File scan report
Verdict Safe
Is Roshutsu. exe safe? Yes, no threats found.
None of the 71 antivirus engines that checked it flag this widely shared executable, first seen on Dec 18, 2021, and five sandbox runs showed no high-risk behaviour.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This file can be used normally; obtain it from the original source you trust and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
1 point against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
It has been submitted by 840 distinct sources since Dec 18, 2021, and sandbox runs recorded only routine activity with no injection, persistence or known-bad network contacts.
No engine flagged the file, and every major antivirus engine reported it clean. The file is widely distributed, with 840 distinct submitters over several years, which is typical of ordinary software. The combined sandbox verdict was clean, mapped only techniques common in legitimate software, and contacted no hosts with a malicious or suspicious reputation among the 24 checked. Reference databases and community malware rules returned no matches, and the antivirus analysis found no packing. The lack of a code signature is the main gap, but nothing else points to harm.
What We Detected
None of the 71 antivirus engines that checked it flagged this 64-bit Windows executable. It was first seen on Dec 18, 2021 and has been submitted by 840 distinct sources. Public malware databases and community rule sets returned no matches, and the antivirus analysis found no packer or encrypted code.
Threat Behavior
Across five sandbox runs the combined verdict was clean. Only techniques common in legitimate software were recorded; no process injection, persistence or dropped files were observed, and none of the 24 contacted hosts we checked has a malicious or suspicious reputation. Most network contacts were the analysis machine's own background traffic.
What To Do Now
The evidence supports normal use. The file is unsigned, so download it from the original source you trust and keep your security software enabled.
Where this verdict could be wrong2 caveats
- The file is unsigned, so its author cannot be confirmed from a signature.
- One third-party community annotation tagged the file as greyware, though no antivirus engine supports that label.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file, and all major antivirus engines reported it clean.
- Shared by 840 distinct sources since Dec 18, 2021.
- The combined sandbox verdict was clean with no high-risk techniques.
- No matches in public malware databases or community malware rules.
- No packing or encrypted code found by the antivirus analysis.
- The executable carries no code signature, so its publisher cannot be confirmed.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 6sandbox rule tags
- 2spawned processes
- 9network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1129· Loads modules
- T1574.002· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
Roshutsu.exe%SAMPLEPATH%\Roshutsu.exe105b3f64ede564752ecfc6d3c2d2bff1be42ebddca7113faf520253e56c06512.exe%SAMPLEPATH%\105b3f64ede564752ecfc6d3c2d2bff1be42ebddca7113faf520253e56c06512.exe
Network contacts
99 hosts, listed as 4 domains, 5 addresses. Links show the host and path only.
- Domain
cdn.onenote.net - Domain
telemetry-incoming.r53-2.services.mozilla.com - Domain
prod.ingestion-edge.prod.dataops.mozgcp.net - Domain
prda.aadg.msidentity.com - IP address
104.69.90.31 - IP address
23.40.197.137
Show all 9 entries for network contacts
- IP address
23.6.103.183 - IP address
23.215.176.107 - IP address
104.98.118.160
Files
15Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2AD.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2BE.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2CF.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER213E.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21FA.tmp.csv
Show all 15 entries for files
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER222A.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER23EF.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER23F0.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2401.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C5C.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D18.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D57.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER37E3.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER37F5.tmp.csv
Sandbox background — not the file
29The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google2484_1477413519\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3760_1305019971\bin\updater.exe - VM process
updater.exeC:\Program Files\Google1936_279449802\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
Show all 29 entries for sandbox background — not the file
- VM injection target
C:\Program Files\Google2484_1477413519\bin\updater.exe - VM injection target
C:\Program Files\Google3760_1305019971\bin\updater.exe - VM injection target
C:\Program Files\Google1936_279449802\bin\updater.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
fp2e7a.wpc.phicdn.net - VM host
fp2E7A.wpc.2BE4.phicdn.net - VM host
192.168.0.23 - VM host
a83f:8110:0:0:678c:21:0:0 - VM host
20.80.129.13 - VM host
a83f:8110:c062:4e00:0:0:0:0 - VM host
23.216.147.64 - VM host
20.99.132.105 - VM host
a83f:8110:100:0:0:0:e00:0 - VM host
20.99.133.109 - VM host
a83f:8110:0:0:ffff:ffff:ffff:ffff - VM host
20.69.140.28 - VM host
192.229.211.108 - VM host
23.216.147.76 - VM host
20.99.185.48 - VM host
184.25.191.235 - VM host
20.99.184.37
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 25, 2026, 9:23 AM UTC
- SHA-256
105b3f64ede564752ecfc6d3c2d2bff1be42ebddca7113faf520253e56c06512- SHA-1
3ccf89ac311c699b16429a9135274895f4e5b2eb- MD5
34f5d9ec87b765b33e178b80e589829e
About this file
Roshutsu.exe is a Win32 EXE file of 653.8 kB.
- Type and size
- Win32 EXE · 653.8 kB
- Signer
- UnsignedNo code signature.
- First seen
- Dec 18, 2021On VirusTotal.
- Submitted by
- 840 distinct sources
- Packer
- None detected
- Entropy
- 1.18 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Roshutsu.exe safe?
What is Roshutsu.exe?
How many antivirus engines detected Roshutsu.exe?
What is the SHA-256 hash of Roshutsu.exe?
Is it safe to run Roshutsu.exe?
How up to date is this analysis of Roshutsu.exe?
Community
Member reviews and reports for this exact file hash.