ShareEnum.exe

  • File Path: C:\SysinternalsSuite\ShareEnum.exe

Hashes

Type Hash
MD5 03CA4E59B10AFF8F2257DCFAF13CD309
SHA1 59940526E8D8E305177F530427A093408B86E29A
SHA256 0F9DD9BF5B25C879CB5A4D8C7E436FDD95736665F3CEED3FD33E78455287378D
SHA384 20EA1076422D7107E30458A07D5E38D7D4D05557E881E8736EF13378573D0FB3E9E932E07A4CBA711A3B20FD48860A91
SHA512 19007877BF065A51571FE1CC10BE5C338CD4E86511118FBF7F5316962388B5B1D45EE1226478B4C54940A7E59D2A60F02A8E279C34283E4429554D54838129F7
SSDEEP 3072:MoIMqinw5xma9hlW4QpocZGwkvVHEXUkAtGQNmtyQk84:MoIMq1ma9DW4QVZGnvGQN2kP
IMP 8C990359C655B89FE20EF4FB7B5B756C
PESHA1 814FC1BFB095D24CFC105FB718E4A696C3C27C7A
PE256 D32DE4DFEA31003956366DF4CE010D845C491C0F8A7BBE0E7D295F905647E306

Runtime Data

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\mpr.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\user32.dll.mui File
(RW-) C:\Windows File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.488_none_89e6152f0b32762e File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627 File
(RW-) C:\xCyclopedia File
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\1\Windows\Theme2036293991 Section
\Windows\Theme1324212991 Section

Loaded Modules:

Path
C:\SysinternalsSuite\ShareEnum.exe
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll

Signature

  • Status: Signature verified.
  • Serial: 61469ECB000400000065
  • Thumbprint: 564E01066387F26C912010D06BD78D3CF1E845AB
  • Issuer: CN=Microsoft Code Signing PCA, OU=Copyright (c) 2000 Microsoft Corp., O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename:
  • Product Name:
  • Company Name:
  • File Version:
  • Product Version:
  • Language:
  • Legal Copyright:
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/67
  • VirusTotal Link: https://www.virustotal.com/gui/file/0f9dd9bf5b25c879cb5a4d8c7e436fdd95736665f3ceed3fd33e78455287378d/detection/

Possible Misuse

The following table contains possible examples of ShareEnum.exe being misused. While ShareEnum.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_false_sysinternalsuite.yml - '\ShareEnum.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.