc84a533b45e4b9ee18d1093eee1

SHA512
6923b8a46f3e9d25019c42a1ba4c2a762018669763fa519b91a2400f27d82ab60dbb9ab8d646da27e960ed5da6094b722b22be5c799159fa3416400229f3f92c

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\security\policy\unlimited\local_policy.jar

Filesize
637B

MD5
f806291db11e776452ccecf758baa9a9

SHA1
fe361d784a529ff865a82f4a25a2b73f67781937

SHA256
e854c3f944227acd80ec4753b845cf633cf94e59c936fbe949f4602255933286

SHA512
9ea508ee6cc335982b70333c86aa3c1099c957cf613987680b1cfcf9c8a2350b7c77983b98d86b2e78ed94d0421bb901c3a6cd06f406e16bfbe249cb08b4213c

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\tzdb.dat

Filesize
104KB

MD5
17208383ffe68cf141246532061f735e

SHA1
0b43a496dc4f589212e983bbbf05d9059de72c82

SHA256
7a6e97bacf6077760c3db41a21d8688876c36ac3350ba2a40f39dd094a0609c4

SHA512
d01f59a5970e99567fb654073dc57ce4074b0dd048b46c35b0902740bed5d76dc3a4644548cc34b1cb5d6b977a320f9603aa272480de06125fe5f86107088721

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\jre\lib\tzmappings

Filesize
9KB

MD5
62bc9fa21191d34f1db3ed7ad5106efa

SHA1
750cc36b35487d6054e039469039aece3a0cc9e9

SHA256
83755efbcb24476f61b7b57bcf54707161678431347e5de2d7b894d022a0089a

SHA512
af0ddb1bc2e9838b8f37dc196d26024126ac989f5b632cb2a8efdc29fbce289b4d0bac587fe23f17dfb6905ceada8d07b18508db78f226b15b15900738f581a3

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\bootstrap\updater.jar

Filesize
807KB

MD5
a616e898ea735980492f41da00f88f39

SHA1
6de46eb8ddc768bb6652d45fe59904371e153c5d

SHA256
f018c09f5f093f5aa02fe54efb36d2c79382da298bdd16731f22a51ad69bf240

SHA512
130337c5738e9cee84dff629c5d4a34f9b2bbf587e7b0eaa518075a76a8086854e7604c9ae23455eca239fbbf36c3c1472b477d306a347a1dba9b1c63c61ee3d

Download Submit
C:\Users\Admin\AppData\Roaming\.Salwyrr\launcher\launcher.jar

Filesize
3.9MB

MD5
a7cae50be0f0efbc4b2615679ea0a4de

SHA1
ec466e117fd221170f2d7ac8b7966d2fe314999a

SHA256
81ab6677e3b37fb3d1a1dad4bb7ce7026d532f80985839376e5d00f8d6b7f8cd

SHA512
300b0108507a7e775faa1f6c161387950f542431049aeacd5b4dc0e18b4d748342882612a3df07f32e5188789e50090ea5a440bc55ea359e5798a80a69566031

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2386679933-1492765628-3466841596-1000\83aa4cc77f591dfc2374580bbd95f6ba_8329e3af-909b-464f-88cb-23d8b2c5eadf

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
memory/444-299-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-291-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-297-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-242-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-251-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-294-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-296-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-295-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-258-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/444-272-0x000001F846E60000-0x000001F847E60000-memory.dmp

Filesize
16.0MB

Download
memory/2080-351-0x0000024980000000-0x0000024981000000-memory.dmp

Filesize
16.0MB

Download
memory/2080-350-0x0000024980000000-0x0000024981000000-memory.dmp

Filesize
16.0MB

Download
memory/2080-348-0x0000024980000000-0x0000024981000000-memory.dmp

Filesize
16.0MB

Download
memory/2080-343-0x0000024980000000-0x0000024981000000-memory.dmp

Filesize
16.0MB

Download
memory/2080-332-0x0000024980000000-0x0000024981000000-memory.dmp

Filesize
16.0MB

Download
memory/2080-337-0x0000024980000000-0x0000024981000000-memory.dmp

Filesize
16.0MB

Download
memory/2884-352-0x0000025463580000-0x0000025464580000-memory.dmp

Filesize
16.0MB

Download
memory/2884-309-0x0000025463580000-0x0000025464580000-memory.dmp

Filesize
16.0MB

Download
memory/2884-326-0x0000025463580000-0x0000025464580000-memory.dmp

Filesize
16.0MB

Download
memory/3624-150-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Filesize
120KB

Download
memory/3624-134-0x000000000B2C0000-0x000000000B2CE000-memory.dmp

Filesize
56KB

Download
memory/3624-132-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/3624-149-0x000000000C880000-0x000000000C8F6000-memory.dmp

Filesize
472KB

Download
memory/3624-148-0x0000000005F10000-0x0000000005F22000-memory.dmp

Filesize
72KB

Download
memory/3624-147-0x0000000005E10000-0x0000000005E1A000-memory.dmp

Filesize
40KB

Download
memory/3624-133-0x000000000B2E0000-0x000000000B318000-memory.dmp

Filesize
224KB

Download
memory/4576-362-0x0000024E68DA0000-0x0000024E69DA0000-memory.dmp

Filesize
16.0MB

Download
memory/5012-213-0x000001F0CA900000-0x000001F0CB900000-memory.dmp

Filesize
16.0MB

Download
memory/5012-298-0x000001F0CA900000-0x000001F0CB900000-memory.dmp

Filesize
16.0MB

Download
memory/5012-227-0x000001F0CA900000-0x000001F0CB900000-memory.dmp

Filesize
16.0MB

Download
memory/5012-179-0x000001F0CA900000-0x000001F0CB900000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads