File name:

sunshine-windows-installer.exe

Full analysis: https://app.any.run/tasks/5b953be9-1f2d-4c57-90b9-552e856c4374
Verdict: Malicious activity
Analysis date: February 23, 2025, 03:20:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 9 sections
MD5:

6AB9F40108C106FE1332A12647AE123D

SHA1:

50AE30DD7FFC972CA1021B4DFF03383026EA240C

SHA256:

D0FF60B60219B58C5EB05848ACB303403028601A9126715F266AC1DD290F6630

SSDEEP:

98304:oprga0ATBUkKSyBbFYhXTQg90jdYmGmuK0VjFl+oY1xEzIjyDPZOAroAccj6ugIY:21cx+CzhJYAQh/iUsCcp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • nefconw.exe (PID: 7652)
      • nefconw.exe (PID: 2792)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 8080)
      • net.exe (PID: 8060)
      • net.exe (PID: 7824)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sunshine-windows-installer.exe (PID: 4668)
      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)

    • Reads security settings of Internet Explorer

      • sunshine-windows-installer.exe (PID: 4668)
      • virtual_gamepad.exe (PID: 1416)

    • There is functionality for taking screenshot (YARA)

      • sunshine-windows-installer.exe (PID: 4668)

    • Uses ICACLS.EXE to modify access control lists

      • ns8A05.tmp (PID: 4764)
      • cmd.exe (PID: 1200)

    • Starts CMD.EXE for commands execution

      • ns8B00.tmp (PID: 2164)
      • ns8C59.tmp (PID: 2212)
      • ns919A.tmp (PID: 6824)
      • cmd.exe (PID: 6924)
      • ns231E.tmp (PID: 6940)
      • ns184F.tmp (PID: 7276)

    • Starts application with an unusual extension

      • sunshine-windows-installer.exe (PID: 4668)

    • Executing commands from a ".bat" file

      • ns8B00.tmp (PID: 2164)
      • ns8C59.tmp (PID: 2212)
      • ns919A.tmp (PID: 6824)
      • ns184F.tmp (PID: 7276)
      • ns231E.tmp (PID: 6940)

    • Creates a software uninstall entry

      • sunshine-windows-installer.exe (PID: 4668)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 6252)

    • Manipulates environment variables

      • powershell.exe (PID: 6948)

    • Execution of CURL command

      • cmd.exe (PID: 6924)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3928)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6924)

    • Application launched itself

      • cmd.exe (PID: 6924)

    • ADVANCEDINSTALLER mutex has been found

      • virtual_gamepad.exe (PID: 1416)

    • The executable file from the user directory is run by the CMD process

      • virtual_gamepad.exe (PID: 1416)

    • Checks Windows Trust Settings

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • drvinst.exe (PID: 7816)

    • Reads the Windows owner or organization settings

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7532)
      • sunshinesvc.exe (PID: 7296)

    • Process drops legitimate windows executable

      • virtual_gamepad.exe (PID: 1416)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7144)
      • virtual_gamepad.exe (PID: 1416)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)

    • Creates files in the driver directory

      • drvinst.exe (PID: 7816)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 7280)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8100)
      • sc.exe (PID: 8032)
      • sc.exe (PID: 8020)

    • Creates a new Windows service

      • sc.exe (PID: 8172)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8080)
      • cmd.exe (PID: 7596)

    • Sets the service to start on system boot

      • sc.exe (PID: 8144)

    • The process creates files with name similar to system file names

      • sunshine-windows-installer.exe (PID: 4668)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • sunshine-windows-installer.exe (PID: 4668)

  • INFO

    • Checks supported languages

      • sunshine-windows-installer.exe (PID: 4668)
      • ns8A05.tmp (PID: 4764)
      • ns8B00.tmp (PID: 2164)
      • ns8C59.tmp (PID: 2212)
      • ns919A.tmp (PID: 6824)
      • curl.exe (PID: 6472)
      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • msiexec.exe (PID: 6688)
      • identity_helper.exe (PID: 7236)
      • msiexec.exe (PID: 2072)
      • nefconw.exe (PID: 7652)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)
      • ns184F.tmp (PID: 7276)
      • sunshinesvc.exe (PID: 7296)
      • ns231E.tmp (PID: 6940)
      • drvinst.exe (PID: 7280)
      • sunshine.exe (PID: 7476)

    • Creates files in the program directory

      • sunshine-windows-installer.exe (PID: 4668)
      • cmd.exe (PID: 1200)
      • virtual_gamepad.exe (PID: 1416)
      • sunshine.exe (PID: 7476)

    • Application launched itself

      • msedge.exe (PID: 5748)
      • msedge.exe (PID: 2216)

    • Reads the computer name

      • sunshine-windows-installer.exe (PID: 4668)
      • curl.exe (PID: 6472)
      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • identity_helper.exe (PID: 7236)
      • msiexec.exe (PID: 6688)
      • msiexec.exe (PID: 2072)
      • nefconw.exe (PID: 2792)
      • nefconw.exe (PID: 7652)
      • drvinst.exe (PID: 7816)
      • drvinst.exe (PID: 7280)
      • sunshinesvc.exe (PID: 7296)
      • sunshine.exe (PID: 7476)

    • Create files in a temporary directory

      • sunshine-windows-installer.exe (PID: 4668)
      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • nefconw.exe (PID: 2792)

    • Manual execution by a user

      • msedge.exe (PID: 2216)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6948)

    • Checks proxy server information

      • reg.exe (PID: 2260)
      • virtual_gamepad.exe (PID: 1416)

    • Execution of CURL command

      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 6924)

    • The sample compiled with english language support

      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)

    • Reads the software policy settings

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • drvinst.exe (PID: 7816)

    • Reads Environment values

      • virtual_gamepad.exe (PID: 1416)
      • identity_helper.exe (PID: 7236)
      • msiexec.exe (PID: 6688)
      • msiexec.exe (PID: 2072)

    • Reads the machine GUID from the registry

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • drvinst.exe (PID: 7816)
      • sunshine.exe (PID: 7476)

    • Creates files or folders in the user directory

      • virtual_gamepad.exe (PID: 1416)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7144)

    • Manages system restore points

      • SrTasks.exe (PID: 8188)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:28 20:33:36+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.42
CodeSize: 35840
InitializedDataSize: 73728
UninitializedDataSize: 402432
EntryPoint: 0x4280
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
227
Monitored processes
94
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start sunshine-windows-installer.exe msedge.exe no specs ns8a05.tmp no specs conhost.exe no specs icacls.exe no specs msedge.exe no specs ns8b00.tmp no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe cmd.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs msedge.exe no specs icacls.exe no specs ns8c59.tmp no specs msedge.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs netsh.exe no specs ns919a.tmp no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs curl.exe findstr.exe no specs curl.exe virtual_gamepad.exe msiexec.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs identity_helper.exe no specs identity_helper.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs nefconw.exe no specs nefconw.exe drvinst.exe drvinst.exe no specs ns184f.tmp no specs conhost.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sunshinesvc.exe no specs ns231e.tmp no specs conhost.exe no specs cmd.exe no specs sc.exe no specs sunshine.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs sunshine-windows-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
68"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5744 --field-trial-handle=2324,i,17457794477955183075,15584536496801058534,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
624"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2456 --field-trial-handle=2432,i,3001181828904762888,14175110344160066711,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1200C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Sunshine\scripts\migrate-config.bat""C:\Windows\System32\cmd.exe—ns8B00.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1416C:\Users\admin\AppData\Local\Temp/Sunshine\virtual_gamepad.exe /passive /promptrestartC:\Users\admin\AppData\Local\Temp\Sunshine\virtual_gamepad.exe
cmd.exe
User:
admin
Company:
Nefarius Software Solutions e.U.
Integrity Level:
HIGH
Description:
ViGEm Bus Driver Installer
Exit code:
0
Version:
1.22.0
Modules
Images
c:\users\admin\appdata\local\temp\sunshine\virtual_gamepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2072C:\Windows\syswow64\MsiExec.exe -Embedding F59CFE641F3115486E58C1613DCDF6C9C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2164"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8B00.tmp" "C:\Program Files\Sunshine\scripts\migrate-config.bat"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8B00.tmp—sunshine-windows-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nso53e1.tmp\ns8b00.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2212"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8C59.tmp" "C:\Program Files\Sunshine\scripts\add-firewall-rule.bat"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8C59.tmp—sunshine-windows-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nso53e1.tmp\ns8c59.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2216"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://docs.lizardbyte.dev/projects/sunshineC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2260reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2792"C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe" --install-driver --inf-path "C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBus.inf"C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe
msiexec.exe
User:
admin
Company:
Nefarius Software Solutions e.U.
Integrity Level:
HIGH
Description:
Nefarius' Device Console Utility
Exit code:
0
Version:
1.6.0
Modules
Images
c:\program files\nefarius software solutions\vigem bus driver\nefconw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
Total events
24 013
Read events
23 667
Write events
318
Delete events
28

Modification events

(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayName
Value:
Sunshine
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayVersion
Value:
2025.122.141614
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:Publisher
Value:
LizardByte
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:UninstallString
Value:
"C:\Program Files\Sunshine\Uninstall.exe"
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:NoRepair
Value:
1
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:NoModify
Value:
1
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Sunshine\Sunshine.exe
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:HelpLink
Value:
https://docs.lizardbyte.dev/projects/sunshine/latest/md_docs_2getting__started.html
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:URLInfoAbout
Value:
https://app.lizardbyte.dev/Sunshine
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:Contact
Value:
https://app.lizardbyte.dev/Sunshine/support
Executable files
51
Suspicious files
191
Text files
123
Unknown types
1

Dropped files

PID
Process
Filename
Type
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\UserInfo.dllexecutable
MD5:2C4D44DF9AEA8F958567D1F553BE57AB
SHA256:E4E377E4EE465CEB76764B20542EC59D780024B82765A7AE3338ACAA73C5D7B2
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\StartMenu.dllexecutable
MD5:5814072D18E9583EE1A64F18975B8D48
SHA256:FE6A44806D7A38DE3929790E724AA31692289FD523A7738B2FA23156BA0E6DDB
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_packed_uv_type0_ps_perceptual_quantizer.hlsltext
MD5:770E5F40434C5B20DC0E4684A3869044
SHA256:D5F937713422D2122BF57F482CF14C9B7CF70DBDB2E7A881742334E22FD951F2
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\apps.jsonbinary
MD5:4DEC1CF39B94CC2A310BEF765E607724
SHA256:6AA14F95E7BA22B05A06ACB24C077DF2B0959DE43C201A686A5EF5A628FD6DE5
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\sunshine.exeexecutable
MD5:41554F900EFDFE4B9DBCCF271D0A3281
SHA256:C5F55EB3CB705C0D373CE832319889E4662330CF772748AE8D37ABFC07D69581
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_packed_uv_type0_ps_linear.hlsltext
MD5:7BA99F704E3D336B7DA19EC698373F18
SHA256:C0A67152C118E59C7B19BB55D180B3DBC7FC5841FC93688D799BD572F62997B8
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_packed_uv_type0s_ps.hlsltext
MD5:75305AABC5B3D48C02CA2C6EA4503574
SHA256:B3C44BF4515FAF5AEF652E3801FDD932EEF5977961E7C3CABAE6DAA96860F06E
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_packed_uv_type0_vs.hlsltext
MD5:88820E52A237F7B6E78BD99F4C081095
SHA256:8B524DB00460581242BA8BFED502D04FD6DF2DC0B88E8BE1CB0042A4FEB9E1C1
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\InstallOptions.dllexecutable
MD5:BAC67AF2C731D172568A188C63FFBC2E
SHA256:05D0DECB3A43D1B64F9AEC9BB2C6E760F8904FF82FC03C9548DA8AF7F9C827C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
81
DNS requests
73
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4308
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CECoW9cIBGAf3CpJj3Tw5qfI%3D
unknown
—
—
whitelisted
1416
virtual_gamepad.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
7504
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1416
virtual_gamepad.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
1416
virtual_gamepad.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA4sR33wtnOE7yQZOQX4O%2F0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4308
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1544
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4308
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4308
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4308
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5392
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5392
msedge.exe
104.16.253.120:443
docs.lizardbyte.dev
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
docs.lizardbyte.dev
  • 104.16.253.120
  • 104.16.254.120
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.44
whitelisted
bzib.nelreports.net
  • 23.48.23.51
  • 23.48.23.26
whitelisted

Threats

PID
Process
Class
Message
5392
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
5392
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sunshine-windows-installer.exe