File name:

Roshade.Setup.3.3.1.exe

Full analysis: https://app.any.run/tasks/6d2a74da-337d-47a0-9c67-511ac2bee87e
Verdict: Malicious activity
Analysis date: April 29, 2025, 14:08:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 3 sections
MD5:

FE51CDAC1D70CC17A57CAE25C164BF47

SHA1:

814144CB9DF1C25942321FF04BB9B64BA55FC5FC

SHA256:

83FD3EB8248B4A41AB7BCBBE193D93E57BC0034D20259C6E21DC6A427CFE0DCD

SSDEEP:

98304:wSUoEyUQRr+SLX5fuK5QBEcMXiqvC7CjpLgMFX7e1V0fZAICcB5E3d66cIKwZ/0e:wn1QVFX5fZqBEcqvC2jTx76V0BACY3db

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 2908)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Roshade.Setup.3.3.1.exe (PID: 5608)
      • MicrosoftEdgeUpdate.exe (PID: 2908)
      • wv.exe (PID: 5668)
      • MicrosoftEdge_X64_135.0.3179.98.exe (PID: 5048)

    • Executable content was dropped or overwritten

      • Roshade.Setup.3.3.1.exe (PID: 5608)
      • MicrosoftEdgeUpdate.exe (PID: 2908)
      • MicrosoftEdge_X64_135.0.3179.98.exe (PID: 5048)
      • wv.exe (PID: 5668)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 2908)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7508)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7720)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7616)
      • MicrosoftEdgeUpdate.exe (PID: 7456)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 2908)

    • Starts a Microsoft application from unusual location

      • wv.exe (PID: 5668)

    • Application launched itself

      • setup.exe (PID: 7728)

  • INFO

    • Reads the computer name

      • Roshade.Setup.3.3.1.exe (PID: 5608)
      • MicrosoftEdgeUpdate.exe (PID: 2908)
      • MicrosoftEdgeUpdate.exe (PID: 7456)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7508)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7616)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7720)
      • MicrosoftEdgeUpdate.exe (PID: 7876)
      • MicrosoftEdgeUpdate.exe (PID: 8028)
      • MicrosoftEdgeUpdate.exe (PID: 8068)
      • setup.exe (PID: 7728)

    • The sample compiled with english language support

      • Roshade.Setup.3.3.1.exe (PID: 5608)
      • wv.exe (PID: 5668)
      • MicrosoftEdgeUpdate.exe (PID: 2908)
      • MicrosoftEdge_X64_135.0.3179.98.exe (PID: 5048)

    • Checks supported languages

      • Roshade.Setup.3.3.1.exe (PID: 5608)
      • wv.exe (PID: 5668)
      • MicrosoftEdgeUpdate.exe (PID: 2908)
      • MicrosoftEdgeUpdate.exe (PID: 7456)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7616)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7508)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7720)
      • MicrosoftEdgeUpdate.exe (PID: 7876)
      • MicrosoftEdgeUpdate.exe (PID: 8028)
      • MicrosoftEdgeUpdate.exe (PID: 8068)
      • setup.exe (PID: 7728)
      • setup.exe (PID: 644)

    • Manual execution by a user

      • chrome.exe (PID: 6724)

    • Application launched itself

      • chrome.exe (PID: 6724)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 7876)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 2908)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 7876)
      • MicrosoftEdgeUpdate.exe (PID: 8068)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 7876)
      • MicrosoftEdgeUpdate.exe (PID: 8068)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 8068)
      • MicrosoftEdge_X64_135.0.3179.98.exe (PID: 5048)
      • setup.exe (PID: 644)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 8068)

    • Create files in a temporary directory

      • wv.exe (PID: 5668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:04:22 10:23:43+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.31
CodeSize: 5988352
InitializedDataSize: 8192
UninitializedDataSize: 7053312
EntryPoint: 0xc70170
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.3.1.0
ProductVersionNumber: 3.3.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
ProductName: setup
FileVersion: 3.3.1
ProductVersion: 3.3.1
FileDescription: setup
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
32
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start roshade.setup.3.3.1.exe wv.exe sppextcomobj.exe no specs slui.exe no specs chrome.exe chrome.exe no specs microsoftedgeupdate.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs chrome.exe no specs chrome.exe no specs microsoftedgeupdatecomregistershell64.exe no specs chrome.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs microsoftedge_x64_135.0.3179.98.exe setup.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{D194B51B-FD62-4F79-A1F5-AA7635B107A4}\EDGEMITMP_0F709.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=135.0.7049.115 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{D194B51B-FD62-4F79-A1F5-AA7635B107A4}\EDGEMITMP_0F709.tmp\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=135.0.3179.98 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2a0,0x2d0,0x7ff713b67608,0x7ff713b67614,0x7ff713b67620C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{D194B51B-FD62-4F79-A1F5-AA7635B107A4}\EDGEMITMP_0F709.tmp\setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Version:
135.0.3179.98
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{d194b51b-fd62-4f79-a1f5-aa7635b107a4}\edgemitmp_0f709.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\bcryptprimitives.dll
2384C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2908C:\Users\admin\AppData\Local\Temp\EUC565.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EUC565.tmp\MicrosoftEdgeUpdate.exe
wv.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\euc565.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4040"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1912,i,16556532848869780940,8570919988484655556,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4932 --field-trial-handle=1912,i,16556532848869780940,8570919988484655556,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4408"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=1912,i,16556532848869780940,8570919988484655556,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5048"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{D194B51B-FD62-4F79-A1F5-AA7635B107A4}\MicrosoftEdge_X64_135.0.3179.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --user-levelC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{D194B51B-FD62-4F79-A1F5-AA7635B107A4}\MicrosoftEdge_X64_135.0.3179.98.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Version:
135.0.3179.98
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{d194b51b-fd62-4f79-a1f5-aa7635b107a4}\microsoftedge_x64_135.0.3179.98.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5344"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1d0,0x22c,0x7ffc88b5dc40,0x7ffc88b5dc4c,0x7ffc88b5dc58C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5608"C:\Users\admin\AppData\Local\Temp\Roshade.Setup.3.3.1.exe" C:\Users\admin\AppData\Local\Temp\Roshade.Setup.3.3.1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
setup
Version:
3.3.1
Modules
Images
c:\users\admin\appdata\local\temp\roshade.setup.3.3.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5668"C:\Users\admin\AppData\Local\Temp\wv.exe"C:\Users\admin\AppData\Local\Temp\wv.exe
Roshade.Setup.3.3.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.195.49
Modules
Images
c:\users\admin\appdata\local\temp\wv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
10 513
Read events
9 059
Write events
1 406
Delete events
48

Modification events

(PID) Process:(6724) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6724) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6724) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6724) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6724) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2908) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(2908) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(2908) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(2908) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.49
(PID) Process:(2908) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
Executable files
203
Suspicious files
57
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:A6D59861272EE24F43DDE137AB82B116
SHA256:146DC78518FDACB266295EE49CDB48E898D74B7F23B5C08D006D64577CDD6C6D
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\msedgeupdate.dllexecutable
MD5:34366289614548C60837E31DA6477A6E
SHA256:6EE3E95AA78DBD5B3F469F670072574AFA16EA00EE2A7077472BF0405F572635
5608Roshade.Setup.3.3.1.exeC:\Users\admin\AppData\Local\Temp\wv.exeexecutable
MD5:FA04ED70DC9743693C0B62776547BBF4
SHA256:0A7FF586F6F5A830729949F301A444E4C565898463EBA1C7E907B3FE6EFC5267
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:B2CA6C419F03D1AF9B283E8E696504DC
SHA256:1AD04F1EF3A5C1DC31EFE1F08FAF6ABD35C0721E10D11DE31823DDBF5882E0D4
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\psmachine_64.dllexecutable
MD5:1F2C831EEA682084A8D08408A9A004C4
SHA256:70991CB93309773CED85BE9FF4D687957A207FBD04F695A13273704DED1FB15B
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\msedgeupdateres_am.dllexecutable
MD5:E5633DC22831C95059BFBE02620786EB
SHA256:4F10A5729472EB54263693B954457CD038036527D42E13CF990C384E6DB4CA48
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:3183363DEE370C1ADB75B36D381C37DB
SHA256:228BB625B37700C215E3B23C7E7DEEDE8931B32646CEBB80E3CFBFE9BE945EDB
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\msedgeupdateres_ar.dllexecutable
MD5:F026BD3E7246ACD7DC8BEEE93F559D73
SHA256:C3EF91C84129ED36479BB479B13B6DF338ECCA53A9DFD4EC7710BE146C97F17A
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\psmachine.dllexecutable
MD5:F10322ED75B0567C0A69DBF1163F9503
SHA256:9DB888B286DC32656B936D5E1438D39D46DA82212826F36C29DD99FCB0419803
5668wv.exeC:\Users\admin\AppData\Local\Temp\EUC565.tmp\NOTICE.TXTtext
MD5:6DD5BF0743F2366A0BDD37E302783BCD
SHA256:91D3FC490565DED7621FF5198960E501B6DB857D5DD45AF2FE7C3ECD141145F5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
38
DNS requests
38
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
756
lsass.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8140
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bef3bb0b-b1c2-4068-a2cd-1eae1dd922b4?P1=1746540540&P2=404&P3=2&P4=R8Ukh2GtJeqrxc56n4HoUbKEJofno3V%2fX5w%2fcZGwpSlnL1nlHLRYpNjW2StEr7sonulYxApXOiTBpkEdOnZudQ%3d%3d
unknown
—
—
whitelisted
7852
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7852
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8140
svchost.exe
GET
200
199.232.210.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bef3bb0b-b1c2-4068-a2cd-1eae1dd922b4?P1=1746540540&P2=404&P3=2&P4=R8Ukh2GtJeqrxc56n4HoUbKEJofno3V%2fX5w%2fcZGwpSlnL1nlHLRYpNjW2StEr7sonulYxApXOiTBpkEdOnZudQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5608
Roshade.Setup.3.3.1.exe
95.100.186.9:443
go.microsoft.com
AKAMAI-AS
FR
whitelisted
756
lsass.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5608
Roshade.Setup.3.3.1.exe
2.16.168.117:443
msedge.sf.dl.delivery.mp.microsoft.com
Akamai International B.V.
RU
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 2.16.168.117
  • 2.16.168.116
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.128
  • 20.190.159.64
  • 40.126.31.3
  • 40.126.31.69
  • 20.190.159.71
  • 40.126.31.0
  • 20.190.159.4
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
clientservices.googleapis.com
  • 142.250.185.195
whitelisted
accounts.google.com
  • 142.251.168.84
whitelisted
www.google.com
  • 216.58.206.36
whitelisted

Threats

PID
Process
Class
Message
8140
svchost.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Roshade.Setup.3.3.1.exe