Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 18:12

General

  • Target
    Unishade-Setup-0.6.2.exe
  • Size 3.3MB
  • Sample261011-wtlnbabx71
  • SHA256 deb86fa83c092e6e4a963c43cb36109e8622b46b0a32c7009e7abf1d194ba632
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Modifies Control Panel 1 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-0.6.2.exe
    "C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-0.6.2.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\ReShade-Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\ReShade-Setup.exe" --headless --api dxgi "C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\reshade\Unishade.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2008

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ReShade-Setup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\ReShade-Setup.exe
        • Size 4.1MB
        • SHA256 afe4c8f13048306307983b8b3d41d5bf00a86820440b0e57dea10950e1176445
        • MD5 SHA1 SHA512 SSDEEP TLSH

        addon-downloads.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\addon-downloads.ini
        • Size 620B
        • SHA256 9cb1435e5aef96ca79b101f85c3c4cea09027fa9c8007d2d2aa89a7dd9331155
        • MD5 SHA1 SHA512 TLSH

        addon-downloads.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\addon-downloads.ini
        • Size 396B
        • SHA256 55a6465396ce0692fc0eb32611d81f6a3d18e5bc9e58f383b84976236c3c0eb8
        • MD5 SHA1 SHA512 TLSH

        EffectPackages.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\files\EffectPackages.ini
        • Size 24KB
        • SHA256 97ab336719d25359abd1ae693d12742296d6f1bccc1e18113f3b5703c9d0e414
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Unishade.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\files\Unishade.exe
        • Size 1.2MB
        • SHA256 1712a3c63bd293f8657e8f27b66573be8dcb69b2818418330741fb300d121247
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GenericPreset1.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\files\presets\GenericPreset1.ini
        • Size 1KB
        • SHA256 cc8899f300270e391adc6106c06673d0e2012cb78f8baadf42e45fb62b2a6b56
        • MD5 SHA1 SHA512 TLSH

        GenericPreset2.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\files\presets\GenericPreset2.ini
        • Size 1KB
        • SHA256 608218ab87a2ca5643caabd45c538310be0a5205ec052d37c88cbeb4acecbf6a
        • MD5 SHA1 SHA512 TLSH

        StageDepthmap.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\CorgiFX-master\Textures\StageDepthmap.png
        • Size 9KB
        • SHA256 dd27edc7d9bfe4bdc1c237bfafa10e738432abaf4832a9d65c6b9418f079aa0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fognoise.jpg

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\CorgiFX-master\Textures\fognoise.jpg
        • Size 48KB
        • SHA256 0a2cc46fc10922428a49e988afc4c58aef4549b147dc64d7ced1212eee98482e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ArcaneBloom_Dirt.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\FXShaders-master\Textures\ArcaneBloom_Dirt.png
        • Size 716KB
        • SHA256 97a1ea1d13d328fbed460391fe7f5b5a7b06215be0e301d0864de6b361b4288e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_bxdf.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_bxdf.fxh
        • Size 8KB
        • SHA256 2052c6268c5647f67ab5a04d1147fbd0fe15bb9f597a644cc72a06c65df88e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_camera.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_camera.fxh
        • Size 2KB
        • SHA256 d59bec69f2aa19f93cc4972fc67da257b94db69675bf730bb1d0ed4c6c029566
        • MD5 SHA1 SHA512 TLSH

        mmx_colorspaces.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_colorspaces.fxh
        • Size 5KB
        • SHA256 c5a6ddf47a3896b9c439c440ba3dfe145864d896d89cd78d60d653165b04201e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_debug.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_debug.fxh
        • Size 2KB
        • SHA256 1425c64bef0ba76875636c6aec17f1ce877b434f6ed354cf24b6da72107c4001
        • MD5 SHA1 SHA512 TLSH

        mmx_deferred.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_deferred.fxh
        • Size 3KB
        • SHA256 34efa062ffb5819ae89855e18060872ab8c50e8c13cf32127e1d49a4b62057e5
        • MD5 SHA1 SHA512 TLSH

        mmx_depth.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_depth.fxh
        • Size 4KB
        • SHA256 14d747980ff5d0e7197be4e1196361eb51716fd813684ead0fefac23d7ec3dca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_fft.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_fft.fxh
        • Size 8KB
        • SHA256 98cd9d4254ce7fe1da856e649804d672bf009e448f0b87f18aeba5fd596da9a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_global.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_global.fxh
        • Size 11KB
        • SHA256 ecbff2770f0c3aa72442c4f42512c23a23c14759794c71c2f5787f24688f9d30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_harmonics.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_harmonics.fxh
        • Size 2KB
        • SHA256 f5c7490c8d5bc85adab0fd368dfa857089e766d554273175d91f31d6ae841729
        • MD5 SHA1 SHA512 TLSH

        mmx_hash.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_hash.fxh
        • Size 2KB
        • SHA256 4c1bf89bb3881434aeffca4e7afa03355bf7e461e7438569fda5af9c45e8237d
        • MD5 SHA1 SHA512 TLSH

        mmx_input.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_input.fxh
        • Size 2KB
        • SHA256 4564cd9ba6dd12d4ee24f03291d05ae3477c6e5b21ad64e3a948560c8644dbef
        • MD5 SHA1 SHA512 TLSH

        mmx_math.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_math.fxh
        • Size 11KB
        • SHA256 775014fcb7e37a1c60311c817ee3fc517346e19721cd131b3d3f644f755ef034
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_qmc.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_qmc.fxh
        • Size 6KB
        • SHA256 58dac456c2ed37f3f79b58432fc71769b2c8a2ca637671998597cbb2131f362b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmx_sfc.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_sfc.fxh
        • Size 3KB
        • SHA256 3ac268e3581a5057fdb45d40ae63a9190174da06e3d3e9c8c50acc86b4a2c46f
        • MD5 SHA1 SHA512 TLSH

        mmx_texture.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\METEOR-main\Shaders\MartysMods\mmx_texture.fxh
        • Size 5KB
        • SHA256 b263d2d9c1c97d642547036cf1a0cd6d80c2230c8709f4582aff017fb2f73248
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NTSC_RetroArch.fx

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\RSRetroArch-main\Shaders\NTSC_RetroArch.fx
        • Size 10KB
        • SHA256 119ffc60fc43cd315583d848c0925ffb8257eb5d5167cf3ec663b94d7ffdd12a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lilium__font_atlas.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\ReShade_HDR_shaders-master\Textures\lilium__font_atlas.png
        • Size 14KB
        • SHA256 11a711a8167d1c1606892e6fa6f661a477e749d6cbdb1ff700ac381842066ec3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1_catmullrom_9tap_dx0p000_dy0p000.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\Reshade-Shades-main\misc\output\resample_vis\1\1_catmullrom_9tap_dx0p000_dy0p000.png
        • Size 13KB
        • SHA256 fb2faf0e0d9699c4ede0ca34a7217f053505892dd14c9e46dcf6be24a4233c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2_catmullrom_9tap_dx0p000_dy0p000.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\Reshade-Shades-main\misc\output\resample_vis\2\2_catmullrom_9tap_dx0p000_dy0p000.png
        • Size 9KB
        • SHA256 d617d4fffd3ec24e598783e17669950055eca89d774e6a245b7ef36c64069897
        • MD5 SHA1 SHA512 SSDEEP TLSH

        3_catmullrom_9tap_dx0p000_dy0p000.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\Reshade-Shades-main\misc\output\resample_vis\3\3_catmullrom_9tap_dx0p000_dy0p000.png
        • Size 14KB
        • SHA256 8dccc569f27c1ee312106b3b62aa93540e66ce8bf52a81a4c4e236ff19cd75b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TriDither.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\SHADERDECK-main\Shaders\SHADERDECK\Include\Functions\TriDither.fxh
        • Size 3KB
        • SHA256 d6f780996889c0ea2efebde26b515c4acc1ad4310e06affc3d5d42e2f325c42d
        • MD5 SHA1 SHA512 TLSH

        CustomNegative.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\SHADERDECK-main\Textures\SHADERDECK\LUTs\CustomNegative.png
        • Size 4KB
        • SHA256 b35e64f34accdd0053c1166ef0c241e362f7421d043d1926787eaccc5543b9ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ui_box12_mask.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\UniqFX-main\Textures\UniqFX\ui_box12_mask.png
        • Size 67B
        • SHA256 a4d4c009619311d9b83904acfd62fe3b7f918c312522bbcc6ad51cdec4fd1edf
        • MD5 SHA1 SHA512 TLSH

        pd80_gaussnoise.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\prod80-ReShade-Repository-master\Textures\pd80_gaussnoise.png
        • Size 650KB
        • SHA256 70f200a55be9f83829b26a1420470c53c595c959bdfff6e501dcdf433e4f6ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        neutral_lut.png

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\reshade-shaders-master\Textures\neutral_lut.png
        • Size 273B
        • SHA256 c81d61b0c7caa5cb8ff77b10183f2a00ffc5b4601ef328f7b9368e625fa9a214
        • MD5 SHA1 SHA512 TLSH

        FXAA.fxh

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\package\reshade-vrtoolkit-main\Shaders\FXAA.fxh
        • Size 83KB
        • SHA256 26435f77adef392fd751ed6a648a05d375c57ac88d00bbad19653c75ac9c36fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        preset-downloads.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\preset-downloads.ini
        • Size 187B
        • SHA256 0a9c9ededec4a587ee261d27462b1ec070f005c18f2cfe311e983075121dcf07
        • MD5 SHA1 SHA512 TLSH

        ReShade.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\reshade\ReShade.ini
        • Size 401B
        • SHA256 bf9f15e6891b6bf8f2fa067d6e770a0eca0b6f452bf504220ddf1f4a048b70ed
        • MD5 SHA1 SHA512 TLSH

        ReShade.log

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\reshade\ReShade.log
        • Size 982B
        • SHA256 a649ccd07dc38931801de04c3523da3f22cc021232095938d59df693cae77670
        • MD5 SHA1 SHA512 TLSH

        dxgi.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Unishade-Setup-7361459465ed7177d2721bec4911f0de\reshade\dxgi.dll
        • Size 5.3MB
        • SHA256 0cee63f9c9f13f3ac909c5b4903f4dbb4b719a7ab3b4f13b0deaf83c814b94f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2008-37-0x0000028341AD0000-0x0000028341ADA000-memory.dmp

        memory/2008-36-0x0000028341AB0000-0x0000028341AC2000-memory.dmp

        memory/2008-34-0x0000028326AF0000-0x0000028326AFE000-memory.dmp

        memory/2008-33-0x0000028328330000-0x000002832836E000-memory.dmp

        memory/2008-32-0x0000028326AE0000-0x0000028326AE8000-memory.dmp

        memory/2008-31-0x0000028326570000-0x000002832659A000-memory.dmp