File name:

reshade_last_addon.exe

Full analysis: https://app.any.run/tasks/fe16eee2-b125-4695-bd2e-3a434c7dfa80
Verdict: Malicious activity
Analysis date: June 11, 2025, 17:07:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

97F664517773C8FE9412ADD155C333E1

SHA1:

3C80786BF33DD43AFE2A16CA71A55930B635EF46

SHA256:

9AC89947607EBE01724F4F7A71788023FA458D12BEED0435C8362190AF1E5A6B

SSDEEP:

98304:xXQHtIZUdcHFVCkMh6gqkl30lsw+X3iL0p4zpZlmtSkac5AzSVVA4swasxL2QPnt:7ujkbD8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Creates file in the systems drive root

      • reshade_last_addon.exe (PID: 2760)

    • Reads the date of Windows installation

      • reshade_last_addon.exe (PID: 2760)

    • Executable content was dropped or overwritten

      • reshade_last_addon.exe (PID: 7072)

    • Application launched itself

      • reshade_last_addon.exe (PID: 2760)

  • INFO

    • Reads the computer name

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Checks supported languages

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Disables trace logs

      • reshade_last_addon.exe (PID: 7072)
      • reshade_last_addon.exe (PID: 2760)

    • Checks proxy server information

      • reshade_last_addon.exe (PID: 7072)
      • reshade_last_addon.exe (PID: 2760)

    • Reads the machine GUID from the registry

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Reads the software policy settings

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Reads Environment values

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Process checks computer location settings

      • reshade_last_addon.exe (PID: 2760)

    • Create files in a temporary directory

      • reshade_last_addon.exe (PID: 7072)

    • Creates files or folders in the user directory

      • reshade_last_addon.exe (PID: 7072)

    • Creates files in the program directory

      • reshade_last_addon.exe (PID: 7072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (43.5)
.exe | Win64 Executable (generic) (27.9)
.scr | Windows screen saver (13.2)
.dll | Win32 Dynamic Link Library (generic) (6.6)
.exe | Win32 Executable (generic) (4.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:29 22:08:57+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 128512
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x21566
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 6.5.0.0
ProductVersionNumber: 6.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: crosire
FileDescription: ReShade Setup
FileVersion: 6.5.0.0
InternalName: ReShade Setup.exe
LegalCopyright: Copyright © 2014. All rights reserved.
OriginalFileName: ReShade Setup.exe
ProductName: ReShade
ProductVersion: 6.5.0
AssemblyVersion: 6.5.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start reshade_last_addon.exe reshade_last_addon.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2760"C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe" C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe
explorer.exe
User:
admin
Company:
crosire
Integrity Level:
MEDIUM
Description:
ReShade Setup
Exit code:
0
Version:
6.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\reshade_last_addon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3480C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7072"C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe" "C:\Program Files\Internet Explorer\iexplore.exe" --elevated --left 393 --top 23C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe
reshade_last_addon.exe
User:
admin
Company:
crosire
Integrity Level:
HIGH
Description:
ReShade Setup
Exit code:
0
Version:
6.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\reshade_last_addon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
12 020
Read events
11 755
Write events
255
Delete events
10

Modification events

(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
2
Text files
97
Unknown types
0

Dropped files

PID
Process
Filename
Type
7072reshade_last_addon.exeC:\Program Files\Internet Explorer\ReShade.initext
MD5:B82180AA128363C33F35D67B387A8CFE
SHA256:ED11CF9CF89C6AB701CA796AB23AD9743F843105FD74B00696F9093511F07F27
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\DisplayDepth.fxtext
MD5:D4421758A6D4F205FFF2AF5EF8A768A8
SHA256:E2266C47C75DCC30030C8EC68CF62CF16F2AEBE1ECDECF0265D91CE65DBD7F32
7072reshade_last_addon.exeC:\Program Files\Internet Explorer\d3d9.dllexecutable
MD5:27AA3A695C2ACC525ECFF932125D5993
SHA256:48FCA221A70F9167A34B878598A9D3580DD95A629834354E0BF15A1A155A4EDB
7072reshade_last_addon.exeC:\Program Files\Internet Explorer\ReShade.logtext
MD5:D9A1DD79235BDE84B66C30A881D724D5
SHA256:A649CCD07DC38931801DE04C3523DA3F22CC021232095938D59DF693CAE77670
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\REFERENCE.mdtext
MD5:936A944D5BC2C38FBE8151AF63E3CE9A
SHA256:E90951A22855FB1B8653AB08C634EFCF08397D828185E74F23AAACC86284BDD3
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetupDownload.tmpcompressed
MD5:719075E56682B03176BEA50249D227A2
SHA256:E445BB1F8F4A3793CFE027576630B269BBA7CA50A2E9D669B1E195C3159A1E0E
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Daltonize.fxtext
MD5:F5871BE80D0CA8F5EDF4CC9D1B269AC5
SHA256:AB6006E886DB0F1FDB9845B892DEBE774EDA9EC498182373AA6ADE601D258D3F
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\LUT.fxtext
MD5:6D4B5D63AB0F440911A55903E5767076
SHA256:E3179C023A599D1EBE0C73FA00084A64D0BE66F4E5B43A45C1BB25C3C9DF0363
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Blending.fxhtext
MD5:66720778A8178B7D690960D3D7FB248F
SHA256:1EAB08B853014FD6AAAAE6783C5052DE2EC2A74792C149635E4ED44A58660BA3
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Deband.fxtext
MD5:4B48FAD97630526702BC33C1F38A6497
SHA256:8959CA995090BC89762CC0BF4BA3BB1FFCFFDF143E9E0DDAF84F0E004B53DD29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
28
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5848
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5780
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5780
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
592
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2760
reshade_last_addon.exe
140.82.121.6:443
api.github.com
GITHUB
US
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5848
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5848
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.73
  • 40.126.31.0
  • 20.190.159.68
  • 20.190.159.4
  • 40.126.31.1
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.219.150.101
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
reshade_last_addon.exe