487e2d4d5412d3b4e1459af30a33159164184550f0271cc85d56698ae762d0d2

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
salarixi.exe
Size 49.7MB
Sample260816-wcy73stcmd
SHA256 487e2d4d5412d3b4e1459af30a33159164184550f0271cc85d56698ae762d0d2
MD5 95b55d6a8f664510d8b6d17aeede98b6
SHA1 521334aa12271b740c49c4edc8e73884f62c4b1c
SHA512 0aa3f75731f8ac871255c963542e04f3c1d1d505e0916422175833302b719457c746bf7c2d7f3b5585fb7744af5c81877c7407529cae90da6bc239abc25b2bc7
SSDEEP 393216:Y7nSfkxMfEMgwJe6bLbdq7Tip1RvbUbee6jlkZ:5foMgwJndpjUmjlA
TLSH
T17FB719217A9B996EC15AC4B4934A4A365F3134CB0B39B9FB45C546383F7ABF41A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	salarixi.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313761207559887"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5108	msedgewebview2.exe
5108	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2436	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	salarixi.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2436	2964	salarixi.exe	83
PID 2436 wrote to memory of 1456	2436	msedgewebview2.exe	84
PID 2436 wrote to memory of 4392	2436	msedgewebview2.exe	85
PID 2436 wrote to memory of 4392	2436	msedgewebview2.exe	85
PID 2436 wrote to memory of 4392	2436	msedgewebview2.exe	85
PID 2436 wrote to memory of 3116	2436	msedgewebview2.exe	86
PID 2436 wrote to memory of 4080	2436	msedgewebview2.exe	87
PID 2436 wrote to memory of 4080	2436	msedgewebview2.exe	87
PID 2436 wrote to memory of 3784	2436	msedgewebview2.exe	88
PID 2436 wrote to memory of 3784	2436	msedgewebview2.exe	88
PID 2436 wrote to memory of 3784	2436	msedgewebview2.exe	88
PID 2436 wrote to memory of 5108	2436	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\salarixi.exe
"C:\Users\Admin\AppData\Local\Temp\salarixi.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2964.4408.4126084535209122877
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffe8e51b078,0x7ffe8e51b084,0x7ffe8e51b090
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,14675020653581158872,7501213686665195536,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,14675020653581158872,7501213686665195536,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1376 /prefetch:3
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,14675020653581158872,7501213686665195536,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,14675020653581158872,7501213686665195536,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4088,i,14675020653581158872,7501213686665195536,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\.salarixi\config.json
Size 5KB
SHA256 5e398b61a707daf776be4bfaba5cb9fb4fc16504113a6d12137dc730c0a9b933
MD5 f162ce93c49049be1a63e9069d7fa190
SHA1 e301bd37086b267453cd1e73ba5f44920fa2ecb0
SHA512 588b2e3cc0636f1a91be095342b5156415aee5d860db4e3954c2a0f838efcb64d451498f0ba9d40d99471c24b952ba74a6d8354a3d49974592def6a49b6a9990
SSDEEP 96:KXqbURYAd5Alu5UbjoqacDGTHW61ijd8vhbHy/zWslHn+UOHw1jH6sHwFytAH1Ho:KX2URYAd5Alu5E1DGT261ijdgb8iSjdF
TLSH
T13DB1870919352EFA42DD01FAED832A1D7DB412DA1835B534D47CEBDD59AE8D0C3C39A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8881607c-c811-4b2d-9676-fdce4e5f2fc8.tmp

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\8881607c-c811-4b2d-9676-fdce4e5f2fc8.tmp
Size 3KB
SHA256 7fe90e05404ab4a00b584baeed854c062eda24577b429428bd83b749b54b0bad
MD5 13ae095da1735b3cbc4cfbe30d44ba55
SHA1 b5a8ea0befad45609eea32e957614ec93a053b37
SHA512 6d5acd9d13c29cf7b3cc1708e6083166146dfc3167f49ef26ea7f5c12ef0c33abdb3749243811ea7723301caf1b2e6a2fce2b8d406024a53efe572d85fa566f9
TLSH
T10771C67268A5A93B5DE3EA45B8462B06BBB1A037D4D13FD4D9EC0F1C01CB2981352C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6b20aee236a6949c32ea1f2a6e0526eb4b51d8c5ad42d6968dfb3b4d6d388134
MD5 8f2be018cb6dee2ce263129f828fb3b0
SHA1 1107414cfeedcf0bef19c27fc7db3464e06f68c3
SHA512 b7d4fea1978f0961a9e2bc34668f6c382d7d77ccfe232a388a26a0f3dbbad93e908c44b1fd86781ac16effda0c5ae0f1ea761ae53330dd8e415eba62501c4578
TLSH
T12CD0121332130234C51020732042E2091441C60F810A41445839851DBE340740A124D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cbd7884da2cbbde097c1fe34f64718134f1cfc69ab1b2fe60779ed8e0473a059
MD5 076cfcb1aaf3e907d9dbe32fcdad70e0
SHA1 09406c3f2512f709a33c258ad2c5141eb7058d44
SHA512 6f9daad255ed5c7360c025a3420bdb43b5b7b792107cb04ceb2de67c96d21871e3138483574703df39c62df9140c080e9fa0f611b5e3ddadbc000ad689e94a7e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b5d760866c8330af95a480fdd338c8eea6677af7f0878241224674175ef1cb8c
MD5 044c3e7eae1d79df2ad0db49febbed79
SHA1 927c02c92e5b83026028f0e0038ac41840e91588
SHA512 ffad72b1b511f6fbab1901e20d1f71a60841c9f2533845856608b3bac28976c0f59f00c31afbd4cd9bfd3b8034890662dac0f8fd9cdaa5f88c530ef3f139853a
TLSH
T1A8A002B5C1480106C21423B420D53265FB398A960603060991E91CB8EDA53544513554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c2fd.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58c2fd.TMP
Size 48B
SHA256 e0bcc0404e59b0adafec20dbf633071fa528c9ddcd904299a70675dfe06768df
MD5 a1713cce582ca2a4344bae4fbc25fb2f
SHA1 93283563550c503448d11441d32c3283485b5b16
SHA512 7cb3d0c0a291330c7019be333f411c971cdcf1e3efa8618688e0e5f8e238278088e8e3c2e30402bef1639d45885a5e0a814386cb0ee440cf6fc45ded7a68cc42
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences
Size 6KB
SHA256 fc5e39931c22990eba9b4260ee7d21f2e7adf08d66e40abb9368029f34bc4338
MD5 264b4005cc27e7ee47c24798db8491a7
SHA1 6b47e3982f86d2cc4a85f2d29c75c2297804632f
SHA512 5a67d8b0e6dbdb2cb43276d0d39acd6e4fbe2e53f66240f9651e1927711e559cc939f5406d435c60ae4651caa425128850261eb9fcc8de59f7d395c9002e0141
SSDEEP 96:stp0514Twb9I1QffqyZ8i0vhEfktgm/7qx+WVHMSm+uecJWd1idQji+gcOMOB:stp0DXfTZ8paCZ/S+WiTWdwdryOMC
TLSH
T1B1E1C8426E686D7B5CC7F2197A35BF12E3F5206255D11E58EFFC861C08E66CC220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589bae.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences~RFe589bae.TMP
Size 6KB
SHA256 0781a6d0fb6228aedb98b0b89ec2dd46c158c107cf1d37d024c342ad98295624
MD5 f422ae89eae0c656e1df7b1a90b9f9d3
SHA1 c8f8ae0cd6c518a2f2159d07a91b1ce31fa0a9cc
SHA512 a6c55c311a81bada4d86144b4e7352243efe7cd337fa1834058f4a4161ec487a106d16c5063da1129774c0a36c451a5583fb0f225a4a03812b348a981bcda05c
SSDEEP 96:stp0514Twb9IuQffndZ8i0oEfktgm/7qx+WVHMSm+uecJWd1idQji+glOMEB:stp0DkfVZ8pFCZ/S+WiTWdwdr3OM8
TLSH
T1F0D1C7425F68797B4CC7F2197A35BB12D3F6206165C51E58EFFC861C08D66CC220B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 5KB
SHA256 2621d52d2334f29c5a716b59152a675c0611becdb46ad54d659b3978ee1b8ca3
MD5 88ef16d1aa2b2e9d83e4b84274a7e3e7
SHA1 ddbd90c5ea50501f08c53bb25523951ec30d21da
SHA512 39629a49d0c8edea68774b9cdc90028c8ca7c62b01192145c929937ba6be39506c9c3983b9bcfb58f47338c13093ba1a9cdfbf7eb57f8db45fc16b35217995ac
SSDEEP 96:zuSbNkEIbTfDayS8Frh/cInURoDoto+5U0DpBuBCX60toBHlGKaIjZUxZKT+lSa:zhbNgT9ooDUhLvuBC/o3ajDSG
TLSH
T1C0B1B531A8A1E6375CF3E681B9473B52BBB1A126D4952F94CDEC1F0C468B29D1347C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 1KB
SHA256 c9c8ceb99d508a5d90b0fb09e1a1a1c552303060c226eb815bc0f283fb25972c
MD5 323082c8fe68673610d25f41eec18589
SHA1 56d4a85f8dc4b32a0979c2888f96dcd7b62b09a8
SHA512 1f3a49b33702b77854c417267de1dc5ef24c0a745965d013fd029f1ba4e64921da24689dde92fa05158977a67704c47c22ceeff491c403caec059bb87405dcf6
TLSH
T1F331A7B2E4D52F367C93A28772126A476F71E06AC0619EC4F9EC572C42DB18C913AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 2KB
SHA256 4442f3ca20fb364db79546b1afeb20defe2715ac428a0bc08b222e177144be49
MD5 6c7b2b2944242651579c4804217fca48
SHA1 b65595c9e6e61a941b20d9383fa062f14ebec7e3
SHA512 c7942dd9f449255d0bb79a12088a69b77488a9ad9a34257c82bb72b9e16eabd7ef7565b46c985f8ad06773f2439986440d03405deed7f181331917e77da1d687
TLSH
T15551A7737C95AA3B99E3964579162F13AF75E06595612FC0E9DC1B1C01CB15C2312C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 3KB
SHA256 1e0931a7ee1db75124544e90eec37608020e9469c651529892da55a0b55048ea
MD5 ee6d281c061bb0020f683fb2a36cce99
SHA1 44c01bc291d81d0a7d7f82c1b741b2e939e8a42b
SHA512 54e8e07cde37585ebbd72522249dc0798793ea9328aad1d2368bd8472e5e6ac46d5ee51325a4976cc6bc990eaf6c178c7c007ed7e1c176405f844ccac451824f
TLSH
T18381A53268A5AA3B5DE3E946B9462F07BBB5A026D4913FD4D9EC0F0C41DB2D81342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 4KB
SHA256 72f99c360f33d18490258d97142b736315cf1b9ba47684e852a33faee4abf4ee
MD5 94856b99daeb5d42d16349640fd44ea5
SHA1 c5a76d78622c395dcf3d58dbc409ddc32ab5b80c
SHA512 3137a3b07798a599c13332a7b575a075afc46792839b2620953d6ecd11635009ec6b7d0e5152505eb5149fe8c1450bd22bc736fd58422911851e183c7a7eed45
SSDEEP 96:zuSbNkCbTfDayS8Frh/cInURoDoto+5U0DpBuBCX60mZUxZKT+lSa:zhbNbT9ooDUhLvuBC5DSG
TLSH
T11281B622A4A5AA3B5DE3E546B9462F07BBB5A027D4913FD4DDEC0F0C41DB2881352C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 5KB
SHA256 6b23f081fd5f4cc78052e8ed2c21cdd89dc3fc6211216278391a0abd77c5f795
MD5 cc005bc68a3343e8ecacaa5caabeee05
SHA1 57fb9fb06d0cf37b6e0f16555381446400879e64
SHA512 4cceaf9fb4486e4bc1037f73fc490ece5294f11e19a3179302c3986a0984c42626e8909c05b6d2bda9c72df03437cc95f776145bdc6c6b1759856b63494fd303
SSDEEP 96:zuSbNkCbTfDayS8Frh/cInURoDoto+5U0DpBuBCX60toBHlGKaIjZUxZKT+lSa:zhbNbT9ooDUhLvuBC/o3ajDSG
TLSH
T162B1B531A8A1AA375CF3E681B9473B52BBB1A123D4952F94CDEC1F0C468B29D1346C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe580d69.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State~RFe580d69.TMP
Size 1KB
SHA256 6465edef988a593b65b781f8d0f6c687a38bf22ef1d63d01ac1e5c3d6ddd9684
MD5 68aa72dee0e88abb3eb980e575438871
SHA1 b44f4e3308f0fbbffb25c8a93da588f33b9e4602
SHA512 25fd6d0d030b51eda3937b6f22edd637b39f9876e282911b99e4c1c43665ef762d52a14e238fa639c489d4b16b04fedb8c0c3c475f7d6a406d75f6b5d5a957b9
TLSH
T1D7218773D4D56E36BD929597B2126A462F70E07980609E84F5DC132C46CF0DC8136C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3784-136-0x00007FFEA9000000-0x00007FFEA9001000-memory.dmp

Download

memory/4080-48-0x00007FFEA8B40000-0x00007FFEA8B41000-memory.dmp

Download

memory/4080-55-0x00007FFEA8970000-0x00007FFEA8971000-memory.dmp

Download

memory/4392-25-0x00007FFEA9000000-0x00007FFEA9001000-memory.dmp

Download

memory/5108-289-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-291-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-290-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-301-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-300-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-299-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-298-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-297-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-296-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download

memory/5108-295-0x0000025B288C0000-0x0000025B288C1000-memory.dmp

Download