Overview

overview

7

Static

static

3

XTweaks Premium.rar

windows10-2004-x64

1

XTweaks Premium.rar

windows11-ltsc_2024-x64

1

XTweaks Pr...m.html

windows10-2004-x64

3

XTweaks Pr...m.html

windows11-ltsc_2024-x64

3

XTweaks Pr...um.exe

windows10-2004-x64

7

XTweaks Pr...um.exe

windows11-ltsc_2024-x64

1

XTweaks Pr...47.dll

windows10-2004-x64

1

XTweaks Pr...eg.dll

windows10-2004-x64

1

XTweaks Pr...eg.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...GL.dll

windows10-2004-x64

1

XTweaks Pr...GL.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...v2.dll

windows10-2004-x64

1

XTweaks Pr...v2.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...te.exe

windows10-2004-x64

3

XTweaks Pr...te.exe

windows11-ltsc_2024-x64

3

XTweaks Pr...er.dll

windows10-2004-x64

1

XTweaks Pr...er.dll

windows11-ltsc_2024-x64

1

XTweaks Pr...-1.dll

windows10-2004-x64

1

XTweaks Pr...-1.dll

windows11-ltsc_2024-x64

1

Resubmissions

11/07/2026, 16:01

260711-tgblgaew2r10

11/07/2026, 15:53

260711-tbwpfset9p7

Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 15:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XTweaks Premium/X Tweaks Premium.exe
  • Size 168.6MB
  • Sample260711-tbwpfset9p
  • SHA256 ca520d62d7cc605afe1f910f223610fd84239abd32d6be2acefb417bf5ba7d79
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
    "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
      "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1652 --field-trial-handle=1656,i,10198966105952568028,7258960122934718712,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:1860
      • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
        "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --mojo-platform-channel-handle=2348 --field-trial-handle=1656,i,10198966105952568028,7258960122934718712,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        2⤵
          PID:1668
        • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
          "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --app-path="C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2408 --field-trial-handle=1656,i,10198966105952568028,7258960122934718712,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
            PID:1152
          • C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe
            "C:\Users\Admin\AppData\Local\Temp\XTweaks Premium\X Tweaks Premium.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\x-tweaks-premium" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2640 --field-trial-handle=1656,i,10198966105952568028,7258960122934718712,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2932

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
              • Path C:\Users\Admin\AppData\Local\D3DSCache\cff0ca358d4eb568\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
              • Size 64KB
              • SHA256 6b2e3ce2f06ed9759c8994c0e37a27d2b9e07979df864387225e9b54dc8a33b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
              • Path C:\Users\Admin\AppData\Local\D3DSCache\cff0ca358d4eb568\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
              • Size 4B
              • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
              • MD5 SHA1 SHA512
              Submit Download

              F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
              • Path C:\Users\Admin\AppData\Local\D3DSCache\cff0ca358d4eb568\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
              • Size 1KB
              • SHA256 3bf8e795ec3d60300a2c603cf0f0d6eded27915ae742e7fc02b83d5e635cc047
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              default.exc
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
              • Size 2B
              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
              • MD5 SHA1 SHA512
              Submit Download

              data_0
              • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\DawnCache\data_0
              • Size 8KB
              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_1
              • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\DawnCache\data_1
              • Size 264KB
              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_2
              • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\DawnCache\data_2
              • Size 8KB
              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              data_3
              • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\DawnCache\data_3
              • Size 8KB
              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Network Persistent State
              • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\Network\Network Persistent State
              • Size 855B
              • SHA256 9d44cef42fced29cca128072b001c2d53200b5fa73de29cbcde3f8b96c227160
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Network Persistent State~RFe5a98f5.TMP
              • Path C:\Users\Admin\AppData\Roaming\x-tweaks-premium\Network\Network Persistent State~RFe5a98f5.TMP
              • Size 59B
              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1152-82-0x0000020D234D0000-0x0000020D234FF000-memory.dmp
              Download

              memory/1152-34-0x00007FF8D9840000-0x00007FF8D9841000-memory.dmp
              Download

              memory/1152-35-0x00007FF8D9AD0000-0x00007FF8D9AD1000-memory.dmp
              Download

              memory/2932-103-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download

              memory/2932-114-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download

              memory/2932-113-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download

              memory/2932-112-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download

              memory/2932-110-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download

              memory/2932-109-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download

              memory/2932-111-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download

              memory/2932-105-0x000001E66BB80000-0x000001E66BB81000-memory.dmp
              Download