File name:

sunshine-windows-installer.exe

Full analysis: https://app.any.run/tasks/5b953be9-1f2d-4c57-90b9-552e856c4374
Verdict: Malicious activity
Analysis date: February 23, 2025, 03:20:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 9 sections
MD5:

6AB9F40108C106FE1332A12647AE123D

SHA1:

50AE30DD7FFC972CA1021B4DFF03383026EA240C

SHA256:

D0FF60B60219B58C5EB05848ACB303403028601A9126715F266AC1DD290F6630

SSDEEP:

98304:oprga0ATBUkKSyBbFYhXTQg90jdYmGmuK0VjFl+oY1xEzIjyDPZOAroAccj6ugIY:21cx+CzhJYAQh/iUsCcp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • nefconw.exe (PID: 7652)
      • nefconw.exe (PID: 2792)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 8080)
      • net.exe (PID: 8060)
      • net.exe (PID: 7824)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sunshine-windows-installer.exe (PID: 4668)
      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)

    • Reads security settings of Internet Explorer

      • sunshine-windows-installer.exe (PID: 4668)
      • virtual_gamepad.exe (PID: 1416)

    • There is functionality for taking screenshot (YARA)

      • sunshine-windows-installer.exe (PID: 4668)

    • Uses ICACLS.EXE to modify access control lists

      • ns8A05.tmp (PID: 4764)
      • cmd.exe (PID: 1200)

    • Creates a software uninstall entry

      • sunshine-windows-installer.exe (PID: 4668)

    • Starts application with an unusual extension

      • sunshine-windows-installer.exe (PID: 4668)

    • Starts CMD.EXE for commands execution

      • ns8B00.tmp (PID: 2164)
      • ns919A.tmp (PID: 6824)
      • cmd.exe (PID: 6924)
      • ns8C59.tmp (PID: 2212)
      • ns184F.tmp (PID: 7276)
      • ns231E.tmp (PID: 6940)

    • Executing commands from a ".bat" file

      • ns8B00.tmp (PID: 2164)
      • ns8C59.tmp (PID: 2212)
      • ns919A.tmp (PID: 6824)
      • ns184F.tmp (PID: 7276)
      • ns231E.tmp (PID: 6940)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 6252)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6924)

    • Manipulates environment variables

      • powershell.exe (PID: 6948)

    • Application launched itself

      • cmd.exe (PID: 6924)

    • Execution of CURL command

      • cmd.exe (PID: 6924)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3928)

    • ADVANCEDINSTALLER mutex has been found

      • virtual_gamepad.exe (PID: 1416)

    • The executable file from the user directory is run by the CMD process

      • virtual_gamepad.exe (PID: 1416)

    • Checks Windows Trust Settings

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • drvinst.exe (PID: 7816)

    • Reads the Windows owner or organization settings

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)

    • Process drops legitimate windows executable

      • virtual_gamepad.exe (PID: 1416)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7532)
      • sunshinesvc.exe (PID: 7296)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7144)
      • virtual_gamepad.exe (PID: 1416)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)

    • Creates files in the driver directory

      • drvinst.exe (PID: 7816)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 7280)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8100)
      • sc.exe (PID: 8032)
      • sc.exe (PID: 8020)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 8080)
      • cmd.exe (PID: 7596)

    • Creates a new Windows service

      • sc.exe (PID: 8172)

    • The process creates files with name similar to system file names

      • sunshine-windows-installer.exe (PID: 4668)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • sunshine-windows-installer.exe (PID: 4668)

    • Sets the service to start on system boot

      • sc.exe (PID: 8144)

  • INFO

    • Reads the computer name

      • sunshine-windows-installer.exe (PID: 4668)
      • curl.exe (PID: 6472)
      • virtual_gamepad.exe (PID: 1416)
      • curl.exe (PID: 7052)
      • msiexec.exe (PID: 7144)
      • identity_helper.exe (PID: 7236)
      • msiexec.exe (PID: 6688)
      • msiexec.exe (PID: 2072)
      • nefconw.exe (PID: 7652)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)
      • drvinst.exe (PID: 7280)
      • sunshinesvc.exe (PID: 7296)
      • sunshine.exe (PID: 7476)

    • Creates files in the program directory

      • sunshine-windows-installer.exe (PID: 4668)
      • cmd.exe (PID: 1200)
      • virtual_gamepad.exe (PID: 1416)
      • sunshine.exe (PID: 7476)

    • Checks supported languages

      • sunshine-windows-installer.exe (PID: 4668)
      • ns8A05.tmp (PID: 4764)
      • ns8B00.tmp (PID: 2164)
      • ns8C59.tmp (PID: 2212)
      • ns919A.tmp (PID: 6824)
      • curl.exe (PID: 6472)
      • virtual_gamepad.exe (PID: 1416)
      • curl.exe (PID: 7052)
      • msiexec.exe (PID: 7144)
      • msiexec.exe (PID: 6688)
      • identity_helper.exe (PID: 7236)
      • msiexec.exe (PID: 2072)
      • nefconw.exe (PID: 7652)
      • nefconw.exe (PID: 2792)
      • drvinst.exe (PID: 7816)
      • drvinst.exe (PID: 7280)
      • ns184F.tmp (PID: 7276)
      • ns231E.tmp (PID: 6940)
      • sunshinesvc.exe (PID: 7296)
      • sunshine.exe (PID: 7476)

    • Create files in a temporary directory

      • sunshine-windows-installer.exe (PID: 4668)
      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • nefconw.exe (PID: 2792)

    • Application launched itself

      • msedge.exe (PID: 5748)
      • msedge.exe (PID: 2216)

    • Manual execution by a user

      • msedge.exe (PID: 2216)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6948)

    • Execution of CURL command

      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 6924)

    • Checks proxy server information

      • reg.exe (PID: 2260)
      • virtual_gamepad.exe (PID: 1416)

    • The sample compiled with english language support

      • curl.exe (PID: 7052)
      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • drvinst.exe (PID: 7816)
      • nefconw.exe (PID: 2792)

    • Reads Environment values

      • virtual_gamepad.exe (PID: 1416)
      • identity_helper.exe (PID: 7236)
      • msiexec.exe (PID: 6688)
      • msiexec.exe (PID: 2072)

    • Reads the machine GUID from the registry

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • drvinst.exe (PID: 7816)
      • sunshine.exe (PID: 7476)

    • Reads the software policy settings

      • virtual_gamepad.exe (PID: 1416)
      • msiexec.exe (PID: 7144)
      • drvinst.exe (PID: 7816)

    • Manages system restore points

      • SrTasks.exe (PID: 8188)

    • Creates files or folders in the user directory

      • virtual_gamepad.exe (PID: 1416)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7144)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:28 20:33:36+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.42
CodeSize: 35840
InitializedDataSize: 73728
UninitializedDataSize: 402432
EntryPoint: 0x4280
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
227
Monitored processes
94
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start sunshine-windows-installer.exe msedge.exe no specs ns8a05.tmp no specs conhost.exe no specs icacls.exe no specs msedge.exe no specs ns8b00.tmp no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe cmd.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs msedge.exe no specs icacls.exe no specs ns8c59.tmp no specs msedge.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs msedge.exe no specs msedge.exe no specs netsh.exe no specs netsh.exe no specs ns919a.tmp no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs reg.exe no specs find.exe no specs cmd.exe no specs curl.exe findstr.exe no specs curl.exe virtual_gamepad.exe msiexec.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe no specs identity_helper.exe no specs identity_helper.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs nefconw.exe no specs nefconw.exe drvinst.exe drvinst.exe no specs ns184f.tmp no specs conhost.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net1.exe no specs sunshinesvc.exe no specs ns231e.tmp no specs conhost.exe no specs cmd.exe no specs sc.exe no specs sunshine.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs sunshine-windows-installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
68"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5744 --field-trial-handle=2324,i,17457794477955183075,15584536496801058534,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
624"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2456 --field-trial-handle=2432,i,3001181828904762888,14175110344160066711,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1200C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files\Sunshine\scripts\migrate-config.bat""C:\Windows\System32\cmd.exe—ns8B00.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1416C:\Users\admin\AppData\Local\Temp/Sunshine\virtual_gamepad.exe /passive /promptrestartC:\Users\admin\AppData\Local\Temp\Sunshine\virtual_gamepad.exe
cmd.exe
User:
admin
Company:
Nefarius Software Solutions e.U.
Integrity Level:
HIGH
Description:
ViGEm Bus Driver Installer
Exit code:
0
Version:
1.22.0
Modules
Images
c:\users\admin\appdata\local\temp\sunshine\virtual_gamepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2072C:\Windows\syswow64\MsiExec.exe -Embedding F59CFE641F3115486E58C1613DCDF6C9C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2164"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8B00.tmp" "C:\Program Files\Sunshine\scripts\migrate-config.bat"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8B00.tmp—sunshine-windows-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nso53e1.tmp\ns8b00.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2212"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8C59.tmp" "C:\Program Files\Sunshine\scripts\add-firewall-rule.bat"C:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ns8C59.tmp—sunshine-windows-installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nso53e1.tmp\ns8c59.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2216"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://docs.lizardbyte.dev/projects/sunshineC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2260reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2792"C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe" --install-driver --inf-path "C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\ViGEmBus.inf"C:\Program Files\Nefarius Software Solutions\ViGEm Bus Driver\nefconw.exe
msiexec.exe
User:
admin
Company:
Nefarius Software Solutions e.U.
Integrity Level:
HIGH
Description:
Nefarius' Device Console Utility
Exit code:
0
Version:
1.6.0
Modules
Images
c:\program files\nefarius software solutions\vigem bus driver\nefconw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
Total events
24 013
Read events
23 667
Write events
318
Delete events
28

Modification events

(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayName
Value:
Sunshine
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayVersion
Value:
2025.122.141614
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:Publisher
Value:
LizardByte
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:UninstallString
Value:
"C:\Program Files\Sunshine\Uninstall.exe"
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:NoRepair
Value:
1
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:NoModify
Value:
1
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Sunshine\Sunshine.exe
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:HelpLink
Value:
https://docs.lizardbyte.dev/projects/sunshine/latest/md_docs_2getting__started.html
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:URLInfoAbout
Value:
https://app.lizardbyte.dev/Sunshine
(PID) Process:(4668) sunshine-windows-installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sunshine
Operation:writeName:Contact
Value:
https://app.lizardbyte.dev/Sunshine/support
Executable files
51
Suspicious files
191
Text files
123
Unknown types
1

Dropped files

PID
Process
Filename
Type
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\InstallOptions.dllexecutable
MD5:BAC67AF2C731D172568A188C63FFBC2E
SHA256:05D0DECB3A43D1B64F9AEC9BB2C6E760F8904FF82FC03C9548DA8AF7F9C827C5
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\tools\sunshinesvc.exeexecutable
MD5:91E6AB349E9D3D36F0524315D0C3DEAF
SHA256:3E8E39D6B2C0F4A2FCF61B80EEAD9C2E032CC79C13DCDF79B2EAB13FD38DFA5C
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_packed_uv_type0_ps.hlsltext
MD5:920BFD762632909D51768DF25483356C
SHA256:897BC37D0319B5400E142EE5D04C7DD260AF1071040B4D8F0BB6DCA90C510A3E
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\zlib1.dllexecutable
MD5:EE01439A96E6C269C5D3D42C46C4516E
SHA256:1DC85208162EE57FE97E892BB5160FE9588903992995F90ADC3A3A358DAC6FC6
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\UserInfo.dllexecutable
MD5:2C4D44DF9AEA8F958567D1F553BE57AB
SHA256:E4E377E4EE465CEB76764B20542EC59D780024B82765A7AE3338ACAA73C5D7B2
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\apps.jsonbinary
MD5:4DEC1CF39B94CC2A310BEF765E607724
SHA256:6AA14F95E7BA22B05A06ACB24C077DF2B0959DE43C201A686A5EF5A628FD6DE5
4668sunshine-windows-installer.exeC:\Program Files\Sunshine\assets\shaders\directx\convert_yuv420_packed_uv_type0_ps_linear.hlsltext
MD5:7BA99F704E3D336B7DA19EC698373F18
SHA256:C0A67152C118E59C7B19BB55D180B3DBC7FC5841FC93688D799BD572F62997B8
4668sunshine-windows-installer.exeC:\Users\admin\AppData\Local\Temp\nso53E1.tmp\StartMenu.dllexecutable
MD5:5814072D18E9583EE1A64F18975B8D48
SHA256:FE6A44806D7A38DE3929790E724AA31692289FD523A7738B2FA23156BA0E6DDB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
81
DNS requests
73
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4308
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7056
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c269ced-c74b-4e70-9b58-6e7999b292c0?P1=1740402693&P2=404&P3=2&P4=OSugYCEsgXdze15Iu9XJftsur9VqBxylDdDjyxD0dT1NcKZmKuCjSZi2wdmZ8HW0LWKS795p9eqqiK4lVfR5Cw%3d%3d
unknown
—
—
whitelisted
7056
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c269ced-c74b-4e70-9b58-6e7999b292c0?P1=1740402693&P2=404&P3=2&P4=OSugYCEsgXdze15Iu9XJftsur9VqBxylDdDjyxD0dT1NcKZmKuCjSZi2wdmZ8HW0LWKS795p9eqqiK4lVfR5Cw%3d%3d
unknown
—
—
whitelisted
7056
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c269ced-c74b-4e70-9b58-6e7999b292c0?P1=1740402693&P2=404&P3=2&P4=OSugYCEsgXdze15Iu9XJftsur9VqBxylDdDjyxD0dT1NcKZmKuCjSZi2wdmZ8HW0LWKS795p9eqqiK4lVfR5Cw%3d%3d
unknown
—
—
whitelisted
7056
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0c269ced-c74b-4e70-9b58-6e7999b292c0?P1=1740402693&P2=404&P3=2&P4=OSugYCEsgXdze15Iu9XJftsur9VqBxylDdDjyxD0dT1NcKZmKuCjSZi2wdmZ8HW0LWKS795p9eqqiK4lVfR5Cw%3d%3d
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4308
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4308
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1544
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4308
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4308
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4308
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5392
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5392
msedge.exe
104.16.253.120:443
docs.lizardbyte.dev
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
docs.lizardbyte.dev
  • 104.16.253.120
  • 104.16.254.120
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.44
whitelisted
bzib.nelreports.net
  • 23.48.23.51
  • 23.48.23.26
whitelisted

Threats

PID
Process
Class
Message
5392
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
5392
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sunshine-windows-installer.exe