32346e6298cd7ace60e196e8aa06adac7219ee66bbe51772f3651598aa12bf15

Analysis

max time kernel
2706s
max time network
2585s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solar-Tweaks.exe
Size 60.3MB
Sample240224-v7ml4aae3w
SHA256 32346e6298cd7ace60e196e8aa06adac7219ee66bbe51772f3651598aa12bf15
MD5 e911e177424d3759fb6e29b987fb0dfa
SHA1 cd3b1650b21b3d2ffd41b4fd5099d0643cdaf2b7
SHA512 915010f3717e2c3646a6e5bb579b65a0e151a4e6baae7bb6756e10993ef89b41981b4725655f2452bcc757bba9d623aa95dbdb4f360ab8df653149aa6d5a78e0
SSDEEP 1572864:C/1s9gbBcaDH7QDv2zFZJTCT6MR9L0T+wIseEI:C/1sb8cL2zfNwbnL3dEI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	Solar Tweaks.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	Solar Tweaks.exe

Executes dropped EXE 5 IoCs

pid	Process
1492	Solar Tweaks.exe
4508	Solar Tweaks.exe
5004	Solar Tweaks.exe
3488	Solar Tweaks.exe
4640	Solar Tweaks.exe

Loads dropped DLL 15 IoCs

pid	Process
3076	Solar-Tweaks.exe
3076	Solar-Tweaks.exe
3076	Solar-Tweaks.exe
3076	Solar-Tweaks.exe
3076	Solar-Tweaks.exe
3076	Solar-Tweaks.exe
3076	Solar-Tweaks.exe
1492	Solar Tweaks.exe
5004	Solar Tweaks.exe
4508	Solar Tweaks.exe
4508	Solar Tweaks.exe
4508	Solar Tweaks.exe
4508	Solar Tweaks.exe
3488	Solar Tweaks.exe
4640	Solar Tweaks.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1604	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Solar Tweaks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Solar Tweaks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Solar Tweaks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3988	vlc.exe
2208	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3076	Solar-Tweaks.exe
3076	Solar-Tweaks.exe
1604	tasklist.exe
1604	tasklist.exe
5004	Solar Tweaks.exe
5004	Solar Tweaks.exe
3488	Solar Tweaks.exe
3488	Solar Tweaks.exe
3488	Solar Tweaks.exe
3488	Solar Tweaks.exe
3488	Solar Tweaks.exe
3488	Solar Tweaks.exe
4640	Solar Tweaks.exe
4640	Solar Tweaks.exe
4640	Solar Tweaks.exe
4640	Solar Tweaks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3988	vlc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	tasklist.exe
Token: SeSecurityPrivilege	3076	Solar-Tweaks.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
1492	Solar Tweaks.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe
3988	vlc.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3988	vlc.exe
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE
2208	EXCEL.EXE

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3408	3076	Solar-Tweaks.exe	86
PID 3076 wrote to memory of 3408	3076	Solar-Tweaks.exe	86
PID 3076 wrote to memory of 3408	3076	Solar-Tweaks.exe	86
PID 3408 wrote to memory of 1604	3408	cmd.exe	88
PID 3408 wrote to memory of 1604	3408	cmd.exe	88
PID 3408 wrote to memory of 1604	3408	cmd.exe	88
PID 3408 wrote to memory of 3888	3408	cmd.exe	89
PID 3408 wrote to memory of 3888	3408	cmd.exe	89
PID 3408 wrote to memory of 3888	3408	cmd.exe	89
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 4508	1492	Solar Tweaks.exe	94
PID 1492 wrote to memory of 5004	1492	Solar Tweaks.exe	95
PID 1492 wrote to memory of 5004	1492	Solar Tweaks.exe	95
PID 1492 wrote to memory of 3488	1492	Solar Tweaks.exe	97
PID 1492 wrote to memory of 3488	1492	Solar Tweaks.exe	97
PID 1492 wrote to memory of 4640	1492	Solar Tweaks.exe	102
PID 1492 wrote to memory of 4640	1492	Solar Tweaks.exe	102

C:\Users\Admin\AppData\Local\Temp\Solar-Tweaks.exe
"C:\Users\Admin\AppData\Local\Temp\Solar-Tweaks.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Solar Tweaks.exe" | find "Solar Tweaks.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Solar Tweaks.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\SysWOW64\find.exe
    find "Solar Tweaks.exe"
    3⤵
    PID:3888

C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
"C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=gpu-process --field-trial-handle=1992,9726402664477864672,18422658484774571156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4508
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,9726402664477864672,18422658484774571156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=renderer --field-trial-handle=1992,9726402664477864672,18422658484774571156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\solartweaks\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
  "C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe" --type=gpu-process --field-trial-handle=1992,9726402664477864672,18422658484774571156,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1100 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3868

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PopDismount.aifc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3988

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\TestClear.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\D3DCompiler_47.dll
Size 111KB
SHA256 2fe3cfb6e7664e9aa0d8c4c1f4b6ad8200dbe3c75edac959a9b3d00e95d218ce
MD5 cbab38fab6af6b934f2259220f8e2324
SHA1 93d232f45ef958e7f38ebc1736bbba09aa32c26a
SHA512 80aef900388025e37886b32a03fe893ff9797fafd3cab89ff0fdcefd7bc24476991f3ddc9b6344185443e6db71faff76d2fed2e69be212c2df3e9c843e4a1640
SSDEEP 1536:eCVdquhKCjRYy8gtvPMxbRyWf4LBSC+u1YWgeUsXDaxolEYR/C4w4kgpQWGZV/:zVphjYWtvPLIdYhC49kgyWu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 8.6MB
SHA256 8b51ccf691f82e3deb1ecaf77a2f8a61be9447522f80793cc03a97f867c6a0ff
MD5 8c10a1e67ef3fabc88138909154d482e
SHA1 0e27518e58b2c8e7a75b219bf6e4881e9adca20e
SHA512 ec87381447ce839d886773e34086f153e17e15f7d1b34833c292e458c47c388f98b1d56acf7a7f047183102d245294b14906058c48f12eb6bcc04a6213fec907
SSDEEP 98304:o6Z50ziFtZBS1Wt40tZ73RqFtvKEgNgbgc3O:o6gzw81MEgnYO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 4.9MB
SHA256 ed10b7ed4f134a2c5e81ba6f180013367dfc9add7f71997602b1cfddb7e97b04
MD5 ab11283a7e43e92f8b5093bacca42116
SHA1 c7684180c9c80caa655743773c767e34ab92343a
SHA512 23256179f00f4c14f7addc049b524403c5157af5f8576a6a2bae83524b6486511ac8e8fd6b820b027df5d970a2c31d396904d6fbfc0cf328134c77f54998dac2
SSDEEP 49152:lax6PB5bOrzAvyk2kOESmVvyiH05QqAAgPyhdTS/kMFqnm6MLKClS0E/nvb92kQM:o6Z50ziFtZBS1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 880KB
SHA256 ba20962f4e17a34b6808465f1ce71c43ad42ebba25bb18c5ffab606908236f84
MD5 4e726cdc60361abca9f92eb748ee6649
SHA1 bb438948685824d23aec57e583b263056733eb94
SHA512 ce55b0dfeb76172a2a99db1fb6a8664ca9337ce50207f3af133f3c79ae075d36ab8501c6342b0bd9d713c0d1aa63490ec059f8a02dc536aee6aa52dab8379700
SSDEEP 3072:T5A9y+d0SabpppPpSyR7fZfXpyz/4xtIxPtVgeL/yqc6+8UKUXuesTxRpLhbk8kk:TP9SaLxNpyz/4xtWpqseWRnb7/74e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 1.0MB
SHA256 39ebd0c6a75fa1e8f62c63af21aabd376d714bc060e2c3c9de6fd42a0a310990
MD5 01950c99832a8d3047782ea725e68f6d
SHA1 baec3e6e13786652ceca9dc3d575bfcf34f240d5
SHA512 123f1a277a98c377e3c8c42d163def59b09104a3830dd9326e85da64a5268574d396417238d70b3621eee79e2735e4fc3befe93764ee514c6c67a0fa3fe64552
SSDEEP 3072:T5A9y+d0SabpppPpSyR7fZfXpyz/4xtIxPtVgeL/yqc6+8UKUXuesTxRpLhbk8ke:TP9SaLxNpyz/4xtWpqseWRnb7/74kty8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 573KB
SHA256 fa7a098fd71198e7bd2446b49d69a034249af03df4b214c38b0b45acd825372f
MD5 729f973a698ae0623f9123348dd50de4
SHA1 408520ccf789042c10724d670684edda52846b24
SHA512 61e652804e62fbb53375a634be5cdf873fd7c719958edd85616156e45b7bd463b792f9570b90a30f93d934fd797359e8738b41afe86fb3f593fec8e419e0f9fa
SSDEEP 3072:T5A9y+d0SabpppPpSyR7fZfXpyz/4xtIxPtVgeL/yqc6+8UKUXuesTxRpLhbk8kT:TP9SaLxNpyz/4xtWpqseWRnb7/74V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 382KB
SHA256 f9d8e786c28a47e37d915f5aa9810ee55a1bac2d70b3bba9679e99cc0ff7e5f8
MD5 ade8ac79a4a51bceff5df2f023c8a200
SHA1 1cac09426fcf248b816d682501e015e2cc84f305
SHA512 6dc806dea3f469cfe8831b47ad338346da07c9ce7576d4d348468730a4c8e54ec0d129214168dc536d14e6e71ca151dfd042e627366a9a2ed5c69975f3a4844c
SSDEEP 3072:T5A9y+d0SabpppPpSyR7fZfXpyz/4xtIxPtVgeL/yqc6+8UKUXuesTxRpLhbk8kC:TP9SaLxNpyz/4xtWpqseWRnb7/740
MD5 SHA1 SHA512 SSDEEP

Submit Download

Solar Tweaks.exe

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\Solar Tweaks.exe
Size 145KB
SHA256 ce76661b761a2f1f6f3f124140d5fe5be2ad59db3d9e46345790295567be29bd
MD5 f18a010b1c06a323c51e4742085b6d56
SHA1 4dcaaab9e6b8552566cce25226a8e58d8268160c
SHA512 735899ce24a4114c289d3aba2dac76fcd794f2e8610eca7f740b726fca23b21dbd588e3b8bf25141018701b339f45729e46ab135764e2e57fe49a2ff58301b04
SSDEEP 1536:T5A9y+d0SL6sJkoP6cxopppPpSHLlzcR7fI0GcbfXpynzRySGThrX7x7QHESx4Rv:T5A9y+d0SabpppPpSyR7fZfXpyz/4xtV
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\chrome_100_percent.pak
Size 138KB
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
SSDEEP 3072:igKzw9bpyZFM5fgm32Z8Gb0+VRLf0ld0GY3cQ3F2DExm/KLQ2I:nKzw9ozA4m3m8Gb0OV8ld0GecQ3mExhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\chrome_200_percent.pak
Size 202KB
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
SSDEEP 6144:TDQYaF+9b7zA4m0k5GMRejnbdZnVE6Yopym74:gfs7T6edhVELo374
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\d3dcompiler_47.dll
Size 163KB
SHA256 b51466fdd074768c41df96b6fc9894c537c815a938aa58e4b7e4ed38cea3c877
MD5 12b02ad9b432ad257d1a88c88c3eed5a
SHA1 9623a406f7fce8fef5821c7fcc37bbfbc836c1a5
SHA512 4d23ed11d1a935a7e2ee9a29aadf6a2bca332ab8ee3ed040beaf9d2ca391b6bd33b97442ebcdb119f799cf5e8073aafdf3197bcf71459f139fff2cd25d3a4dd4
SSDEEP 3072:zVphjYWtvPLIdYhC49kgyWuf5CvuhtNHvp:ZEOPLEYA49kJWuRKc/Hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 2.6MB
SHA256 39293258d5a2418841edb5ccf9ab3ad23064fb95e1ddfa7a3c6295a24c272a08
MD5 7c3c780de9ae5cc4abeccbd7cb6b367b
SHA1 bda27b3c0b1ec023e2a0a97099a84b10e04cb135
SHA512 80a79f827c3154461158ec6f466db0c2ecd9ce9ffd7728001644d4cf382721d09c0758f98f73d7fa548e4e220ffd2b8842303d67a43e79b9146e8b882853658c
SSDEEP 49152:8MnbcrH9v7eCZPxX+qzohT99hDoapghnshy43yBcxnyKbZtjB0HVEMGJSj/8NOv:dCZpX+q27saesDSjbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 699KB
SHA256 d3ecf7f0483bfbdd354d461c09fc5bdea4d3bab883f1e76fb5e9c8f6a6d4554e
MD5 ab3abd08bbb5bc5ea3c1df8da2ca2de5
SHA1 6629ad7d8cc703b12c274075608317a090a4680c
SHA512 7a2b07ca17d022e718f6d0259dc75e4007790d5e6aa0b919d314e336e49c7bccc9ecf6f5fd74efa6d234badf68336478651ffbfbf3f450f35611a583948808d6
SSDEEP 12288:cmDnKEQx3ROGU8MUn3/brwnysFPcBs+xsY9v77NUCdZ5W6jcH4sNajj8yXo:I3ROGU8MUn3/bMnbcrH9v7eCisjjxXo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 692KB
SHA256 f570ec100650972e7e52126a68149dac38be9a7de031314e67ef134a0b29c23b
MD5 0438901579874f3a8a91c12c2e991470
SHA1 4337f4115429fa7e38ca1b6699bc802505af4c11
SHA512 76f276a0f556d36d5f1d66aa236588f76ee59ed641ecc94bd464153902cc7a9433a020ba6ede3e89e92e56e177e393ae3a390c370c8655a2387e92ff20341376
SSDEEP 12288:cmDnKEQx3ROGU8MUn3/brwnysFPcBs+xsY9v77NUCdZ5W6jcH4sNajj8yXU:I3ROGU8MUn3/bMnbcrH9v7eCisjjxXU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 639KB
SHA256 a990c378ae966f65c225af906b8d0b7383d7580500d16a72b03af320d140e825
MD5 57290ec7b914629c652fda8b0a8a2d00
SHA1 396e7bcd169d9ecfe5a45bfa41879e52e2f17c7e
SHA512 fff767e068253ec7927cac481ffb69b1f341cc97d2f45c894a10b7205bb8c39719e1a970526505a14a665ca53fb1531606d216cb48ef4a41574e1acc965d0e14
SSDEEP 12288:cmDnKEQx3ROGU8MUn3/brwnysFPcBs+xsY9v77NUCdZ5W6jcH4sNv:I3ROGU8MUn3/bMnbcrH9v7eCiF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 401KB
SHA256 e0912d37c4bff275a21bbfb8a49dcdbca8b674acf1959a99c136b53e3bb10d9f
MD5 fc14c8d79d557b583904e8ded69ed2f7
SHA1 a08d2fea9191e30cbbe482dcc6841d3b5462b992
SHA512 74fe67723c02c9de4b113d418fb2455144fb9a8e97a09076dece355699a1a3af53674aa8793354129a8e9bcc80439aa580f79b8e3f8ed0f236dade59e6e1f8e0
SSDEEP 12288:cmDnKEQx3ROGU8MUn3/brwnysFPcBs+x7:I3ROGU8MUn3/bMnbcr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\ffmpeg.dll
Size 101KB
SHA256 d54b7ca7cbb93608cee0364a5243897f12a6e9367a90200ee38bc97b41850b61
MD5 ec90adce562db0d1cff52deb5292de91
SHA1 b6ae67c8eec8ddab7adc5fb5121cf88b3ab42de7
SHA512 ce862d039005208bb7eb088771e4a7703070c74eacf7c6afb019974c721e72cecab6bc54c85ad2ef6c271747194849705948b01fbb9c4c11089230a0173cb3cf
SSDEEP 1536:0N6l6ViRDOsnTIXpXQkJ2JMaAnjOfDnKhi8nPF5nokep:0N6l6VOnTYADonjOfDnKhiyznokw
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\icudtl.dat
Size 47KB
SHA256 61542c29246ddd801bed42f0aed6e5636cd59a323a2b75db356bf5519ae7b0fc
MD5 e0dd8a09df03b5e395c90b7f2f6ce603
SHA1 162f26d9b8350b1a58a2ba022afd4657bdce50ef
SHA512 8cdc8132181e5e1f3ca16f9d5b4d9577d27aaa303a334441bd4d69f8bc9d89eb153d39dd00f2ba86f1ff8165116f4a0219210f538e4a825cb639d8bd53e3afb6
SSDEEP 384:iiZXwzz4P2ugWLQrHu3N4qVYvhcCIdhf99tC0po9m1desVOrPR6fRcfVo12KB5sh:7izEP2u8uHKNatvREsorPR2RO9zgmsg9
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\libEGL.dll
Size 237KB
SHA256 32b1508b069e956d875753c89ca96f637a47c5c02f36f34d5a7b61f3907ffc3a
MD5 d01ddef64e6f2d46f0b7b2cb1dd66556
SHA1 db228d0cb1d470cd745faa1d0bdcad363d608295
SHA512 f6772bb6ee7fc8a028aa5ff7a49573585e1ede68b693254ad092f2e8f11d5ee34d9a64b0fbcfd273b2962ab53cc0a7061819bbda8eb8797c1420b6350771f94d
SSDEEP 3072:6Zsf+Cgx8ksqjnVUdu1mHbFZeaMXneyrslXvlRECYRrRk9o+3RvcoZ9ZXK3wpTgl:67Udu1o3YnElXvzYhRk9o+3Re3wpo
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\libGLESv2.dll
Size 47KB
SHA256 4662a1a9b98e9573ef9aae54a01dfd4d255977aa9ff64a440ccbc0b9924b5a10
MD5 4523dd132fd743397f75764a039abcc9
SHA1 325fbc9a0ae799bcd858de236b902f738a90abba
SHA512 db448a91662040b4eecbde0ba4fba66a46876f33ea079b61c0a61a5e91e9cb875178406d37791fa0ec66af7e6fb27a12080472704ea3fd352ca02bb08ea734b2
SSDEEP 768:Kiog78/Z+nIBYeT6oDnu7ICeuJHENDSQujA4q0G1+sAYIYuqT8fm3kNBhGv+vpyv:PdyNyiNb0fH5LSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\libegl.dll
Size 192KB
SHA256 5f81dac27c5d62d3946aa3438e4dd7f423e5547fffd548cdb2aee27ac535ae99
MD5 62977b75e1642d7b1cda9743736e7549
SHA1 5bf297aa9c69507fa7b05d91be4b1060d80bcf20
SHA512 e078a26f0f86f8e439e73e64c8459cb9a488b2fdd03c1d081461a9695d786e0fb764bcbaf0936d8a6ad8c21ed0b69b742b3b9667ad1aafbad8fba05946401ac1
SSDEEP 3072:6Zsf+Cgx8ksqjnVUdu1mHbFZeaMXneyrslXvlRECYRrRk9o+3RvO:67Udu1o3YnElXvzYhRk9o+3RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\libglesv2.dll
Size 240KB
SHA256 85cdb00c2a3917740bd0f2858b1b30cd0eebf5328126877ac6f0473d37e1bd6c
MD5 6cd88098bdba220cdbbbd7a20d452e6a
SHA1 49dcf6065783bb5f8c8287f8b5e3e784e9728747
SHA512 8cbfb98dd28753c9fdc5a45a8a99e59ece1f0525a0c6a99b3120a58c82b6f5dd0937ed90de8af7086eb5fcf6ca51fc1a6661cc0973a7b8f2e8d3368ffad76d56
SSDEEP 3072:PdwhNimx4ZgLekM5Cj5EZeaEK0piOhOLIWJ9w:Aimx4ZB52Oead0piJJW
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\locales\en-US.pak
Size 88KB
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
SSDEEP 1536:lnI8PwZKfs9B0fYSED0TI4RVQ2trM8M5Xx5dBxgZSO0JedMVrBHhBeVfD3ggl+CA:LEKE2YStRdMLBxgsvBq3ggl+CGwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\resources.pak
Size 801KB
SHA256 d0803a19d89f71c42df73a16c08d0f6fd1c747c0d8434c03ff8387ad111f1709
MD5 67ca7d89d849bc597a09ba57d2864410
SHA1 de71aa182c96ab6cf0d4c202826b9282a720a731
SHA512 55ffe0d5d6c9499f3b048f7c008cace0356976830385a22025d6b349451b0df111de5b6f566ee6df3788063f83f29db1ed78b8b3f307b5536e1d2d9124ec97b7
SSDEEP 24576:ZY4TNGOL9cY7ACWoXSPp3a7FjYT0a/Vi7G:aMYOLcbZa7qT0eU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\resources\app.asar
Size 1.3MB
SHA256 1b016b7679e002af36b8f867eb4d61ef045c202127c5951e0e473ce7e512e113
MD5 37b8f867abc61fcec75a87ac9a309f7a
SHA1 be10fc5f47c3800e8f39d425c96f654d860b3f71
SHA512 5bcd25c663f3a37087c9fd4f490403d474f81b7b71fb077502ceb4926c1c4def4c0ca1c60434a94a3b2079e7dade44ca327764edb3436e93151d1989f6de638a
SSDEEP 12288:R68v4yR0SrE3NAqNP5+Dw3GA0x53/jOc/awLBroYK3+cGoRR/dbl:R7ASrE3NAqNPWWGA0vCc5Bro/ujoRDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\solartweaks\v8_context_snapshot.bin
Size 17KB
SHA256 23af09a467d3443f207f97b2995d08512f13280b0dd1defdee51eb891c8950d5
MD5 48fbef339b0bf1a75a8ca92222dd6e7b
SHA1 620a701062e4c20a7cf76a06112e51b2890a60e5
SHA512 9735645c046eab311da0c144f6041bfbb82ab7892be7a6aa07160f55ac2a424bc0280e49caf7906a8d0e11ba12274af4780606e3d29f4c10410a6eadd52c38d1
SSDEEP 384:Ik868lQl7ni4RV685STdWt0f4Hb6kKoz1zDzWH/3A:95JiQeT4t/Gk5VPo/w
MD5 SHA1 SHA512 SSDEEP

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv645.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
MD5 SHA1 SHA512 SSDEEP

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv645.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv645.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv645.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv645.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv645.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\solartweaks\Network Persistent State
Size 1KB
SHA256 40658c9db2d23d70650768a72ec937f3a0e0e7c52284cd63ec236bf39ecb0db4
MD5 da0824dba4d634e8d824a54b4cd3312a
SHA1 908838fb991c027ee94c369d6d1e724681f05a5b
SHA512 e9576e9eda42465b887369327d1c29058fbd82f9ceba4f3efb619d2de38ab431b06da0b3b842fe6c2324d676b49c4f98b4e218e56f294b7e8c68110b849263e5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\solartweaks\Network Persistent State
Size 1KB
SHA256 babdb8f9ec1f20d7422a3da1fa174fe977b9d5dcd991ca33a90b39dea043c39d
MD5 4b1837848233e9f5ffc24d68a0312d79
SHA1 38fa9a7ab05a0b0c4ada8b9fe2904380635abb68
SHA512 9bd15de3275c891e96d213c29583a3ff7a605cce88ae9c2819e92b028b8cc66997a28155625c8b078a25a9c71c1b2d0ada209ce0502937a5c1e78ce7798839e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe597313.TMP

Path C:\Users\Admin\AppData\Roaming\solartweaks\Network Persistent State~RFe597313.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\solartweaks\TransportSecurity
Size 874B
SHA256 c0a81212bd1c06bef3d60bdb7aad7ed4e07a1117faef18649f9eacf50afb1e26
MD5 ed2d73297a3170ea16b1d07af943b225
SHA1 7ffd309a828eda31bbc9f5b57d1e8fa3d0f3474b
SHA512 a268ceafab12473be52c528ecab6691768f87884195460a517dfabac214f30fd6d85435e8bed17050b05754b39c6d246dc1689e1dcea30d44b2d79bb7d47d5ce
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe600285.TMP

Path C:\Users\Admin\AppData\Roaming\solartweaks\TransportSecurity~RFe600285.TMP
Size 874B
SHA256 34c903ec182177b03cd2e2a4f5cdeb103d2d775538b4f567847a65083c7949b8
MD5 cb61bea1b5595dda86fa5a1e1dd95d80
SHA1 cdda98ed791895e69b9eaf02a6ff50d53cef0670
SHA512 e827ba83105047a9baee590385e7eba9ae1f1a7e7e2d9b3aa2284ce1f9460d02b43721dc350399296baa3c903ae5ba36c3b6708477a4999900eca44b86933a05
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\solartweaks\settings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\solartweaks\settings.json
Size 30B
SHA256 16f55fe4c00cc23b10100e5b0d9000de1c7780be111b75cfbefd11ac30b88be1
MD5 74538e1a59f12ed943d2d1268a54f83d
SHA1 4ba608191ff4a515a98261e615219a84db384376
SHA512 e5d73e20e80bc63fc9ecd8877553b42995e40634cfc4e39c7a9eeba9ca1f856c9dd72fcc919912b3f78e04b5bc97d4f4158a12313186e6cf6b494664dc4a7b1c
MD5 SHA1 SHA512

Submit Download

memory/2208-6632-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6639-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6703-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6702-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6700-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6622-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6623-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6624-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6621-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6625-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6627-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6628-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6626-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6629-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6630-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6701-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6633-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6699-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6697-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6636-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6634-0x00007FFBDAEF0000-0x00007FFBDAF00000-memory.dmp

Download

memory/2208-6637-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6638-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6640-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6641-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6631-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6646-0x00007FFBDAEF0000-0x00007FFBDAF00000-memory.dmp

Download

memory/2208-6696-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/2208-6635-0x00007FFC1D670000-0x00007FFC1D865000-memory.dmp

Download

memory/2208-6698-0x00007FFBDD6F0000-0x00007FFBDD700000-memory.dmp

Download

memory/3988-6615-0x00007FFC167D0000-0x00007FFC16804000-memory.dmp

Download

memory/3988-6614-0x00007FF621AC0000-0x00007FF621BB8000-memory.dmp

Download

memory/3988-6618-0x00007FFBFF6C0000-0x00007FFBFF7D2000-memory.dmp

Download

memory/3988-6617-0x00007FFBFB6C0000-0x00007FFBFC76B000-memory.dmp

Download

memory/3988-6616-0x00007FFBFFAE0000-0x00007FFBFFD94000-memory.dmp

Download

memory/4508-230-0x00007FFC1C140000-0x00007FFC1C141000-memory.dmp

Download