829357c489c494f3290d0448e46c12be3d18d51839ce845dff8c6d27ceec3dd9

Resubmissions

17/07/2026, 14:37

260717-ry481adt7l7

17/07/2026, 14:19

260717-rm299sc12r8

Analysis

user interaction
yes
max time kernel
56s
max time network
60s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SimplyTweaksInstaller.exe
Size 60.5MB
Sample260717-rm299sc12r
SHA256 829357c489c494f3290d0448e46c12be3d18d51839ce845dff8c6d27ceec3dd9
MD5 32ce30ec3a06fff6f94ebeeef3be4ec5
SHA1 5fce553336f636fa1a7505944e31237f3e1c97ba
SHA512 b4c1b4c2a050a22a146311f1a32642abf77d729b0fa26eaac576bdb04df3dbbc41dd700d7feaeebcd1d1fe59430d4674559d6ad508807f389520ae7b0a48fa5d
SSDEEP 1572864:QUAgd40XeRQWwzJz7+Nl7xTahKTUbsedlV:QU56LE5K/LTUbseHV
TLSH
T123D73333B19A703AE12E55356B76A214843BA6716D279E19D2F004ADCF261F23F3F706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4892	SimplyTweaksInstaller.tmp
296	simply_tweaks.exe
1436	simply_tweaks.sys

Loads dropped DLL 5 IoCs

pid	Process
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	simply_tweaks.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimplyTweaksInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SimplyTweaksInstaller.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2576-1-0x0000000000530000-0x000000000060B000-memory.dmp	innosetup
behavioral2/memory/2576-10-0x0000000000530000-0x000000000060B000-memory.dmp	innosetup
behavioral2/memory/2576-47-0x0000000000530000-0x000000000060B000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimplyTweaksFile.myp	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimplyTweaksFile.myp\shell	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	SimplyTweaksInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\SimplyTweaksFile.myp	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\SimplyTweaksFile.myp	SimplyTweaksInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimplyTweaksFile.myp\ = "Simply Tweaks File"	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimplyTweaksFile.myp\shell\open	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SimplyTweaksFile.myp\shell\open\command	SimplyTweaksInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimplyTweaksFile.myp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\simply_tweaks_free\\simply_tweaks.exe\" \"%1\""	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\SimplyTweaksFile.myp\DefaultIcon	SimplyTweaksInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SimplyTweaksFile.myp\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\simply_tweaks_free\\simply_tweaks.exe,0"	SimplyTweaksInstaller.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\SimplyTweaksFile.myp\shell\open\command	SimplyTweaksInstaller.tmp

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4892	SimplyTweaksInstaller.tmp
4892	SimplyTweaksInstaller.tmp
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe
296	simply_tweaks.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5964	msedgewebview2.exe
5964	msedgewebview2.exe
5964	msedgewebview2.exe
5964	msedgewebview2.exe
5964	msedgewebview2.exe
5964	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	296	simply_tweaks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4892	SimplyTweaksInstaller.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4892	SimplyTweaksInstaller.tmp

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4892	2576	SimplyTweaksInstaller.exe	87
PID 4892 wrote to memory of 296	4892	SimplyTweaksInstaller.tmp	89
PID 296 wrote to memory of 5964	296	simply_tweaks.exe	91
PID 5964 wrote to memory of 2612	5964	msedgewebview2.exe	92
PID 5964 wrote to memory of 3928	5964	msedgewebview2.exe	95
PID 5964 wrote to memory of 3928	5964	msedgewebview2.exe	95
PID 5964 wrote to memory of 3928	5964	msedgewebview2.exe	95
PID 5964 wrote to memory of 3928	5964	msedgewebview2.exe	95
PID 5964 wrote to memory of 1052	5964	msedgewebview2.exe	96
PID 5964 wrote to memory of 4884	5964	msedgewebview2.exe	97
PID 5964 wrote to memory of 4884	5964	msedgewebview2.exe	97
PID 5964 wrote to memory of 4884	5964	msedgewebview2.exe	97
PID 5964 wrote to memory of 4560	5964	msedgewebview2.exe	98
PID 5964 wrote to memory of 4560	5964	msedgewebview2.exe	98
PID 5964 wrote to memory of 4560	5964	msedgewebview2.exe	98
PID 5964 wrote to memory of 4560	5964	msedgewebview2.exe	98
PID 5964 wrote to memory of 4560	5964	msedgewebview2.exe	98
PID 5964 wrote to memory of 4696	5964	msedgewebview2.exe	99
PID 5964 wrote to memory of 4696	5964	msedgewebview2.exe	99
PID 5964 wrote to memory of 4696	5964	msedgewebview2.exe	99
PID 5964 wrote to memory of 4696	5964	msedgewebview2.exe	99
PID 5964 wrote to memory of 4696	5964	msedgewebview2.exe	99
PID 5964 wrote to memory of 712	5964	msedgewebview2.exe	104
PID 5964 wrote to memory of 712	5964	msedgewebview2.exe	104
PID 5964 wrote to memory of 712	5964	msedgewebview2.exe	104
PID 5964 wrote to memory of 712	5964	msedgewebview2.exe	104
PID 5964 wrote to memory of 712	5964	msedgewebview2.exe	104
PID 5964 wrote to memory of 2068	5964	msedgewebview2.exe	105
PID 5964 wrote to memory of 2068	5964	msedgewebview2.exe	105
PID 5964 wrote to memory of 2068	5964	msedgewebview2.exe	105
PID 5964 wrote to memory of 2068	5964	msedgewebview2.exe	105
PID 5964 wrote to memory of 2068	5964	msedgewebview2.exe	105
PID 5964 wrote to memory of 2524	5964	msedgewebview2.exe	107
PID 5964 wrote to memory of 2524	5964	msedgewebview2.exe	107
PID 5964 wrote to memory of 2524	5964	msedgewebview2.exe	107
PID 5964 wrote to memory of 2524	5964	msedgewebview2.exe	107
PID 5964 wrote to memory of 2524	5964	msedgewebview2.exe	107
PID 5964 wrote to memory of 1872	5964	msedgewebview2.exe	108
PID 5964 wrote to memory of 1872	5964	msedgewebview2.exe	108
PID 5964 wrote to memory of 1872	5964	msedgewebview2.exe	108
PID 5964 wrote to memory of 1872	5964	msedgewebview2.exe	108
PID 5964 wrote to memory of 1872	5964	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\SimplyTweaksInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\SimplyTweaksInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\is-QCH3WQJTVN.tmp\SimplyTweaksInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QCH3WQJTVN.tmp\SimplyTweaksInstaller.tmp" /SL5="$4009E,61971464,835584,C:\Users\Admin\AppData\Local\Temp\SimplyTweaksInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe
    "C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=296.5680.10910351792079788787 /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830
      4⤵
      Checks SCSI registry key(s)
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x12c,0x168,0x18c,0x14c,0x194,0x7ffd07445fd8,0x7ffd07445fe4,0x7ffd07445ff0
        5⤵
        
        PID:2612
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830
        5⤵
        
        PID:3928
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830
        5⤵
        
        PID:1052
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3436 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830 /prefetch:1
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3608 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830 /prefetch:1
        5⤵
        
        PID:4696
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4668 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830 /prefetch:1
        5⤵
        
        PID:712
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4852 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830 /prefetch:1
        5⤵
        
        PID:2068
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4620 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830 /prefetch:1
        5⤵
        
        PID:2524
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView" --webview-exe-name=simply_tweaks.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5480 --field-trial-handle=1728,i,14683133295657244742,9828863232368038697,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:15b326738b80892b51722712cc6ef033ea6b5830 /prefetch:1
        5⤵
        
        PID:1872

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6008

C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.sys
C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.sys
1⤵
- Executes dropped EXE
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\simply_tweaks\N3j24yPsYQ1xcIA8zkEhF0BtmHMhCbE=\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\simply_tweaks\N3j24yPsYQ1xcIA8zkEhF0BtmHMhCbE=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 67629b6aaee39328d02b11e5d85a53b35aa6cea71d4d37a671295a76c02b240e
MD5 38f9831155956106c61b9885d6113444
SHA1 8cbc1aaf60edfd4155bb4f10fdb5257d7c4b84f8
SHA512 e1e3859d83ee49bfdd0ea5b929772426d529e417c7d6d6bbdf251cc3d5ae5a2eaf055d0be62598231a444a5e54a1b0cea5eb60d4140d5e9739210c3b0d667b18
SSDEEP 24576:/hNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa5:/xKcdPHmMLYpX7T35/fPoGPpGFjztQcR
TLSH
T1FC453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\simply_tweaks\N3j24yPsYQ1xcIA8zkEhF0BtmHMhCbE=\WebView2Loader.dll
Size 155KB
SHA256 1ac87267e52ccdf5621678697f948030307a650ca56f38f69e74c7cfaf9605c6
MD5 9235a2ae9fbb00d0fe57b0f107eeafa0
SHA1 d99d568ea4c1182da7de0160965e812bed049a40
SHA512 0773609ef3bc844a1dea0bbeecbb08ef61cb76d50313b4e9a205c526f7ee551b188fb8d8acf08350bef9620707d7b988e7f57bb6009aee0db0615cbd44d283d1
SSDEEP 3072:k7+r33Gx3Xe/uy0A4BBnkDC49KMNU9eATmuEtJjvv8WD+a:kwnGV4p4BnkDCEKtEtJwm
TLSH
T17BF35C57B3E9006BE07BC278C5A34A55E772B8115B509AEF03A4477A1F237D0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\simply_tweaks\N3j24yPsYQ1xcIA8zkEhF0BtmHMhCbE=\vcruntime140_cor3.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\simply_tweaks\N3j24yPsYQ1xcIA8zkEhF0BtmHMhCbE=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 1c1c5d5ae7530615585b77a8b15588ed51ea66da9a75fceeea7f772970edc01f
MD5 f344857a45f59103361fd5a5edbdb670
SHA1 34ce32a1182377e612673add6d2644b9bd723d94
SHA512 553baf174e8d0b5e8ef4d837a4c16a974b1b52693c3920baa4edc6177a4fc1a05a27923f78d8c3d84f4b7dcfe86b8f50a4ab942045f8afa6087b122b07e64898
SSDEEP 24576:Dek+C9iX4izlWkFLgcUxwdHaKzhWjl9sIovgbAvJh5A2RwK2Ebie2K9dUghF0+J:4PoKlWkF3CwpaPl1oYbA35A252EbNDxJ
TLSH
T15495494AB6EC40E9C47AD23CDADB461BF63174152761A7CF23A0479D6F27BD00A7A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimplyTweaksInstaller.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QCH3WQJTVN.tmp\SimplyTweaksInstaller.tmp
Size 4.7MB
SHA256 fdc9bc777e3690e2d6fe72099550e5039beb801f88c28977431d9d5406585efa
MD5 74a1cea62d1d8bf467e17c50abfef42c
SHA1 3d746343f3ece1cd92bd56200943e6183a98303b
SHA512 821d787b762fd318b4ebce36fff579a4ff7246cc53bf5c78b82944b30c05cb24c2eb0fd933f38ddb376b32b0989b5f8300d529951c4cb5f809d7c1c0b37dd8c2
SSDEEP 98304:8xl4wfBBe16TErt7DgWEoQOic87G/m+333Gf:E4wfP2j78Wxef
TLSH
T10C368E13B384653AE4AB1A3A587BA64C583F7A703A168C477BF40D4C4F396417D3AB87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9f42afc655d86afb5d570356b5ac7f97c281315be008587787dbf6cf91bf0ec6
MD5 1720f03477afdbc5f39da90307640f4a
SHA1 752c6842e486e46f5809504f2cf35ea6c9ee84cc
SHA512 64ed43de9164ff988adc617ef9cd9acfd9143bd131aa1601697983bdef32da3e044f60063fa131a5bd9abc9d2bd300a3e9a700e1810fb41923f975315e6f9b5b
TLSH
T175D02B23F218877DE810B5730141F1381F01B30F20465026E83C862C5A1C4D70B81CB1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0998f0c94f79de8b734ebd9fd511231f42836afbdfc2c48405a197cd80ad75a9
MD5 458372540fe239afc34fbf40ce83a556
SHA1 165bed5fda3eb8efef934ced3c89d46ce42652c7
SHA512 489d995ed8c4c1fb7037d55e81168301f0af20f1b2b7f29e416991cd5fb922011b286f888c63a7c8675d45cd3b7e9578159299dac9a9f0964c352cbd1177ce20
TLSH
T148D00430D50CD570FC00D7335014D11047105510105535115534001405544010101534
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 620b2535baf078c6cc364e693535dac4a02d073a951de7c66cd0fdab9fe066ac
MD5 4b6330a25a7bf01553d33ab36e7673bd
SHA1 9d420ce6fae6ddb7606cd0461018e5d67ef0866e
SHA512 e91f8a0e83d723de3ef1029b1a737371d50f2db72c369df3281572c1ad4aef55b86398e495629f2014a97d132f2044cab7d8fea91e9de6dc2ed9e5796a4d0729
TLSH
T158D0122276098674D81066331002B1080A00D21B40495001A83C852D1B184500A02861
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001
Size 66KB
SHA256 8d4ee2ad120ee1cc2073a77471866e80ee403216a2e268f7f307959106e430ee
MD5 f9fdae30fa66546bef55455243362f81
SHA1 3bbe1b410125b7c254d3e7d69b721bec96300ccd
SHA512 17ce2bbb637a5a658a0299ba4f39c0f4d836c178adf63b4d1c6830eb4d632c87e696c8b4b3a088c9b390ccee42800cdaef33ad82346b46a92bc38908fcef004a
SSDEEP 1536:CLwl0w25NZUijO5yQbiHecFf+IBjRAX1bHVf73aai:CssHZU2Qm+jiArVf7qai
TLSH
T1406302327E9756AA3C2B186319397C46895037DF4EA0F4BF8941D98643D84F078F2BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000002
Size 159KB
SHA256 a3c08144e62f514b292fde7d819dab09928597f87d10d6fdbab00f741673a0bd
MD5 eb67f98b1500eff64febab215369edba
SHA1 6dda8e759238eef766be522cecdf176fff5ab49b
SHA512 f05072d7e6d1992ca04e88d500477261e545cfc44b98008e1027c7ed6be662b7b2f090091dcff52ce2ab31ac7a5ce3453a4c4088a9549dc01bf066b2f4c5359a
SSDEEP 3072:IwEQd11DHF4rUewpH/0YdsmB6Ydz4PZibsattC3zejSmZ2vzgcIwc3rZKmfv:IHQjdHKUxHhs3Yp4PZYsatEOIzgcTc7r
TLSH
T1E8F30139F7D3E3951B23291C687CFE33976588E861C5145B02A74ECA4D89FB0A507A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000003
Size 202KB
SHA256 bc50cc43a31771d1505f37c0009581a994d7dcb4deb365298bd9933473653b50
MD5 e0f3a1a2e058f82784a73e170ca6180f
SHA1 fdd641e7400ecf4845c53119bab69af884ec995b
SHA512 0f2d151291dab6417ec99dbffad74fb45c50566a8d6d577225b6335c58334080bcd83ddeda59f1068bd9ea857b578eccddc1690037ccf730c99e46c5dae4ce43
SSDEEP 3072:CQlEdhBUiG5q+RoKQSw7AWgz8bD8t4EXKHDaAwLOd/+tyefkJfvwj/xD4D:XChii7+RoNdFbDgk2VadW9fkdU/l8
TLSH
T1701423D013D6D56313B2B40B1DAF01F3B9126854B25A7BBCA606BC16E82787C343C6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000004
Size 175KB
SHA256 5113eb079017f143319dac89fd73500579a88e4a93f00d744f40f6b699641218
MD5 31e8c97a0eedf71a29449b2bc6190b5d
SHA1 3652455f93717e2440c92be0fa68196783913844
SHA512 2cace1ad75e88ab46b44b44dd99e79aaaa8728badfa1070c67045e328c03bcdc9c573f8825b4f3e9e441bdfb06aeacd8111eebf27283f107bec3d147aeec5ced
SSDEEP 3072:nS9m9A3EqVjj0SsHp5X7cWmqoZPISRTLqa5qM35dbhl2cq5eIm8cAtZp9N2E/dDd:nWlLnveX71uZbwOqml2cA1cypbAR6kW9
TLSH
T1A204137A4130DCE466E775CFB25E4882562435B82BEC1502B3C809E7F678ACD37B56B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000005
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000006
Size 42KB
SHA256 366b4a6a0c20a841e738e4f937fdbf8602558539af2615811139e5fa6d557886
MD5 362ddde587e70aafc1eb6751f3374fc3
SHA1 3d1445b91ab6e5d08834dfd26ee23659fc14aa64
SHA512 5d4bea93c01704ac225f6fe5130fee14134a3ae9051f74004779a190bd8c7f202a0784e2a04cbb6aacc299a0a2be6215786034ec994741838e045745f5066a54
SSDEEP 768:TnxEY5wqv7oTyTKy+IAIdW503isKrz77a58lwYL72R0ayTn2CMZyQO44v:TxEYiqDoTGK5IA503lcra58SY2mayTnT
TLSH
T13C13F1615617536CD847091BC96622C91E44299E82DE2C6D703F2CFB32DD84F76AFB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 a2ff0774082dfb4bb9672fec62e8b2e350cf6cf69f4419b55856d8c7dd4c30a4
MD5 17ee1916d1028120b8182ebf769a2411
SHA1 583160061ea3537f7749525dab9abfc184cbba50
SHA512 4016daccd3a0612a59edcda569bd71e8538a27324bf598abe390c02f01b6f8050b829ddc737b472b840b988a1384e9dd34545a952dec91dacdf67a05b3259308
TLSH
T1E9C02B44192032C1F700027001F1E1807020FD204022DA52C46080145C12AD0851248C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5853.TMP

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a5853.TMP
Size 48B
SHA256 f65b0cc3114b13ef88d862ce28d9ecef0a4ad3ddb78c68689e58b16d8614aacf
MD5 0ed0102ae3f093370d7b8e435c33b757
SHA1 29bb06f67407bf2fcaaa4b81919df03e79c5373c
SHA512 7ff1f6eac5948956cb9394841515555b5c218320f88d0eb2feb3d7c194409cffe25f04e4d0ce2faf55b5731fb727664f6c3da4a33c6ba8f6fd0f7e3d07035631
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 3KB
SHA256 6db7d531d59ec8ae685a9ef1335114bd0b3bac0ef2b9f16d49674235243e69c8
MD5 8a7ffd00acd36c99cc9298a5e053449f
SHA1 fbae3afcd0eec7f12e7a4a126244665bcf5dee86
SHA512 5c05a316b11dcbcb5d6776541235a69ebb0e3193c0c38ebe83a7fe2ebf4fb04992f7d32247321e10c377498181cd48d7bfa9d58758300c734141f1db4e7e92fd
TLSH
T1B7617DE6C2F486AED95211F82A38391BCE1E191543283E5DC8D9BF9BA7F14F1D20164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a58d0.TMP

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a58d0.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 860B
SHA256 a1857a5835078ca9ed1d3325b531590ad7b8a3d1cf16c5954a00f71290852abb
MD5 e927eac1fca23c893636e6c3c14eb014
SHA1 cf5cca1e03fdf0d34ab62c3ea626b628dd1e1475
SHA512 64f633d2dbeb38b8b366a66f83e1f0c9b955f61a7f722194ad8538cd54ebb2ee1fddd92f0444c1975cb8c8e406456e104c5ae1596b4bd13894f14e89d86f10b9
TLSH
T15C114C979BFEA46720792A7A1C48B8115B36F0340291FCF9DB96906DB0819F74612036
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 692B
SHA256 57d5e90ada413000380847276ceee6ec0a25f7c6ffaabd97a5163b85bd951d8e
MD5 0696b70e4a440d69f444ffb0d450410f
SHA1 4ac98c7b0b7ac6121436db8614546543fd20f6e1
SHA512 7a7fc06c13fec287ccda2b6b09495699820a8cae2daeacefd48ec727aa0fdef4a4995a2fca654e3bf166009a251c821ef34e3b0f32ac67798ab7109db42f676c
TLSH
T137017B979BFEA47720B919BA1C48B8115B36F03402A1FCF9CB97906DB0819F74A22033
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a51ab.TMP

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Network\TransportSecurity~RFe5a51ab.TMP
Size 860B
SHA256 9b50c17bbafb3c414442c7e50da83d77e091c6b782d729ca2216eae54da95575
MD5 9ad2c0b56060de34b2a9fd6fa889f5a2
SHA1 3388f6b3e89ac3ab094def38a4936239fd3e594f
SHA512 dbedc24479fc04a94bf02d260b697f2efb5ce0e9c1262cf20b91fca0ec38810d8f4b917ac93ef72d3d6e1207fb00ba085f34730615d3e2276c113aa5c69b1f2b
TLSH
T10011885797FEA4B720782A7A1C49B9119B35B03402A0ECF4CB9A902CF081DF74A12037
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 8edfc230e0c3dd79d4348e5b739434d03c39d062cef7e8e5144a3b6d4455898d
MD5 f60d6ed7d0c58678ee8cdadc79af9dc4
SHA1 f7c01203cd4a49bcf19b219ffc23955c721e0395
SHA512 6f6ebc3cff7a58bfc1895e527e69d7706cec551580e0fcd87076f022c6b3e32394fafb8a91dc691b33b7102848cdae8ae45c3d2a751d3ccaf2c26d351b112a19
SSDEEP 96:sth/dhsiy66b9nkio5h16ZYl2zs7/x+6Mhmuec4B7iOi/l7+OdjeuK+gtK428XMz:stVg0Qfoll2zsV+FEBGXla2jSJG6K
TLSH
T11ED1B5036E28797B0CCBE108BE29BA57E2F55432A5D51E4DEBF84A0C08DB5DC2207D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 fb02b23944c2124edbb0ca9980440eacabc746ebebdd80a6bddc146e9ae2a246
MD5 be46233f2164fd52a5ff7733b5de4477
SHA1 cebe639394bab602c28c2ea2ac06b81fd6d4bb2e
SHA512 f139fce6e72fe4f0116c7b1dc335a1f1f2dd05e7158b454054f91978a7040e6cab0bcd58508d1ef54c649f197eb4dec1a6242ec6bd3b5f10ac57425d9a6e0230
SSDEEP 96:sth/dhsiy66b9nkq/o5h16ZYl2zs7/x+6Mhmuec4B7iOi/l7+OdjeuK+gtKHI8XE:stVg0QRoll2zsV+FEBGXla2jS8g6K
TLSH
T1EDD1A6036E28797B0CCBE108BE29BA57D2F55432A5D51E4DEBF84A1C08DB6DC6207917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a510f.TMP

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Preferences~RFe5a510f.TMP
Size 6KB
SHA256 1f1386e1d70b3d566ee9da194604180031988abcf8b7ff601006f4a272163306
MD5 cd699fad24b1596016ded0f0e9e0c7ec
SHA1 f680ac625fce7e3ba8a27c5765362689340e1f8b
SHA512 56ac41a5ec7db7845535a0ae6b5678976628b0670db1f9db5817484a201508cad05c3046beb726420083383b35bd1dd23bad5d5e7edf47525aa79d9e4f467ee1
SSDEEP 96:rh/dsoiy66b9nkMdo616ZYlJUs7/x+6Mhmuec427Z1H/p7a1ejeuK+gtt28XM1CO:rVD0QRoelJUsV+FE2dxpeQjSFG6K
TLSH
T159D1D7036A287A7B0CC7E108BE29BA57D2F55472A2D11E4CE7F98A1C08DB5DC220BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 232e260dd97d1f1de02b784ecc3b346c4cee507f852691d2224bac59f25413b7
MD5 bdc01845402aa898a0bb05d1ac83b7a0
SHA1 4899926ac21c8455078c250f8994beae714ce790
SHA512 281d3fbe2dd02e291eac94670bffd55f4cf52fc144c7052f2d26a782dd6ac57a142cdcc1524f309295577e9cca6b8605cbd5b87fe68ee3090b83faf9bd7eb9ae
TLSH
T13581847B69B4AA374AB3C604BC463F57AB604037A9857F99DAEC0F0C01C76881356D23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 536084aadebeb17eb3c0efe1a4f8fcfa9dc88747293b97aaa733c76826818b91
MD5 28bc98d1df8aee6654cd2ec080ad39d6
SHA1 e4835728272556b5e018563f7b58a1c116db7691
SHA512 d19d78b85e9952963aceefac4fce1f9a870dc724cc8e3d53531a4b6626e02eefb4f7f55d85a8806d12f9f4910173bd8f11cb590ce99595eaa886dfe638b06e33
TLSH
T1765182B36994AB7B96B386457D467FA3DE3441A6AB416F54EBEC0B0801CB54C231BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 d43090b3909e1a25c71496ddf93d28a6fbabff2b9599e244b827e09be600cf65
MD5 eb498fd1ed83d418ed8ad3a7bc38a78a
SHA1 043a642b9a8359c452f7cc925d73d7ba3b50eddb
SHA512 d3f22785538b319c8bba94764eee313df6ef73d06010d2c7c07e91beda785b3dd97ffcdca52f470e5a9a367c95d0165ff6d4d69f655a527323120ded602604e4
TLSH
T10471997B59A4A97749B386057C863F57EB604037E6857F99D6EC0F0C01C72881357D23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Local State
Size 15KB
SHA256 df8149dc68354845159e8bcbe3f803b4cb5535e3613d0d51f555faa0080daf78
MD5 1ba0b34f887d3df1820ac7782e509fa8
SHA1 4742cab1d59960482267a661182a7d9108cb32b1
SHA512 31bbf6638dc66323de9c171a6c175d59e3acc6b7b7b4767a41228eea470b78f6ffb5288a41db822a9ea42352611c3a60f6cc0740ac17ed02829faeb6fe20b20d
SSDEEP 384:KHsrv+89zHqlDNP9oid6NBS0ItHdGOlbzNU:vrv+4UNbdJ97bzNU
TLSH
T15F72AF73A57CB63769F38504F88B6A177F7850A756C20BA4E5980F8D06DE0C92317E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59fa64.TMP

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe.WebView2\EBWebView\Local State~RFe59fa64.TMP
Size 1KB
SHA256 be036e4cd8b23c4225e1d3337f025bd396e4695d3f18752f935d7f06802adc5f
MD5 e63024ec388fffb668c658bbf31130f9
SHA1 96554be2bd2a828b891906bc09c4c73640be97c3
SHA512 5052a7ade4ec31a636b87a2e2750e50391b0bfc9160bb26cf8c3c44b43203afc9abbdd939c245b6ee981c6ed21825c8f996be01b87166dda85f35ef832ab97d2
TLSH
T1923157F795E46B76686352463942BEE7AE2050BF53408F44A7EC4B0806DB44DA23FD33
MD5 SHA1 SHA512 TLSH

Submit Download

simply_tweaks.sys

Path C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
TLSH
T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1436-231-0x0000000000010000-0x0000000000017000-memory.dmp

Download

memory/2576-1-0x0000000000530000-0x000000000060B000-memory.dmp

Download

memory/2576-10-0x0000000000530000-0x000000000060B000-memory.dmp

Download

memory/2576-47-0x0000000000530000-0x000000000060B000-memory.dmp

Download

memory/3928-76-0x00007FFD2A460000-0x00007FFD2A461000-memory.dmp

Download

memory/3928-244-0x0000029416D40000-0x0000029416ED9000-memory.dmp

Download

memory/4560-154-0x00007FFD2A460000-0x00007FFD2A461000-memory.dmp

Download

memory/4892-6-0x0000000001B50000-0x0000000001B51000-memory.dmp

Download

memory/4892-12-0x0000000001B50000-0x0000000001B51000-memory.dmp

Download

memory/4892-11-0x0000000000530000-0x0000000000A12000-memory.dmp

Download

memory/4892-46-0x0000000000530000-0x0000000000A12000-memory.dmp

Download