23510261bd7f3501110cbb46ec7a909c8ea566dba16c7a4b8b44ffc0a9097fe2

Analysis

user interaction
yes
max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SYXUI.exe
Size 24.1MB
Sample260427-1vxt7aes2j
SHA256 23510261bd7f3501110cbb46ec7a909c8ea566dba16c7a4b8b44ffc0a9097fe2
MD5 df1a2b78693682b4c0270b82ccab5f67
SHA1 ee3ed204025c4c502338a255ec570ccf30b6b9e5
SHA512 04d437da05a6e17be3d0be11c1843ff05e34c5a9aa3319caa5d38ae0ace98a44011fd98b52279a39521b2a2f736c2f6442a5aed229da2a5449cc24f328b34ea6
SSDEEP 196608:Ka1HF18gBp2+XI6eCPhhvXmoMuqYYDUdh:KG9Bp1Y6eCPhtMu99
TLSH
T144478C53B58224B2C2DE817295B74143F33238465B2402DBB668E5ED2FBAED066F7770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SYXUI.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1079172276\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1079172276\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1079172276\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1697886775\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1697886775\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1697886775\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-gl.hyb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134218007711667170"	msedgewebview2.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	SYXUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	SYXUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe
4192	SYXUI.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1788	msedgewebview2.exe
1788	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	SYXUI.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4192	SYXUI.exe
4192	SYXUI.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1848	4192	SYXUI.exe	85
PID 1848 wrote to memory of 1204	1848	net.exe	87
PID 4192 wrote to memory of 1788	4192	SYXUI.exe	88
PID 1788 wrote to memory of 4328	1788	msedgewebview2.exe	89
PID 1788 wrote to memory of 4720	1788	msedgewebview2.exe	90
PID 1788 wrote to memory of 4720	1788	msedgewebview2.exe	90
PID 1788 wrote to memory of 4720	1788	msedgewebview2.exe	90
PID 1788 wrote to memory of 3832	1788	msedgewebview2.exe	91
PID 1788 wrote to memory of 3768	1788	msedgewebview2.exe	92
PID 1788 wrote to memory of 3768	1788	msedgewebview2.exe	92
PID 1788 wrote to memory of 1656	1788	msedgewebview2.exe	93
PID 1788 wrote to memory of 1656	1788	msedgewebview2.exe	93
PID 1788 wrote to memory of 1656	1788	msedgewebview2.exe	93
PID 1788 wrote to memory of 2628	1788	msedgewebview2.exe	103
PID 1788 wrote to memory of 2628	1788	msedgewebview2.exe	103
PID 1788 wrote to memory of 2628	1788	msedgewebview2.exe	103
PID 1788 wrote to memory of 3884	1788	msedgewebview2.exe	108
PID 1788 wrote to memory of 3884	1788	msedgewebview2.exe	108
PID 1788 wrote to memory of 4668	1788	msedgewebview2.exe	109
PID 1788 wrote to memory of 4668	1788	msedgewebview2.exe	109
PID 1788 wrote to memory of 3144	1788	msedgewebview2.exe	110
PID 1788 wrote to memory of 3648	1788	msedgewebview2.exe	111
PID 1788 wrote to memory of 3648	1788	msedgewebview2.exe	111

C:\Users\Admin\AppData\Local\Temp\SYXUI.exe
"C:\Users\Admin\AppData\Local\Temp\SYXUI.exe"
1⤵
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1204
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4192.932.316754569702954330
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x11c,0x16c,0x7ffaff36b078,0x7ffaff36b084,0x7ffaff36b090
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3676,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4540,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4040,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=764,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3888,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView" --webview-exe-name=SYXUI.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4052,i,16384412656879815080,2629671618512638598,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
    3⤵
    PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1079172276\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1133107991\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1697886775\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1788_1697886775\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 84e8b94d524ea1c8c1a84307b3f99dab7688b6170fb9f236cad45773e35b5500
MD5 ef563d09407cffc5b5c0aaa23277572e
SHA1 9bc23acb95e592ca1075e6b7d574cf36f2e5f00f
SHA512 9ba8c71569089a313556983869eda4f58a44e44d6bb9cf08789d941e97a86e993a11e28a20f10a7b94dd0f0aed1d80a9c3081bc83998eed95a497f078505caf9
TLSH
T1E2D004FD71410101CC0451311050451517014704400113010131114F5DD11C010151DC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8233264cdb6e36a72b45663fe074c6ae95b9d76b3e735fc213a5e3a865ebabce
MD5 4a117a6fe3787ff9c36d35b7cabb4a0b
SHA1 28c004bc1107a7b199928adf2d4ce4846b3511b7
SHA512 0e9da69c0925bac04792f4135488497cd3f875040295cec4eb6247a9cb85f7748bb8fc70c462ee42c0036b5cd34bd452d7c04ce535add01b58b57804860089d4
TLSH
T1FDD0127B32420234C81021331042650D1901C30F800541015439965F6F540D019164D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fa1e0fe08584783ec030103ac5b61630523ae152b445b6a8431f66232653294f
MD5 698b4feeefdc7b0707aa030e22519e67
SHA1 93d2eeb16d320a32a0ae734135ea1220fff42e47
SHA512 71f91b67c4ec78f06442c94fb931b5399706feea04bb54563236d945edbecf438a0149bbd9f1dc5422cd8373f2d2bc0f08eaf026463dbf7c657d53c7ccdde985
TLSH
T186D02BBF31130B20CC1034331141A20E3E10C20E804391020C3B514F9FB00D13AC66CC
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b77942108d544f4d69f9fca02f9892afc537ab218d19a460f9b99f179e7b4971
MD5 4fff212d653d195c352509fde82f16f5
SHA1 0f9de878a87080d19e0cdd1a9662f3a9cdcb8bbd
SHA512 48673e03ec30b84b5c905188b17e4d227e3b794920b85616b3b106c4683d14a0794d3c758c7280f6ad8baccd0d171fc648cc52834621fcb800007af2e28c1c91
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 b129ffa173363ca783c0b751dfb924a585c6b83e08581e651644d133ad5169d1
MD5 39ca9415dfb1d5a9b8c899a6dfc395bc
SHA1 5908f66b8b561f506272531245368b4c796eba8a
SHA512 95137fe888c58f95e2c2afc9fb3efbabcd9d603d9adf2dd74511aa5e37df53828ceb505034688354e1be892d1d7582eb6741dafcbec007d02c73832d36bf4844
TLSH
T13EF0D64440042063F34D2F720BE683A032FA8803C44F8EA3AADD30B2B9E0F10D623B98
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 abdd4a7506cd40b6de748c990cf327b1bd71c8a0b378d0a8682e845c5349569c
MD5 549561af829e297aa2122bdd55540aaf
SHA1 b2acfde801b2b0c96378a77dd64a80f76593ca96
SHA512 7a65b370c7153d5cccb9009f990218b97cfca0b3b56b479d0c6669832e87e13094a06f691c566cb5674e7c535a2a161c1729cca938ff904eb4a1f16000e55c4c
TLSH
T158F08C4441182073E34D5F720BD6836432F58813C45F9F936ADC34B6B6E1F20CA12B98
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 2bfbc824091a52d6adb58e7d3bf56447f5218e3e28ac02169f2d8e8353e96a2e
MD5 9a1100a8880d7f747cc65a5382f51407
SHA1 8839f654c4a0d67ba609592c3c023b7d9fa0c0bc
SHA512 69d512f2f6ad50d91fca40253cda1b317c53940eafa04d895272867567814b6ee83600740e6a0e1ac6e76eb602ecc34b67ee7e36740b7fbffbe6bb8217f0689c
TLSH
T1BFF0DF98000020A3F38D6FB60BD6832132F28887C45F8F936AED347575D0F10D612B94
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 bd6d65080c1be5191aaebdcbb573fbb2b894089fb1366b67c81254671e53d2f0
MD5 2fb01001149336effb848984d2f67b9d
SHA1 1f28eae4a330345b973c920d5d3f17a154f92423
SHA512 ab621220637d1b7a1d211b2ed12210b6681c1ab2027ab7a6eb7c393b9c169dc047b89162cccd896b17b8301716677fa0bcf1b361cd2dfbcadba3c2c670f9655f
SSDEEP 3:LstlNllkll/lgJ:LsX3lEtgJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59671d.TMP

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Network\Network Persistent State~RFe59671d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 528fe16cfaff470bbc68a79b6a7189372158523b73c754b8b701df57241cb3ec
MD5 d48db82d79ed0c2fdb71da4d36287013
SHA1 555ec21166409a20fd6bc02f236adc70cf312c0c
SHA512 671e812ec3b8c9806bb59d85a60b222fa21340842918e22f53e535104169a807d0af6c1d695d13a0910f8ea234726b38d718a5caef4f930272af435e8797c685
TLSH
T16BE068A240ABEC3640F809223E887C006AB7B03502C1A4E0CDB2816E21800B34306422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe598e7b.TMP

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Network\TransportSecurity~RFe598e7b.TMP
Size 188B
SHA256 9893bc45d20694b481e38e9770e1c5c207547f1c0b35f8ffe42627cc85863a97
MD5 875755449a0777651dee1876b47903d4
SHA1 f220c122f6d4d5415bece4617c4ed1942dddf328
SHA512 d4a8cdd13b3732a8c10ced0c82546a968945caa80ad40fad0e262ab3b5d76464e2f7369ae61fb7b7a93b7d50932affd0fd58f42ba81f105c5b3cf46f2fe83d4b
TLSH
T1F4C022A1413AE936107805212AC46D405F37E030018090E89772092960802666613293
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 c06961c3776816d8a346515ae970c341f278ac838fda04b49bc2cb9fd994201f
MD5 1df041e5c756f04f5d923a7b78ff41a1
SHA1 e8593dd6994d28668535ac17edb3f947db04c0fb
SHA512 9d8c12b010d1b3432c7e581e4bb037f79f98b117691d72720378baf4d29f2c27c35c6cbcb5a7ab0c3ce1fd67991cbeb73f1ab66b8870bf0b529f29cf93e4f9f8
SSDEEP 192:stE873fgZ8paQ2f/S+WiQ2vKXWdFSVMM8:stp733a/VYWq8
TLSH
T1ABD1A9075E64AD7B4CCBE6197A75BB12E1F91022B6D40E58EFFC861C08E66DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 2f9dc4aa55eef45834f0bd058f2dabfe70d77f7a69ad2990b8762c6e81e0e189
MD5 ba452c0320ac5fc7fe270cce72836bfd
SHA1 0037bf61fa0f2f966cd10b21f4d12fac86aad6fb
SHA512 7e6460ef76d84d78322c223cc89b05fc7ab646285bfb609627222bf11484947a2e73d445ebdff73c15d55b6dad17571401442bfbc44d3848cecb41a3cbd52c06
SSDEEP 96:stE85G6Nepb9JffqPZ8i0vhESkc2Cm/7qx+WVHMSm+uecScj4PjUdQjQ+gGrMMOB:stE87gfgZ8paQ2f/S+WiQai4dFeMMC
TLSH
T1F0E1B8065E646D7B4CC7E61D7A75BB12E2FA1022A7C50E58EFFC861C08E66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58b011.TMP

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Default\Preferences~RFe58b011.TMP
Size 6KB
SHA256 26856aa28d8092e9edf087c810198962ea90293a638eac58db14f9670731b1b5
MD5 e00b79a618251c4435241535b5b8b974
SHA1 751e86d995be6fc520fabb9866c1d2957c783998
SHA512 51c23e8ae17e6df5bf31cdf94b80ae4082b5165cbc59ffac50f3fcac752e12bec4dc5ee29d75ed3976653a92ab97ee67bd1f48dcfe497e42fb1e9901d330f314
SSDEEP 96:stE85n5Nepb9mffYZ8i0vhESkcKm/7qx+WVHMSm+uecSyK1idQjQ+gEY6MEB:stE8n3fQZ8paQH/S+WiQyKwdFeY6M8
TLSH
T195D1A8079E686D774CCBE6197A35BB12E2F91072A6D40D98EFFC861C08D66DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Local State
Size 17KB
SHA256 59e56136475770df01678f93699516bc300a7af7d6bc101ef00d0df1c44683ee
MD5 ff7885a3b06b1fe57c4636ae83ce74ff
SHA1 d8e9974372d5b5f0791e98f2d6be9f418d280fca
SHA512 f0a9036238b207a94c526f188cf9a7cce2612668c22e7a3f688ed259d77d45cd2c13de86cac4dbd525c019262c4d6ac6a53a7b53bcd56b5a3313e10f309e44f2
SSDEEP 384:z+fRE5BdEZfr0kuh9Rt/nP9yJ3NgKdwtfdRGCxaEctQ8:KRkurqhNsJFYRGCSQ8
TLSH
T167829E73D971EE275CF782463A0A6B06A6B5814AA6D51ED4ACDC1F0D0AC3BDD1343C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Local State
Size 1KB
SHA256 026e869364363968c631e5c296f0072d311157467909f0036ff70f11b8460ae7
MD5 af65bd66a9b0a348cc41eb74caff71f8
SHA1 59e9a53d319e6af765431c8f8fdfc99754e17bfd
SHA512 dfa1362b18b0aaee5a4f0a95ce4e80296f61ba544aa5725df6608d8cdd3f393f01aab2ba7ec533c5d451b5ef8ce808ccc82ba3718e5b68f1b81778ec5d32b0d6
TLSH
T1773177B3E4E05F322C926142B2857A573F31606BD2508E9878DD471C12EB3ECB26AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Local State
Size 2KB
SHA256 1d0159729f27a38325d66b279de6629954b134de31dd2df336f6f43d9eef6a16
MD5 0201a6cafb8c0bb67dcea4b7d081938f
SHA1 6197bd18291e57bbd8793409c778f812d97fdd4f
SHA512 f7101be6a4acad6328ec2c1b1ba9761a1fb30c450e5160627da18debbe4624beab0a46f915dd7d20cf3a5f9d5803d41f2d476a4093bff8e024125f901ac6343c
TLSH
T111517373B8549A3749A35545B98A3F136A3591A6E6A12FA0ADDD0B0C01EB2EC3342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Local State
Size 3KB
SHA256 ec581db4b76532e4590bda7d6c554d7bc848ded818f2e1ef69d32dbbf44a4231
MD5 3fac25aba084803563d4b264fa9a8fee
SHA1 2e9f055e3d1eadcedb6dc7fad68620a7c3fc6c09
SHA512 b7811c9c518df563b096eec4fb97a18c2e6afb09819cbbed88580985c93118391527848264223e04e827d901da6bfe6e028cf3b44ec954b93e4c6f7a5e0c103f
TLSH
T17E716377A8A4AA374DE39941B9852B167B655137E6943FA8DDEC0F0C01DB3EC2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Local State
Size 16KB
SHA256 8fcc904a144329a8e17050326fea3608e9fa2e9fa0034f8eaf2405ba3dca6817
MD5 62bf817ecced5bdc5a8a7d617de97b07
SHA1 4ced484e2a3127941dd47aa7885c4843e6b6a15e
SHA512 cb11a95789d41a3c4b7ec4dbf7b6d006debac88c63e4098e5c1b8908f13062b1f44823535ed3e691712e05773facb007de47ecfd9bea62783294163c2ed4fe8b
SSDEEP 384:zBfRE5BdEZfr0kuh9Rt/nP9ybNbkUG9CxaEctQ8:hRkurqhNs/8CSQ8
TLSH
T124729E339A719D271CE7810B3A495B0266B5C04EA6A12EE8BCDC1F1D06C77E91393D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583c77.TMP

Path C:\Users\Admin\AppData\Roaming\SYXUI.exe\EBWebView\Local State~RFe583c77.TMP
Size 1KB
SHA256 08474818fc8c41743956af92fd290787df31e5378d847a9340ed0d91a53c822a
MD5 2f908f8f3a5ffd040fcdd3799cf36a73
SHA1 0da4fa16c829e9946f74e0dd53d5a028528c8c77
SHA512 01a195d06dcca597c1e6546011cf8a8e91707e9464956181190b9e7db7a8757359d285636a28978bc97ce636041a464ba74283a828e3d8d00cbaadb632d27492
TLSH
T1AF213273D4A46E3268522452B2517A473F20A1ABE2648E5864DD471C26EB6FCA267C33
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\_SYX\config.json
Size 342B
SHA256 0c84ff0251420344b1107ef83493c952928071169dc0981952de92557ae5bfd4
MD5 9b5b8a046ca8ba6fde506ac9631f7268
SHA1 54a1b18f4621d32c17745ff9cf04b79d14f582d6
SHA512 bd1e5814d181d3b585071c0c66e99d1a9b7e8a669876d0c14138b8ea9b98325598da0e238f6465a1756ac690f2c9edd01991c9950c48a88b8e0f01f52973c772
TLSH
T151E0CD15863C507372F0D52599CEA60369335DA511887D2CD17343196C9E73774B59CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1656-157-0x00007FFB19760000-0x00007FFB19761000-memory.dmp

Download

memory/1788-226-0x0000016E82F40000-0x0000016E82F4C000-memory.dmp

Download

memory/1788-228-0x0000016E8ABE0000-0x0000016E8AC1B000-memory.dmp

Download

memory/1788-227-0x0000016E8A8A0000-0x0000016E8A8C7000-memory.dmp

Download

memory/1788-225-0x0000016E82F00000-0x0000016E82F2C000-memory.dmp

Download

memory/3144-904-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-913-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-905-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-917-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-916-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-915-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-914-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-906-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-912-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3144-911-0x000001DB2CF30000-0x000001DB2CF31000-memory.dmp

Download

memory/3768-62-0x00007FFB1B640000-0x00007FFB1B641000-memory.dmp

Download

memory/3768-61-0x00007FFB1A680000-0x00007FFB1A681000-memory.dmp

Download

memory/4192-224-0x00000274FFEC0000-0x00000274FFECC000-memory.dmp

Download

memory/4720-32-0x00007FFB19760000-0x00007FFB19761000-memory.dmp

Download

memory/4720-246-0x0000010ED9000000-0x0000010ED9115000-memory.dmp

Download