83fd3eb8248b4a41ab7bcbbe193d93e57bc0034d20259c6e21dc6a427cfe0dcd

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roshade.Setup.3.3.1.exe
Size 5.7MB
Sample260727-2127jasgpg
SHA256 83fd3eb8248b4a41ab7bcbbe193d93e57bc0034d20259c6e21dc6a427cfe0dcd
MD5 fe51cdac1d70cc17a57cae25c164bf47
SHA1 814144cb9df1c25942321ff04bb9b64ba55fc5fc
SHA512 87c02c489ecc68a186df7e5d2c5dda3d7ff594fd4fb19a2dacd8556ff91b9a7494889a466a28e930cbe02a57247f8042c1d6e84c91c064c4acb40f8afbcc8075
SSDEEP 98304:wSUoEyUQRr+SLX5fuK5QBEcMXiqvC7CjpLgMFX7e1V0fZAICcB5E3d66cIKwZ/0e:wn1QVFX5fZqBEcqvC2jTx76V0BACY3db
TLSH
T1255633C640519FF1E06BA8346E0CB4E2E5072FB7AF8734340D2AF5D5463E9E296C9987
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan upx

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Roshade.Setup.3.3.1.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2472-0-0x00007FF719B40000-0x00007FF71A7B3000-memory.dmp	upx
behavioral1/memory/2472-246-0x00007FF719B40000-0x00007FF71A7B3000-memory.dmp	upx
behavioral1/memory/2472-290-0x00007FF719B40000-0x00007FF71A7B3000-memory.dmp	upx

Executes dropped EXE 1 IoCs

pid	Process
2204	7zr.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Roshade.Setup.3.3.1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296670485460405"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2472	Roshade.Setup.3.3.1.exe
2472	Roshade.Setup.3.3.1.exe
2472	Roshade.Setup.3.3.1.exe
2472	Roshade.Setup.3.3.1.exe
2472	Roshade.Setup.3.3.1.exe
2472	Roshade.Setup.3.3.1.exe
2472	Roshade.Setup.3.3.1.exe
2472	Roshade.Setup.3.3.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
368	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2204	7zr.exe
Token: 35	2204	7zr.exe
Token: SeSecurityPrivilege	2204	7zr.exe
Token: SeSecurityPrivilege	2204	7zr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	Roshade.Setup.3.3.1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 368	2472	Roshade.Setup.3.3.1.exe	88
PID 368 wrote to memory of 4900	368	msedgewebview2.exe	89
PID 368 wrote to memory of 4456	368	msedgewebview2.exe	90
PID 368 wrote to memory of 4456	368	msedgewebview2.exe	90
PID 368 wrote to memory of 4456	368	msedgewebview2.exe	90
PID 368 wrote to memory of 4436	368	msedgewebview2.exe	91
PID 368 wrote to memory of 2760	368	msedgewebview2.exe	92
PID 368 wrote to memory of 2760	368	msedgewebview2.exe	92
PID 368 wrote to memory of 2400	368	msedgewebview2.exe	93
PID 368 wrote to memory of 2400	368	msedgewebview2.exe	93
PID 368 wrote to memory of 2400	368	msedgewebview2.exe	93
PID 2472 wrote to memory of 2204	2472	Roshade.Setup.3.3.1.exe	94

C:\Users\Admin\AppData\Local\Temp\Roshade.Setup.3.3.1.exe
"C:\Users\Admin\AppData\Local\Temp\Roshade.Setup.3.3.1.exe"
1⤵
- Enumerates connected drives
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Roshade.Setup.3.3.1.exe --webview-exe-version=3.3.1 --user-data-dir="C:\Users\Admin\AppData\Local\Roshade\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI --mojo-named-platform-channel-pipe=2472.1916.15661901611114683781
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Roshade\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Roshade\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff81a82b078,0x7ff81a82b084,0x7ff81a82b090
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roshade\EBWebView" --webview-exe-name=Roshade.Setup.3.3.1.exe --webview-exe-version=3.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,10109981592078509660,10668821174108249063,262144 --disable-features=msPdfOOUI,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roshade\EBWebView" --webview-exe-name=Roshade.Setup.3.3.1.exe --webview-exe-version=3.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,10109981592078509660,10668821174108249063,262144 --disable-features=msPdfOOUI,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roshade\EBWebView" --webview-exe-name=Roshade.Setup.3.3.1.exe --webview-exe-version=3.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2344,i,10109981592078509660,10668821174108249063,262144 --disable-features=msPdfOOUI,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Roshade\EBWebView" --webview-exe-name=Roshade.Setup.3.3.1.exe --webview-exe-version=3.3.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,10109981592078509660,10668821174108249063,262144 --disable-features=msPdfOOUI,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2400
- C:\Users\Admin\AppData\Local\Temp\Roshade\7zr.exe
  "C:\Users\Admin\AppData\Local\Temp\Roshade\7zr.exe" x -y files.7z
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3d0b5deeea79cf5d1a454afd8f12da793731223cdf4ff27dbaae6616af978c79
MD5 ca51a169bbcd998733f4b3390cc3add9
SHA1 2a4b4d1256248965c19f63a5c6b2a64664e6d7c0
SHA512 6148504c0d2635074de0f6d19e41d43d70bba03c05311efc6672c15efe29b77b74d0af64a5c06eecb6cc8a944c2e996be904313ea3ff1a5f37cce5c6fefa9801
TLSH
T199D0121633024934C01036B30202660B0400D11F810950485C29955E6A580600D07E51
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 83bae39c9ac6d2f7cb531d6d5c1c24c2673e1e41c7ced969cbbdb6864e24a707
MD5 486a966e1e5b89e10f082b13a6deebe9
SHA1 1f2cc318a3f81d2e524e4661e756e32640e85a84
SHA512 1eb2fcc3bf34e00943c03391bb373d36902033d5b492d1c3477758d64d370a5bfdd327707b94486c380e76457716e9a04007ecbd5fbd8ccb5bec40b6dec9e4e6
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 465997876f887fdf511fa444b96dcc8aaa2213d250c2a58195495f7496610bdc
MD5 803c2ee544ccb25987d576962a8a05d0
SHA1 01efa0cc8329026223fce13bde2c903c97710655
SHA512 63f5f9712496796d265d1d6b7a6f9d5390d31720203e6c91b25e30a21aec462ba42c4c8169a0f52f7789c34ec0665b94d540e8a93d29f74699a21f6fedde0c13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 027aeed5ba678ca728c45ac4d1671660ff66d279a9a3643202ae9367bfb69865
MD5 090c71f627b49060d0d5010dba86e6cd
SHA1 0a82459f32d3158a293fc918903b9284e19e5337
SHA512 f5a9c1e9306411833dddd1d6e8810211818ab4cb13178427e251c4aefde86756444734aa3d9c6299faa53ee284fbec35173361a5ecc0d2e977068cf9dfde34dc
TLSH
T164A002110189F451C20413B0718D024D3A287A2971078A514894D565D8782D05547004
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Network\Network Persistent State
Size 3KB
SHA256 88679a466a64330e4f596f74ac8dd27ea1237f5332c1e21982519e69bc1ae8ef
MD5 ec51af5086cbc476312885ea31d79334
SHA1 25d6d91b43e3b04cc7ce193542f03169c1dc29f7
SHA512 558a695d8d7e8b67d95f20cb8ea295292744c51630cd611ad60fa242a9b4b505d185f5db8d982452bb51e78c5c6192e0b62ce8bc083eb047c62fa10351c4de60
TLSH
T13C5189A7C2E8DA6DC85116F95A243C0BCE2D4D1C0A783D6D88E5EBCB93D1071D24268E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe587ccc.TMP

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Network\Network Persistent State~RFe587ccc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Preferences
Size 6KB
SHA256 dce5d767134d1b79d1a257353703b39f01ee90c4f65134335ad9cef8cd8707e1
MD5 700b381ae462d385b9807ee92b87d02c
SHA1 c589a1062cf0803054393b525dec217914ef43d9
SHA512 a077b38caa2727daec72f1b3e7c9c545c6477536179958e63c67b5ec4b3f58ffea95a0cb7ce2240f307b14f8bd4248d68d7f30e37d8c8e910069e8bd749ce260
SSDEEP 192:stW0OLKflHZ8paRB/S+Wi7+koYYQiNuWK8:stjOuN2y/V1o9wd8
TLSH
T193E1CA47AE24997B4CC7E6197E35BB12D6F52062A6C01E48EBFC861C08E66DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe587c4f.TMP

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Preferences~RFe587c4f.TMP
Size 6KB
SHA256 e59096e64e904415a7f1e44c725f305d69653126352a0d1a270bea964590caff
MD5 8bff5e4f2bb8a0c8440667dd6169ae78
SHA1 342347055b1bf8a0b54160d4227a6e8869b432b6
SHA512 35ea13e265739a19019f9388e1bfe3ffc938574e28ad838d83aaf3f375916cdc31d69bab954846ad0b4eec44ee90ba333995fa4ef07287e8d457afef46e88442
SSDEEP 192:stW0OLKfSHZ8paRB/S+Wi7FDwYYQ7/pM8:stjOu62y/Vxweu8
TLSH
T1F6D1B843AF2869B74CC7E6197E35BB16D6F62061A6D00E58EBFC860C0CD66CC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Local State
Size 1KB
SHA256 6586b8ec5ce5a989759e5652fb194a9f3b904ee47849f449ca6d32fde1c5222a
MD5 dc0a3e77db24932934b4ad55ddbc9c94
SHA1 53b735769b937834cc391134082d195136f4563b
SHA512 cc1df9204b229436040fbca88ecb458f57e07fc50bff43bfc0e51eca45a117f5faefb67231bd264211ef4ef252ba19ffe92f31ebd7aa6b29076ea610573c86ca
TLSH
T1833165F3E58057B2AD82A786B1476A672E60616AD2608E44B1DE0B0D12D61CC5627E33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Local State
Size 2KB
SHA256 ce2ffdd919dc68517462b0b44041a444e9aec58aaae9d289e668db98cdbbcff1
MD5 870e3f4784d411904641f5166826bbad
SHA1 6431d22f99c9f89b8dfda90815c6028129512d11
SHA512 5adaffc4289f585cb34cdb0e9ff30667d4fe9402187385c45f6efa7c5ef31c451543709e5fe999931ea0da2f02519efabafd7eb2e2f22ee6d42dca80f5b67bc8
TLSH
T1D65175B3B944A7B78DD39A44B94A7A226E7562A5D7A11F50A6DD0F0C01C669C2303C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Local State
Size 3KB
SHA256 ad9943b03983311b777726bf1ef6b4ac2bcf0cd731d10ff27dc01cc4867f2dc1
MD5 dcbd6e2c3cf3315f3adefdfa34129841
SHA1 70248ae7dfbf912dfe4c036cfdeb51d76db77094
SHA512 9c4a13cb5acf5b71b6777cde890b77439635067e3c9d92e81d80d7aa4e8bcc3ac69f7af5aee3fe2e9814970dccc6d55284f2f3c10072c5e4e386cae6a120c0fd
TLSH
T1A97195A7A954A6778DE3DA44B9862B267BA55227E2D03F94D5ED0F0C01C72C81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Local State
Size 16KB
SHA256 7172eae97d9837ac7b498f6a86e638af41da2d439fe95445dab6430ea9270838
MD5 4ede7e064e91c0de934759dbd9cde07b
SHA1 88cae3ef9de2b1fb5843b340ad1e0acc49b72614
SHA512 379761d99264cc1759c0bd27eaab12c2b3685be558d7222447cf758ba0357c3e011564a904076532242cdddb5758d355a040980749c08eca5cf6744832dba69f
SSDEEP 384:zy+aQikB+z/xvxjg/qhEwNb4sHInXwyfj9zQ:x/UxvxjgC+MiXwyfjFQ
TLSH
T101729F3B55696A2399F3FA047A4D0B5BDFB99472C1C16EB84AFD0F0D06CB2D41302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Local State
Size 16KB
SHA256 350950875798036e01e7b6ec013274af73dc554ec953e681eda697ce5a4c823b
MD5 042ee6bc6d60635196d134d228f7153c
SHA1 c3b73c3bd68ef15d512866a9fe6da4c17229d72f
SHA512 852d5265325413d63a47b8cfb726237fa653cdea5587a36e0a85a847101840d2cb4d8504dfaefe4d0f26378cbff68cf587f876b0241388a92c2bdd18bcffa612
SSDEEP 384:z2+aQikB+z/xvxjg/qhEH3Nb4sNInSwyfj9zQ:N/UxvxjgC+HxiSwyfjFQ
TLSH
T12872AE7B55696A2399F3EA047A5D0B5BDBB89472C1C16EB84AFD0F0D06CB2D81302C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58436d.TMP

Path C:\Users\Admin\AppData\Local\Roshade\EBWebView\Local State~RFe58436d.TMP
Size 1KB
SHA256 67b4353934bd0c233daefa6be9e0c027f3b7b28ac5ea9e74592453d28c75726a
MD5 5c99faa3a4cfc8114febb7f225f2d937
SHA1 6d678206db1a6d4864b1d53f43d735e31b1121eb
SHA512 1e96824449600dc0c7c23d30851c464b63c5d52792b4a5bb10fbc3532e08ea75225465371038ace531b7b54ec18f12e37262859a2772eea7c59ea28a5ace0f3e
TLSH
T1502184F3E5C067B2FE829A95B10376572E6061AAD2608F08A1DE070D13C75DC5723D33
MD5 SHA1 SHA512 TLSH

Submit Download

Roshade Launcher.url

Path C:\Users\Admin\AppData\Local\Roshade\Roshade Launcher.url
Size 79B
SHA256 04a3e38d0d04f8d6bf803ccb28bbb4088b3d2eeddf66433a57857fd7fc3dc561
MD5 82eae2bd26ed7b0ff2963676829088f7
SHA1 9eaa89c9bbd533cd248f616bdab1c62227f0faf7
SHA512 44b2c3f7e825337d3c46a7802b12e2a5da112b8150857998ffab1225f00259b881f7681812f8493312dfaf256bbcb957d4990326bdaee814ccb2e3f19e2fcfab
TLSH
T1FAA02454445D4100D05DCD15CFDC5030541C11C0D113D544F107F544D4FF0C451447D5
MD5 SHA1 SHA512 TLSH

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\Roshade\7zr.exe
Size 564KB
SHA256 5e47d0900fb0ab13059e0642c1fff974c8340c0029decc3ce7470f9aa78869ab
MD5 f86bb4469587005a6717649c9b160f70
SHA1 f229314ebbed02098a4adb33b706d68026d866fc
SHA512 a7881fe868c34124efa567b09274a885d05aef008914e5d341c4b8ead58451d1b29f4ace9782cd0c93d3c8fd1acb1f6e1e6cbb5b19cd51223295777b223c1366
SSDEEP 12288:W8wKMieUWaxG8AchmRWZesGoK3n6cZ+l8App/FrUFv8KAcxO90:W37UWaxCcsYZ5Gou6w+l9p/VUFv8Kxe0
TLSH
T1DCC49E167AF1C07ED65221308B1D6BB5D0FA93680B3208C763844E6D2F759E6D73B93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files.7z

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files.7z
Size 1.1MB
SHA256 e676b4cadab34caf887c158f7a4831eeee1ad9bea51861d6481f33963a083555
MD5 1a483967f133d16591d019252195238e
SHA1 3c83de9514df12daf213daadcef3a533283eb79f
SHA512 8b56d359c62eed1671e10c5ab8dfb4c8eb99b7824ec8cb033a5204fe270601afc9d48f8a074270e53ad0624c031c5d6a3eee7923e675b78d278f0ad9fe36d23f
SSDEEP 24576:equvTkNt2+bKd2Y/ZltlZVUvGEiWzC1PrRb8O5kkGH0p5bFvP41pUP9+qrI:e5vA2kKAYb9q/Crd/bRP41p2+kI
TLSH
T19A4533C39421AA9848B6F5D11E09AA73752C8F9C5E043B7FD36227DEBAA7F54B1440F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

font.ttf

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\fonts\font.ttf
Size 126KB
SHA256 6c8324f228c5cace4e0bc072f24754ee0c0bff0713a85641190f062a4db53b6b
MD5 d0d2737060b43dd07326a00e97bf4ee6
SHA1 44588a6cca4cece9c0aa611aed6fea014ce55916
SHA512 e61c9c224330dcd8e4a6a7adc844e74cbf547729f5fa72a3c4ca05f7ec2e8e1bcdfa84aafcd97dcfe95c31b59821a37f7fe41bab25f271ffbdeb496553f55bac
SSDEEP 3072:NQrCS8SXrBdNGdNZ6H2r9ZdP3mnfDnUTJlLh3br4pHRuEw:muS8SJGdNZqs93PmSdFvC0Ew
TLSH
T18FC37D23F3138E6ED5332DF947DAD3917F97AC51A369C30FE48D2214A8470D895B8A89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glossy.ini

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\presets\Glossy\Glossy.ini
Size 8KB
SHA256 1b59aa7d27f97620e8a79640cc7129136461986c0fa6d05544cd63f019004859
MD5 188ad88641733896400d99529d52dabc
SHA1 adb9d4e65236cb8078537491f0faf9146e29a23f
SHA512 e9d95ffa01e5f0ec80af26f0c3f61babccc95f1df5bc1fd6e025afc2f9a279fc1f5a00ec16eebe8346cecbfcc6b1c0a1c6b15e4ad25f8b87c0fb85e4e6d2cdd9
SSDEEP 96:Q5YoYM37oBPugtGWtijcvvHIafxrRMstJfk7Z0zBX/ai4VhvQM+KEP5ouqtth3wZ:CeugtGWtlIQrRjO0zx/h4oM0XKe9t3
TLSH
T1DB02D8DACB3D0995ED479787C8A23AF118F631DB8CD4961C2CD824263CD2D8D090A92F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Very Glossy.ini

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\presets\Glossy\Very Glossy.ini
Size 9KB
SHA256 b9147d9d4cb79e31d7d64307ae3bcb9d0c58c3c23f3a8ddb24f2929b68f57f69
MD5 ebe04b3034f3f9266e128c848e46030d
SHA1 e1e5d14a11e07dff338e1058d7ae14b647d2cfaf
SHA512 3cf9a233bbd80f3669a3bdf8a5c97a6b5989f47b5e6dbdca5f7691cf277ed97bd9ca5e50ceb2cfdc08f6e5135209c6cfbd0176978d12c18416d4d2fc2c122170
SSDEEP 192:CnugtGWtlIQrRjO0zx/h4oM0Xz88mRFX9tG:Cnu+GWzIQrRjR/mX0XF2pDG
TLSH
T1B112E9DACB3D0995ED479787C8A236F018F631DB5CE4965D2DD824263CD2D8D090B92F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roshade High.ini

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\presets\Roshade\Roshade High.ini
Size 9KB
SHA256 f7209d5adc2a6a8c52411044f3d1e7c71c7d743539fb9a9b4db0ceaa1ee6fdd2
MD5 ecabb07bb46183b6a76b7a95ddbb848a
SHA1 e50a066d16fa996e7e2aefe44b449d92c870cb8e
SHA512 1838445d44e6734e8304609d959aa2c1c183a6d0a2ae602e2a0dc002df39b1d92e9d2d9fdf0a6ddcaa09b4ef5b2bd562bc972576d839bf751db1114d7c2fa2bd
SSDEEP 192:CA0/lyEE9wZ3WZUYiWrRDHBU8fM9G4lhIR:Cl479wZ3WCYnrRDH7Ucl
TLSH
T19522D9D6CB3D09A4ED479687D8B236F028F731DB98D4D61C2ED824262CD6D8D190B92F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roshade Low.ini

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\presets\Roshade\Roshade Low.ini
Size 9KB
SHA256 42a1f230a64b407c59653e5bfb82db1b157b023a1c8ab8b2f54b802f8f20c4a3
MD5 a3042e76af2efaa8ac2095f8b0d50f02
SHA1 b913c52b93d9d61c483974b936712739c2a0ce5a
SHA512 fa0620c35ca4747ff51a9634e165b8f4870bd7d26a0c9c5f4a8b66b2a230fa094f96371fd0962e06468d079a112e03d1fc7d767e9d1980b2b2b4ddfb19eaaeea
SSDEEP 96:Q5YoYM3vy0WXH+5lyEE9wZwhIWZyj5exvvibAfxrRMstZGjQ70K1CKt5r7Eb8+W/:CK0VlyEE9wZ3WZUWiWrR7nBU8jM9G3
TLSH
T16712D8DACB3D0995ED579787C8A236F118F631EB9CE0965D2DD824263CD2D8D090B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roshade Medium.ini

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\presets\Roshade\Roshade Medium.ini
Size 9KB
SHA256 f1e71132e00d97f858da712aa5a57dbc02dd2c9d84ea22cf9a24df31cedb7e06
MD5 48c50fc4a5a0013988a0a6894b0f1336
SHA1 da081c5bc4268b1ef376f89e80229306c5448679
SHA512 18d3a197d09875c5bd50861254e3966413b482c978df8d91b4cde0832035146a94fe5df9a90d2bc556fb96e999bf13adf117a5aba5f581a54fc542c68bac5275
SSDEEP 96:Q5YoYM3vI0WXD+5lyEE9wZwhIWZyj56KoxvvibAfxrRMstZWrjQ70KG5r7Eb89oH:Cg0/lyEE9wZ3WZUYiWrR7OBU8KM9G3
TLSH
T10E12F8DACB3D09A4ED479687D8A23AF018F731DB5CE4D65C2DD820266CD6D8D190A82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenscreen.ini

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\presets\Utility\Greenscreen.ini
Size 2KB
SHA256 7a48b3488e7b7b37fd8132b04913315cf915f5c7672844ae4fd0c291611e22a4
MD5 2bd3cbbb070cd3aa39bca3b1a27a5599
SHA1 a256bb9e98754627405ec3dbafaa7b1aac90b403
SHA512 417b32bd601bd2360ef4e60c36def5b1e27d2e3e36d599fec7b96729e665ab500db4649567e980e7fbb9336e223c0d3c724b4cac958c15fe2a54b20598bda0dd
TLSH
T14C5185C8C52D0A94EC93EA97ECBA36F224F3304FCCD4C96842EC50067DD5D8E981A51E
MD5 SHA1 SHA512 TLSH

Submit Download

RepositoryInfo.json

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\resources\RepositoryInfo.json
Size 877B
SHA256 8abd416a36ab91299f22187bb2ab8e40147d87618bb1c382e99537442b103c07
MD5 55ab797c9dc7db8b81cf1140c1b18dd3
SHA1 4b8bf5e3c477cdaad91768d8d376e45ee279f3a4
SHA512 e137ceafe29168304ef995c864a83c441dd72e9c1b923a832e52713bd04480ff4209b475af824fd377a33dbb46578e26e1946a85e4c43f92576dbec7726a2b7c
TLSH
T1E411DBA3DDAD0C2B4AF582D962641B13F1C5836F03894C4732B02A5D1FF2E8BE415D9E
MD5 SHA1 SHA512 TLSH

Submit Download

excludeShaders.json

Path C:\Users\Admin\AppData\Local\Temp\Roshade\files\global\resources\excludeShaders.json
Size 36B
SHA256 ab8b78143a2b43d55aff8b90eba889352f3e7670d5e02975d7c81947a0ab4c25
MD5 2a863b881c4b18c2cf21b38ddbc02bfc
SHA1 08cd8c3e3ae9457441c3f2a12760704557c0ac63
SHA512 83ad1e59d458c09bc007648f34364783d286383a67a9b7e07802474cc6f55570b2f894c34eb39b3d6b773ca84330561d750723130c66fd3dfc45c6f38f27f04f
MD5 SHA1 SHA512

Submit Download

memory/2400-131-0x00007FF836E70000-0x00007FF836E71000-memory.dmp

Download

memory/2472-290-0x00007FF719B40000-0x00007FF71A7B3000-memory.dmp

Download

memory/2472-0-0x00007FF719B40000-0x00007FF71A7B3000-memory.dmp

Download

memory/2472-246-0x00007FF719B40000-0x00007FF71A7B3000-memory.dmp

Download

memory/2760-287-0x0000024E0D0D0000-0x0000024E0D100000-memory.dmp

Download

memory/2760-76-0x00007FF835280000-0x00007FF835281000-memory.dmp

Download

memory/2760-77-0x00007FF8352E0000-0x00007FF8352E1000-memory.dmp

Download

memory/4456-26-0x00007FF836E70000-0x00007FF836E71000-memory.dmp

Download