18174d1caa01188f3bb0505c7bb04b64a8c92761c95ac67bad3f52df28a96950

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
salarixi.exe
Size 51.1MB
Sample260910-q3mdbahb76
SHA256 18174d1caa01188f3bb0505c7bb04b64a8c92761c95ac67bad3f52df28a96950
MD5 e889f13618d238f6cc50fa4ba19fd612
SHA1 e2d843851592d4b59c30875bcc5f0d26921d1a07
SHA512 7c1bab4421e6bafb17c894acaa379b9e5c1f73fe3150acbcf42b00ac4a6bddd2b3493cdf39945fad86a99f920e2110e6d8d84665750a69820523ccedc8c10115
SSDEEP 393216:xChaCkM0/gBmrzzPFHoj9YXa2jJSw7HPaUHPgE2J:YE+Dmr3PFHoAa2jUcaUYE2J
TLSH
T149C718217A9B996EC05AC4B593468A326F7134CB0B39B9FF44C546393F79AF41A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	salarixi.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_1205754011\keys.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_1205754011\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_1205754011\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_2053770702\ct_config.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_2053770702\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_2053770702\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_621234196\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_621234196\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_1205754011\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_1205754011\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_2053770702\crs.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_2053770702\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5936_621234196\manifest.fingerprint	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	salarixi.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	salarixi.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335216972288724"	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	salarixi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5124	msedgewebview2.exe
5124	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5936	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	salarixi.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 5936	1948	salarixi.exe	85
PID 5936 wrote to memory of 4876	5936	msedgewebview2.exe	86
PID 5936 wrote to memory of 5748	5936	msedgewebview2.exe	87
PID 5936 wrote to memory of 5748	5936	msedgewebview2.exe	87
PID 5936 wrote to memory of 5748	5936	msedgewebview2.exe	87
PID 5936 wrote to memory of 5780	5936	msedgewebview2.exe	88
PID 5936 wrote to memory of 6056	5936	msedgewebview2.exe	89
PID 5936 wrote to memory of 6056	5936	msedgewebview2.exe	89
PID 5936 wrote to memory of 2052	5936	msedgewebview2.exe	90
PID 5936 wrote to memory of 2052	5936	msedgewebview2.exe	90
PID 5936 wrote to memory of 2052	5936	msedgewebview2.exe	90
PID 5936 wrote to memory of 1796	5936	msedgewebview2.exe	109
PID 5936 wrote to memory of 1796	5936	msedgewebview2.exe	109
PID 5936 wrote to memory of 4408	5936	msedgewebview2.exe	111
PID 5936 wrote to memory of 4408	5936	msedgewebview2.exe	111
PID 5936 wrote to memory of 5124	5936	msedgewebview2.exe	112
PID 5936 wrote to memory of 4268	5936	msedgewebview2.exe	113
PID 5936 wrote to memory of 4268	5936	msedgewebview2.exe	113

C:\Users\Admin\AppData\Local\Temp\salarixi.exe
"C:\Users\Admin\AppData\Local\Temp\salarixi.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1948.5892.5422780417515767170
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x118,0x16c,0x7ffcfed1b078,0x7ffcfed1b084,0x7ffcfed1b090
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3640,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:8
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4492,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:8
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4580,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView" --webview-exe-name=salarixi.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4556,i,17420031260148195650,8321521939333398089,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
    3⤵
    PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5936_1205754011\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5936_2053770702\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5936_621234196\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5936_621234196\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

accounts.json

Path C:\Users\Admin\.salarixi\accounts.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

current_config.json

Path C:\Users\Admin\.salarixi\current_config.json
Size 6KB
SHA256 5b6b0d05cebce80c2a99504099fb9c3880ba50ebbfac15b22514ba310236d06e
MD5 0fe0488c4c06d821961f39bc871cca5a
SHA1 666b740ab1546f2e012efc6980ccde1a911d28ef
SHA512 94ac27632f63db917b88c5a0238430ebaa81b87548e0d39da51170fa8fcf08325f2baebb70aa3b6383a40ae07ef2c9ee088612cbb5b50a5e60f1ad20cca62c85
SSDEEP 192:lAx8x4x8x1xLxHxJxxxiG6HYsdXQ1rWhPiOddHaIPmVoL6KX1CM:COWWnZdrPMXMWhPJXHBL6I
TLSH
T137D1470549311EF611DD00BAA9D6575B3BB48F8A00227939923BE7DC061EFF192F3AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 651bc61e7ce5137f84dc669ee459eb17dc9d051cc9b1432cfa6cf150f4df0790
MD5 87e43271ee64e23cd48e6074bc9c9152
SHA1 0fca12df2a9c42d1935bb421e3375c33b96800dd
SHA512 ddf9468c3ed63e452de425161888feaaaeb94587dbdfd5caf0548c71fdd9d9d265f5b3ca366302228d7648a1e2fca0a7c7e27ea2d6b9fe017a24b6dbba1f04c9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 435e5251b3e7e83dfa7290c1b878b572520f28efaee4f6b0952c24fdcbb295b5
MD5 551b9a8c06e756b2169ae49d15d585ce
SHA1 d816f326615e8a7f5c557fb6d178950654ece1c3
SHA512 4247e5e6c1b5d7e19030ba913b4dbb6ee5d49658bea0f49229853f38f8ddc86c78e9fb70076c03ea63172b475a297336af035534b0523b7c4d1c1efcff80ec72
TLSH
T121D0121632A20134C4107073040262094400C10B824541445C38CA2DDA584505A02442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3fdd1be90c49e041c6d11ec0446715758bcefb2adcb6eb6209dde9600c37b545
MD5 be8c8d1ed4e4d462ab5559ab0325bc2c
SHA1 72e3d8865934c54855a726c347af3d7e9404076e
SHA512 273ebf63f901a28a35ce32971701aa2b04a7edf06b2836f72f55f4d4ad382e544188b0f3ff26aeaed816c0467b72a05295ab8bdbc66cea8e522349574149c02a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c7f5ac02cfeb901bf0346c52435519aa42294c576f399c38137eded01ac00271
MD5 fac0ea9bff3d4637fbf241ade3390633
SHA1 afa0bcf8254414dc6a721ceb565c6f9de63954da
SHA512 8f2b3f88a44850367340e3d876fb6dc289046ce03adee1c8dac87145075633f640753ac3e1a12f4139795e30fa61aba3656534c41297716f2b342ee7ba60856a
TLSH
T129A0022852750812D11C53B114F19255F2B24AB4AECF161A4DA0916FDDF5360DA11005
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 f4f8174e7fbd5acd6f23956f43a0d01326ce9ed4602c24eb5299419f4eec7df8
MD5 fef0da120f9c06b1965681bd664e2c31
SHA1 95fb95215801e58ef022b4d05c9406a80b237e1b
SHA512 ba69258dec755d68b1ea794aa58d68f42965a1dc48b27bef03b1aea2d323be3bcb771c4550713a49b8d69094d024d3b829a6c10ab47f265806cff887f319d58d
TLSH
T1BA0182A2C3D4C67D4A4117E026343813DD2E041552242E27CDEEEFD967E14B5E11054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe598217.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\Network Persistent State~RFe598217.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences
Size 6KB
SHA256 df376acd728e6397c8b4ed703cb3e1d54fdcb309676907282c20ca5b3fc0a54f
MD5 d8df2f995dd9356662621d76cc05ce5e
SHA1 7f7880e13ec0f1d7cb5cea07ae5545a2d1060a9e
SHA512 a69b861ac8d13f7c773c966d4d037a8a1de59448f8c49ae491d288c28a44424760bdd7733ba1e4330503bcc1505899c1b3a58d4e4c3ede4f98ed6ac875aa7e50
SSDEEP 96:stM051BZumb9xScfffUHZ8i0vhETktLm/7qx+WVHMSm+uecJbO11iYaQj+V+gjYL:stM0DLfEZ8paOa/S+WiTbO1wYa/VVYMC
TLSH
T196E1C8025F78A9774CC7E6197A35BB62E2FA502261D11E58EBFC8A1C04E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59093d.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Preferences~RFe59093d.TMP
Size 6KB
SHA256 2aed6beafdda6aa9754ac4999e569e1888c7a2d45575890f30317169afa5253b
MD5 c6db5afc7a6056c02ebf9314bba25b9b
SHA1 f2172c5c141553a27bee2624cab717f2c79e29a6
SHA512 3d5ad532a755d352bf65e599da06c1604e8524a9c5fb35f1b5ce2cca13e37429f6eae63ba3adbafcb38dea91e227dd38055d2a94df156bdeab41ac22c0dc81cc
SSDEEP 96:stM051BZumb9xRcfffUHZ8i0vhETktLm/7qx+WVHMSm+uecJbO11iYaQj+V+goYx:stM0DEfEZ8paOa/S+WiTbO1wYa/VOYM8
TLSH
T1CCD1C8025F38A9774CC7E6197E39FB62D2FA502261D41E58EBFC895C08D66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 1KB
SHA256 c8e2c5314241d4bcb28fc53549400a5ec5b529670a921ed27a13b518ca867bf0
MD5 b31d9eddaa4fae49aa14e61204f5a090
SHA1 4a4b26808ddd3528e0ab6ea0aec8c34f2d80a71e
SHA512 dda0d16550c97ce2adc316a2de88ef09a4984bdfeb687265bebb950a71316f770e9b87330e7032be19e35d811652a019a51887178d7c77bbbb8d5d98a221f88d
TLSH
T1A4316272E0A06B375CE3504271C22EE76C20917A42654E88A4CD1F1C02EB5CD663AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 2KB
SHA256 c1d19dd996d8702f11333900bd600e41708948b69cc4e0061eb9fbdbb41d2248
MD5 32b075579765dc69f670e2b8a528ddc3
SHA1 ce46243a0806e428bb996fc0b8b94a4540629bc2
SHA512 d52144680b3e3eb4ff4e0ad0c467815f55a3c9cf14eb3834d59d281ead9a7cf4bab1c84f87adca78c9006035ed4b370eabe7910842d74b1f6006fb214e7698c6
TLSH
T16B51B433B454AB3789E3850475CA3F62E93591625AA62F90A9DD1F1C01DB59D3312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 16KB
SHA256 135ce7706b1a3571c14f42d9889e464def77ec14233fd8137a17e3354e5c8c3a
MD5 c2b7268e7282ec3750f2cdc1c521dbb5
SHA1 19eb89ad1419b14fdd08f40e4a9cd5aebbcf2bb6
SHA512 d4c8b8d4ad7db9bc7b12def3b88429d5896a71f998173576c36354d88cdbb006631a53b19734f41626586a3033ed1ea8c02a72be28e17e8bcfbc28de32373919
SSDEEP 384:z8+aQikB+z/xvxjg/qhEwNboG5ONQ2Ub9zg:v/UxvxjgC+MENQ2UbFg
TLSH
T18A728E3B91696E2399F3E905799D0B9BDAB5C47254C12EF84EED2F0D06DB3D81302C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State
Size 3KB
SHA256 2ab4b87281f7d8363ff41f48428b5d80f4fd95530558f7dd199f9192bed60848
MD5 2f6cc4d6348d258b53c92e48e044be87
SHA1 2a23dc919cc75dd0119d678bc193c6fffb6ae065
SHA512 f02e90de79e4519bd11ff3d78a8f03a8a21745c6c1f9daa202dd002bed2a26ec66aa444dd4ef778cccd54116601bc14089696abf4761d5d0fdadc3f054fe6604
TLSH
T1DA71A436A4A4AA274DF3D901B8C62F56BAA59137D5D53F98D9EC1F0C01DB2DC2312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe586a1f.TMP

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\Local State~RFe586a1f.TMP
Size 1KB
SHA256 23ab2948201126d2fce1b53d4d246c37a0ca97722d49318d661137b56774b26e
MD5 7d873e591f1807e7f454d48260d62923
SHA1 67e1d1d8b6a38dc6df372f98e1fb8c65274faff0
SHA512 cade0d5cbe824a9acbee955311e726532be5f9f6b0191c42ed7de1bcbb6d51643d9b11c23b96af81d41914eb3a0811050bc82bc0edc447870fcae6a0511a5f02
TLSH
T13F219273D0E06A376CA24002B1D27EEB2C50817A02644E4CA0CD1B1C02EB9DD6737C72
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\com.nullclyze.salarixi\EBWebView\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2052-340-0x00000250B9340000-0x00000250B93DE000-memory.dmp

Download

memory/2052-117-0x00007FFD19A80000-0x00007FFD19A81000-memory.dmp

Download

memory/2052-242-0x00000250B9340000-0x00000250B93DE000-memory.dmp

Download

memory/5124-454-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-461-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-453-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-452-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-464-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-463-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-462-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-458-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-460-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5124-459-0x000002E216BF0000-0x000002E216BF1000-memory.dmp

Download

memory/5748-271-0x000001B5C6880000-0x000001B5C691E000-memory.dmp

Download

memory/5748-25-0x00007FFD19A80000-0x00007FFD19A81000-memory.dmp

Download

memory/5748-237-0x000001B5C6880000-0x000001B5C691E000-memory.dmp

Download

memory/5748-518-0x000001B5C6880000-0x000001B5C691E000-memory.dmp

Download

memory/6056-98-0x00007FFD1A880000-0x00007FFD1A881000-memory.dmp

Download

memory/6056-95-0x00007FFD1B410000-0x00007FFD1B411000-memory.dmp

Download