b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
46s
max time network
152s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Salwyrr Launcher.exe
Size

150.5MB
MD5

358fcbfda7fdc5e8966be81cd82e3fc9
SHA1

1ca3c9cd0e791c82f139c543449630653447c33a
SHA256

bcc98408be7d77e03ca6fd8f1e7e01d30f3b55e3bb236735d514037f6b2da53f
SHA512

bc26f6e9395386791a7438e2e2f25644029584e6c318775b20cf8f13d268397b6a0e2f6ad8b2ccf726dc8a1102c6b08cef9a00fbd83855b65b0626deba009956
SSDEEP

1572864:ZGdFYlhnXsryUGmVlsdBbd51I8udcDs/VgC5daNcBgBTIWfbgrLvNc3xhRsOmpe:nlhnXr7er5c+rp

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\International\Geo\Nation	Salwyrr Launcher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Modifies system certificate store 2 TTPs 29 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e309000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Salwyrr Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Salwyrr Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Salwyrr Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe
Token: SeShutdownPrivilege	1108	Salwyrr Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 3040	1108	Salwyrr Launcher.exe	28
PID 1108 wrote to memory of 3040	1108	Salwyrr Launcher.exe	28
PID 1108 wrote to memory of 3040	1108	Salwyrr Launcher.exe	28
PID 3040 wrote to memory of 1468	3040	cmd.exe	30
PID 3040 wrote to memory of 1468	3040	cmd.exe	30
PID 3040 wrote to memory of 1468	3040	cmd.exe	30
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2632	1108	Salwyrr Launcher.exe	31
PID 1108 wrote to memory of 2832	1108	Salwyrr Launcher.exe	32
PID 1108 wrote to memory of 2832	1108	Salwyrr Launcher.exe	32
PID 1108 wrote to memory of 2832	1108	Salwyrr Launcher.exe	32
PID 1108 wrote to memory of 1180	1108	Salwyrr Launcher.exe	33
PID 1108 wrote to memory of 1180	1108	Salwyrr Launcher.exe	33
PID 1108 wrote to memory of 1180	1108	Salwyrr Launcher.exe	33
PID 1108 wrote to memory of 1912	1108	Salwyrr Launcher.exe	34
PID 1108 wrote to memory of 1912	1108	Salwyrr Launcher.exe	34
PID 1108 wrote to memory of 1912	1108	Salwyrr Launcher.exe	34
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35
PID 1108 wrote to memory of 1888	1108	Salwyrr Launcher.exe	35

C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1468
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1028 --field-trial-handle=1204,i,4613839825761222861,8661241327415782885,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --mojo-platform-channel-handle=1324 --field-trial-handle=1204,i,4613839825761222861,8661241327415782885,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1592 --field-trial-handle=1204,i,4613839825761222861,8661241327415782885,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=cs "--cs-app=Salwyrr Launcher"
  2⤵
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1316 --field-trial-handle=1204,i,4613839825761222861,8661241327415782885,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2412 --field-trial-handle=1204,i,4613839825761222861,8661241327415782885,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:704
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2600 --field-trial-handle=1204,i,4613839825761222861,8661241327415782885,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Salwyrr Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Salwyrr Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3096 --field-trial-handle=1204,i,4613839825761222861,8661241327415782885,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
bad0d4d1ffea8953717bbb196238bacb

SHA1
d984d3f3619bb60e216f0d55885bdca853c54f49

SHA256
af45440b544a387efbb96fd6663d46d2e0820c5cf963c996ccd08213340b72be

SHA512
393ecee92a27ad935091d5bdddd192cb34c954ce9895bad675c5ac3a6ae6d2817bd2894c1c6c1b7db2d8c2f6990b329575319204127e1889fc80ec0db9964e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4221726be8bd266436e4af176376284a

SHA1
63f15c551e2bd1563ca4b5ddfedd8e79174e2045

SHA256
8d027d13e6676fb5723cf13c387747640b92215789bbec4ca843c11ebb9d1954

SHA512
5cd04cc3db78ccdc7bdac6cd88fb0e53bb1f22246008fe2ef63ec2f522e348ce30c17a59892f9569efd8c710149e1d563201d9c6dc4aa6a4cac577e45a3af34a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

Filesize
252B

MD5
fbee2e09ce3744dd00e898b9bcaad309

SHA1
ca06c9f954f8f05fd13cf1434b2ffa4931121013

SHA256
98bb05cb089ce32fe43798d247040c5268fd1c6de68bf4bb3d405c299abcdc4e

SHA512
be17c2547c31bab4767a0530a8004ed52737b2186304f76e6b30fd7b2e2c65836ee1990cb78b21dca173ab6a3081bb632c223b11ba0d747bc364b215f792c616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc7486c29a4661b8481ab1207db6abd1

SHA1
2813b223353d8f9f21ad15c571dce32cb3ecf1d3

SHA256
3e046ac81916f5a6982c723ca03ed43d0100debd9b511fa181169934bf76cf05

SHA512
467e408a8f5e1fceef09f4fa5926ebae5fc38b9c3691f9deb93092e15a0bc543cefae88d533f4e96ad7d45c038c925d7a52b2867d9691ba8bdabf25e2883e9f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08ddabca6fbf5165555d80051ce027ea

SHA1
044ad51dbbdff2b551376306d9df97e398ae89c2

SHA256
1dcf3ab755496fd11a213bfaf585d9ae9c5f19fb17c497c6e3d12d5a35905feb

SHA512
5bd1d63497bcc39a2f7776da50513bbb424ee91f241a7a0f6b8fc57577aca9eac6695b0ae8de5d605b4c1bc1c5085465d9d3e55d17c39d5c8462d4b55cc7d368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
caeee774604e343c73f58af57b4d3dc5

SHA1
f9af6eb4ee07e59541f2d776815af642496ff452

SHA256
73fc0cba98adcdaece805abd8d2e7e19a1c61880c6e488a7359b0b2d2b6d0dc7

SHA512
093f85cdac560b7837f58a855ab280b0f1a6a9af3bdc9caccc5e83c78e68ec7ad840f8f9719835bb1f0c528d4368137a61b69d345b705a96f8af627c4112bb30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d684efda6cdd7a321239121cb134909e

SHA1
14d3055f2cbe8873ac91100baf16bb8a65516951

SHA256
69a3ce6919e9fdc2595e4c5a10f794de66e69383c35e88a3fe50ce897eff447f

SHA512
412a0083904894ec6895e9dc143c937efae40f651d20c3fb06310b44a3e9e1ace7635cc036830a8c2cdd2a48d17ebd35749f82dc51abe26c5104d857c9dc8ca5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a3fa2ea42169c555d3c4c8d1a5a067

SHA1
28278792b6b2d9bfac730338250d17f633424480

SHA256
e4dd2a58a812e8bdb27de94037e6586d8426d56ff7c2738cb2b6ef86f6ad043e

SHA512
548cd683ec133eb77316dc411fdec7bf7b63143fac4be24c74bd60feb9f3c3fc6f5e8c970d8225266af13a3082cfd79f0d2da3e5d41270f7dedd5d429846cb08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ba29e41820c625e222db403a4156108

SHA1
ec19c8480c16d7a576d6e6d1215ab4e66d6bb5b6

SHA256
61e075d47f0af5dcf0ce48cc78fabe242d47464f24882108736db92c4e7a06c4

SHA512
7168b74d686cedaf2b65f8f776841bf1c542f92c5520f3f5f0f08ac02936f4e60bf4ff1604792bf0e8a5493eb281fd87e1d0879041a62569bae3bebd8b651ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab29562493a346fb7a53797ca2e6c311

SHA1
3db9dd003d7d8cbecf053f4a06aa0d2a2390faae

SHA256
116ebc743177f75b992ab42c3c9067b7e8eaf2a7bb69a550f168dccac34ab0bb

SHA512
25a87effb514e3ed98af0b3cd6e9a803695a771beaad33067c92be7826defa024b4ef5d83607a2691b731987e3da22876e2546264edf3d7bdb4147a1a8ef8090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2c5072dc8ada994e6562234a0196931

SHA1
9fcf9273947062769cb68075cb1293498e94c555

SHA256
6e4e3ec8285a92cdb8724025773818400c35a9e30765d427d264e31eeb874908

SHA512
506d887fa3734dffaad80b0b03961aeb65dd906ec6ec5ab0c4810ca40159d9b2e9c366d9367739009849ab8ccc06dc8de4efe0772dce6e1db60548b183d1f1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2836eaff92df45c89363f87793e491c6

SHA1
60a49138b898de4d69e153625be3e0b62e215760

SHA256
73f3bb72552391646403574fea674c0f2e70d53de4cc173b7877c85ddb2c6e49

SHA512
dd643bdaa68c73f9fe3ca3dda9464b645193b386ce42f0d00280c2be992db7b499eb64b487d60a6cec8971eebbca29c8c7261fd7e31901ccbfdfa23deda06561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94d5b94fae611ce592d851547da62100

SHA1
98ab91b53bd1a560c3570da036fd95a199990824

SHA256
392b38883bd8c8bb29c9fb6ad1b0c0c50c7e6a591924bba2fcd0ad3eb07543da

SHA512
93b3eb6d2e4a4a6bea70d602e3173e09900434d9cb456ae39e8fa42a905bcd886f11c9c4e8ddd2fcb31cffe6d3002ca505f289ccd00bdd6a4245cb3549c275d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a97d4bee80d752b8445c7871f365d63

SHA1
b181ae168dde140adb46d1576f360026f39ee27b

SHA256
04593d7c5a1e399ab48ee06bf7ff213e00a874502b3d2b54ae6d0244ffa9058f

SHA512
59915bdc508296cebf08dc544e022f1a7d2ad687ad5aae3922e526fa1d8419e21616d2b10b8848ed1c1500a6970e2e0714b1bb51181c7a22a24162579dfbcdd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47ad8bfa4f9200d4409f81d003f46ecf

SHA1
8a63230405bca04294a90c77ee9ea3ef9fb01c40

SHA256
9e39babd20599e364427a46135b0ae1b4983aa438cf4b6c4edd678bc1130558f

SHA512
b6ee93840bd53753a883be0e2bff0b6326c32765dc0faa193f7b33e712da0451e581f0d4cea0f53e397dc822e93df5ab99c43faf5fa3c8c6e5c6e889ea6a08e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7fa7640ce949c0b7221e1d5cb985cf7

SHA1
b440e0d1c0ae86b206c4e0d17d086560f61c92b8

SHA256
e1e1fd0f2c5ca3424e1a603a1bf4ef173d1aadc7b974d7511ec337659ae8a53f

SHA512
ad6ca679d3f289830b67a75e87e84e870dac51166a3b11d4ad3969e19c250634bc8c7da76278b1448a18f5a081c5c3b5ca5a4a766cebc1149ab0087c76331248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
549e2a59ae934ff5b2019620d112dfc4

SHA1
2bdc2a948c670df9344cd49be2c2eb8d1a1c3d6f

SHA256
f5713936a3265f95ae4116ddbfb59c4323cc951ff9244bfdb1db2fd90bea9f4d

SHA512
cc8725dade988a81ec549f7cd86052477c4d3ea1f7428315a76c98406d7878acdea94d1e9f8c32c5dc20fb0cfb0c6db8627c8c09462bbfc37c299c23556c8cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cefd0294c5db4e7a515bd5aacd588cc0

SHA1
954c1ba7d4d200b92a6c47359928e0715c38749a

SHA256
79e1949b5fe529345317783881d0538391ec53383bec656a80d0251003829920

SHA512
c169092d4d074b1addcfcb1f28d6967b17a4c97c0f939b2f957292bc244065ea6ce19d3f49bda68dd74717ccad8533044dccb064a952e03a2043d55cc0a43d94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0738fb0dee26f6f7490a4a4210e37483

SHA1
bd4eef50542561b35d99fc4630338b5e6c196e46

SHA256
aceef731e4cabc92b4da2c78ea77199277e6181e0a8a9be061682248a8f6f24b

SHA512
47451b31e117bf2d641bc76d4edddf060ee23dab14bb69b66a1c0342630e847c088c2f4b52911776f7699e10e0ea8df7edb10e5353f8f5979b3c10da4224b515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
035738523b4f586d70a9e11fa44644e1

SHA1
77d918008cb06d13fe836b067ae17ba0956105be

SHA256
2f4b773acbf090e4896f11d30681ea708e4bccb4b567549a2381ab73db764505

SHA512
b3e054096cf0ad1ffd4f690c9a167514839c70f9aea7f3f0ad5f4c7159f467cd034fb545eebb09a8c62294df3eee682e137edd02a3f19d6d73066fcdca0fafb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d30d630535d400447dd46e9a7eb58f43

SHA1
b4cde1088c0fc4aea6a3b2327d3253984b39f3dd

SHA256
d51057ab280b632487d2268a5b40bd5f68d5049835b00c203de52d1f5db42b69

SHA512
58593823431d287a9d2eed26c2dba7a79cea9a2d2644ebc0c61369f8f53aae42f71a5465bb53eddbeaf9d4d0f513456c69c87f4462b79337a2a1ede783911f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
801d2d8c615d652c269a3a8f22b972cb

SHA1
488d9b67cb975bb1daee23cba8704626888b42a6

SHA256
251896169037662f73cf0f1db76781784dba59d68871db1b341f579ab9954526

SHA512
84caf0fa8c0775fe36d7fe246052a23fc9f0f2f968b83314a1c2817a0236515914540c495296b641ca373def870d249476f06020a15d9876a4edf037ee92794e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ed7ef31f0fa7d53bae5d4ae35e737d0

SHA1
4939c1e660d2f9c843ec8e37fd0f5c4905b3d8f3

SHA256
644e08f686bcb6383f4d7d77152c7ffbc533402a3f638534439a79d29238a66e

SHA512
cb903079921f455aa7f91662d03f8280dfd59ceba28cdea94ad83ddbc015c4991a25ae0afd7d40dddbddc4824e3a6b5f454608cd29cee5ba109e8f5c67f022d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa3c318eb5b28c922fd5cc66bd1c424b

SHA1
a62d7bda2e35f9019caa76b88286f23dda47b089

SHA256
5209949833d632832c5be2908e057f555cad475b724d1039ac0fbbdd9e465041

SHA512
d8b7274daa9b6389a532f0ff0a11b46c9c3d3311e2b3d5c96e0af688af0d444526932da68e7b472a51f683704fcace4b8057f9bd893390c588cc73311d4efcd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67dc01fd889be7098a4faa3a7ca708fc

SHA1
e4c8f52ef69d4bee8eae5166c801558d12b1e80c

SHA256
b9bef0dab8fdfc5622b2625c1b07a422b5bae0048a71fd44e9f9cdd75a8d6288

SHA512
df70a841b1066109fa3ee269e6126e1213d24ed34411ae6c40b7cba653c48c6dfd5ddae3c5abeabd5c622fc42b6ebf6b97928cac706f9d1045aec5f86faf59cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4112a6f1183c11cb70b32d04bf24b48

SHA1
d1e543434f8a8e7328ba772fd439f97c6a212c75

SHA256
ef1e41367a45fc20b4ca660b2b6680b4e328c6727315273e594c07d8a9e519be

SHA512
5a9f3990713edd02285cdc86e625b442bf82c758540c36f1a12c6bdc65b7ae4ea951b2dcf2450051e75e203799594f00da59d425417352757e3db7dc7cdcc198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86430cc353931fb52c4f5474c816e5aa

SHA1
3436871a78aba58ec075b095eff961ceda9b5213

SHA256
83f955d8a19f6ec201ff08976333c4a3db6eacb4e883724959a3d94c0b144502

SHA512
8b373cd0b52aba373fdcf97b2773f72b64d34e5dc9615f73fe7d45ab956b508ce992add9b506aeb4b3c2166559ade17bb4369bae3662b106bb68afc58c57eaa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90a1dd008b4f78a7ca0b1a3161c90f08

SHA1
be5b3cd0d03fac9220e2e6c2838e34274c44660d

SHA256
b88fe315f66387f574ff41cc84698eba42a9100048539bffeebafba82bf32aca

SHA512
269c994c7e76ebdc973d6491fe997743fd5d07271d662087230aaedfde9f1a4bb021698a21f08ba9e19ad24dd3947981664b6e17876d7735a24e6c31d8f27dce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b716f8c8cf360af849f529151561a1fd

SHA1
cf04d8ecf0c5a1ced0c07c93105df2c05a03509a

SHA256
175d0015169a45534ba26382dca259f17484c88609f72fa25cd8cc6c4feafc8e

SHA512
753188aece05cdf62db7b809ebd80c086db74b542a214f0abeb126db4fc4530a2f7fb83e2822197e3e38456f55d081c59deb7eb365821ed7e595d51435b9ed03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4492a109fefcd03ceb41a3548694aece

SHA1
0aca9c10ff04a075d5ba281a7b174c9e3a7df484

SHA256
410926aaaa941bfe84c0b23e51705d1af931ec1ba175971e0e696ff1c2526f92

SHA512
76ff420efe03acdee427e24b69b4af4273c5b5900ff92707bc040f632e1a744d4bd0ff5ae32122dba01d6af6ef958078c41c23cd57b08d1338d6c637acaf96be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be193bb7662913ef1b03fcc077a2e9da

SHA1
75a07f3d87ac2f30855de9c32c5531b55e60ea93

SHA256
4b15c6551d1593e933951a828da237fab2c0c025b8dece7289bdee34b7a26992

SHA512
4c6fa237e1c86d4b947198a66abec1cd7fc6e557e6a57bce0864afa9dd657848acba5bf1226c11beaae1acc2731f010a4f1bfe55c9a1cc42f1104cab9d66c163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b29dc1f9529f1c256813f9a19d723a0a

SHA1
78ce649397f597153a68434bbebd28471f595768

SHA256
299c175295757329b983b30a133993d720cec0fcd38ee7ea8ab4dca24c954e33

SHA512
4a047e6c60b385e1a08d1295da7c3fe930f70bf866fd5de1443170d71856427ba989ebd5f976f7fb2644d88466f15ac9383f01a1575fbcc6362b38febb26cd2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
869b1c98e0ccd975be9f748df05bdf7b

SHA1
cf6326c40e9aad3ffa26be01ae47cf66bfbaf622

SHA256
a8c6e3c55c46522219468105ca22705350800b43043d83174ca225481b7cf69d

SHA512
7d477527c4b0cb939b8488b2fe53390e7333218836726111a3d1e6c7303440ed9f49c936d672120efaabd1d6d6019da1649b37a4e0cd53c2fa650b8bde088e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4e32921e8a14d394cc17835cc44200

SHA1
bb30c1950afce9eaae0c88bef73b0d1f22d96177

SHA256
46845a805fe98c7a2a0a223f3e5f07884b40fc218f47c85621cac4e22b422b8c

SHA512
6d243aff542d38b29c2add61cebd8e32843e7813a910276a59dfce196609a5fa213b5962a87d37c51fbebdb333518866d86ad8cf212be8566b3fc6c43c1e3e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2931c91d257d1dab89139828f3e5b424

SHA1
85eab19998bed470f2705d332444e20bd0bd70e8

SHA256
a9b6759fe2edab537ee028bde97dd80ce5fdf2d7282291226c1ab330d95e6505

SHA512
d3212cb154c4149a65ee7c60df66a255fbb7bd1bb82540e9926d55b1a2e064c2f522525b6bf1661d9161ad9c2d032fc03bb0f8406bfebb1cee005261aed66714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aea485e576642e44015f5a4f9ec0289e

SHA1
ef4aa157e5fa0e83c0f02c74cd383122182fc2ea

SHA256
b209b26a9f09d80dd7bf56a20f2f46ac43c8b57d7837e1cc020c314efae81db5

SHA512
cfc3a5ee30070cf39d55c59ea238834508d931e2145122cc849ce7b02c1b25e724b9ea5688fcf7e4e9ff56cd41346329b0ba410ef8846386c43ddf2d27b1d830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6046345ba2caac135afe25dd158a2643

SHA1
3b167acba952ffe40436f4990532146571fb3654

SHA256
76414d9066eca7a345e861e2839e4bf90dbc66bb7a709fe3388965de116eee67

SHA512
2922dd8dabf4d6f5b75f9e67fa584d4d09e7e559e05d0574922abeea7be39381eafdc42848044891a8d4e3811d396e7c665832e7dd13aa4ba44bd323e8010b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
983a852180b5454a9b8a61271bb9fb8c

SHA1
4a48bef3b01695cda941d939740b62606b0c458a

SHA256
4f59129d926bacac5e167729048491652a1f6aaf400c56c8f7d7b9c62eac33b2

SHA512
96fac08a8466294cb2e9a90f70c07c8810b8d7881fa88eb0b90dcf1fff29182c37138fb2728a14316f8c9da0faa3b8aa833995a4c6bfaad66eb6555a3b79fc3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95f55f2e9d8320d05cf835232a1c70f0

SHA1
9301f7b5864f19f745fa0b3607132f1bf7b58003

SHA256
a3093f641b2c478410848d3fdedcd2ff0ef89117596bec50db60c2e0e382b225

SHA512
b99cf2fcd94066f328cd4422c0905b0b165afadf914d097682b4b684a74e238759ff4044fc37965ea587e4864bf42ca26699c73090621ae9e7405d009fd3aea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80339f3f4fa58c919b79089778c47cbc

SHA1
1a3020007ca8065649ced32feb10d793d5f64fa9

SHA256
a0d11c8235398243a19f7fdd0f73c63fb9dcdd777301e365b475da9d29c039a8

SHA512
ed2d4f09383225fffc61b37fd7984f55a10203c367f25e74a33bd5139c8a3fa28ced0ff7aa50ad2339c7138f3187209c6978f817b3bd2816eb5c40a77d46f2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd545eabbc76c3ab780d0c409f18c67f

SHA1
9b733d35d4d153e248c3d6db7e4dcd33b14433b4

SHA256
c4c61eb5fe9425397e85f27b8430c284ee2a3613ccb214c4ecbeb0e7893baa12

SHA512
dd303ac743f47a11f21956bf610c5034101763c41d132e4716dbd52ad274140c2e205718b296b91ba7b04fd9d09c5f4511c6e9f36672c739e54b828942125864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d345795f5eb0e0231ece9237a2ae2588

SHA1
9af9a5166c0ccafbb6b6cf4efb71d6711e284528

SHA256
fdc9dfcf6f7851449a4c9ab15cddca6ea23b78bc4a71f6fc22a9e3a5846952d2

SHA512
4125aa05924f874bb4b68d8944b1dc5ee8bc23b2b1944ada5177437e8f3316d5f3cc7c0ac2c99eb837eb9d665d6fc8c193e872e4a31130efad162851717f21fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60a4e9547733755cb6c8d9408ed47112

SHA1
5ea4b2b03075761562713f281d689e8e5fd887b4

SHA256
675544278c4a8afc29efe1044b239cf7a7da84bd290a609219da9879993aa628

SHA512
95fac1caeed0da1d5ae194de7c1c33a27ca0406d5122422545bd64fc645518d5cfb88b110ff321f6efed78d45dcee4304bc2402fcd2e0e5d11260abd62e2de56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
777ce91bc57bec46cd4b1897e6f87588

SHA1
b4a29d65b5bc82e4302d15740b271fe8955ec254

SHA256
bf2fb7199113747eab11515d2913c4252949ac558c3ac79ea339495b69945214

SHA512
06c4c8437116e813b46857ab8713f4a1657172105d920fbff6a95df75cbbbdd99255074e5a5f36916f4d406fb6a08871a5286c53e38ae0b943e22fe2bf07d24d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08569b1e5bd2950dc0cdfc120fd6ec06

SHA1
e62430f2f5a5b25a84cf46ba69f30c386b635415

SHA256
e6b25b20a4fdbe49d091ea94d23cf4f24b508eb48650d3df350b53b518733158

SHA512
8f3ac3030f37e5e51546be0973315162ac57a4315d225f02698f4e67182b90827552dce985401558479ee1a67a1f4315b311fbaa2a62ee7843f1a3325defb7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
457b9935147647ae90a641704d5e1b0b

SHA1
6cea0f1efdb4106d5de2036708633cf85f5df3e0

SHA256
8e67652d9e2aeec5e13339058fbb28a5e67776aa24ad84c06eb9c2a0546b13ef

SHA512
3d4dafd799fc5114923366cdd55c1bd80c02c5d2619249aa2f3ae66f69a7e3135866deed57936d9732b3ee1d51558a2851cf1172dc65bda221ded4cfa3ad83ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d18899d0208485d013f787070b9932c

SHA1
f6aabead31e40607f9401ddcfa6f0461c0dc9610

SHA256
71f5e4c0bd430320e290db5bb1a053ad552321068ff37ed67d522a9455972bfa

SHA512
6b389181469d13a0cc2a3e858161b734abeb1f012e53bf6008b2129ed1d5e5917dcf68078f9133e1cbc9f2e5288d6e4805e0e4533d28927ae131bb08c791be98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f4ee277b6e572d5f0a4e5dd8b55296b

SHA1
b921f1a2a788334e64b2147518b1a511bc370324

SHA256
7bf3b66377bb6eabf6ca031ea9649a5a39ecb965172b5632798db7d675120490

SHA512
be5304e8499546e82c1ceb790d0044311a6d72e53c981b23e51a2e7233c043c0eca387ede41a60744b21eb6bc0d4e5d87f1d321f835ed065c6c59e6c3a707028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6854ce59905eb390d45c221296b79ddf

SHA1
bd092a83b4c55da0ee5f64428a7a73259a52dbc3

SHA256
60381364a0c170b957c2858ea4204b51644009acae6c3f77978c5b3f05810815

SHA512
2dad689bc0fba636377d7436b56e3bb5dfb5ee8d2faf1170b3c6102199dddefe2f519c455c90bd65c2a70c2886020fad5136433b373763325879f9864a906a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7316c8adf372ea1a0bbb1705ed5eae1

SHA1
68f2623c657263541b60c747dac04b0a9cd2309e

SHA256
c2bc6032b77a2fca58d438cbaf048c0654bb231a2fdfeb9592626e9d2055340a

SHA512
e6975e33b798db2e143ed0a65818efee2a1bafc7b6fbb7b416f3238618d1202c5990338d2d2599db4e7e852fc994ef50fcf195a890d97661f60dddbef4872ed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50bde8f22795d84795aebee258565056

SHA1
af11488691a2fc75dfdc99399f61ca3e13c06502

SHA256
4b382a57bff04fa73c603067632795be4338b98240343586d568a8daab1ecfab

SHA512
e0e206c002a0f998d2a75badef2f6a7533fb3c25c8e60848438e5076ca40b8407b4e8eb61136daf56d52ccf65501b4e87620c4dab7a9478999577f628da14eb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ec8d6164501be44d107965ecf6b2596

SHA1
6bb796452877fdb5d378a1067a18b0966921aaf9

SHA256
f79d9d6924de0ef7153b7748845078b4fe521ebb98482cc66f08fc9fc89e9155

SHA512
f2f12d2f980cd843f17c0f2b91ae62afd3739f26270754c89bcd37a16a99ae7dd02189c133df480c8e579fc44d23e5adf5d3df0bd876dcc345a20f1db10d979e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3670d50061dfb97a80df6152f2f043ec

SHA1
443f37fd5339aa7d3727ab24eebe377d4b42c39a

SHA256
4956702bce6716876b0ede77f2032b5c9c4030abe62e4a7dc270cd71b033bfc4

SHA512
80cca614566338afdb7f68273d533f70f39775b72e76e4910b0cd507c8d1c89339f31831b55cfcda0f65660c1ac621d5a2a72054ce3e64027244d65002db7405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df52fc4ceb0ebf33283126bca700c8eb

SHA1
e67f73d2178f0606d520eec2dbce111ce9c30457

SHA256
baf9081546d5efd2e722b60f6f085578aa2c6fedc2f11bd728864e8c0a0617ab

SHA512
c88e775c8e978aebfec555b4b59bea4f3f95b3a5650e5d6be4ca0eff7ea8260e1ea1c484f70131d8f1063b0aace742120250224a4df08e94ce7406ab1cdcfdab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3829da50ced3fdc264a43169e667978

SHA1
ed8ccf11573bc8a9917721367895cbd685d65286

SHA256
c66e03dff79e7200938cb99c0576dd8806afd85c730cb3bec3b91d32d811d32f

SHA512
f795350e504298b5dfb6a09c3b1d0d9dbf701f7aa30d3e1949c3255baf3562964328f64a52f438a54f3226d41d2abbd75878c9fe3c0007f09a80e17f2410d1aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
058b433b34a5290e4dd34cbbe374f021

SHA1
ea1ee349e32fc6603df6331a488afab41a19eb9f

SHA256
a348e19696e2983d6fc9b724725d66bf31397c876e626f7003c2e4cd698f3371

SHA512
0cbbb6e40ad19337b6e10e6ec9bf147b7422631f6bfbc492d70c3e12bcb1119818439285f844cf7d0e5d9b413826ff27a9d546e3a40bc05e7372add539626978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0973476c4ca53b9b83fa741235a1f03d

SHA1
4b1ef58b2a3e4fbffc402220dd0c5421231fd060

SHA256
5540b120180e133c11cdc152428af926f55688e38fefe1965444431378778557

SHA512
2538698ea506dab5faefbda34cec4da0d0e483511924572b679de4d727ca89f74793fc81c53d890a665f73560228c6236865b920499679d41bfec949f07f4617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
346a06c24332a25bf23b24f9f85d7596

SHA1
11e4e93f56e07dfa856a5e6d98bf53579e8db6e1

SHA256
b8eda145900f648ca5cb7a6e33d171869a91d8bb7c328fb26013bab7213d761c

SHA512
f1f161546d6028600d35349f00cc64b66616f9e81ac7de3d53e0bb1d705eae27d8145b0f7935c0c933b171b0c77834865b273ec46b2fe6125414f96d198d0b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ac745032969fe7c76833bfd6be1bea3

SHA1
d962d6ba7bd896ed9d64e1c1aef5a19447466de3

SHA256
3d358c5ce3a0bbdec571443790aa42b98667c3417c35b64bdc086e507d0a438b

SHA512
1bff6989caa9819c1bf98fd371048318511f7090271f8ec395f401daebe4bb94790c258d87b0a96881c38f89a33ef056f895daf3ade2bc48eee79dfb64424a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f3601460e516f097312d3ec00ab61b

SHA1
dec6a2b75233227281e06d0c0d271fe2603748b3

SHA256
948a7eb047bdfbb8880f0f7f03c478e6fc0a9776bc0ff6c15da5c551fc3ac84d

SHA512
f3d8fa1e633b70b5a3e32581479d83f03371affceb7fc84d06131c31257bad74d6a443412f9250a581ce976f446668e376a2961b7f30c58fba849544db3643eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7a30a1ada4ce2dd2748acfa620c86849

SHA1
ddd4e2f6cbd813e1bf56c73ab89330df6e4ff27a

SHA256
aa9d6e85d58b8c4b328d09071f8f7fe8b8ae6696f1588e62e0aa80c4ae960c30

SHA512
8d891d433e61eb73f2ab8398720f6b8efed9b4527627d04f943eccdabd6df99823296f224dbdb903381f7183ad51f5945ffacfa9130224b4c6388cd672e3847b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
33a290339e343266d7f1b5dbb2a0fe5e

SHA1
f9efd5109beff3f2b4287a0b363aa1743b227ea3

SHA256
45646453677322f749968b78cd507309423469dba260a570941cfc3dfd66a670

SHA512
aa6402b3dbb3042ac752a34dc0c1a6d5386ec87757d39f81f0703924505945dcc3d587eb429f6b00b498150a5794c2289f4a80cc4727cdb3a1fec1fa220186fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar286D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\6d4e0878-6f1f-4062-b739-980909607fae.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Cache\Cache_Data\f_000002

Filesize
17KB

MD5
aa887e23c9428d0de82953dceca1db41

SHA1
2f74f13b33e3ceddf087ea3cdd405df98989f900

SHA256
b82aaef585a92b08d708c3c9ebc22aa39dea389b0a820dfbde137598fea4f041

SHA512
cf10532c66f1d99c16bc6a0a15f576cc4222f50f5bd08a1cdb05ea2b21290b28455266f74ce386f8391313c22c85f891dcf3dabe5011dbbe5942d02db4489617

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
897f8e65ab27671afdd2219722a503bb

SHA1
7117aa9cf32711a78d3996294918076ad93db9bd

SHA256
888813d756706b4b4166463dfd1689a6a657cac4e4e056514eef8008be976a7a

SHA512
3eee9c5e13e8fe9f63561a4cb94ca35777fb53492c4b9c664c3f49c1c5027d38f82cebbb6ffdd4555a9fa7d3ca58c67b1d54e22285f78ec62cb6f2013f806310

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\DawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\DawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\DawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Local Storage\leveldb\CURRENT~RFf761fd0.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Cookies

Filesize
28KB

MD5
ccf182eba517015b532f6f9a17958a0b

SHA1
95b431a3b0831c063651726fa3e11dc94c5e81a9

SHA256
50689921dec5daa501017f897a08d1b39a9ca2a95cb8ef53b60fd1ee0bbbb9ed

SHA512
581f833282544f223374e7e3929ff9aa301329e9fa4318c627f474d6efa7adbc699c3de5f28b4e7f69a8cf40eb535e310178dab36937fb0e0dcb1ddeb414f9c8

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\Network Persistent State

Filesize
8KB

MD5
484ca6d7280070f9e4b65e768d5e6103

SHA1
bc5189962bb965e2cb2bb0d28d417f1b73a83f5d

SHA256
c91b5741b7924b192a140d895085f645dba51855776110fa9b0cf681403761c5

SHA512
cffe7cd360cf1d2d2889b68d46e785da580ac60005ed3f3369036c0a434dfebfb83df42132cbb54f7f806b40e81d4453075bf651ec18336b6cc3226403ade0a9

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity

Filesize
1KB

MD5
79cf12b7ced614af1d7e1d8400c4c3d0

SHA1
13755ffb26583c766c4055fbc4f93312df642a92

SHA256
e3097d84876667fa53986257528bf2dafcbf3bfd8355d08f317cc03b040838ba

SHA512
6ff4139d38af45eb757a1315c146e76d5c5a53e5db1e0c8882ade109c6d0d7111caf360827c40bbea95628e0ca228117ea606289cb27bf4daf204612ba3a7141

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity

Filesize
1KB

MD5
178df222a33e741b3e05405078422147

SHA1
d1a57ad231a0d39bec4a26e72df9f532f241c271

SHA256
4f5a09f0ac41fb946c788dd5277a3e42da0abcf705e20db902a7d6fcfcc9fc77

SHA512
d3ae7125116dc8477de949632714c77c976325cc72c5decdddf8b7b0eba2acc067222817a15f4d63556e6e10b4554ee45345c0d4e9bf8583418769d9a1566d24

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity

Filesize
1KB

MD5
3c8fb070cb0fe1e29b3ece42986fe9d7

SHA1
1f752ec68e85ed698ba196cc5818ed444cff910d

SHA256
f92e9efa62dfaaaa50715f7b9ff60c7ce5905a0c3e40afcd51c06fa5fd0716c8

SHA512
ac4526e2cec63f2bca0888b58fd0611a3ad1eaf98b01a7099ba6545d224a2e809c6d8d2d073f996ecdc0bafd26818d58125ed556339c727773ada82cdfcf6c8e

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity

Filesize
1KB

MD5
321ab9dbfcac38444f05e241f79584aa

SHA1
6273ee4ba7b9e4da37321dcd5dd6275af03e5543

SHA256
f0d80dcb0a06f1765386426af601ce3193659c9f7ecd68a5f8dd51552cfca663

SHA512
bdd601b1d1913d39b203e967a9002a32de06fbf6c7ec105596018ddbfcf58b89aed8efd58d1233087847b70aa8535d9049167bbbae9ff59ec9bedff1305ce7c4

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Network\TransportSecurity

Filesize
1KB

MD5
9547fbeb5484609c2236f3a5c8b2e441

SHA1
8630b73db63ef760e4266a9a97fad0877b571f86

SHA256
d3e88d7eda8590dd05a93c1f0cf927a3f3a06fd9fd62c258cb03c51e6cf5683e

SHA512
5c0fbbc54f4180fa8a3dd1950a06d2f287a9af21366aa65df7cf156fcbf51df979191dd3f82045ad3467ed44da01066b6c0964ce1dc4ec81ec6c8fb54fb0b303

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\Session Storage\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\config.json

Filesize
140B

MD5
2dee85ac19aebaa50662a4ba424441af

SHA1
d0b03e28e9a14d48a1a9b206e92dc1bf1266328e

SHA256
dc4d87159e452383f6e39c1b7dd2830c69457a547565c43cfd9e9b86f336f336

SHA512
651d95e57716081376c14c26852e01997c77597da0e0350620ad4cadbf14f0a02956d7b3e8cbdf52a777b64f7ef7db63066791e24074d5e5b57a38af2b7c6a6e

Download Submit
C:\Users\Admin\AppData\Roaming\Salwyrr Launcher\en-US-10-1.bdic

Filesize
441KB

MD5
4604e676a0a7d18770853919e24ec465

SHA1
415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f

SHA256
a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100

SHA512
3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774

Download Submit
memory/2632-33-0x00000000770D0000-0x00000000770D1000-memory.dmp

Filesize
4KB

Download
memory/2632-2-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download