7c09991f92458e5eef9c6e50b1329d845b5c2e978e7fde3c04dd88c6180a7f63

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShadeFN.exe
Size 13.1MB
Sample260812-1wkagseq9w
SHA256 7c09991f92458e5eef9c6e50b1329d845b5c2e978e7fde3c04dd88c6180a7f63
MD5 e9a12672a2f985ca236dc40e2b03634d
SHA1 baa2b0d86b244cb1e893007e2b2008467934570a
SHA512 30aeb1ca76bb4422eaf3427b9a52f7bba32d9c864ef08b8efb85bd0e7ced16113324aefa14e56088d1820d43e405560115de20d3c6093f9f18d1c835503bb3f1
SSDEEP 98304:NCC2snF5RaVOmm3DZQsUVKDpSzYRERrDLHrGy2kdnfBssQ2kZy0KInDChqxD0:NUWxTFUwD6YyRrDLCy2YnZ/aZfJDCh
TLSH
T1A5D69D03EDA559E9C1AED23489B29213BB717C480B3267D72B60B6386F73BC46D79350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ShadeFN.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4348	tasklist.exe
3600	tasklist.exe
5468	tasklist.exe
3420	tasklist.exe
1736	tasklist.exe
5640	tasklist.exe
4284	tasklist.exe
3252	tasklist.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1059483243\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_424964065\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1198946271\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1720066069\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1720066069\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1198946271\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1059483243\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_424964065\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_424964065\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1198946271\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1720066069\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1720066069\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1720066069\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1059483243\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_424964065\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1198946271\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3812_1198946271\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1856	wmic.exe
1856	wmic.exe
1856	wmic.exe
1856	wmic.exe
3964	wmic.exe
3964	wmic.exe
3964	wmic.exe
3964	wmic.exe
3796	wmic.exe
3796	wmic.exe
3796	wmic.exe
3796	wmic.exe
1516	wmic.exe
1516	wmic.exe
1516	wmic.exe
1516	wmic.exe
4556	wmic.exe
4556	wmic.exe
4556	wmic.exe
4556	wmic.exe
5000	wmic.exe
5000	wmic.exe
5000	wmic.exe
5000	wmic.exe
5288	wmic.exe
5288	wmic.exe
5288	wmic.exe
5288	wmic.exe
3352	msedgewebview2.exe
3352	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3812	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1856	wmic.exe
Token: SeSecurityPrivilege	1856	wmic.exe
Token: SeTakeOwnershipPrivilege	1856	wmic.exe
Token: SeLoadDriverPrivilege	1856	wmic.exe
Token: SeSystemProfilePrivilege	1856	wmic.exe
Token: SeSystemtimePrivilege	1856	wmic.exe
Token: SeProfSingleProcessPrivilege	1856	wmic.exe
Token: SeIncBasePriorityPrivilege	1856	wmic.exe
Token: SeCreatePagefilePrivilege	1856	wmic.exe
Token: SeBackupPrivilege	1856	wmic.exe
Token: SeRestorePrivilege	1856	wmic.exe
Token: SeShutdownPrivilege	1856	wmic.exe
Token: SeDebugPrivilege	1856	wmic.exe
Token: SeSystemEnvironmentPrivilege	1856	wmic.exe
Token: SeRemoteShutdownPrivilege	1856	wmic.exe
Token: SeUndockPrivilege	1856	wmic.exe
Token: SeManageVolumePrivilege	1856	wmic.exe
Token: 33	1856	wmic.exe
Token: 34	1856	wmic.exe
Token: 35	1856	wmic.exe
Token: 36	1856	wmic.exe
Token: SeIncreaseQuotaPrivilege	1856	wmic.exe
Token: SeSecurityPrivilege	1856	wmic.exe
Token: SeTakeOwnershipPrivilege	1856	wmic.exe
Token: SeLoadDriverPrivilege	1856	wmic.exe
Token: SeSystemProfilePrivilege	1856	wmic.exe
Token: SeSystemtimePrivilege	1856	wmic.exe
Token: SeProfSingleProcessPrivilege	1856	wmic.exe
Token: SeIncBasePriorityPrivilege	1856	wmic.exe
Token: SeCreatePagefilePrivilege	1856	wmic.exe
Token: SeBackupPrivilege	1856	wmic.exe
Token: SeRestorePrivilege	1856	wmic.exe
Token: SeShutdownPrivilege	1856	wmic.exe
Token: SeDebugPrivilege	1856	wmic.exe
Token: SeSystemEnvironmentPrivilege	1856	wmic.exe
Token: SeRemoteShutdownPrivilege	1856	wmic.exe
Token: SeUndockPrivilege	1856	wmic.exe
Token: SeManageVolumePrivilege	1856	wmic.exe
Token: 33	1856	wmic.exe
Token: 34	1856	wmic.exe
Token: 35	1856	wmic.exe
Token: 36	1856	wmic.exe
Token: SeIncreaseQuotaPrivilege	3964	wmic.exe
Token: SeSecurityPrivilege	3964	wmic.exe
Token: SeTakeOwnershipPrivilege	3964	wmic.exe
Token: SeLoadDriverPrivilege	3964	wmic.exe
Token: SeSystemProfilePrivilege	3964	wmic.exe
Token: SeSystemtimePrivilege	3964	wmic.exe
Token: SeProfSingleProcessPrivilege	3964	wmic.exe
Token: SeIncBasePriorityPrivilege	3964	wmic.exe
Token: SeCreatePagefilePrivilege	3964	wmic.exe
Token: SeBackupPrivilege	3964	wmic.exe
Token: SeRestorePrivilege	3964	wmic.exe
Token: SeShutdownPrivilege	3964	wmic.exe
Token: SeDebugPrivilege	3964	wmic.exe
Token: SeSystemEnvironmentPrivilege	3964	wmic.exe
Token: SeRemoteShutdownPrivilege	3964	wmic.exe
Token: SeUndockPrivilege	3964	wmic.exe
Token: SeManageVolumePrivilege	3964	wmic.exe
Token: 33	3964	wmic.exe
Token: 34	3964	wmic.exe
Token: 35	3964	wmic.exe
Token: 36	3964	wmic.exe
Token: SeIncreaseQuotaPrivilege	3964	wmic.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1856	4896	ShadeFN.exe	90
PID 4896 wrote to memory of 3964	4896	ShadeFN.exe	93
PID 4896 wrote to memory of 3796	4896	ShadeFN.exe	95
PID 4896 wrote to memory of 1516	4896	ShadeFN.exe	97
PID 4896 wrote to memory of 4556	4896	ShadeFN.exe	99
PID 4896 wrote to memory of 5000	4896	ShadeFN.exe	101
PID 4896 wrote to memory of 3600	4896	ShadeFN.exe	103
PID 4896 wrote to memory of 5468	4896	ShadeFN.exe	105
PID 4896 wrote to memory of 3420	4896	ShadeFN.exe	107
PID 4896 wrote to memory of 1736	4896	ShadeFN.exe	109
PID 4896 wrote to memory of 5640	4896	ShadeFN.exe	111
PID 4896 wrote to memory of 4284	4896	ShadeFN.exe	113
PID 4896 wrote to memory of 3252	4896	ShadeFN.exe	115
PID 4896 wrote to memory of 4348	4896	ShadeFN.exe	117
PID 4896 wrote to memory of 5288	4896	ShadeFN.exe	119
PID 4896 wrote to memory of 3812	4896	ShadeFN.exe	121
PID 3812 wrote to memory of 1112	3812	msedgewebview2.exe	122
PID 3812 wrote to memory of 3264	3812	msedgewebview2.exe	123
PID 3812 wrote to memory of 3264	3812	msedgewebview2.exe	123
PID 3812 wrote to memory of 3264	3812	msedgewebview2.exe	123
PID 3812 wrote to memory of 3264	3812	msedgewebview2.exe	123
PID 3812 wrote to memory of 4224	3812	msedgewebview2.exe	124
PID 3812 wrote to memory of 2816	3812	msedgewebview2.exe	125
PID 3812 wrote to memory of 2816	3812	msedgewebview2.exe	125
PID 3812 wrote to memory of 2816	3812	msedgewebview2.exe	125
PID 3812 wrote to memory of 1980	3812	msedgewebview2.exe	126
PID 3812 wrote to memory of 1980	3812	msedgewebview2.exe	126
PID 3812 wrote to memory of 1980	3812	msedgewebview2.exe	126
PID 3812 wrote to memory of 1980	3812	msedgewebview2.exe	126
PID 3812 wrote to memory of 1980	3812	msedgewebview2.exe	126
PID 3812 wrote to memory of 5868	3812	msedgewebview2.exe	130
PID 3812 wrote to memory of 5868	3812	msedgewebview2.exe	130
PID 3812 wrote to memory of 5868	3812	msedgewebview2.exe	130
PID 3812 wrote to memory of 696	3812	msedgewebview2.exe	131
PID 3812 wrote to memory of 696	3812	msedgewebview2.exe	131
PID 3812 wrote to memory of 696	3812	msedgewebview2.exe	131
PID 3812 wrote to memory of 4468	3812	msedgewebview2.exe	132
PID 3812 wrote to memory of 4468	3812	msedgewebview2.exe	132
PID 3812 wrote to memory of 4468	3812	msedgewebview2.exe	132
PID 3812 wrote to memory of 3352	3812	msedgewebview2.exe	133
PID 3812 wrote to memory of 4748	3812	msedgewebview2.exe	134
PID 3812 wrote to memory of 4748	3812	msedgewebview2.exe	134
PID 3812 wrote to memory of 4748	3812	msedgewebview2.exe	134

C:\Users\Admin\AppData\Local\Temp\ShadeFN.exe
"C:\Users\Admin\AppData\Local\Temp\ShadeFN.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get ProcessorId
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get SerialNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Windows\System32\Wbem\wmic.exe
  wmic bios get SerialNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Windows\System32\Wbem\wmic.exe
  wmic baseboard get SerialNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get model
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe"
  2⤵
  - Discovers running processes
  PID:3600
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x32dbg.exe"
  2⤵
  - Discovers running processes
  PID:5468
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe"
  2⤵
  - Discovers running processes
  PID:3420
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida.exe"
  2⤵
  - Discovers running processes
  PID:1736
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq HTTPDebuggerUI.exe"
  2⤵
  - Discovers running processes
  PID:5640
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq HTTPDebuggerSvc.exe"
  2⤵
  - Discovers running processes
  PID:4284
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe"
  2⤵
  - Discovers running processes
  PID:3252
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq windbg.exe"
  2⤵
  - Discovers running processes
  PID:4348
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get model
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5288
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ShadeFN.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4896.3132.1764324894644446172 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView /prefetch:4 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd60a55fd8,0x7ffd60a55fe4,0x7ffd60a55ff0
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1904 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    PID:5868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4588 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4588 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView" --webview-exe-name=ShadeFN.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1756,i,2067994286434076786,5079140868089093864,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:932157969a85535743e76f69c83ee99bd038d80b
    3⤵
    PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9f86ecd4847a0293f258c2ed922e36866b31f6f9290c0daec07a2ce298a93d6d
MD5 3d35a894b45790148df767341d0edc93
SHA1 43cb9ac45b56eeff124e87b9f37992426f708d36
SHA512 af10d8305f0e197c4deed4d323eb75a5e53d062fbd7328d85d5ba85a89366f8a30f1b3ab037f1723b4e284aa94bd1e39b11d273a3a240e85ea7276a098140766
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 75b80ecfc6117927c9c9c6f37c26e1a9275b8b8f0ad9eeed4c17aacf1ff286c0
MD5 48cd6cf9adbad8929805329b13c989c0
SHA1 652ca040d4b575f45088f0ccf83f7559ec3b610b
SHA512 ac789d758de9daf1c018a666c3acb4be147f984018a9cbe16959ed9346dbd96b9e33eb0044e3f9d4e4b8d15b22ce8b9f048eee86016abb2e1fe5c2a5a77cd849
TLSH
T184D0121233420174C43520730202B6480800C60B4009C009D82CC51D3A1C0550D02481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

7423b56b-89f5-4b44-ba58-3ae147d1143b.tmp

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Default\7423b56b-89f5-4b44-ba58-3ae147d1143b.tmp
Size 5KB
SHA256 92f8981e6058599fbb5564a33b0fc0532c5a6f0d1c73471794723467146e438b
MD5 963e53345b44ef3ad562d058703916f1
SHA1 af9f284d0bd903b3b9dbd7916b7420f8158c965f
SHA512 596323157334ce6139f7bc5793ea9d40e76220b7a5990edaed822b0a34805d59994de6bb87ea5925469cd092bfaa654b8eaffacc9a2d5e65c5bd647628c09803
SSDEEP 96:stL/dM++rKZ1b9EkQo5h16ZZs7/x+6MhmuecmjeFK+gU28XM1C7K:stTObqUto+sV+FijD2G6K
TLSH
T1BFC195015E28787B4CC6F659BA69BA03D3F9A07234D51E58EBF8462C09EB5DD2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa191.TMP

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Default\Network\Network Persistent State~RFe5aa191.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Default\Preferences
Size 5KB
SHA256 46c2e60cdab3292a733c1b276f508ee2811dc7863295432deb0483bc9a4d8148
MD5 41916e7bd1fcc215b77cd35274a68d37
SHA1 014ce13914bc72634258c9d829a38d9a43dd946c
SHA512 74b373129f699db38827d64bc4724ed67411f2cd2ea666ab5d4f2db820a4468a79bba465addcd8a7d8f8e2f67c3f5c730aa16d169012f478ce99c62598256e4f
SSDEEP 96:stL/dM++rRGZ1b9EkQo5h16ZZs7/x+6MhmuecmjeFK+g6I28XM1C7K:stTOb4Uto+sV+FijD5G6K
TLSH
T1B6C194025E24787B4CC6F659BA69BB03D3F9A07225D11E58EBF8462C08EB5DD2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Local State
Size 3KB
SHA256 7a2a33b2820160f1e40845c347745f631e7802768ccbc4b476e2ce7ace35a724
MD5 50ee9d58695a183fb3e7ebe27944ec56
SHA1 6365d1a0563df20da3a10ba80ae775827861153e
SHA512 370db2c91d61a6b51eb95016bdaed49b88d70822fa0d2b113dd2c32cd155db57749f8fd5a40daefef85dcb3e21057755605f5999260b39070587a576ecafba05
TLSH
T1887176226975AD3B4DE2EA4678863F13A7695063D5923F95DAEC0F1C029B3CD2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Local State
Size 3KB
SHA256 97d41f833427731168d7119e6f23dd7d9aaa02ff8ed63a176cca3a61e2138a15
MD5 e74fdd0d0a27ae6ce5f78e4d6f400037
SHA1 886e0c594bdf284e825a33b137892423bfe24ea5
SHA512 dad8fe965f78fbd2f643bba3514c76034c41eba9508e70c86fef23be582af9498465f87c746b5b083019080548dd94897a163848434611fdf9e07a4d4175b2d5
TLSH
T1097176226975AD3B4DE2EA4678863F13A7695063D5923F95DAEC0F1C029B3CD2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Local State
Size 2KB
SHA256 0e8370b32950995cd5f51b067d9f6c1bb1c774d05b22a7f70d5da00304b75cc0
MD5 ca9170334532d8ea11c29e9ba2a4c499
SHA1 fe76c322dfd4152c72a4e30db68f6fc1484d5483
SHA512 8ce68d90015aca909b8284f951f87b229026d084f0f27a623e6b09461c53f3b24c9397d5d1966667690f6cb87b07a849299fc989478ae656ff3438d9cf77b3fa
TLSH
T1975197336C245E3799E26A5578877F239F3950A196531F50AADC0B1C029F68D3306C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Local State
Size 3KB
SHA256 8c46593a2a5c3f6cca2d6360e67bde2c89348a98ea060086c756a9fead352ac3
MD5 2d61ed3b2c570c5011cd206ad708443e
SHA1 aaf3358425a40765f1a70b91d8cb040ea08d4aef
SHA512 e962d724a9b2c11a46ab97cd37e3ae0ae261e963524034eb00527c373116c51999e8a9edc5fb5d7d62449722ff2ea34fb0c60cb01bbee25904f66fc8c113877f
TLSH
T1A561663369759D3B4DE2AE5578C63B1667695062D5923F95DAEC0F1C02DB3CC2342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Local State
Size 14KB
SHA256 73602c266e8490e0ea3a56c8d2139cb2f991969a0c6438a84fb271f09dcff603
MD5 384dd811eb900513641785879bfe8d7e
SHA1 e680ec3b5b88e5a633752582ab914e477ee6caf0
SHA512 2e59888aa14c88da11872d29296b8c1af8ecc6c3456ad8013bd8efcb973257477552f997e0563c571b6c8bb150bcd8f58e1ea4754a2a0dd6a998ea9b641f933d
SSDEEP 192:5DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kcNBS2GRKeoDUhgIy:J+aQikB+z/xvxjg/qhEYNBS2DJS8R9z/
TLSH
T117628E2765787D3795F2FA1539891B5BDBB9947290C26AB84AFD0F0C07873D81302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597a18.TMP

Path C:\Users\Admin\AppData\Roaming\ShadeFN.exe\EBWebView\Local State~RFe597a18.TMP
Size 1KB
SHA256 c0b0228900077267041106875a60e834c8294226e6f08b7e11006f9514961e2b
MD5 16449c27835ef059431fc9322fb561b0
SHA1 d4d5680588b70dafcd48286dbcb71dfef79da4c5
SHA512 7a55ffe9b18db2944070c57f457aea15c73d711bb8ed3c99c6ea15b2103ef760753094311dea86ba3223e1f7810f994d482903c5020ed0c894cb0d67a0b86cd6
TLSH
T173213573E9755F37BCC16A9731937E271F2410A642524E4076DD0B2C13AA28DBA6FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1980-113-0x00007FFD82E20000-0x00007FFD82E21000-memory.dmp

Download

memory/3264-37-0x00007FFD82E20000-0x00007FFD82E21000-memory.dmp

Download

memory/3352-310-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/3352-300-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/3352-302-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/3352-306-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/3352-308-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/3352-307-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/3352-309-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/3352-311-0x00000211A5830000-0x00000211A5831000-memory.dmp

Download

memory/4896-2-0x0000024368E20000-0x0000024368E48000-memory.dmp

Download

memory/5868-228-0x00007FFD82700000-0x00007FFD82701000-memory.dmp

Download

memory/5868-229-0x00007FFD81B00000-0x00007FFD81B01000-memory.dmp

Download