Overview

overview

7

Static

static

3

XTweaks Premium.rar

windows10-2004-x64

1

XTweaks Premium.rar

windows11-ltsc_2024-x64

1

XTweaks Pr...m.html

windows10-2004-x64

3

XTweaks Pr...m.html

windows11-ltsc_2024-x64

3

XTweaks Pr...um.exe

windows10-2004-x64

7

XTweaks Pr...um.exe

windows11-ltsc_2024-x64

1

XTweaks Pr...47.dll

windows10-2004-x64

1

XTweaks Pr...eg.dll

windows10-2004-x64

1

XTweaks Pr...eg.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...GL.dll

windows10-2004-x64

1

XTweaks Pr...GL.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...v2.dll

windows10-2004-x64

1

XTweaks Pr...v2.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...te.exe

windows10-2004-x64

3

XTweaks Pr...te.exe

windows11-ltsc_2024-x64

3

XTweaks Pr...er.dll

windows10-2004-x64

1

XTweaks Pr...er.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...-1.dll

windows10-2004-x64

1

XTweaks Pr...-1.dll

windows11-ltsc_2024-x64

1

Resubmissions

11/07/2026, 16:01

260711-tgblgaew2r10

11/07/2026, 15:53

260711-tbwpfset9p7

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/07/2026, 15:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XTweaks Premium/X Tweaks Premium.exe
  • Size 168.6MB
  • Sample260711-tbwpfset9p
  • SHA256 ca520d62d7cc605afe1f910f223610fd84239abd32d6be2acefb417bf5ba7d79
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
    "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
      "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1684 --field-trial-handle=1688,i,10077040619083444146,10943548938648454864,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:3200
      • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
        "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --mojo-platform-channel-handle=2144 --field-trial-handle=1688,i,10077040619083444146,10943548938648454864,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        2⤵
          PID:2740
        • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
          "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --app-path="C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2424 --field-trial-handle=1688,i,10077040619083444146,10943548938648454864,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks computer location settings
          PID:5012
        • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
          "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1152 --field-trial-handle=1688,i,10077040619083444146,10943548938648454864,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2216

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            default.dic
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
            • Size 2B
            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\Network\Network Persistent State
            • Size 855B
            • SHA256 416d593f84918e1867d2e125224b5d127366af40f33ddfee05b04f6d0eef07bd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Network Persistent State~RFe598860.TMP
            • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\Network\Network Persistent State~RFe598860.TMP
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2216-91-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-93-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-92-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-103-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-102-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-101-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-100-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-99-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-98-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/2216-97-0x000002239FE00000-0x000002239FE01000-memory.dmp
            Download

            memory/5012-68-0x00000220720F0000-0x000002207219D000-memory.dmp
            Download

            memory/5012-44-0x00007FFFEDBB0000-0x00007FFFEDBB1000-memory.dmp
            Download

            memory/5012-47-0x00007FFFECA60000-0x00007FFFECA61000-memory.dmp
            Download