487e2d4d5412d3b4e1459af30a33159164184550f0271cc85d56698ae762d0d2

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
salarixi.exe
Size 49.7MB
Sample260816-wcy73stcmd
SHA256 487e2d4d5412d3b4e1459af30a33159164184550f0271cc85d56698ae762d0d2
MD5 95b55d6a8f664510d8b6d17aeede98b6
SHA1 521334aa12271b740c49c4edc8e73884f62c4b1c
SHA512 0aa3f75731f8ac871255c963542e04f3c1d1d505e0916422175833302b719457c746bf7c2d7f3b5585fb7744af5c81877c7407529cae90da6bc239abc25b2bc7
SSDEEP 393216:Y7nSfkxMfEMgwJe6bLbdq7Tip1RvbUbee6jlkZ:5foMgwJndpjUmjlA
TLSH
T17FB719217A9B996EC15AC4B4934A4A365F3134CB0B39B9FB45C546383F7ABF41A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	salarixi.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2260	msedgewebview2.exe
2260	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5616	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4428	salarixi.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 5616	4428	salarixi.exe	90
PID 5616 wrote to memory of 5280	5616	msedgewebview2.exe	91
PID 5616 wrote to memory of 4296	5616	msedgewebview2.exe	92
PID 5616 wrote to memory of 4296	5616	msedgewebview2.exe	92
PID 5616 wrote to memory of 4296	5616	msedgewebview2.exe	92
PID 5616 wrote to memory of 4296	5616	msedgewebview2.exe	92
PID 5616 wrote to memory of 3456	5616	msedgewebview2.exe	93
PID 5616 wrote to memory of 6948	5616	msedgewebview2.exe	94
PID 5616 wrote to memory of 6948	5616	msedgewebview2.exe	94
PID 5616 wrote to memory of 6948	5616	msedgewebview2.exe	94
PID 5616 wrote to memory of 6640	5616	msedgewebview2.exe	95
PID 5616 wrote to memory of 6640	5616	msedgewebview2.exe	95
PID 5616 wrote to memory of 6640	5616	msedgewebview2.exe	95
PID 5616 wrote to memory of 6640	5616	msedgewebview2.exe	95
PID 5616 wrote to memory of 6640	5616	msedgewebview2.exe	95
PID 5616 wrote to memory of 2260	5616	msedgewebview2.exe	97

C:\Users\Admin\AppData\Local\Temp\salarixi.exe
"C:\Users\Admin\AppData\Local\Temp\salarixi.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4428.3252.17093559649891846581 /pfhostedapp:7bbfd8c3d6a16c7a80ad9800b0e2c00ddc58cdc9
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView /prefetch:4 /pfhostedapp:7bbfd8c3d6a16c7a80ad9800b0e2c00ddc58cdc9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff983d45fd8,0x7ff983d45fe4,0x7ff983d45ff0
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,13716083577909048294,12689740861313640794,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7bbfd8c3d6a16c7a80ad9800b0e2c00ddc58cdc9
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2224 --field-trial-handle=1796,i,13716083577909048294,12689740861313640794,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7bbfd8c3d6a16c7a80ad9800b0e2c00ddc58cdc9
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1796,i,13716083577909048294,12689740861313640794,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7bbfd8c3d6a16c7a80ad9800b0e2c00ddc58cdc9
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1796,i,13716083577909048294,12689740861313640794,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7bbfd8c3d6a16c7a80ad9800b0e2c00ddc58cdc9 /prefetch:1
    3⤵
    PID:6640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4392 --field-trial-handle=1796,i,13716083577909048294,12689740861313640794,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7bbfd8c3d6a16c7a80ad9800b0e2c00ddc58cdc9
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path C:\Users\Admin\.salarixi\config.json
Size 5KB
SHA256 5e398b61a707daf776be4bfaba5cb9fb4fc16504113a6d12137dc730c0a9b933
MD5 f162ce93c49049be1a63e9069d7fa190
SHA1 e301bd37086b267453cd1e73ba5f44920fa2ecb0
SHA512 588b2e3cc0636f1a91be095342b5156415aee5d860db4e3954c2a0f838efcb64d451498f0ba9d40d99471c24b952ba74a6d8354a3d49974592def6a49b6a9990
SSDEEP 96:KXqbURYAd5Alu5UbjoqacDGTHW61ijd8vhbHy/zWslHn+UOHw1jH6sHwFytAH1Ho:KX2URYAd5Alu5E1DGT261ijdgb8iSjdF
TLSH
T13DB1870919352EFA42DD01FAED832A1D7DB412DA1835B534D47CEBDD59AE8D0C3C39A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a81365abe97113c8d5091154afa535d50dd6b9f429ca36312d5f41a9fab14d19
MD5 483354f05676fa872559bc75fbc7a611
SHA1 34e8d8abe4577355f4f110194b1a7b01af12fd4b
SHA512 c76b37afe79644a4244126b2c4bc98ba9fa7c1b4f4422e1de8f0f3871c2c9d017323e216299178a5d39aa171594a18ef2573e50346a1d58415cd905eb7c3acb7
TLSH
T18DD0121237110134C42120730443B5C80501D10B4009800098298DDD1E580600A47C82
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5073f1df4f930b77d59ead4d1439f8279aec235c244de3b67c78c8a7e6cf909f
MD5 0c285f2f47aaec1d7e52712e0f7977b0
SHA1 3451040531d00df64bf1ed943e69e9426846a61d
SHA512 a710992bf9363ce935f4dd4eed48aa083d86fb6ffd52d00d8abf8a131a1c77ad9aee99d3c68ccb5a4441870cb6cf5ea405065d2e66c660449404495e52420871
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c294e8477aa930c8293743ed7022c0b37376156bb66a2aa1e776aada01c15671
MD5 c4bbaa8f50245608ca94344f80a12a04
SHA1 5bbe2bc0acf23085bb65e760319817382baebdb3
SHA512 2976fe5c56870e4e193210e6eb7b34f2edaece08eecd4a23af9bbdac5ffa23bd415787716bc395678b3b1eeee1d8397553cddc2b55ccc1a9522d8e6e64db5f8e
TLSH
T110A002E08258150ED120237521C52251B33C8897530306099AB60874DC953505613018
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4826.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a4826.TMP
Size 48B
SHA256 d1988ec20ab5277971e6ca72ad6fdd9ba469c6c8a108436e0b0ecec176b90b11
MD5 797eb1044f7e41fc94f5ddf47fd1b3a9
SHA1 458e8adb55d70fa199f1038f74f630cb45c7c761
SHA512 6386575c12b9e6847ed82ee7944feff3e76bc01fcb3dda710eaa83bced000d829a82fc8032b51e6f22c943b825f8b4b4e6dcff97579b770f596e1cac2e870626
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences
Size 6KB
SHA256 666366df9bb13138d2c84c8f60310256987400dcd3fc8faf739b7dee486b9077
MD5 fa5144b33c54d093a3c760360ecbf050
SHA1 6133ae459a9676ffaa34b479a741ba37d010372b
SHA512 db7d14885358722a45f6d0af13a56a49cab5f974a06a6b5840aa7568e8066c31016852cb6d6cbd46e41583f02ec320408d8a86d7c58e403fad73aca17fc4249d
SSDEEP 96:st5/d73jipZb9/k+Ao5h16Z0nrs7/x+6MhmuecJnXbo1ejeM5K+gHPD28XM1C7K:stdhI78onnrsV+FdnXboQj3kRPDG6K
TLSH
T19FD1A5015E64B97B5CCBF219BA35BB17E3F5607261D12E58EBF8452C08DA6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences
Size 6KB
SHA256 3e135ec630c83536fe4d1e31209fed6ceda0b77ae81b3b7238342736fc7ecbec
MD5 b93d90d1d1e5b27d6ad3e965d52e75d3
SHA1 499b6519e857c31fe89ba39ce4df18575ea86bb2
SHA512 7d37bda556b44f5862f3abbed6d570f45fe3601661931b03b3f17eeb648c6606debff2112b0c4156925a951fb635641de5cf64f9dbcdc19ce910d0551f3b4b19
SSDEEP 96:st5/d73jZGpZb9/k+Ao5h16Z0nrs7/x+6MhmuecJnXbo1ejeM5K+gHgKa28XM1CO:stdhK78onnrsV+FdnXboQj3kRgKaG6K
TLSH
T1D5D194025E64797B5CCBF219BA39BB17E3F5607261D12E48EBF8491C08DA6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a2116.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences~RFe5a2116.TMP
Size 5KB
SHA256 accc6943e71a02bf475b7af22d04f754c27e777cd04673b23691556a367baf9b
MD5 12aa0bb0ea50bfe25b55de57f3735294
SHA1 31c4217258429af7074418b63eee6eb8b4cbf8c0
SHA512 9a9d5781d76631a2968d2bdbf9d063e40bd879c5a41a9f4f07635d7716f79242bc9c74bb5d6345280f5a5f34eb7336701f387bd65330e3564431fb209e633fd9
SSDEEP 96:r5/d73jipZb9/khdo616Z0nrs7/x+6MhmuecJnXbo1ejeM5K+gHJ28XM1C7K:rdhI7Co6nrsV+FdnXboQj3kRJG6K
TLSH
T18EC194025E64797B4CC7F108BA397B16D3F5607265D12D58EBF98A2C08DA5DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 3KB
SHA256 fa6a52e27653e6c48f20461b5760ab8f6e4d287525120e9245adbacd31a66855
MD5 11300c1b20ec2574a4c499bbebf4e1fe
SHA1 3bbaf833ffe12238898ca846c1963d96c9ed3bb5
SHA512 3705ed85f3b09b6c0f3eadaac7ce49540cb40e20cb942cde797f4d21303f7e01d687bd0ceee3dc207b4471efcd8b9b0a006b8a9c5aa9301ee953a4b18a116bd6
TLSH
T15671A572A975A93B5DF3EA04B9873B13ABB56123D4813F55CAEC0F0C01D72981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 2KB
SHA256 b9b70009fb1ec85c4a7c8ff737a556de1bacfa9468ded6fa7e9e1a5dee0e4773
MD5 c7171f0355f62786b82dc8bad127c882
SHA1 4c97f762efa9c5eb65d614d4db7e56efe00621c2
SHA512 5e578a8b46bbf619b55ab7748f90d1148546e3fb95d044e59b8bb2754ba7ee256b6bc3b747a207d32512ac88ff38516b16ab36beb8b30a4ee9f424c72da3ca40
TLSH
T13351B573B9256B37A9E3A6047A5B3F238F757191D6521F109ADD0B1C01C615C1302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 4KB
SHA256 2dd3eb59b1459d2ce57cbf6616e30e54ee463b9e83c0ce69bbaca7858013d050
MD5 870defa97616ac726d74feb50089efe1
SHA1 6b590ba6c9c89dec5449288b3f4b661d64100f26
SHA512 c31a0afd75b2d2aa13bac163c3f67751ca57ee6797fefe6dca4a393438e758f382e321327feeb29e1180adffe876db915143fbb5abb6dff7129e1129fb163217
SSDEEP 96:tNkGS3fdpRqSwO8kh/cI9URoDoto+5bLBiCY6bgmztZ1ZATmJga:tNBSFpRHNeoDUhhiCOmDYu
TLSH
T119918472E8B5A6375CF3E784BA473B52ABB15253A5812F94C9ED0F0C42872DD1342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 3KB
SHA256 55c0908a0b6b0d8a4697ae6d6f76f08af7f8c0f22c7aa4b95e822c04e8e86df7
MD5 70dcb17fb7fa2b4bdcd15971de57981b
SHA1 bee3ebfdcf29da70a9b61ba0abd03bae0d0db9fe
SHA512 6a3cc0ef0310db5001a5aaaa33532c1ed4328d5a8aad4845cf3097693bbba384daa39c13020b49dc85d3c1836b616c7b08fbff259a79eaec05b4c2d87729a5e1
TLSH
T1D761B677A975AA3B6DE3EA04B9973B13ABB56123E5813F54DAEC0F0C01D72981302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 3KB
SHA256 128e73a488b548b470008a11334c024ab21298043a38f8dd9f05e27710cbc2d3
MD5 536a213f754c01b93bcf868996667ae4
SHA1 702b450c20c98aba53d8737e6bd7c36510d63077
SHA512 0bba5c71f2800df9d2932081896e3f78beac3d5e13c7375bddae89e4bc36697c3efea62fed911855435563ee5824e7d05e69eac332eab7d1f0160add8a8df890
TLSH
T1F871B776A975A9375DF3E604B9973B03ABB56163D4913F55CAEC0F0C01DB2981342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 4KB
SHA256 561ca173fe6f80a38bb816a90200e7d4f0f47627ec601383b4b064f688b6f712
MD5 788c4bdfc516fdf3eea0c977ede29e50
SHA1 0e6651b64327a802be5f8077df4f38cdef869907
SHA512 0419b47fd4628b243e741974d0696a63f4b3f2a2665c9939634d49af51b3b66a90f0310bd146b7b626b8b5fbe7c2d91ac968d4719ea22b375d2c20fdcc4f0b81
SSDEEP 96:tNkE93fdpRqSwO8kh/cI9URoDoto+5bLBiCY6bgmztZ1ZATmJga:tNlFpRHNeoDUhhiCOmDYu
TLSH
T19AA17472E9B5A6375CF3E784BA873B52ABB15253A5812F94C9DD0F0C42872DD1342C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5997b2.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State~RFe5997b2.TMP
Size 1KB
SHA256 05b7f611b88f2641dcc5e272efd6f43f89d300935345a6de736ee0dbdf61c938
MD5 94a5e329d2d1725d46932933fd63f403
SHA1 3d7db7202eae843b9eb7755e003dd0a93dd55e43
SHA512 3543987bc5b3111bbf63bb7857337b5ae4399b717605a1a81981cf2abaf1661b435c79f7a67fd62269dfccf07a948d194286ba1d80ce4e0f51d52950be3b02ff
TLSH
T1AC2172B3E5755B32BC83724932673B275F303066C1424E00A6DF4B1C02E619C5117C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2260-266-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/2260-264-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/2260-273-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/2260-275-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/2260-274-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/2260-272-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/2260-271-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/2260-270-0x0000022436630000-0x0000022436631000-memory.dmp

Download

memory/4296-26-0x00007FF9A4490000-0x00007FF9A4491000-memory.dmp

Download

memory/6640-92-0x00007FF9A4490000-0x00007FF9A4491000-memory.dmp

Download