Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/06/2026, 04:16

General

  • Target
    setup.exe
  • Size 74.0MB
  • Sample260628-ev2bqafs2p
  • SHA256 b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 27 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Salwyrr Launcher.exe" | %SYSTEMROOT%\System32\find.exe "Salwyrr Launcher.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Salwyrr Launcher.exe"
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4712
      • C:\Windows\SysWOW64\find.exe
        C:\Windows\System32\find.exe "Salwyrr Launcher.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3440
  • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
    "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\System32\reg.exe
        C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
        3⤵
          PID:3676
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1068 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1604
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --mojo-platform-channel-handle=1960 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4176
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2356 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3492
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=cs "--cs-app=Salwyrr Launcher"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:732
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3804 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2112
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3932 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3200
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4204 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3504
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --mojo-platform-channel-handle=4796 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:368
      • C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe
        "C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\Salwyrr Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 --field-trial-handle=1788,i,11433830676222881448,15726152473372358632,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1876

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          77EC63BDA74BD0D0E0426DC8F8008506

          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
          • Size 328B
          • SHA256 e202f6785fe1b698349030c9bed0ca0fad006c62d599a6cc75e9998be0f42786
          • MD5 SHA1 SHA512 TLSH

          owutility.dll

          • Path C:\Users\Admin\AppData\Local\Programs\Salwyrr Launcher\owutility.dll
          • Size 1.4MB
          • SHA256 c127bd152b674d35a7c5a65cc933c385d64622ae2ea09b7194c1de7bdda1c690
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\LICENSES.chromium.html
          • Size 6.5MB
          • SHA256 ec105b4cf1588e28ebd596b2c354e44b4fe2cce5e6d5abbc7174ec7be3df6a09
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\chrome_100_percent.pak
          • Size 126KB
          • SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\chrome_200_percent.pak
          • Size 175KB
          • SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.7MB
          • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\ffmpeg.dll
          • Size 2.6MB
          • SHA256 106b9ef910cb037e0f19d55c7526124fa3b39c5e849c3d5d6c3a116b34121ea1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\icudtl.dat
          • Size 10.0MB
          • SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\libEGL.dll
          • Size 473KB
          • SHA256 8e69fdb7575a626b6111986275b139d15fb56e60156ceb5315c5e503a0fda357
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\libGLESv2.dll
          • Size 7.2MB
          • SHA256 ab282c140b24eacf351fedd21a1ddf4ab9f7f2bb8283fa4726c2be814a1eb31f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\af.pak
          • Size 340KB
          • SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\am.pak
          • Size 551KB
          • SHA256 f92b0299185d963337e96df1016e1cf5ca335e22ff86568c1a6507c3fea29094
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ar.pak
          • Size 602KB
          • SHA256 7ab39416b60ee342ff2874aaa7b9b95b290828807b1395192cdbd29ee1be15e8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\bg.pak
          • Size 631KB
          • SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\bn.pak
          • Size 812KB
          • SHA256 71f99a67bb310fab8068eeed7ce24ea7624a66051ba4e719d051cc7e67e78001
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ca.pak
          • Size 384KB
          • SHA256 b6c895fbca90c36ae2cfefefda989922162a2cc259603fbca066f0cfbf43c4ff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\cs.pak
          • Size 393KB
          • SHA256 1b8c3add009028eb567b0094759daff29b7861e11d5a9d864071012200e9735a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\da.pak
          • Size 356KB
          • SHA256 2497368658a988e4eb3f64cd17423ea04e7555b104d43c8996c0ecbbfed5f74d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\de.pak
          • Size 381KB
          • SHA256 068ba3e34e7f253fad7dc526b1078aaa969bea044d48171925534598aa8becb3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\el.pak
          • Size 691KB
          • SHA256 e42aeaea80dabe82657983a462e4cd3ec74f71d4f08a689f5825f55fc02f3141
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\en-GB.pak
          • Size 310KB
          • SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\en-US.pak
          • Size 313KB
          • SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\es-419.pak
          • Size 380KB
          • SHA256 1b23cda69927c77764bda121ee398ffefcf5edcb5866432aa3526c378553c9b5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\es.pak
          • Size 380KB
          • SHA256 85fff1ca6bd2527073de03fa77dd013db2557a57cce1fd370caa2b185abb9336
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\et.pak
          • Size 342KB
          • SHA256 e2d38131a5ef4b0e8438f45e8c74c56bcf666760d4682120c8071c9220230555
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\fa.pak
          • Size 557KB
          • SHA256 b93145f30e25122015373a248d6ea22a539c7d0d58c8aa853ac35cc80dc06bfe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\fi.pak
          • Size 351KB
          • SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\fil.pak
          • Size 394KB
          • SHA256 a737a14f84b10b2e3c9ad4d147b430fd30c5ac0e125d5aaaf1ea19b0507de5af
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\fr.pak
          • Size 410KB
          • SHA256 a4d0e5a39241a6326143afa4c8ec881d6edb0382c66425411881946f98e053e0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\gu.pak
          • Size 787KB
          • SHA256 dee5ef4f4b36fc5fe0f3b5e10c7cc3a7edc14bf948317b31a3287a95bfe0afa4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\he.pak
          • Size 488KB
          • SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\hi.pak
          • Size 821KB
          • SHA256 5e8f2593dbea5a57c3a974558a3fc91b6087329a1e7b11622a6eac120a973718
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\hr.pak
          • Size 381KB
          • SHA256 e1c793e08e062043cc65271718d9b21d5742729dfa2e076ab012e8a008d06c04
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\hu.pak
          • Size 411KB
          • SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\id.pak
          • Size 336KB
          • SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\it.pak
          • Size 373KB
          • SHA256 e76c3f15529fa7cc088dc32903c6885f4cfa170a1e0144710b05965f3210c31c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ja.pak
          • Size 456KB
          • SHA256 21cd7ae581f6d0c19e90ac7df03d7dd5305b882776a1f091573f824bd28514da
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\kn.pak
          • Size 910KB
          • SHA256 ae4e003458f1a8bd3652e61241e11ff91bd887f6b95c1fe2700e76a117ba2119
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ko.pak
          • Size 383KB
          • SHA256 586f34de2c7bb0e92fc376f3ad962bf9bae1a768398459d39f8ed06b59d8ccbb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\lt.pak
          • Size 412KB
          • SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\lv.pak
          • Size 410KB
          • SHA256 7467360f9addd4d8694e1508a6ab3a3e00dce57e5897d5376ad27d8e651b23d4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ml.pak
          • Size 948KB
          • SHA256 61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\mr.pak
          • Size 772KB
          • SHA256 481faf7dd66cf10a476d8b156fb4ea452f920322d8007f7e25d41b2837bdbc09
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ms.pak
          • Size 351KB
          • SHA256 ead5a37549b98d55839ffcf0dc8f8201d37d71968ec9138fdea79d7c9b79549d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\nb.pak
          • Size 344KB
          • SHA256 d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\nl.pak
          • Size 356KB
          • SHA256 65a9c1efcdd451504e2e9b44b0c8fafd2c3c1445d760fd6c435305e2f8534f59
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\pl.pak
          • Size 396KB
          • SHA256 ce96fd415ffcda01345146faac716e2d45e2c556e5c6c38e9a1ea5ac19dafe84
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\pt-BR.pak
          • Size 374KB
          • SHA256 b26499a256d66feed42b372ea2eaceb75c279694b40a7b5d0f8c1a5c24cf381c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\pt-PT.pak
          • Size 376KB
          • SHA256 abb012215610178b7f8203f61f41103546d3949ac3df4acb3a622b01663f39cc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ro.pak
          • Size 387KB
          • SHA256 3e89d43b86b2582fd7db236659af47ff459a44c5b5ebcbb0bcc9eda244c8e501
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ru.pak
          • Size 634KB
          • SHA256 bd981aa65536b544228ed1d60a552ff4c7800b46f815177b33b3e628b97d77e4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\sk.pak
          • Size 399KB
          • SHA256 75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\sl.pak
          • Size 385KB
          • SHA256 4fa004d80c7e89e38cdfed3a652003787fa810256d294c16aab0bca815eb7c02
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\sr.pak
          • Size 595KB
          • SHA256 524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\sv.pak
          • Size 347KB
          • SHA256 690a83bbefe1e97de5d2c1c0791707e8ddc3414a12cf30b79329fa5d21840d6e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\sw.pak
          • Size 365KB
          • SHA256 690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ta.pak
          • Size 936KB
          • SHA256 9be97a18356b05ac4c3aa2b7e719eb29b47d8ad406aa50cf0f24bdde1d613083
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\te.pak
          • Size 869KB
          • SHA256 06dd7ae122d6f1f394aeb85089a9c837ec05dad627b0bcc92863ab2830e971c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\th.pak
          • Size 731KB
          • SHA256 7870b92c64f7776c469b4d19be8881ce30a5263cc8287c3d7de573aed43c7dba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\tr.pak
          • Size 371KB
          • SHA256 e8f86dc87dbf11935863efb3a5af8213a97123889019e98a7ef313b488088790
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\uk.pak
          • Size 634KB
          • SHA256 b86358579a9cec015c996c6ae862ddcb8cb558f30eedd0d0b9ef3cb18c3cc130
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\ur.pak
          • Size 552KB
          • SHA256 d0c8ae8f4f60f04d4eee8cc639ee3b52ad073f5c9ee6fb84c774eb855fd51e9c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\vi.pak
          • Size 439KB
          • SHA256 ff3cdd834569cf9f957a444ab8a51ebe673bd26d7c907a907aedfeed248d4890
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\zh-CN.pak
          • Size 319KB
          • SHA256 4ff334da089d2ffb9c6173de7c918b74c9326ed7bd76317b2696d57861871488
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\locales\zh-TW.pak
          • Size 316KB
          • SHA256 a0a715a3ef1ead036f0f03d02a8252fbdbd52ce6f8cc5b9298fc1c4494d4e508
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\resources.pak
          • Size 5.1MB
          • SHA256 3dfde11380615c1204b026f94e39ac503f1785d4b967e40d5384bd092c4f0c74
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app-update.yml

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\resources\app-update.yml
          • Size 99B
          • SHA256 38c8aad86e8a999394fbc565c58a53204971766c6e85550e2268063f9c662bdf
          • MD5 SHA1 SHA512 TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\resources\app.asar
          • Size 19.8MB
          • SHA256 e86e6fc78ecb001a6bbd0e86c203f254f89743f8397a2c37796a9a7b1bb44f6f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          PackXZExtract.jar

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\resources\libraries\java\PackXZExtract.jar
          • Size 120KB
          • SHA256 a847432bdf7da12571bbd5bda3b11ca3664675d1ff9baad5abd59b2d0689fa93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          launcher.jar

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\resources\libraries\java\launcher.jar
          • Size 3.9MB
          • SHA256 61ab765fa1f743d34d84e0415144cbff5604ecb7a91370f1ee658f964602afc9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\snapshot_blob.bin
          • Size 168KB
          • SHA256 943b27009d41801c5a649caf680e32d4dd25de002787a4ccd86b0925b3aac3a5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\v8_context_snapshot.bin
          • Size 471KB
          • SHA256 c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\vk_swiftshader.dll
          • Size 4.9MB
          • SHA256 011fc0f126868903dac9fecaa948eeffbc43aea2244cda071f69da08dc2f110e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\7z-out\vulkan-1.dll
          • Size 894KB
          • SHA256 c94823faa547813d388b41f72a791fcd2f36665c444ca88475d69ab7f1e9c3cb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UAC.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\UAC.dll
          • Size 14KB
          • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsDialogs.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsm87F9.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default.dic

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          f_000002

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000002
          • Size 18KB
          • SHA256 21f3fc76275a2871839bda7d39d6c2a0fa591e7ac4e4d05312f652466800b728
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_00000b

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_00000b
          • Size 34KB
          • SHA256 e92efff06e61ff52df4e5f08d11cea05d05b2d6fae9cd6124745b38e85c7216a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000015

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000015
          • Size 21KB
          • SHA256 42d4e8f1a0d2f0529ef1bedd2e9652c257f3244f1f008deb9360694f09afadb3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000022

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000022
          • Size 22KB
          • SHA256 d9fa43796d95d5e6e18b25699e1d29921dbf51825aa5d0025f2c8cb704dc8f43
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_00002e

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_00002e
          • Size 47KB
          • SHA256 6176e5b011bf4beca2d7b0fd94a981e0094b801dd36938d3ded6cc39b3197ebd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000030

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000030
          • Size 49KB
          • SHA256 a2b3fe4ce0ff08057aa651c95fc04112de7b3f442edd1ab71d5cad30e30e2a82
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000045

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000045
          • Size 95KB
          • SHA256 b9dac898bb25db1e94f7d4da269c0f9edafaec9505e9b1a533bae38dcdeeb8a2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          31686511d3d2d9f2_0

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\31686511d3d2d9f2_0
          • Size 273B
          • SHA256 99b3c3d6c4f976b8d5fb745564bfb0452a7c2d33d0602f18f04766c9f450b312
          • MD5 SHA1 SHA512 TLSH

          the-real-index

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
          • Size 2KB
          • SHA256 bffa8e36cdecb6f44511f61e8fe8ebf4e84d518aa5e6df5458055e967a318997
          • MD5 SHA1 SHA512 TLSH

          the-real-index

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
          • Size 1KB
          • SHA256 9a55246656fb0e14be02f2a25865a97051592ffbc5aa956451a878f4ac723ef8
          • MD5 SHA1 SHA512 TLSH

          the-real-index

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
          • Size 48B
          • SHA256 efb7e256f302aec133af240a2f9d82be5f8ae25b1f73f0735b155a9514ff52ff
          • MD5 SHA1 SHA512

          the-real-index

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
          • Size 1KB
          • SHA256 c364799cf0c185148dd11c6ab55c54c23aff9efba7337261aca99fc462b10a8e
          • MD5 SHA1 SHA512 TLSH

          the-real-index

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index
          • Size 1KB
          • SHA256 dc8f5b985d17247b579689c2af57cfe128d1990e1c99adb4946ab226047737ab
          • MD5 SHA1 SHA512 TLSH

          MANIFEST-000001

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\IndexedDB\https_96b868c5810dd94a5ffc1e21ae72130c.safeframe.googlesyndication.com_0.indexeddb.leveldb\MANIFEST-000001
          • Size 23B
          • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
          • MD5 SHA1 SHA512

          Cookies

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Cookies
          • Size 28KB
          • SHA256 950488c22e6616e5732fcd0b4b4363138f97bc01ef39f7eaebbb4fc3c03d0218
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Network Persistent State

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Network Persistent State
          • Size 21KB
          • SHA256 116f2661efc5b63dfae63b182ace4b64aa88f85a4eed8059aed28a35639e77f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Network Persistent State~RFe5a07a2.TMP

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Network Persistent State~RFe5a07a2.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 3KB
          • SHA256 feba4faf59d6fc65511eb5684d366363aba50b6525b2f99b4dfb2644b16827f2
          • MD5 SHA1 SHA512 TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 4KB
          • SHA256 1e5f6dd208d102d6ac655379dac968294f30fefcd3ca5c501f3eaafbbb048467
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 3KB
          • SHA256 0973906182ba7e2d328a952b92b3b480ff29d7a8809bc1ef33602ef6011ef814
          • MD5 SHA1 SHA512 TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 4KB
          • SHA256 64277dc0238c36a7b69e5864fa40e5df9bc50698292fa68f112d41a530eee6fe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 3KB
          • SHA256 b9477aa20e6eaadd66af652aab7b83a29692e8042f5cb16723c857c3dfbfdbaf
          • MD5 SHA1 SHA512 TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 4KB
          • SHA256 fc0347216764e099f1530661ee5ffaf980a6c343bab5004d6eef2a46332dcb6c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 3KB
          • SHA256 1ca9e62eedd4d63eff66bcb6b98cf4a072076d690b04cb33b82763256bad2e1a
          • MD5 SHA1 SHA512 TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 3KB
          • SHA256 495a8f648f81f83d61045f599026df4d1ddcf50f81bab9a3d4c6b0b594fe7263
          • MD5 SHA1 SHA512 TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 4KB
          • SHA256 17fc31d9c2d5dd628782e1faa5d1f90d699892242d8fbce7d29caf3468bddaf4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TransportSecurity

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity
          • Size 4KB
          • SHA256 ef5e021d8323cbdd4d33dc3828d1e5807ee642c3d6bcc0060f837392a108fb3e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          TransportSecurity~RFe594bc5.TMP

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity~RFe594bc5.TMP
          • Size 3KB
          • SHA256 f6e30c939b885ebff98f47d6da656fb5f011efb8df7ab46a59ff9af4ca96cd0d
          • MD5 SHA1 SHA512 TLSH

          Preferences

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Preferences
          • Size 57B
          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
          • MD5 SHA1 SHA512 TLSH

          Preferences~RFe591ed9.TMP

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Preferences~RFe591ed9.TMP
          • Size 86B
          • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
          • MD5 SHA1 SHA512 TLSH

          CURRENT

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Session Storage\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512

          config.json

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\config.json
          • Size 140B
          • SHA256 dc4d87159e452383f6e39c1b7dd2830c69457a547565c43cfd9e9b86f336f336
          • MD5 SHA1 SHA512 TLSH

          MANIFEST-000001

          • Path C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\shared_proto_db\metadata\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512

          memory/368-1228-0x000001D5293A0000-0x000001D5294CA000-memory.dmp

          memory/1604-978-0x000001E7912C0000-0x000001E7913EA000-memory.dmp

          memory/1604-617-0x00007FF9D77D0000-0x00007FF9D77D1000-memory.dmp

          memory/1876-1467-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1458-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1457-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1468-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1456-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1466-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1465-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1464-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1463-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/1876-1462-0x00000252B39F0000-0x00000252B39F1000-memory.dmp

          memory/2112-806-0x00007FF9D69F0000-0x00007FF9D69F1000-memory.dmp

          memory/2112-807-0x00007FF9D6730000-0x00007FF9D6731000-memory.dmp