dc117862bd349e0e41d3870802b9657e7c984723c82043334f5f43e2e227bf5a

Analysis

user interaction
yes
max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
salarixi-1.1.1-windows.msi
Size 15.1MB
Sample260801-tml96asybx
SHA256 dc117862bd349e0e41d3870802b9657e7c984723c82043334f5f43e2e227bf5a
MD5 c1f5c9ff0a62eb5ad58454c0f70fb495
SHA1 403d46481be9e254307554d6ac132437e296dbe0
SHA512 e04cff87983543f37f6306388c4861fa315e2ffe820bd6a6d713a2c856250fc174e814ca7da2bbb7705370f4b4fa19e231dcaa3a92ab87b01fdcc5eefe3998db
SSDEEP 393216:7pT+DT8XQfNjNSbfLbzHZvpPfNi/oa7HWAJmidRRP8MCkslu:78Tbfq/ntpPfwzNgibRPDzR
TLSH
T1DEF63307BE468260C4225DFF49368B708674BFA4651A3422266473B9CFF6DD10EF69CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3660	salarixi.exe
2844	salarixi.exe

Loads dropped DLL 1 IoCs

pid	Process
5112	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	salarixi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	salarixi.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\salarixi\salarixi.exe	msiexec.exe
File created	C:\Program Files\salarixi\Uninstall salarixi.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e585762.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86E6E158-B73D-4E68-80D2-A79687571000}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e585762.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{86E6E158-B73D-4E68-80D2-A79687571000}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{86E6E158-B73D-4E68-80D2-A79687571000}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e585764.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4148	msiexec.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	salarixi.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	salarixi.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300743048426208"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\851E6E68D37B86E4082D7A6978750100\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\851E6E68D37B86E4082D7A6978750100\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\851E6E68D37B86E4082D7A6978750100	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\851E6E68D37B86E4082D7A6978750100\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\PackageCode = "A3B9B433BBFE0B746B830D6FCDF59BD2"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\Version = "16842753"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C38AF6C5DCB5B3050A5D2A2D9C441FEB\851E6E68D37B86E4082D7A6978750100	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\851E6E68D37B86E4082D7A6978750100\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\ProductName = "salarixi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\ProductIcon = "C:\\Windows\\Installer\\{86E6E158-B73D-4E68-80D2-A79687571000}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C38AF6C5DCB5B3050A5D2A2D9C441FEB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\SourceList\PackageName = "salarixi-1.1.1-windows.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\851E6E68D37B86E4082D7A6978750100\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	salarixi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3320	msiexec.exe
3320	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3008	msedgewebview2.exe
3008	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4148	msiexec.exe
Token: SeSecurityPrivilege	3320	msiexec.exe
Token: SeCreateTokenPrivilege	4148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4148	msiexec.exe
Token: SeLockMemoryPrivilege	4148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4148	msiexec.exe
Token: SeMachineAccountPrivilege	4148	msiexec.exe
Token: SeTcbPrivilege	4148	msiexec.exe
Token: SeSecurityPrivilege	4148	msiexec.exe
Token: SeTakeOwnershipPrivilege	4148	msiexec.exe
Token: SeLoadDriverPrivilege	4148	msiexec.exe
Token: SeSystemProfilePrivilege	4148	msiexec.exe
Token: SeSystemtimePrivilege	4148	msiexec.exe
Token: SeProfSingleProcessPrivilege	4148	msiexec.exe
Token: SeIncBasePriorityPrivilege	4148	msiexec.exe
Token: SeCreatePagefilePrivilege	4148	msiexec.exe
Token: SeCreatePermanentPrivilege	4148	msiexec.exe
Token: SeBackupPrivilege	4148	msiexec.exe
Token: SeRestorePrivilege	4148	msiexec.exe
Token: SeShutdownPrivilege	4148	msiexec.exe
Token: SeDebugPrivilege	4148	msiexec.exe
Token: SeAuditPrivilege	4148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4148	msiexec.exe
Token: SeChangeNotifyPrivilege	4148	msiexec.exe
Token: SeRemoteShutdownPrivilege	4148	msiexec.exe
Token: SeUndockPrivilege	4148	msiexec.exe
Token: SeSyncAgentPrivilege	4148	msiexec.exe
Token: SeEnableDelegationPrivilege	4148	msiexec.exe
Token: SeManageVolumePrivilege	4148	msiexec.exe
Token: SeImpersonatePrivilege	4148	msiexec.exe
Token: SeCreateGlobalPrivilege	4148	msiexec.exe
Token: SeCreateTokenPrivilege	4148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4148	msiexec.exe
Token: SeLockMemoryPrivilege	4148	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4148	msiexec.exe
Token: SeMachineAccountPrivilege	4148	msiexec.exe
Token: SeTcbPrivilege	4148	msiexec.exe
Token: SeSecurityPrivilege	4148	msiexec.exe
Token: SeTakeOwnershipPrivilege	4148	msiexec.exe
Token: SeLoadDriverPrivilege	4148	msiexec.exe
Token: SeSystemProfilePrivilege	4148	msiexec.exe
Token: SeSystemtimePrivilege	4148	msiexec.exe
Token: SeProfSingleProcessPrivilege	4148	msiexec.exe
Token: SeIncBasePriorityPrivilege	4148	msiexec.exe
Token: SeCreatePagefilePrivilege	4148	msiexec.exe
Token: SeCreatePermanentPrivilege	4148	msiexec.exe
Token: SeBackupPrivilege	4148	msiexec.exe
Token: SeRestorePrivilege	4148	msiexec.exe
Token: SeShutdownPrivilege	4148	msiexec.exe
Token: SeDebugPrivilege	4148	msiexec.exe
Token: SeAuditPrivilege	4148	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4148	msiexec.exe
Token: SeChangeNotifyPrivilege	4148	msiexec.exe
Token: SeRemoteShutdownPrivilege	4148	msiexec.exe
Token: SeUndockPrivilege	4148	msiexec.exe
Token: SeSyncAgentPrivilege	4148	msiexec.exe
Token: SeEnableDelegationPrivilege	4148	msiexec.exe
Token: SeManageVolumePrivilege	4148	msiexec.exe
Token: SeImpersonatePrivilege	4148	msiexec.exe
Token: SeCreateGlobalPrivilege	4148	msiexec.exe
Token: SeCreateTokenPrivilege	4148	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4148	msiexec.exe
Token: SeLockMemoryPrivilege	4148	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4148	msiexec.exe
4148	msiexec.exe
3660	salarixi.exe
2844	salarixi.exe
3660	salarixi.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 5112	3320	msiexec.exe	94
PID 3320 wrote to memory of 2648	3320	msiexec.exe	115
PID 4148 wrote to memory of 3660	4148	msiexec.exe	107
PID 3660 wrote to memory of 3008	3660	salarixi.exe	109
PID 3008 wrote to memory of 3504	3008	msedgewebview2.exe	110
PID 2844 wrote to memory of 1136	2844	salarixi.exe	111
PID 1136 wrote to memory of 4000	1136	msedgewebview2.exe	112
PID 3008 wrote to memory of 4116	3008	msedgewebview2.exe	113
PID 3008 wrote to memory of 4116	3008	msedgewebview2.exe	113
PID 3008 wrote to memory of 4116	3008	msedgewebview2.exe	113
PID 3008 wrote to memory of 4676	3008	msedgewebview2.exe	114
PID 3008 wrote to memory of 2648	3008	msedgewebview2.exe	115
PID 3008 wrote to memory of 2648	3008	msedgewebview2.exe	115
PID 3008 wrote to memory of 944	3008	msedgewebview2.exe	116
PID 3008 wrote to memory of 944	3008	msedgewebview2.exe	116
PID 3008 wrote to memory of 944	3008	msedgewebview2.exe	116
PID 3008 wrote to memory of 2600	3008	msedgewebview2.exe	117
PID 3008 wrote to memory of 2600	3008	msedgewebview2.exe	117
PID 3008 wrote to memory of 2600	3008	msedgewebview2.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\salarixi-1.1.1-windows.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files\salarixi\salarixi.exe
  "C:\Program Files\salarixi\salarixi.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3660.2292.6309841615188794908
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaf3b6b078,0x7ffaf3b6b084,0x7ffaf3b6b090
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,6296339851765016956,14275481585814743924,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:2
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,6296339851765016956,14275481585814743924,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2400,i,6296339851765016956,14275481585814743924,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3724,i,6296339851765016956,14275481585814743924,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3720,i,6296339851765016956,14275481585814743924,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
      4⤵
      PID:2600

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 66FCE699148789A94FFA5C0751DD67EA C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5112
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1340

C:\Program Files\salarixi\salarixi.exe
"C:\Program Files\salarixi\salarixi.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2844.2124.2547338392581218620
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x1ac,0x7ffaf3b6b078,0x7ffaf3b6b084,0x7ffaf3b6b090
    3⤵
    PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585763.rbs

Path C:\Config.Msi\e585763.rbs
Size 9KB
SHA256 ab32d6e3d253898f41a25e545f6eee21407ee994f2b46a3a01c602d51929f20b
MD5 cc7bca1817fa0ab8c62cd753ac768038
SHA1 d4fcd1ceabc973f10129efdc455c05d0f42ed9da
SHA512 9b035d3c6701b25727be3dae69fb022262d3530fbd3da84ce396ed98cffe5bd48408812b043a17900f32e0198148e4074a5d01d62692df3c783fdd22973d779b
SSDEEP 192:0rsyNfbM/5P5zTPT2eYOv2XG4v2XVpz2+Wyi0ypb:0r/NfbM/Jxr5eFe81
TLSH
T1B0224F417608C5F3FA830734C7172BA137A3C3D5A789170B998C51209FA778A5ED9B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salarixi.exe

Path C:\Program Files\salarixi\salarixi.exe
Size 49.7MB
SHA256 380149c3d06a52bc51ef36a74aa6c21ed23e49239b936c5b5e6e55f3a328e43c
MD5 3ad94863775925d3f56012402818f29a
SHA1 c99b5d87b1a7a8c54a1aadae946a17b745252938
SHA512 ce67b9ab821422670d36b17dc48c6804591522a3033cf80cf322eb0278a358ef8e693cf896bce5fa79964e769bb5413493bca6a84810d0f3aaf6f61a8b143b11
SSDEEP 393216:Y7nSfkxMfEMgwJe6bLbdq7Tip1RvGUbee6jlkZ:5foMgwJndpeUmjlA
TLSH
T16BB719217A9B996EC15AC4B4934A4A365F3134CB0B39B9FB45C546383F7ABF41A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salarixi.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\salarixi\salarixi.lnk
Size 1KB
SHA256 4b84e99cd9c4b220e897dddcbe26ebdb8b04ed65f9b959ee15ec4c90b4597b5a
MD5 e5da425edf870b6bd4688107545ef634
SHA1 ced3ef1fd4c16ab89db26c02b1b73d9b3f4e5ee5
SHA512 0971fbc01f9bd596f888c7eefe8385fedcabba815b95db02b8e5b1f84cb78300c2c0bcc078df6ed10a81c40ce56b41d83181a3befc93de4fef7eec87973e6277
TLSH
T1B141E2009BE61B62F7B34779BED10623A672BC03FA515F1F8184428819B6601DE78F2F
MD5 SHA1 SHA512 TLSH

Submit Download

salarixi.lnk~RFe586339.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\salarixi\salarixi.lnk~RFe586339.TMP
Size 1KB
SHA256 bdd1ed7eec701b0fd2828edee827eee34fcdbdc18a764e4fdd8f748cd496af18
MD5 379e9700dbc04576d42d88ed06cbda69
SHA1 9c6489db6eedd7da95b1530372ce7d194650284e
SHA512 7e1cf0da57ea85c9ce02160e8c5e3808d7b8628e198ca9b7985026d5fc8b6a233d8a2730d66c475e607edf484b9e5a4ab986a8040bf7954b2cb0e0f882a8cafb
TLSH
T11741F4008BE60B25F7B34779AED10623A772BC03FA505F1F8184428908B6601DD78F2F
MD5 SHA1 SHA512 TLSH

Submit Download

client-info.json

Path C:\Users\Admin\.salarixi\cache\client-info.json
Size 238B
SHA256 e7b9f823a9dbbaaf5c192023e171f36cd0060dab506ae85af17de825daeec421
MD5 12777bf2924efc21da4d715fbfbd4f81
SHA1 8a50fd49230d5932a9fb8a1a007770392b60ec3d
SHA512 5abac39d8e5a2622aa1f559d737d93573ae79aed3276e2d899547bfd03ba7bda18418b93e262d255d1d72b60722405cee6e91d3f670c5ee8072fc0f00ad1b966
TLSH
T1D1D0A7ABD1540D6307D668EE89182308A605C68F9C987C3BB185464C8F5C7F721B455E
MD5 SHA1 SHA512 TLSH

Submit Download

plugins-info.json

Path C:\Users\Admin\.salarixi\cache\plugins-info.json
Size 3KB
SHA256 068835c05015924d0a54e145c70acf390281f3c6bd3d4d2540d4279beedcd882
MD5 e9f1b42784982176d874d6fb3769af08
SHA1 f8003d6fae6a68bb46895504b62701a847f82cd1
SHA512 99785fc09eb706cc4911726b27c1f9093275ee480f4efa00f80d900b497a5b8b28e646987301071c59cac279ef26167d4a91248b50a08f069ebca6234967a91b
TLSH
T102813660959858DE4245B112EC15B6092AFA41BF3F6B66173EBC687F3FA2038C63861D
MD5 SHA1 SHA512 TLSH

Submit Download

translation-meta.txt

Path C:\Users\Admin\.salarixi\cache\translation-meta.txt
Size 19B
SHA256 e7de5eff5d9b18b8b4dec15b7568c5f6e89a5117d050a1173ad0d9911d683222
MD5 5602488f8cffd2d9f2dc07d04f4a095c
SHA1 8ac7f88a42bacbfa7d9e36d3b985a6690de70b24
SHA512 b6d0a03ede31142686c07d9167a895e7eed2de5b97fdb23e4cff90ea2418e66139fd8fb9b2594aaea799e4106c2fe8cfd98d1631f73149b7fb1d0326c59f8a9f
MD5 SHA1 SHA512

Submit Download

translation.json

Path C:\Users\Admin\.salarixi\cache\translation.json
Size 74KB
SHA256 0d953351a306334ca5aa0e05440eee182d8c2781cbdf11c1869161f981e63c4c
MD5 6bd6296619314e8fdb8146cd30adaa65
SHA1 4524870a59340e31229e76f546c2fa3cfae45735
SHA512 14556f0acdaa002662ccba34e19c163a7cd9749e35c718e41d48d69bda39c0c9c2dc97bc31ab390cbf90fc1e851fb750b7523912bcaa212f21cbc9931b2063d6
SSDEEP 768:mydVz6WdKOZjbIF7PyD6Mlu7RKZVFJEqOR6qEmoeKyIuZ0TQlLT65A+b:lSMDVFGC/y7qTey5Ak
TLSH
T1BA733839CBE0ADF7444A64B5292A49437620009F4E993D1C3B9C745C9F2EA4F29B67FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user-docs-meta.txt

Path C:\Users\Admin\.salarixi\cache\user-docs-meta.txt
Size 19B
SHA256 44dbdfae5a003117305d5f1f968c0430af070367eb8d57b2ed183bcbd89bfca5
MD5 af0f3a471492b36e3643a0791fb62f95
SHA1 d954efc36e729391869f3501aa8999d54fc7e122
SHA512 17fe2a39c4a4d960d799d71e3c4b1790ac1f81a7b38b3fd59774cc43ab85fd8646c61977b6c011ed36eb9adbe2e0f2bc808733bb9ffd5cd121c7d794b18fc07a
MD5 SHA1 SHA512

Submit Download

user-docs.md

Path C:\Users\Admin\.salarixi\cache\user-docs.md
Size 58KB
SHA256 153a9257fb08b534e568b36c3953eb739985fb6b6af9b0c36e39e6d10fff0b8e
MD5 08ad9db83c4cee035d7393ff5838ebe7
SHA1 0943023fd5a4796d3313e841e5161f2c2d77bd44
SHA512 6e1e20f93fb70365eba6b19af80b9bd2e66c7fca331c9d640b6cb91abd9d6c131c2812405ef16da5d2573c58c91d11833d5583556132a82e8f96f63d61a10d88
SSDEEP 1536:WzO1U++Ktja9B0U7VH+bHnBiVCTMgf0yWEEuxhuo:WzO/+KA9/7VH1yMgfaEEuxhuo
TLSH
T170439721969924EE4102F41BE9097E093DFA45FE3FABA36619642D7F34F2034C63D61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\.salarixi\config.json
Size 5KB
SHA256 48619b9a4d3dcc39044d7d007ac305b943e9c13d65c5d3f6fc682c777baebfeb
MD5 b6f529eeddf12193b7d48f138a689a00
SHA1 2fc7b04640efb6115f2a6f7ab56f30951eb4e58d
SHA512 7497c7f03604cbe03ca777c03159e98156c6c73894ab8fdb22290b8ae837e96cfc0ec60dabf8aabca3de2d1b3c78e5529453029a661de4348cd89a60308c854e
SSDEEP 96:KXqbURYAd5Alu5UbjoqacDGTHW61ijd8vhbHy/zWslHn+UOHw1jH6sHwFytAH1HK:KX2URYAd5Alu5E1DGT261ijdgb8iSjdB
TLSH
T1B3B1870919352EFA42DD01FAED832A1D7DB412DA1835B534D47CEBDD59AE8D0C3C39A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4BBA9EEA6AA043515F00F279DEC8DA55

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4BBA9EEA6AA043515F00F279DEC8DA55
Size 34KB
SHA256 9ef3f94377e73f9bab4c1b7bd15a365235b3d28c5d8776fdb326cfebb1f0ebe8
MD5 5e6b518abbb63ff3d6451624fb75a315
SHA1 226c08e8af7f8625a7ad036f78ab07c3fd13191c
SHA512 edf18818a210f9ef1ba2cf00faae1a5f6d7b3b787958e4804a6c59fd7d2dbe8a72785a2b0847ec5905629a602859fe85344d87bf1ae83edc60a0eef55dc58e75
SSDEEP 768:6/VkxKqchqpAUTKpnaOKGYv75uUml64Yhda8n/X1caRW:26xV+qpAUTU67gbw4Gm
TLSH
T114F261A8AC37B9A19D0F4F654DDEDAD657E601C52D02922F0E347E7C6C03AABDB57080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4BBA9EEA6AA043515F00F279DEC8DA55

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4BBA9EEA6AA043515F00F279DEC8DA55
Size 246B
SHA256 fc1e6d9c9bf0d32fcbcb6e37c898537474532474f80537dae1c23d5395e95dbe
MD5 1e25080da92d4f9ea2cf085d837cd509
SHA1 a4cd1a588d1520cf0dfea39512d689921bc83c44
SHA512 a3b06d87230543b8d80ad5de4ad6c19fe88f18431eb041eea91b2b5e87e09357bf97eb90d378e1bde7f43b88cf2848a1b957d957991e9e37bedc70097f7082f6
TLSH
T183D08C0E2361130AF2A4C137683542C4FA99B312B4924F0A0673114C5C1DA1109AAC0E
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1A0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1A0B.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 507cc1de42b2d84e261a64bb80c95e9dfb63ebc8ae316d2d7ef8e906b54d4588
MD5 35da8405e86411194f7db1e335f2ea6b
SHA1 c8cfb20cf567689dd008bed7409d79f2f95a1cc4
SHA512 b300f0b71cbbce52dabb4504f137f1bca0dbc77872613ada6cd2aa7c9c4bf02f9ebe78cfdbbcd6a1c60489fc526f975fb57ac5427daebcec42533ef25ed53598
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cd694aec8a268dd965e3a35fe0a6e150320f025245a7b0aee911af73b48b077d
MD5 da15fa50a395e2abbc28dab48f21beb3
SHA1 14b510ae4310c1d4d37385c23226558bcef5b0af
SHA512 1b5078c7a92c820b20fc70b1353c8961705f236c4a412528f067dbf85828293499f777bdb23fd1332577791a4b18a046e74be069e6ec937838b404e6ba9932a3
TLSH
T11ED0112232020BB8C82030330002A2882A80C20B800A80A8B8388A2EAB280A00E23882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9ebb2a22aab6281f806daac97d9026633efc39bdef7bfd6d4b59700749175d0d
MD5 60972ce86311ada4b1aded6cad0ca337
SHA1 c965dc1d573af2cc1319d1ea10a5ba130bf2adb3
SHA512 f8c3109f5f2a914543f031798018b8e7af84016ff3fa11db8597a8700a93a8cf22e72120c5f50fd3c546328de1b9955ed9cb20fead76ee6ed01bd1a85f4be6c1
TLSH
T1BEA002691555000ED54043B016C63B81B7778E5902038746DBE110F598953509172009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 247e825b507ac7de76443b493709c359f246f96743bffea53c2cb328fe81b593
MD5 f92ebc16ad554a48a67dde87ffeab5d0
SHA1 7e789a9120f134927246dfbe13e6c7f7d42444f3
SHA512 cba26fa3d5ba35a285d7727d072db3117d35edeaecea40e06055ae2778c45d22baa8370b4662eac85654af6186e82bf48e4b6f6c914d27f8958ec960182fcd82
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 a302bea8c9bfd552e512985a0085dcbc90d38f8ba4d3aaf785a606874c995f87
MD5 c952f57041698c9f9018fb7b027f2bd5
SHA1 802e624129e73761d2ba7b5d607abf714bb5aabd
SHA512 7e17b725f89350786b4dc91873b47353d81f06c081ac41859c43f0eb536be5ff68a4ab631e95ca54ba720b4f1c1ca0c01019673fe1f318956ee72e1d4525e8b3
TLSH
T1910182A2C3D4C57D4A4117E477343813CD2E042992247E27CDEEEBE967D10B5D11054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59c181.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\Network Persistent State~RFe59c181.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences
Size 6KB
SHA256 0ee318b2e361e2093817e1f1525c3b6a6e931d4bc5ff7ba448e232f6a082a1cc
MD5 cf8d139c2f9d4666f098df6e35b06918
SHA1 66ffa9e42b04e9b8c5acf2b6cfade62c6ba0ecfc
SHA512 b4a66407070cf66a08e6c10a027a22d9b25e1de3e7ca9675ea0daad59f0b36ff00734e4b130794dc7c4e9cb47378e41e2cbcb835c90a948cd33a9e12a22a2550
SSDEEP 192:stI0DqafDZ8pa67y/S+WiTTF14YsSDKbMC:stRDqaCU/Vn4AC
TLSH
T1E7E1A7025E247D774CC7E61D7A25BF16E2F6102262D50EA8EBFCC61C05E66CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe594702.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences~RFe594702.TMP
Size 6KB
SHA256 978b373b404afe9bd874f5d706960e6d244b317852f0b1f75d755cd338e1233b
MD5 dea976981a11bf7583e5ad1c5d30a78d
SHA1 e3374cf3715837d59de0b34c7a3a1f8d149a35b3
SHA512 b9aa1e5c63752e6c3b3f5a7838cb46f05f562626b95f7d780a86862c266997ee5d669f0f3622359bfeb7aaacf34c10fd68f4ec0a1ec0026e831df170b7cd4930
SSDEEP 192:stI0DCafDZ8pa67y/S+WiT5pQYsSRKbM8:stRDCaCU/VTQo8
TLSH
T116D1A7025F28797B4CC7E2197A35BF16E2FA102161D50EA8EBFC851C08E66DD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 2KB
SHA256 d4e56303714014e2d3bb0d45361bcf3ecfd3eb81d0499fbc3feb377df8e174f3
MD5 7cfbd41efa2b6d8d12e6f3252a6c7c9f
SHA1 6f66a7e5d56f82a9506d1d4397953d5302344eb9
SHA512 205699c4c3333b8286c16eed8c7dcd00afc8fe2e1c67480bef5747ade8ce14ed727e21e752c8a359dcad3152f54360c77263babaaafcaabc02760e5861aa267a
TLSH
T15851C833B854767789E28604BD453F22AF7610B5AA962F2196DC071C01DF59C2312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 3KB
SHA256 05d1b76a9e8cc12639a47e4a5660731fd93a69e50ca5f5e7c3a23da820d6276b
MD5 aa29eb23e957fd185e75fe8df9e13c6c
SHA1 8fe5adbda60051af99f9f37ba19907597eccd4eb
SHA512 29c967ade7a9fc05e1cfcaf26fd4202e658fc40d834b4ee752bd0bdb7961c06848b6f601cc3e0954c0de76adfc07e747b01eaa1d041c0c5ac128bf0e221bf9c5
TLSH
T152719637A8A4A5374DF28905B9852F16BBA61177E9D53F65CAEC0F1C02DB2D82312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 3KB
SHA256 6e9e3ec62772913d15cc4e8a6b923b37d7d78d794a83ad15a4833b73aa20d10a
MD5 fbac1453db51342ca0a973479d0e9fa3
SHA1 a25aa76d58cc38eedd3d2e8f7bf23d4bec440a0a
SHA512 902324f8b72922ad86b3ddb8669d62b3d3e1bccd2db0956c6a56790865fada82d10223a0bd4008b8dceeba65b4e46016149a79b1276c0dbd2c4814aa7cdf8a25
TLSH
T151719637A4A4A53B4DE28945B9852F1677A61077E9D53F65CAEC0F1C02DB2D82312C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 16KB
SHA256 e0f780674793a033455e73f9a9d9d5a18e78211bbea1911c7d2744be6b3b48a5
MD5 598e5a632b0a806681c5d618eedfb527
SHA1 d602732576744c2fd4efd23b87cdac55a73edb90
SHA512 16381a6491248225e2f2662e40ea28ba6f343a57e8e1ae8f9a5eb1ff844e9de46574ea0844adbc2fd9df629645aef6111ff972151b9a8b632b33dabeaa141cb9
SSDEEP 384:zy+aQikB+z/xvxjg/qhE9Nb0wF9g0MM9zz:J/UxvxjgC+hbZMMFz
TLSH
T14172AF2B61783D3789F3E5057A5C0B8BDBB884B694C56EB849ED5F0E06DB3D81302D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 1KB
SHA256 2d9c34b7a5de7f5f480ece054b09cd937bb752bc3dd956f2b641e482a06cfca5
MD5 499db9ffe7fea379d37e62731148875a
SHA1 1ea5ae02a98751a40340b9d26291d111a2489f18
SHA512 81bfba3745f953d174c74ccd10ecc50cd73853cf460dd7b12661a2da9fbeabd0ac722867dff32dcbb5ae49b5b37d0c0b1296612fe245684a676224478bbf0123
TLSH
T1DC31B273E4A03B768CC18246BA41AFAB2F62007AA6558E0491DD472C02EB5CC5B3AD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58a822.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State~RFe58a822.TMP
Size 1KB
SHA256 44110dac3584abdbcb5cb1749a37a76872f72917666560ea9ad9c76cfb0f6538
MD5 ca6236df0b20e5f3872e2013cd09fb30
SHA1 52d016d6741e1d89ba2631baffc89e3ac7d9c253
SHA512 c8c753afa1fbc119729f4b423ca3c8162dd123e13ef8f833fadb6eb75f2ca62bc1592f2b4213e1c7c104d09027be3d2e16349076a8645575623bd85114d63a76
TLSH
T1A8219233E0943BB69DC14446BA11AF9A2FA1007AA6189F08D1CD032C02EF4DC4B3AC33
MD5 SHA1 SHA512 TLSH

Submit Download

e585762.msi

Path C:\Windows\Installer\e585762.msi
Size 15.1MB
SHA256 dc117862bd349e0e41d3870802b9657e7c984723c82043334f5f43e2e227bf5a
MD5 c1f5c9ff0a62eb5ad58454c0f70fb495
SHA1 403d46481be9e254307554d6ac132437e296dbe0
SHA512 e04cff87983543f37f6306388c4861fa315e2ffe820bd6a6d713a2c856250fc174e814ca7da2bbb7705370f4b4fa19e231dcaa3a92ab87b01fdcc5eefe3998db
SSDEEP 393216:7pT+DT8XQfNjNSbfLbzHZvpPfNi/oa7HWAJmidRRP8MCkslu:78Tbfq/ntpPfwzNgibRPDzR
TLSH
T1DEF63307BE468260C4225DFF49368B708674BFA4651A3422266473B9CFF6DD10EF69CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 d4ea3d84389aee54d850ee7f24706683f1845691690dc9f874b280221a551e8b
MD5 f1bf262e67826e2a9c872922ff6b97e8
SHA1 f6e217fd36254131e694d65df8c384ac16fa824c
SHA512 c19e121f6fd4915dfe0f541dc086182892889c11587b382eec02370875739510d5fab187f7e92b959b85a7d4351bf7965cbd788eda9e23875df5f53f30eba232
SSDEEP 24576:Nu8m+1zKdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:g
TLSH
T1E047F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{93e1288d-4182-4307-bf17-ee8816787432}_OnDiskSnapshotProp

Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{93e1288d-4182-4307-bf17-ee8816787432}_OnDiskSnapshotProp
Size 6KB
SHA256 45b7082c8b3764a8d8e9aa88bccac9f1c65120ddfb7aa3291e26f37655ec15e4
MD5 ec548d4a810ea217acdf873e4e4fb681
SHA1 ae1af8844cd404871e169b7842c6cb5f4048d561
SHA512 8bb844e5ccfe90ec338fc22d60d0735b2aba1cdce24226897b3c94b34247b444610e969a2acc4d8b40d4c79d8e629c3fe9a8bcc94494f83a0831a5c2e7916615
SSDEEP 96:FyFGeDfFu/vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:m5zw1b++ZVmN
TLSH
T1D3D188085AF54711E2B3AB3229F14557A877B911FF33CB8E0198238E6670A10F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-202-0x00007FFB13020000-0x00007FFB13021000-memory.dmp

Download

memory/2648-110-0x00007FFB131D0000-0x00007FFB131D1000-memory.dmp

Download

memory/2648-111-0x00007FFB12F50000-0x00007FFB12F51000-memory.dmp

Download

memory/4116-72-0x00007FFB13020000-0x00007FFB13021000-memory.dmp

Download

memory/4116-286-0x000001E005C20000-0x000001E005DC1000-memory.dmp

Download