b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
25s
max time network
166s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Salwyrr Launcher.exe
Size 150.5MB
Sample240408-bgnxpaca9x
SHA256 bcc98408be7d77e03ca6fd8f1e7e01d30f3b55e3bb236735d514037f6b2da53f
MD5 358fcbfda7fdc5e8966be81cd82e3fc9
SHA1 1ca3c9cd0e791c82f139c543449630653447c33a
SHA512 bc26f6e9395386791a7438e2e2f25644029584e6c318775b20cf8f13d268397b6a0e2f6ad8b2ccf726dc8a1102c6b08cef9a00fbd83855b65b0626deba009956
SSDEEP 1572864:ZGdFYlhnXsryUGmVlsdBbd51I8udcDs/VgC5daNcBgBTIWfbgrLvNc3xhRsOmpe:nlhnXr7er5c+rp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Modifies system certificate store 2 TTPs 23 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	Salwyrr Launcher.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	2316	Salwyrr Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2320	2316	Salwyrr Launcher.exe	28
PID 2316 wrote to memory of 2320	2316	Salwyrr Launcher.exe	28
PID 2316 wrote to memory of 2320	2316	Salwyrr Launcher.exe	28
PID 2320 wrote to memory of 2756	2320	cmd.exe	30
PID 2320 wrote to memory of 2756	2320	cmd.exe	30
PID 2320 wrote to memory of 2756	2320	cmd.exe	30
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2588	2316	Salwyrr Launcher.exe	31
PID 2316 wrote to memory of 2484	2316	Salwyrr Launcher.exe	32
PID 2316 wrote to memory of 2484	2316	Salwyrr Launcher.exe	32
PID 2316 wrote to memory of 2484	2316	Salwyrr Launcher.exe	32
PID 2316 wrote to memory of 2516	2316	Salwyrr Launcher.exe	33
PID 2316 wrote to memory of 2516	2316	Salwyrr Launcher.exe	33
PID 2316 wrote to memory of 2516	2316	Salwyrr Launcher.exe	33
PID 2316 wrote to memory of 1652	2316	Salwyrr Launcher.exe	34
PID 2316 wrote to memory of 1652	2316	Salwyrr Launcher.exe	34
PID 2316 wrote to memory of 1652	2316	Salwyrr Launcher.exe	34
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35
PID 2316 wrote to memory of 808	2316	Salwyrr Launcher.exe	35

C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:2756
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1044,i,1270471494406963703,3415679547209516177,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --mojo-platform-channel-handle=1192 --field-trial-handle=1044,i,1270471494406963703,3415679547209516177,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1556 --field-trial-handle=1044,i,1270471494406963703,3415679547209516177,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=cs "--cs-app=Salwyrr Launcher"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1276 --field-trial-handle=1044,i,1270471494406963703,3415679547209516177,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:808
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2480 --field-trial-handle=1044,i,1270471494406963703,3415679547209516177,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3020
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2624 --field-trial-handle=1044,i,1270471494406963703,3415679547209516177,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3080 --field-trial-handle=1044,i,1270471494406963703,3415679547209516177,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

F59A01A8B782D93EA6991BC172CEFFB1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1
Size 867B
SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
MD5 c5dfb849ca051355ee2dba1ac33eb028
SHA1 d69b561148f01c77c54578c10926df5b856976ad
SHA512 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 8acc7002f5084df496ab5b9c3d532d68d0ee9aec13337cfb0cf136f9713b95ae
MD5 0069c969e0417722a8173e6305adbd24
SHA1 570127f971a743b4028c184e17830e3f242cfc9f
SHA512 0ce09739c418f4f06cc671da27419bb4a4d964e0ae4d386e4f7c5a4a7dc84e8e93d84eac32f5df5bc9cb70073db0b3e6525406cb8ee6dc151572f77bdfd8f800
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 94360852612184044d387bf1828d1f63dfb0feeb3d30ca66cb5dbff3f9b68243
MD5 8c622ebdd69bd626d03c5c72de8a5c98
SHA1 a237114c986340110693fb21521503e6cd3c278a
SHA512 e88dfb89d2f4d65423e84a8748cbd3673fb02d577a631cad1b77a01612d8e4a89963c1af40ef546fc1be0ef1887a2f4c04450ecf4a6aa4de013d2facf6a17c51
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 739cccec1481e2f80dca5d14dd6066d09f7140049e31a1fc0840a8a14c10340a
MD5 467ec0497e36fe4ff520ec916315a478
SHA1 c6ba5cbe45d01a0bdca153e47e8f842db1e6ae60
SHA512 d39068373bdc7e528f0617a73ffb5f3be524107c276aa400306d837bb8a16ec308ddfc818db34449b8543661039fd19d08dd2a1300f22d4c1df3c00f8b6400ce
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 58c44466b7f932a0995992901265e54c0e36e16340690ac1eae79d2cde6f67db
MD5 0a171920bd27225a9cd3679bbf35f98a
SHA1 e88f46d03579271ac249cf777d61a4ecbd1623df
SHA512 657ab77ac3a3178eed6fc8f7c12a37ce40e57fea4e0ebdca6fd51260d4c8f46849c7d6e84df894e8a51a1fff5fd6762426329174d28ed0adc2965a1f4cfc3c7c
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 1a19c4165983888fa0a7e1416abfd1636d55af7b9aa8e09f06de08ca9868b836
MD5 aa8dbbcef187bf877c51743bcd2f8b05
SHA1 bbb0197a228f45a9268a9aa24f3305e98bebcf59
SHA512 f42171556965263183ab6259a5d49cc3796b83338510d8a6a1ad2baaf0ce52fdf0dbf10a129f027795d2a47dafe8a3cdc8267bc08de18e944117c05a55a7b76e
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 d234ddf6006b66be46c1ece798cf1e2ce1cc38523ca3d3226a2806395be4b072
MD5 1fb633244af71875312039abe0632d58
SHA1 3bcd837a731f4ad5d9dab868b40b8b99e0fa15f8
SHA512 994cab0f5d65cf1e51b45e79ee06b8419cab5e0d9e72bcd91faa7a1abddfd188148a6ae3b9a81b568ef17b9ddab6137e8ce5425bebe171232e559b6767e71317
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 2f0388836aa85fc4d5bfa458079c0c9ec7de6619af3acc64462744a8865ccb52
MD5 7f440e0295d656c801a3071fd0fd5522
SHA1 a9bfc699846eefcf82611b69c93fad9c18688f71
SHA512 9dac4a6832d4657c64e615b821dcb0cda8c1e9b5b1f2e43f429359eff88005b0ae2bc04473b33671fee161993ce807d30c075f838e73d95a634b96680f03385c
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 dbb54097a32e8bb5c493852bfbfe465412971e6cada3c32a7d28352f9877eb82
MD5 b17aaf8dc1b7ba7c652abcb1f7dbc022
SHA1 ecfdc1eb8fdfd52fd427318138e81ed96a80f596
SHA512 a3d9c51538bdf900768e39b51f4a72100f0b6fec70b054a9145681403f00f63ed7e1b6d8b97788be560dd0ecf8961f0abe3a438ad43c921b81c4ac30ad61e026
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 53ef5d6e78d087cf253df8fdabaf4247bd0098ba94e3f3142de083c9b9f9eec5
MD5 3861f340307ce31c7f434da88d238c7e
SHA1 1e1012304cfc79354dd6b1d270d83af4809835d9
SHA512 f2d7a527acc5e1d31b8d15fe7f80751a4945eb7fcf17d640b40ddb1aa02e613a1cc72373e7ea55f6cd17a1712db589f85aae7e4bf4eaf3ce0b4d2f9e3e850d3c
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 bf7c788ee348680f041f788d3be51334ab2881af5729cec61afae2047a84b320
MD5 a362c95a650621be838e7e41568f3ab2
SHA1 cb410d29df52fb66a12962cdf8186a50ca1e1c56
SHA512 81a12570e1bad2d74ad941ee9158e67e90e71e297c69508e976109ddb9e34cc2378a582e9be0cc29abfce558cd07d0a65dcfba2dafc5ced181eb92073990acc3
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 0edf1d374f6f7a6c988d148254161892c88bdd2df264361e6a523736b727fd3e
MD5 3bd62a88230272bebce9d9904859cb6e
SHA1 889492ae6d48964c16fddb525473fb386f36785d
SHA512 1491cc949a2177b01e03a277b9bb103b74b02007255ae57d4479ff455163727709e844051a46da5f3414936f480c087ea8491b6fbc82929cb1154dde42a2c44a
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 a42647684b2bf60b45b8f86f5427e19dfd7581d06def3e5515288b9b32631810
MD5 770096c3f74bb2463f84bcd3f5acf3c9
SHA1 96c3fbdc3706fe8fe9c9b08de657456933202f15
SHA512 d734c7470f7319dc8720538cebc7e69330fe59839bb378e4561023ee5d18b9a8cd96be2c65c23a2f830f8c7f5464fe70838aee2159d10999502f6908f1ecceb6
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 c815aa4be120b5336c0d5c576c3354f19c5d7b1dda0ce794d500a6877f2b95ff
MD5 544e40413e685ba5edfcf6d31ec1dacf
SHA1 63a755b26ec336164ea02b7ef779fc4c54f8768d
SHA512 3fca6840408729f090b02476b7727961446cc3980b434066b37c4ba74bf37a551d38a0d830247d836e21c7bc91c8571c6b14662d2975d0156cf733d2c46bf9f9
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 20e979c958cd7a17d72512cf238bc202d168472582a4b08a45f0d054b0771b2f
MD5 ea4ce10a18a2370dd2a9a14e9227a197
SHA1 4bf161d89ee78b87c6e0849e3f80b525adea0ec3
SHA512 f543a5f3294e9b0f7dcc29dd2793ba40e8b8a1eaf1dfd48e3aa9a5500ff02d2cc7c8d71c8703f7c086993350c27316cdf75b9183b5f27265a1a109ef17bbbc17
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 c5aef6634fc60dd3c117bbd01bc04e7cfe2c27526e1d95cd2b88476b5fff2d40
MD5 04963faa89ece77d46b95596818befc6
SHA1 a26659c177c76fd8f19b858e1b6d768d010a0f05
SHA512 fee952cb8ba1d9bfc14b30163a7148b0e01c6a4b6d718c7bb513b13df80ee554b553907e8ba017672829a89225907670f315e95c4a7cf6467c8593c56206ccfa
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 e2af2412d6b4daeb603bba290136d4dcbe6df37814ed4ca5ebaec5cd19b5e70d
MD5 c4b64a6420d7e956c048fb070459d917
SHA1 e53742285382904db1eecb49732f0e9af13998bb
SHA512 5ad6f4a98957789916743c86b20aff53abfec02b7e2402f95d847b820d33bd3c9a570e0bb370a810f1a076172bdf5ca54c24dface2f7b8fbd90ff13f49c58957
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 05812ee312249fb872fcf62b4c4d19379de5c6431e2628cdb4e872bcb406bbcb
MD5 71a24a2c986de2afa049255e4b14d955
SHA1 bed4fd6fc8e9cf3a6388a66df8a8fd3e8e2e6a60
SHA512 80cd945f74f0b6b85ab559b8611f789964028303e5e916a61a0681bf20778cd8afded63d99c5460b07b80dd661d596ea92fbe523d7d2186a3d450045bf446959
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 3681cb0e4a1efec2ee1841d0b284bbb6555219023c9768b687c5756ea3875521
MD5 a6b04695a9a714f78fb769879cd6c46a
SHA1 584d0cea99af7b6a762638d8c1d9a46bc43db6a0
SHA512 c96c261aeb875b194617ff80236d67d0463a994b69c160592892d22058ed84bf7b92cf891da02c753f2b9afbae929e262b53e0045f992d4b4b934510158b7591
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 12ebe18f3d72100ab5240124a88922989dd5aee8964c595fc3606962e452cc1a
MD5 6e3d480277b0ba7a8b8d23724259a34d
SHA1 68217c02a3a3f00d151665d4eb6a20cd0857bb09
SHA512 bec09e21b6bfa63f2fdba3ae624b30c47d35740bac209a09032236dbf0ff9c648503895473d0e73ec174485146a0ebb6175a7017a14fcab4a8011881aacab522
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 5c8055cafe157b18aa861167c6ccd2acfd2a165be9c3fd63c87778d6b96c6a5f
MD5 e0bb94896bc258e8ee1fffd40bd79af8
SHA1 3d23384e5c686e7c8c02a783324830f0e9d61e69
SHA512 76791a80a67404e33cc65e1d09f8b09c41f8e4bde7eb6500028a1bfba985552daf00f69d84a723bf8d799c81950cf439d938d4a1a13385667ec0bf960e257849
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 d9ef35913efa6017acfcc6b5e61b9e11e643ffc3e6facb4e1e2008dc2c1af3bf
MD5 3adb4be5aa795e78b5affe7a43228ef6
SHA1 b647e4be45c0ef98dece9962b95fb5f54d16e91a
SHA512 74b0f1119eff0f1c9e595b31862088c4d5e8c7510311312908527440c1cf65a5d1a63a55d4b346b1f83d1d2bc28112155af93cae20573dd5828c128acf7db125
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 e686b74d8d8220a18f02a980e7d9f0d7b740f83b067c0a21e2df2dfe6eff34ba
MD5 ff14f93ef736168020f676e64fee47fb
SHA1 dd538999ff67d58da507b69c5167d02f8c17ee06
SHA512 e06def36f451ac45c692a4158e10cd80910bf40a9ecb88b78bea60a944e4318eafe73846e7677ef601f87f9ca2c39d603a52d14e809b57bfd29f726f9d47cb2f
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 108d534c0b77896153131a3fcd47ae1a1ef1d91153c823e59bd1ca22ff70ce8a
MD5 b635f2a5ee01594e6cc12061096335cc
SHA1 179747a8dd02215def8d64440bc0066d33aa8670
SHA512 53742285ded014158a7b7e8839ba2a31354164a4d5506ac82955af7c445d97d4ef3b5f5f9481ade2d9961a1f7708b01fefa781c59034597e16da9cfda8a2f582
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 e56cba5fc22762c544597ddd77e0e1817fd5f6a2504bb94cb285e0cb7b832c7c
MD5 2f391f371050f544c9a4ea9305335d11
SHA1 b4ee72e43bb7406e2788c04ef2d0485971d1f695
SHA512 55341ec70b099f6fc46f2e745c1b53572cb05e0ed4e06a969ffd4f6959283747c36ff8dc344d8bb5529c83ebfabe6d07ac1f51c875e33d2d89dd33066383ef44
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 6b3c779bd7c8943573d0855c8798ea928bc95d8b69a5fe3d3a81aeb5f31f9111
MD5 1c8971cbae5482de005bf60f02c73578
SHA1 474410a33ef57b1ffdc90d81d5e992d427cbd4cc
SHA512 0ddff18f4cce00fe2e9d9d0fa5e792d630d8b669c58eae13de9da1bcefcea967483822f0673390abd9a9b6b126e2de6af30e780790ff50bd6de8fcadac714c65
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 bae81da903c0e8dd0080c658391db451ff2f5f2a676e7574761387af35d0b12a
MD5 42f72f8c8a048a8d0f87c99584eb20a5
SHA1 7cb47621ab58ef4bbc1999af8729a2179ee18e1f
SHA512 8799b081e0cabccf01ec4c12c767491894c450ae84e6ef69af8b5e4c61d62593c9046df8bd3227ed31ef490637b5e5287c9db1b0fae2d5c2796e6a1a674238d6
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 56579df6d7cb9533ce58b58d84fffa223c53a815e54054d7c8009ce61693eadb
MD5 2340e838bcdd4766fea51423d02f75c1
SHA1 56e8ef1b3d8287b260f4f757a316028befaa6871
SHA512 f0547c33586a762e75f6a37046871f64c778d941e9e51ac6c833b2f11c99767f46c4869e485cfffb16e62be62c8c4a5dbe6330a3b9919dfbf06a4967d3751366
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 4a09c9c1803ae5fb0cecaf9719307f1681a4c42fc0fa35002b57a637aae2f1fa
MD5 c8ad7158e7d7b194012b7585f5a7ae63
SHA1 a5cceedcee7504745ea677ebaf840b72944ad233
SHA512 428594d89a0eb58a9221dc2e2d5636e2868049bb985c664bd6aa671e7511adb5bc4b298ca36bba98707efee52fe666c8225a3efb79988ce472ef21677fba1a94
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 11f8e19d5a1879b8e0adcf5bf1f745b17baa37173ec72375d01e3325860f56be
MD5 2065d2a2153e464a67cfc275b1b45282
SHA1 21fa97c8eaf22e3713fc683e522a41ec6957736e
SHA512 9f62c085ae38439293cac752b558b88d612d25a12dfc3d08d671d940b2504d35177fa4061f281df40c2125e9c3d69b0e455e8bf8033a697ca8c6c2e5fbcfd386
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 f0dc62e576641a91d55c2ed9aa6f956fc43e26e100d5c3c5db79bf96d3e0f117
MD5 e4af9d00e5ea7218320b78d1db1312bb
SHA1 b0f6744eee6525b90c1b7a79a6fba7362af482e4
SHA512 4974218643352b971c88344815eb96cf1cea975824a22a24915ba2067b38424b63ef9dec98ebe363fc916e2742ba7aa99c2052aa01fb0ff51328c0948fca8e9f
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 bf5135374d41968fa8128226858f51f13d4b650e459368cce92a4eaca111720d
MD5 208b9853eabc00ecb2c3683a3fa6b5c2
SHA1 3e0ff313dcb6c21663ff5f700f68863280042fa3
SHA512 a772376e87a9d58aff3e965163a3367f1d445ca925878ec2a972e39f669e21f42032ae46d589b5fec9d52b647ff530684dbab9eda393c0ee7b05165d093bfe60
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 449a6314420841afeccca77cbbd5cc5e412c7a5a00be1ccea11bb56956bacb82
MD5 7b4a940c6aaad9ea161174470726908c
SHA1 b4f8aa85e01adf8402450bc9f56c0038a377e37a
SHA512 3ccc8f0cc1e2f19136b0a4c0fc2dcdc298b8a9533b920bd91cb10521a7c685ab74a0c256cbd398e74ea07dfedfb9b7ce68bdd2393df4aa08a6663c0a3cf2b791
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 8f4097f1d7e773141771a8ea8bcf59e730c4cb9fd3c6e92071bf5d5ca7aca4d1
MD5 1843bb2e59794ba304323b4b7fd04b59
SHA1 e6ab3011c826770092c355b9e72b6c2dbe71dd90
SHA512 d20cb9f041b8996450e81f57599ca167c00f4364d02cc5b8f664f2d7a47cd7962f1d360e1cf2e065c150b3a58439726699a1d74e445c8be0db59f9cb27c961ce
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 dfafd3778927a7a1ecc60b841b971292c5fa60448eebd2405df5f642de7b97de
MD5 fbd625639a87ec45598a6809bb4cbcda
SHA1 4a0b606469b26336cc3ebda9546d0a3fd9c87bd1
SHA512 45f8946eb5c5806803e9133ec8cbb297a46aab33b6550c05b2d8ad5b75ff369dd01bdb401e8f36e9fdfd5fd8b46322080fc9fd1c1f2622d4bc0956f299245f9a
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 ff3a5e668ae3cc1c9fd5f1c9297e44758b78e3b00c2d19c3643c30d222afd99c
MD5 30b80afe0657d9440b74209e940b84b1
SHA1 c298ea2adaf09c2af7a7b506911ebc982621afd2
SHA512 80a41654e1eb86fc418411146a8d22aa2ffa0a22e7a1ed6155eb265cbba3c1a5e82ad2d3f534d6fc4ee131a869e28688b5723bb294c200de99bf2f645c9e22b0
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 890ec9da8526e6f716b286316f608ef57b55a4ba01b0f4bcd7399381e4e15c9f
MD5 adaf446f8bde7839fa9a6fe1ea936b81
SHA1 f2b265c33aceead481b095b050b0e5cebbb8bb09
SHA512 5c6b8823f18d3684e3ef326cb8cf88fb8477271c6d33d420774cd1b16b8274c1887143ac660a706644c80084831c8bb18e713f9a122fcf2f58b12c92c0f16f64
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 304B
SHA256 ebda666b30a32338698259631df6bd31b9264cadbac038cc8537662d3cfb9f8c
MD5 4dcf05eba5bb98c18760a7b1d15760d5
SHA1 657e640497d1d744341d2bbe58efa506cfb084f2
SHA512 2ed5a2a06db32bc9d66e26ffe0eef9c36d52d0c3fbe310342117abb33b7eaba7565301141b49ab4df95cb250431c93e407e737c97774bf3b8bacced106ddcfac
MD5 SHA1 SHA512

Submit Download

F59A01A8B782D93EA6991BC172CEFFB1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Size 242B
SHA256 8b078113cae10289d3d6d203803521014ab9d62ff9b2392d36a614ec3a38fa70
MD5 986cd82d9b3336137b513aa36b9543b5
SHA1 5ebeb4e4fb37c15b6afaf1ea77b7a7ecef86db61
SHA512 1ee7f76ebb18fb2c32563920d9f7830aaf13a703818fb943e774ef9a19cc7e201cdc1b1dcf341cc3ec4fe46b5874dab4adb22b47767351d4713ea7bc0d210b8a
MD5 SHA1 SHA512

Submit Download

Cab7C63.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab7C63.tmp
Size 67KB
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar7D54.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar7D54.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

47823448-ffbb-4df8-bb68-294c36fdcbd7.tmp

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\47823448-ffbb-4df8-bb68-294c36fdcbd7.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000002
Size 17KB
SHA256 4601215325c3092bf758cf29d522a73057dad81f3081057d716b62193fa2e3f3
MD5 a480093731f9b656c5352bea52c40376
SHA1 2346e2c86fdb191a014abf83fa7f4da61b12fd99
SHA512 9b535633276e7c48b256879e69139d7c2e545b27d51ac7d7b4885e7624aea6c614c480ca7c178a7144319cdafbe76b221bc54eef769b7ebce55fb15d473a41d2
SSDEEP 384:kk+K++LL0QxxmsSY63kdGOamhA22giBb2NLryuauQDjoPCxD:kkaQxgq63nzm+22g229ryPuQHX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000007
Size 33KB
SHA256 462e9d5359c0ce798c787ac9859f72d07fb54c51643630b96c38c4e020a63d4e
MD5 0be082938018032cd97d286dca1982d0
SHA1 757326d52f64349b81ad514fd049d3dbae2482a9
SHA512 528cecf357b9e9f235172a6c0b3679cb0ac127701ee54f4466c376bb472f4e6f9ff65a3ff12d8f3b245406c65a794304cdf784ba268892b859b4aac2787c5a5e
SSDEEP 768:STemEXGwFTBAesAw7MdKZB+YJMGMtIQOw8N9E/aJjI6lsV3ugorOfuhxV9n:eem+9BpsidK66M/hV8NwaJ03AbOWV5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 06ceb359f7cf52b4215468ffa02b4a8289c1e9e7a9ee2da7bed9f7c8f7126063
MD5 3177a4ae639bcdfc01a97075ea108877
SHA1 37596ed30dcb6181f799eb752b11899328fe87bf
SHA512 af6f692a68f89eecabbcd113d4eeff6edec2ecf044d422e347ddb1b037e8a21725d1884aa5fef4cbe9231d47e1ce997d57bcc582d2a8beeb1417b5b44c8048bf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e97376d4151e922b314d0eda5d1e2c177727b3ddb6adb3689557bd3a36329731
MD5 6a245abad12e99028c751ca9126886db
SHA1 121bb4ec0ea7c742af18b845c0bd0a7ad87efd44
SHA512 26eb9e32bba22283cfb515eb193052787cbd3d02a501c6794adf290396f4af8c5f203bd88a366ddf818afa98d959427f550c070ac6a906efc1f55ee3096a01c7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US-10-1.bdic

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Dictionaries\en-US-10-1.bdic
Size 441KB
SHA256 a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
MD5 4604e676a0a7d18770853919e24ec465
SHA1 415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA512 3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774
SSDEEP 12288:CHZsTLG/6lu8riHP1qmOeMlh+ebMiCB64or:EZmiv1ClhhA6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT~RFf7676e5.TMP

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Local Storage\leveldb\CURRENT~RFf7676e5.TMP
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Cookies
Size 28KB
SHA256 59a64d65689c0c196c71f8345e7ff8647de6f4a573d415b312f3ead25a3310fe
MD5 0f0169a575dfd15d28f97d40ff3af3f6
SHA1 59551233de17ef7ed488a336bb19610a70ed65f0
SHA512 ec24dca2303bbf0e17873ad9da0fe0505b1263b94f813d8b632e188f034f093dfa60ed39aa697eb7dabc0b854bbf7fe9cc49d9901db3d2cc3caad2552f7bef41
SSDEEP 48:TMOq4ljJl18mlulS+liljlRlilYnw5yLVKyg0uF0Dvl:oKjb1zCSye5ze35yLJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Network Persistent State
Size 8KB
SHA256 b58660aa0a21fc839c14c3c5f2da3380221b562a71ff7c6779632393d608731b
MD5 2797877db2358a4aedc5bcfb8d0f51c4
SHA1 d9eec9bc8d5bc5c12508e2ec9aa798182228cee5
SHA512 6407de897f0eff5c80adce20cbdbb4bfa342baeba033af14dae15b5671d4674cfaf1a626c81b4f9770613c0b8ab56dcd4f0baccaa4c37f778a0c6f8a79e73c30
SSDEEP 192:FHAHCHtHRtHnzqH8HjHliH+H6dHqHaHcgHVHAHdwHUHNH6WHfRH6XHCHXnH8H/H3:FHAHCHtHLHn+H8HjHgH+H6dHqHaHcgHt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
Size 1KB
SHA256 995aada0b34253ea89b6ec21e07b2561f0a1b4d5e643564c192b7d66ea562f77
MD5 b75679aec15e77d4481a4afbbbe83e85
SHA1 b1a7f235fee309e8d3bb9e5a7778f3a0fa43afd5
SHA512 1b0827186a6f2ae6dc0b20bf7a109fee21d4fc7f1d2fe43f8065ddfe7ec4cb2818b6a0109c993d83181bed77f71738c3ca5fda22e3cee0c2712b822ef9ce5f49
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
Size 1KB
SHA256 47b3a4ee9a0ecc91dbf4ddf9c4686deee5c391e113bfd740ed13e6914db85dbb
MD5 86642ae4e413435c3c790b8259a200d9
SHA1 f5bd13fe1a9ebfe9e1770021757e1f1c9305af88
SHA512 5943693453d9bc22dcbc5261bfd5a874b12c656b01e52954babd7c6a2261285dc962a34861aa4d86c70ba4eb667ab70a0fa440c4c425f3c196aacf83c9678a7d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
Size 1KB
SHA256 55917de4693b81b91628b779146eaf4fde835398af7acd93e8481d91ad3475aa
MD5 150db4525383d986d554fea5b7cb7d15
SHA1 9a942279d6b299b3795ac80b3a91cbaec2ef3f5a
SHA512 c0568fdb83a65f33c52ba808e6319a2b335a8f33fcec06a65e02579bda7634544d3c3822563d98a95df06d0aa5241d5155cb5087fd1fb4fd9817538fb2bc2d27
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
Size 1KB
SHA256 3293ec1d10d7fae28550c6ba4b600c912e1566802fea490d9386a63684eb2bd7
MD5 e7101b78efd4f820e0e4c15e8ba9a5a9
SHA1 0e51815f38dca9af8077ccecae7497ce8631f0d5
SHA512 7af8154a928b67c7e98255f3f2b0202de42bf1e846024c184f059c10033c2d4062e743cb4f6ccb6e609c50a22c8130bbadb28afed3d9e72440640a06fe949de6
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Session Storage\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\config.json
Size 140B
SHA256 dc4d87159e452383f6e39c1b7dd2830c69457a547565c43cfd9e9b86f336f336
MD5 2dee85ac19aebaa50662a4ba424441af
SHA1 d0b03e28e9a14d48a1a9b206e92dc1bf1266328e
SHA512 651d95e57716081376c14c26852e01997c77597da0e0350620ad4cadbf14f0a02956d7b3e8cbdf52a777b64f7ef7db63066791e24074d5e5b57a38af2b7c6a6e
MD5 SHA1 SHA512

Submit Download

memory/2316-3404-0x0000000002970000-0x0000000002971000-memory.dmp

Download

memory/2316-40-0x0000000002970000-0x0000000002971000-memory.dmp

Download

memory/2588-2-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/2588-34-0x0000000077360000-0x0000000077361000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads