Analysis
-
max time kernel
97s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 18:08
Static task
static1
Behavioral task
behavioral1
Sample
Solar-Tweaks-Setup-4.3.3.exe
Resource
win10v2004-20230220-en
General
-
Target
Solar-Tweaks-Setup-4.3.3.exe
-
Size
60.3MB
-
MD5
ed4a1a4fc71c4cfd4ff37bfd00114b7b
-
SHA1
581a8f1c303c0d592083b4649dd1819e8394efee
-
SHA256
1c2d92a970c392e744075679363c85a95ab97a28a22ce6431fbaa206d9ac33e3
-
SHA512
8aa009204b3723af95a2d339f8405a6462c2b2f179f544db02a35bdf095c52ae74a2af128d2facd6ca114c5a0dd1ef50b0ae785917f7e1f0d5ba02b25f8f62d0
-
SSDEEP
1572864:aV1s9gPNzITDH7QDv2zFZJTCT6MR9L0T+woseEM:aV1sUUXcL2zfNwbnLddEM
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Solar Tweaks.exeSolar Tweaks.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation Solar Tweaks.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation Solar Tweaks.exe -
Executes dropped EXE 4 IoCs
Processes:
Solar Tweaks.exeSolar Tweaks.exeSolar Tweaks.exeSolar Tweaks.exepid process 4984 Solar Tweaks.exe 4672 Solar Tweaks.exe 3644 Solar Tweaks.exe 2916 Solar Tweaks.exe -
Loads dropped DLL 14 IoCs
Processes:
Solar-Tweaks-Setup-4.3.3.exeSolar Tweaks.exeSolar Tweaks.exeSolar Tweaks.exeSolar Tweaks.exepid process 4500 Solar-Tweaks-Setup-4.3.3.exe 4500 Solar-Tweaks-Setup-4.3.3.exe 4500 Solar-Tweaks-Setup-4.3.3.exe 4500 Solar-Tweaks-Setup-4.3.3.exe 4500 Solar-Tweaks-Setup-4.3.3.exe 4500 Solar-Tweaks-Setup-4.3.3.exe 4500 Solar-Tweaks-Setup-4.3.3.exe 4984 Solar Tweaks.exe 4672 Solar Tweaks.exe 3644 Solar Tweaks.exe 4672 Solar Tweaks.exe 2916 Solar Tweaks.exe 4672 Solar Tweaks.exe 4672 Solar Tweaks.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Processes:
Solar Tweaks.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Solar Tweaks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Solar Tweaks.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Solar Tweaks.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Solar Tweaks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Solar Tweaks.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Solar Tweaks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Solar-Tweaks-Setup-4.3.3.exetasklist.exeSolar Tweaks.exeSolar Tweaks.exepid process 4500 Solar-Tweaks-Setup-4.3.3.exe 4500 Solar-Tweaks-Setup-4.3.3.exe 1496 tasklist.exe 1496 tasklist.exe 3644 Solar Tweaks.exe 3644 Solar Tweaks.exe 2916 Solar Tweaks.exe 2916 Solar Tweaks.exe 2916 Solar Tweaks.exe 2916 Solar Tweaks.exe 2916 Solar Tweaks.exe 2916 Solar Tweaks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tasklist.exeSolar-Tweaks-Setup-4.3.3.exedescription pid process Token: SeDebugPrivilege 1496 tasklist.exe Token: SeSecurityPrivilege 4500 Solar-Tweaks-Setup-4.3.3.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
Solar-Tweaks-Setup-4.3.3.execmd.exeSolar Tweaks.exedescription pid process target process PID 4500 wrote to memory of 2300 4500 Solar-Tweaks-Setup-4.3.3.exe cmd.exe PID 4500 wrote to memory of 2300 4500 Solar-Tweaks-Setup-4.3.3.exe cmd.exe PID 4500 wrote to memory of 2300 4500 Solar-Tweaks-Setup-4.3.3.exe cmd.exe PID 2300 wrote to memory of 1496 2300 cmd.exe tasklist.exe PID 2300 wrote to memory of 1496 2300 cmd.exe tasklist.exe PID 2300 wrote to memory of 1496 2300 cmd.exe tasklist.exe PID 2300 wrote to memory of 1488 2300 cmd.exe find.exe PID 2300 wrote to memory of 1488 2300 cmd.exe find.exe PID 2300 wrote to memory of 1488 2300 cmd.exe find.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 4672 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 3644 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 3644 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 2916 4984 Solar Tweaks.exe Solar Tweaks.exe PID 4984 wrote to memory of 2916 4984 Solar Tweaks.exe Solar Tweaks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solar-Tweaks-Setup-4.3.3.exe"C:\Users\Admin\AppData\Local\Temp\Solar-Tweaks-Setup-4.3.3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Solar Tweaks.exe" | find "Solar Tweaks.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Solar Tweaks.exe"3⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496 -
C:\Windows\SysWOW64\find.exefind "Solar Tweaks.exe"3⤵PID:1488
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe"C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe"C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=gpu-process --field-trial-handle=1948,563054551409761492,12290049487855636805,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4672 -
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe"C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,563054551409761492,12290049487855636805,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2412 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3644 -
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe"C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=renderer --field-trial-handle=1948,563054551409761492,12290049487855636805,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\solartweaks\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\D3DCompiler_47.dllFilesize
4.3MB
MD57641e39b7da4077084d2afe7c31032e0
SHA12256644f69435ff2fee76deb04d918083960d1eb
SHA25644422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA5128010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exeFilesize
130.1MB
MD5340132256d957b9ec3357850f6eec33c
SHA15903ea416bb58d8b52964f8445309cc0769842bb
SHA256befa6aa28a5bafbad17926b29318f13ab026bbb18010ba410b29374821adf08e
SHA51203276db0c832f09abf8dab0d100d9c272f4623130a4b5d80de43f6ea099f6c486229e74db0d25a13857eaefb3133dba4f41d08c6aab7bdfd897a601c5cfdf68b
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exeFilesize
130.1MB
MD5340132256d957b9ec3357850f6eec33c
SHA15903ea416bb58d8b52964f8445309cc0769842bb
SHA256befa6aa28a5bafbad17926b29318f13ab026bbb18010ba410b29374821adf08e
SHA51203276db0c832f09abf8dab0d100d9c272f4623130a4b5d80de43f6ea099f6c486229e74db0d25a13857eaefb3133dba4f41d08c6aab7bdfd897a601c5cfdf68b
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exeFilesize
130.1MB
MD5340132256d957b9ec3357850f6eec33c
SHA15903ea416bb58d8b52964f8445309cc0769842bb
SHA256befa6aa28a5bafbad17926b29318f13ab026bbb18010ba410b29374821adf08e
SHA51203276db0c832f09abf8dab0d100d9c272f4623130a4b5d80de43f6ea099f6c486229e74db0d25a13857eaefb3133dba4f41d08c6aab7bdfd897a601c5cfdf68b
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exeFilesize
130.1MB
MD5340132256d957b9ec3357850f6eec33c
SHA15903ea416bb58d8b52964f8445309cc0769842bb
SHA256befa6aa28a5bafbad17926b29318f13ab026bbb18010ba410b29374821adf08e
SHA51203276db0c832f09abf8dab0d100d9c272f4623130a4b5d80de43f6ea099f6c486229e74db0d25a13857eaefb3133dba4f41d08c6aab7bdfd897a601c5cfdf68b
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exeFilesize
130.1MB
MD5340132256d957b9ec3357850f6eec33c
SHA15903ea416bb58d8b52964f8445309cc0769842bb
SHA256befa6aa28a5bafbad17926b29318f13ab026bbb18010ba410b29374821adf08e
SHA51203276db0c832f09abf8dab0d100d9c272f4623130a4b5d80de43f6ea099f6c486229e74db0d25a13857eaefb3133dba4f41d08c6aab7bdfd897a601c5cfdf68b
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exeFilesize
130.1MB
MD5340132256d957b9ec3357850f6eec33c
SHA15903ea416bb58d8b52964f8445309cc0769842bb
SHA256befa6aa28a5bafbad17926b29318f13ab026bbb18010ba410b29374821adf08e
SHA51203276db0c832f09abf8dab0d100d9c272f4623130a4b5d80de43f6ea099f6c486229e74db0d25a13857eaefb3133dba4f41d08c6aab7bdfd897a601c5cfdf68b
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\chrome_100_percent.pakFilesize
138KB
MD503aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\chrome_200_percent.pakFilesize
202KB
MD57d4f330a5443eadf32e041c63e7e70ad
SHA126ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\d3dcompiler_47.dllFilesize
4.3MB
MD57641e39b7da4077084d2afe7c31032e0
SHA12256644f69435ff2fee76deb04d918083960d1eb
SHA25644422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA5128010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dllFilesize
2.6MB
MD57c3c780de9ae5cc4abeccbd7cb6b367b
SHA1bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA25639293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
SHA51280a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dllFilesize
2.6MB
MD57c3c780de9ae5cc4abeccbd7cb6b367b
SHA1bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA25639293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
SHA51280a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dllFilesize
2.6MB
MD57c3c780de9ae5cc4abeccbd7cb6b367b
SHA1bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA25639293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
SHA51280a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dllFilesize
2.6MB
MD57c3c780de9ae5cc4abeccbd7cb6b367b
SHA1bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA25639293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
SHA51280a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dllFilesize
2.6MB
MD57c3c780de9ae5cc4abeccbd7cb6b367b
SHA1bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA25639293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
SHA51280a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\icudtl.datFilesize
9.9MB
MD580a7528515595d8b0bf99a477a7eff0d
SHA1fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA2566e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\locales\en-US.pakFilesize
88KB
MD5af5c77e1d94dc4f772cb641bd310bc87
SHA10ceeb456e2601e22d873250bcc713bab573f2247
SHA256781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA5128c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\resources.pakFilesize
4.9MB
MD591f8a4b158df6967163ccbbe765e095a
SHA195db67f0a2352fd898f4a4cfdfc860f6a9c58c87
SHA256a30b8269e588c6cc2cea5fd4685da3012fd10451edb59a283005116f8e033182
SHA5126450d75d53f24d11e1c1e7e3cacfc57ee9dd09c00ca0dc2ff30f580b59a6b17e7ad7d96682195bd7d806b49068653538c77ca4200491560cecff128a0b012d92
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\resources\app.asarFilesize
7.1MB
MD5ffbcaf8661b84341601d8a0c75fb27c2
SHA147f107ace93bfa6f83929a8b23fede95973fd86e
SHA256af87efd6abb9aa6868eb7a4eba16eaeef572911aedd872be452d1ee42f55ed67
SHA512f9d691a823f344049d8858d509bf421b7743223fd3bef324aac94e3110e2f4aac8a2b80ababc7bb35c5e34948e1b5680678ad8513b5f4d19ed13d109c49e7129
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\swiftshader\libEGL.dllFilesize
448KB
MD5038a73114d439bfc94be4732b2794998
SHA14b7a9d52da1bd808af979cf5cfb146404494317a
SHA256b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
SHA5128788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\swiftshader\libGLESv2.dllFilesize
3.1MB
MD538ec86347b3e467c5868e35ab48f89f2
SHA14db17d065cc330b277a70f9fb8dff0c4b426f314
SHA2562e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
SHA5122b2405ed51ea1d232f2d60072e4f57e70f36f1a8f9d0a935772bfb9a3be50c1d6136cee496fde9fb3dda1f0d2f1c643cb9f162e0b68828ff854645eb1e8216f4
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\swiftshader\libegl.dllFilesize
448KB
MD5038a73114d439bfc94be4732b2794998
SHA14b7a9d52da1bd808af979cf5cfb146404494317a
SHA256b1054e0dc2ab31a7cf3cd7f3dae07b1ec31acd42c157be13ce47ea870840f0cc
SHA5128788e43de424e1d7a163d0b7f4d719c36bf8fdee9808d405aeb05993c446d4f2a595741cb4d98f5e9611cd16d09de9445bf72176a799f4189168bb8509b115ff
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\swiftshader\libglesv2.dllFilesize
3.1MB
MD538ec86347b3e467c5868e35ab48f89f2
SHA14db17d065cc330b277a70f9fb8dff0c4b426f314
SHA2562e10d308d0207835b07df3bb38bee88300aa57fcb214051e8654d29587257744
SHA5122b2405ed51ea1d232f2d60072e4f57e70f36f1a8f9d0a935772bfb9a3be50c1d6136cee496fde9fb3dda1f0d2f1c643cb9f162e0b68828ff854645eb1e8216f4
-
C:\Users\Admin\AppData\Local\Programs\solartweaks\v8_context_snapshot.binFilesize
161KB
MD5e47426f88649c7f8e27b8a1516cc0137
SHA15452aadfddbc55d6c5c18b801087e39529859b12
SHA25609686ad5bf03d95de7c251d204e60a8e3824bd6420bedddee80b2c6e5609fb26
SHA512f9647a35ff273ca622b3db4aefb9aaf75075386c42a31e085f916fc82f3a18fed25b0e05dcc09e678ca419408f59f0c34fa5762e5f945db35f9c6f67b7b94bc0
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\SpiderBanner.dllFilesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\StdUtils.dllFilesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\StdUtils.dllFilesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\WinShell.dllFilesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\WinShell.dllFilesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\WinShell.dllFilesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\nsExec.dllFilesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
C:\Users\Admin\AppData\Local\Temp\nsz7A66.tmp\nsis7z.dllFilesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\solartweaks\Network Persistent StateFilesize
1KB
MD52954b2f4611738098144438fa265a2e8
SHA18972facb4c4d957a1be23688dca65adf6b8e2834
SHA2567d9480e05e49879847e287b7b4ca15e3654fe66f25411c8157b81f57662463df
SHA51241f4de95f0c0bc8205e6ecd0618288a31e845e0dd6cf3c61298f738f191db0f17b0e9ee5b0ea87abbd74e11c76a10e496ebf3cb522cbcfff569485f2f5085ffb
-
C:\Users\Admin\AppData\Roaming\solartweaks\Network Persistent State~RFe57e213.TMPFilesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Roaming\solartweaks\Session Storage\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Roaming\solartweaks\Session Storage\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\solartweaks\settings.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
memory/4672-359-0x00007FF9A2F70000-0x00007FF9A2F71000-memory.dmpFilesize
4KB