File name:

reshade_last_addon.exe

Full analysis: https://app.any.run/tasks/fe16eee2-b125-4695-bd2e-3a434c7dfa80
Verdict: Malicious activity
Analysis date: June 11, 2025, 17:07:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

97F664517773C8FE9412ADD155C333E1

SHA1:

3C80786BF33DD43AFE2A16CA71A55930B635EF46

SHA256:

9AC89947607EBE01724F4F7A71788023FA458D12BEED0435C8362190AF1E5A6B

SSDEEP:

98304:xXQHtIZUdcHFVCkMh6gqkl30lsw+X3iL0p4zpZlmtSkac5AzSVVA4swasxL2QPnt:7ujkbD8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Reads the date of Windows installation

      • reshade_last_addon.exe (PID: 2760)

    • Creates file in the systems drive root

      • reshade_last_addon.exe (PID: 2760)

    • Application launched itself

      • reshade_last_addon.exe (PID: 2760)

    • Executable content was dropped or overwritten

      • reshade_last_addon.exe (PID: 7072)

  • INFO

    • Reads Environment values

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Disables trace logs

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Reads the machine GUID from the registry

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Checks supported languages

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Reads the computer name

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Checks proxy server information

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Reads the software policy settings

      • reshade_last_addon.exe (PID: 2760)
      • reshade_last_addon.exe (PID: 7072)

    • Process checks computer location settings

      • reshade_last_addon.exe (PID: 2760)

    • Creates files or folders in the user directory

      • reshade_last_addon.exe (PID: 7072)

    • Create files in a temporary directory

      • reshade_last_addon.exe (PID: 7072)

    • Creates files in the program directory

      • reshade_last_addon.exe (PID: 7072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (43.5)
.exe | Win64 Executable (generic) (27.9)
.scr | Windows screen saver (13.2)
.dll | Win32 Dynamic Link Library (generic) (6.6)
.exe | Win32 Executable (generic) (4.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:29 22:08:57+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 128512
InitializedDataSize: 24576
UninitializedDataSize: -
EntryPoint: 0x21566
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 6.5.0.0
ProductVersionNumber: 6.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: crosire
FileDescription: ReShade Setup
FileVersion: 6.5.0.0
InternalName: ReShade Setup.exe
LegalCopyright: Copyright © 2014. All rights reserved.
OriginalFileName: ReShade Setup.exe
ProductName: ReShade
ProductVersion: 6.5.0
AssemblyVersion: 6.5.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start reshade_last_addon.exe reshade_last_addon.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2760"C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe" C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe
explorer.exe
User:
admin
Company:
crosire
Integrity Level:
MEDIUM
Description:
ReShade Setup
Exit code:
0
Version:
6.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\reshade_last_addon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3480C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7072"C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe" "C:\Program Files\Internet Explorer\iexplore.exe" --elevated --left 393 --top 23C:\Users\admin\AppData\Local\Temp\reshade_last_addon.exe
reshade_last_addon.exe
User:
admin
Company:
crosire
Integrity Level:
HIGH
Description:
ReShade Setup
Exit code:
0
Version:
6.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\reshade_last_addon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
12 020
Read events
11 755
Write events
255
Delete events
10

Modification events

(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2760) reshade_last_addon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\reshade_last_addon_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
2
Text files
97
Unknown types
0

Dropped files

PID
Process
Filename
Type
7072reshade_last_addon.exeC:\Program Files\Internet Explorer\ReShade.initext
MD5:B82180AA128363C33F35D67B387A8CFE
SHA256:ED11CF9CF89C6AB701CA796AB23AD9743F843105FD74B00696F9093511F07F27
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\EffectPackages[1].cachetext
MD5:5BCA582261CB1E562388618C96815658
SHA256:5B310CDBC3C81B225271B8AF4FB6AA0897431A6048461637A88BC414C7C25675
7072reshade_last_addon.exeC:\Program Files\Internet Explorer\ReShade.logtext
MD5:D9A1DD79235BDE84B66C30A881D724D5
SHA256:A649CCD07DC38931801DE04C3523DA3F22CC021232095938D59DF693CAE77670
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Compatibility[1].cachetext
MD5:6004AB6C9AC8B8E15A3B752C71720DF4
SHA256:0828E00735114F19D6682EA94747AD4F01D666DDB7072926049F643B3D52683F
7072reshade_last_addon.exeC:\Program Files\Internet Explorer\d3d9.dllexecutable
MD5:27AA3A695C2ACC525ECFF932125D5993
SHA256:48FCA221A70F9167A34B878598A9D3580DD95A629834354E0BF15A1A155A4EDB
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Deband.fxtext
MD5:4B48FAD97630526702BC33C1F38A6497
SHA256:8959CA995090BC89762CC0BF4BA3BB1FFCFFDF143E9E0DDAF84F0E004B53DD29
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\LUT.fxtext
MD5:6D4B5D63AB0F440911A55903E5767076
SHA256:E3179C023A599D1EBE0C73FA00084A64D0BE66F4E5B43A45C1BB25C3C9DF0363
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\DisplayDepth.fxtext
MD5:D4421758A6D4F205FFF2AF5EF8A768A8
SHA256:E2266C47C75DCC30030C8EC68CF62CF16F2AEBE1ECDECF0265D91CE65DBD7F32
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\ReShade.fxhtext
MD5:47282A1A2AFE26B488FDDF25EF18FF9E
SHA256:6DABFBBAF968C3871905D2EA17F96572FF7B1CEC01310B5D0E5252B66B30174F
7072reshade_last_addon.exeC:\Users\admin\AppData\Local\Temp\ReShadeSetup\reshade-shaders-slim\Shaders\Macros.fxhtext
MD5:65662C5DDA1E465942C159925F76FAE3
SHA256:78D8974469B0E7BB2FDD5C6A98EE6304D03A614FFD2BC2A66985A54FF5F9B3A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
28
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5848
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5780
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5780
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
592
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2760
reshade_last_addon.exe
140.82.121.6:443
api.github.com
GITHUB
US
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5848
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5848
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.73
  • 40.126.31.0
  • 20.190.159.68
  • 20.190.159.4
  • 40.126.31.1
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.219.150.101
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
reshade_last_addon.exe