928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1

Resubmissions

22/02/2024, 16:49

240222-vbqc4scf6v 6

22/02/2024, 16:45

240222-t9m5zacf31 8

22/02/2024, 16:45

240222-t9darscf3v 1

22/02/2024, 16:41

240222-t68bqsce8v 6

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup-lightshot.exe
Size

2.7MB
MD5

a1f6923e771b4ff0df9fec9555f97c65
SHA1

545359cd68d0ee37f4b15e1a22c2c9a5fda69e22
SHA256

928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1
SHA512

c9e54f48208151dcf60bf049d09a5c69f6ef7e4f046359fdfd50c61d49a6f9a37c3d3a2016d4beb70ae47270e9e9689e03064c02bee1e1d3d95998000e47f153
SSDEEP

49152:/i85nVhfVnQiGmEwZbyVKf3tOOr/o2rm0mMXgT11rNjiG0C+0LRzasw:a85nVZarmEwZecPzJWDLN+GwOnw

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Lightshot = "C:\\Program Files (x86)\\Skillbrains\\lightshot\\Lightshot.exe"	setup-lightshot.tmp

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	setup-lightshot.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	setupupdater.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-3HDDL.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-M9MRT.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-4KQ83.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\unins000.dat	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\net.dll	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.dll	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-GUVPH.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-J0G3K.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-34ILG.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-RPO6G.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\DXGIODScreenshot.dll	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-LB7OL.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-MS5JK.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\Updater\Updater.exe	setupupdater.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\uploader.dll	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-JK95O.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-ED5DV.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-3HR0I.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-82GJG.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-GB55D.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-MCMQG.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\unins000.msg	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-NN1SO.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\info.xml	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-V2DP6.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-CSR1L.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-5J4EK.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-6DGH2.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-P5N2S.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-7GPQP.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-MOMV8.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-I0BMQ.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-0Q98E.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-J6SSE.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-6L1IA.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-2VPG6.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-6E3RK.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-ABIEQ.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-VIU5P.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-P36BE.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-1NBGM.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-V4F9V.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\is-EA3FL.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\unins000.dat	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\is-3U0VU.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\is-LHDAL.tmp	setupupdater.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-EGEAN.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-NQ0TL.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\is-IUSEF.tmp	setupupdater.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-7F54U.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-6H7NK.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-H1U25.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-QTMMB.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-20E6J.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-HLHAR.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-TK7T4.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-UTMKO.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe	setupupdater.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\Updater\MachineProducts.xml	Updater.exe
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-P7TJH.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-CCSRG.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-8VPLE.tmp	setup-lightshot.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\update-S-1-5-21-3844919115-497234255-166257750-1000.job	updater.exe
File created	C:\Windows\Tasks\update-sys.job	Updater.exe

Executes dropped EXE 14 IoCs

pid	Process
1072	setup-lightshot.tmp
2520	Lightshot.exe
4784	Lightshot.exe
3572	setupupdater.exe
2804	setupupdater.tmp
4476	Updater.exe
2468	Updater.exe
1384	Updater.exe
4756	Updater.exe
2364	Updater.exe
1760	updater.exe
5056	updater.exe
4556	updater.exe
4200	updater.exe

Loads dropped DLL 3 IoCs

pid	Process
4784	Lightshot.exe
4784	Lightshot.exe
4784	Lightshot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1084	taskkill.exe
4628	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "187"	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1072	setup-lightshot.tmp
1072	setup-lightshot.tmp
2804	setupupdater.tmp
2804	setupupdater.tmp
1752	msedge.exe
1752	msedge.exe
1600	msedge.exe
1600	msedge.exe
2084	identity_helper.exe
2084	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1072	setup-lightshot.tmp
2804	setupupdater.tmp
4784	Lightshot.exe
4784	Lightshot.exe
4784	Lightshot.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
4784	Lightshot.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4784	Lightshot.exe
4784	Lightshot.exe
4784	Lightshot.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
4784	Lightshot.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
112	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1072	4796	setup-lightshot.exe	87
PID 4796 wrote to memory of 1072	4796	setup-lightshot.exe	87
PID 4796 wrote to memory of 1072	4796	setup-lightshot.exe	87
PID 1072 wrote to memory of 1084	1072	setup-lightshot.tmp	88
PID 1072 wrote to memory of 1084	1072	setup-lightshot.tmp	88
PID 1072 wrote to memory of 1084	1072	setup-lightshot.tmp	88
PID 1072 wrote to memory of 4628	1072	setup-lightshot.tmp	91
PID 1072 wrote to memory of 4628	1072	setup-lightshot.tmp	91
PID 1072 wrote to memory of 4628	1072	setup-lightshot.tmp	91
PID 1072 wrote to memory of 2520	1072	setup-lightshot.tmp	93
PID 1072 wrote to memory of 2520	1072	setup-lightshot.tmp	93
PID 1072 wrote to memory of 2520	1072	setup-lightshot.tmp	93
PID 2520 wrote to memory of 4784	2520	Lightshot.exe	94
PID 2520 wrote to memory of 4784	2520	Lightshot.exe	94
PID 2520 wrote to memory of 4784	2520	Lightshot.exe	94
PID 1072 wrote to memory of 3572	1072	setup-lightshot.tmp	95
PID 1072 wrote to memory of 3572	1072	setup-lightshot.tmp	95
PID 1072 wrote to memory of 3572	1072	setup-lightshot.tmp	95
PID 3572 wrote to memory of 2804	3572	setupupdater.exe	96
PID 3572 wrote to memory of 2804	3572	setupupdater.exe	96
PID 3572 wrote to memory of 2804	3572	setupupdater.exe	96
PID 2804 wrote to memory of 1000	2804	setupupdater.tmp	97
PID 2804 wrote to memory of 1000	2804	setupupdater.tmp	97
PID 2804 wrote to memory of 1000	2804	setupupdater.tmp	97
PID 1000 wrote to memory of 4948	1000	net.exe	99
PID 1000 wrote to memory of 4948	1000	net.exe	99
PID 1000 wrote to memory of 4948	1000	net.exe	99
PID 2804 wrote to memory of 4476	2804	setupupdater.tmp	100
PID 2804 wrote to memory of 4476	2804	setupupdater.tmp	100
PID 2804 wrote to memory of 4476	2804	setupupdater.tmp	100
PID 2804 wrote to memory of 2468	2804	setupupdater.tmp	101
PID 2804 wrote to memory of 2468	2804	setupupdater.tmp	101
PID 2804 wrote to memory of 2468	2804	setupupdater.tmp	101
PID 2468 wrote to memory of 1384	2468	Updater.exe	103
PID 2468 wrote to memory of 1384	2468	Updater.exe	103
PID 2468 wrote to memory of 1384	2468	Updater.exe	103
PID 2804 wrote to memory of 4756	2804	setupupdater.tmp	104
PID 2804 wrote to memory of 4756	2804	setupupdater.tmp	104
PID 2804 wrote to memory of 4756	2804	setupupdater.tmp	104
PID 4756 wrote to memory of 2364	4756	Updater.exe	105
PID 4756 wrote to memory of 2364	4756	Updater.exe	105
PID 4756 wrote to memory of 2364	4756	Updater.exe	105
PID 1072 wrote to memory of 1760	1072	setup-lightshot.tmp	106
PID 1072 wrote to memory of 1760	1072	setup-lightshot.tmp	106
PID 1072 wrote to memory of 1760	1072	setup-lightshot.tmp	106
PID 1760 wrote to memory of 5056	1760	updater.exe	107
PID 1760 wrote to memory of 5056	1760	updater.exe	107
PID 1760 wrote to memory of 5056	1760	updater.exe	107
PID 1072 wrote to memory of 4556	1072	setup-lightshot.tmp	108
PID 1072 wrote to memory of 4556	1072	setup-lightshot.tmp	108
PID 1072 wrote to memory of 4556	1072	setup-lightshot.tmp	108
PID 4556 wrote to memory of 4200	4556	updater.exe	109
PID 4556 wrote to memory of 4200	4556	updater.exe	109
PID 4556 wrote to memory of 4200	4556	updater.exe	109
PID 1072 wrote to memory of 1600	1072	setup-lightshot.tmp	110
PID 1072 wrote to memory of 1600	1072	setup-lightshot.tmp	110
PID 1600 wrote to memory of 4536	1600	msedge.exe	111
PID 1600 wrote to memory of 4536	1600	msedge.exe	111
PID 1600 wrote to memory of 2124	1600	msedge.exe	112
PID 1600 wrote to memory of 2124	1600	msedge.exe	112
PID 1600 wrote to memory of 2124	1600	msedge.exe	112
PID 1600 wrote to memory of 2124	1600	msedge.exe	112
PID 1600 wrote to memory of 2124	1600	msedge.exe	112
PID 1600 wrote to memory of 2124	1600	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\setup-lightshot.exe
"C:\Users\Admin\AppData\Local\Temp\setup-lightshot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\is-0VC5I.tmp\setup-lightshot.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0VC5I.tmp\setup-lightshot.tmp" /SL5="$80182,2148280,486912,C:\Users\Admin\AppData\Local\Temp\setup-lightshot.exe"
  2⤵
  - Adds Run key to start application
  - Checks computer location settings
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im lightshot.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill.exe" /F /IM lightshot.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe
    "C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe
      "C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4784
- - C:\Users\Admin\AppData\Local\Temp\is-8OU1T.tmp\setupupdater.exe
    "C:\Users\Admin\AppData\Local\Temp\is-8OU1T.tmp\setupupdater.exe" /verysilent
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\is-8VE0J.tmp\setupupdater.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8VE0J.tmp\setupupdater.tmp" /SL5="$60218,490430,120832,C:\Users\Admin\AppData\Local\Temp\is-8OU1T.tmp\setupupdater.exe" /verysilent
      4⤵
      Checks computer location settings
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" START SCHEDULE
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1000
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START SCHEDULE
        6⤵
        
        PID:4948
    - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addsystask
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        
        PID:4476
    - - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
      - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
        6⤵
        Drops file in Program Files directory
        Executes dropped EXE
        
        PID:1384
    - - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4756
      - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
        6⤵
        Executes dropped EXE
        
        PID:2364
- - C:\Program Files (x86)\Skillbrains\Updater\updater.exe
    "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addtask
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
      "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addtask
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      PID:5056
- - C:\Program Files (x86)\Skillbrains\Updater\updater.exe
    "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
      "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
      4⤵
      Executes dropped EXE
      PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://app.prntscr.com/thankyou_desktop.html#install_source=default
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffc736746f8,0x7ffc73674708,0x7ffc73674718
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:60
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9271446832724794617,17578154859318273092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4304

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3940855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe

Filesize
854KB

MD5
fbe0664e1c333e36e3ce73d8bd5cc8a1

SHA1
d7f284e9a8d3a3b5a832c37b58382000b583fbc1

SHA256
c4ce15b1bc8adecbf20a655256aab267c1d72e7a33947598af48ea287cca5670

SHA512
7b7e34aa69e2e92590b79d2b9c9fd095d15fc5a2943335d0f59cdee15083a8bb1a66b669615ce716bb714a59a1be54e8fea88a5889bfa8e0371e7eb8902fa555

Download Submit
C:\Program Files (x86)\Skillbrains\Updater\Updater.exe

Filesize
405KB

MD5
3ec8f4bd54ef439a8fab6467122da0c4

SHA1
ee2e65cbbaa22db70d89b85db28ee955d4db12f9

SHA256
a5e3bdc3b0b0bd6455892e23008161b5478b24f4fe1801f43a8a01cfff1bcba7

SHA512
0f50ce35241d5d55f0f3bae6fb38de39213a48d356478efac76c0292b286b58ddb855e130fd03bdf3cd63e141aa14ffd5318671e9885b2c17411f8ba3aba6189

Download Submit
C:\Program Files (x86)\Skillbrains\Updater\info.xml

Filesize
276B

MD5
466b19bc0b21fe6667778a0c114a9d25

SHA1
3b930a9a836f39467b7bfce4a35499fef7803c36

SHA256
efce940e2e2504326dce91e1112dc19c31a9de49f0fc34886389d36997594ef0

SHA512
1d995818bed8c356aa691ef19a6ce3df54c2fa08c086304f32b0f963934ca6402f1890bdd376d2cb411c58561e3740b73125a4cf0187ff49172d57b3b712028a

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\DXGIODScreenshot.dll

Filesize
93KB

MD5
25c632cd2f529ba142fa706205ac00c9

SHA1
495b777348d26e5fa75dfbf6b50498428fe7748b

SHA256
6acdcd817cc5df637aa4cd101c25c9e0a69c778347a7a40ce7511eeea26fd6f0

SHA512
606e9856eb8153f9dab7f4c23ff967b2d9ce9fcf1902823a424ca4b4ee0a4f1a95bfdd316356dd65831c494f7e74ec4562bf684ab6a20c3376abef8ff10f6c7a

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.dll

Filesize
490KB

MD5
f256a9c7e68a249fe760019d19c022ce

SHA1
5a6279ef4f82270b756053cd34bba96d7fe0ce05

SHA256
04a27f0d1e89341722461119e00a10e00ec2a52f5e305961161ec4378e610e93

SHA512
a97f1cd4554d59ee0d69df6ebfc234e025c5e6e64c057f28c62f3743c8ccf8b502ce3eafc437a34a492b6b590fe62591293e551d0e7db5b6036890a64e6d8de9

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe

Filesize
487KB

MD5
1e1c83b9680029ad4a9f8d3b3ac93197

SHA1
fa7b69793454131a5b21b32867533305651e2dd4

SHA256
0b899508777d7ed5159e2a99a5eff60c54d0724493df3d630525b837fa43aa51

SHA512
fe6f8df3dbbcc7535ead60028ec3e45801a33ccc81c9137b2288bc0d18be42379564c907eb406ce9491f46930690efa9a86a9f6506414992b5dba75adb3d1136

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\EN.txt

Filesize
10KB

MD5
4d195562c84403dd347bd2c45403efc5

SHA1
4203bd1c9f0c0a2133ba7dc5ff1f9c86c942d131

SHA256
4a57246bd4ce9d387ec10f0ab2084c3d91e8463d03c1412f3665aee3885a85a5

SHA512
3de1ba358834c7d238e35f533a192c6e6e41fdf276a29b6714cf02636cad123eff571614a1185025757bec3e9f9f351d612598496600684e4ac676e576e8c601

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\uploader.dll

Filesize
215KB

MD5
08cf9e363d79c9379cabd75382131315

SHA1
22ce1f3506fc46976f2d5dcc5a5735ce8ede63bf

SHA256
037ee2f3243918fffa71b9e3fe0541245f75f89abcac0ccf2ea6a57020ddaad7

SHA512
cab0c8a5b8596054315c69f1ff858da1fad89ea1e3c28d4c90411c293b6b40438e2be67e029a51279637f2704e30903d0d4751e31fa1d1b2af0393af90c8907b

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe

Filesize
155KB

MD5
5bb33555e15c10155882818112ea0e58

SHA1
04db42d7495634e97fbd4610bde36b243ef25425

SHA256
2dfd7a463624c9640dd6b75e8c117b086403236b6a2c87bea5a4cd9158fd448f

SHA512
afa2bfb7708c77b702e7497f58f1b98bec7aa2ff8c69b998422e44ef6dcdff03571ce17a482fd1e34718b7862feb336a571dd41044dabe0f307cd1bd3f59bc66

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe

Filesize
221KB

MD5
62eb961457df016fa3949e9601a1a845

SHA1
0c0a5fa4f6cb9e18c0e3431d5e1bf45fd2e05352

SHA256
8d4c4bcf7d7aedf0480e3eaac52138e63724ae83c419de8a98d6ab32d1c93645

SHA512
fb4fcb6a3f5b7a3eb35a1689a0d15e3d8f9f520180d6cc57857b90b8af3d576da179c30c18019da5500f58d6f86c07645090e0c75accbd87257e1b73d291ae81

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\info.xml

Filesize
362B

MD5
105b94bb4070848b67cc3c23ab32afbf

SHA1
4ff607984309dd4b9c0ebc03a610d0022fd565c2

SHA256
f2cbf4e10f5f71841842c75ab97d2dc59a902a095e4ab54a25ad692c1d3aa1f0

SHA512
9007822bb83f56518570a8acb3b42a1ec79be26fc0dabc22ec40f569a725cbb4bff9b0801ec5e51af8753bce54474107582b72fc8f37e8e305e22255a0793041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
1KB

MD5
e8e36a09afced97f48d2c3e0095e4acb

SHA1
6802d0db0334204d8032c2eede27ec99ffb04045

SHA256
d7a6e62b907cce9b8773971d086023e8ec12b6bf7afe2e1635ec48249d409880

SHA512
fdd41abac6207c4b9ad3636b34cdbac7ac362deac52ac311f86dd116dd48bd108c7dc169c46cb4fce1e6aa60184eaa78f14e2e54b806cf0ff07e6572cc19b845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
1KB

MD5
c2c5244cb8210b3eb979087600961ff7

SHA1
b9300d107d1664fd2ec70beff90775448b38bf95

SHA256
2c005da5808eb7761d6a3f0625191bdecd8734497fad98c08f1103138e569d35

SHA512
ebfc29a84840e82aae13d4b79b419ffd9c64b6d79a9468bf92065afa63f2a1da595a9c33a96432bc3e1b204f128520122860639b1e41ec48deab5f5da43c3416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D391C1D03A63B66863342F8A4B64298F

Filesize
939B

MD5
050457968161a0815dbfb52a28685937

SHA1
a01dbcdc1faabc559a0b7efc795a4144fc26dbcd

SHA256
4da3c34b9ac15155144eb0b834f833ea3810e5caf83b6b8b5fa31ee7ae8c2de7

SHA512
2490153c8d625b5e15619093d95c9bcd3664bbb12e832220ac56b75d1fdb94e582cb075337c7d5d01653bf241b3480ce7448f5439aa216c01af92c2017fae481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
512B

MD5
b154840b030f19aa492cc222bcfed44b

SHA1
b4bbb324d77b67dafcb56bfa85f8399180368517

SHA256
2761444025ee9f9cceba7802416d41dc7d912018712940ed99d7379a15a11ace

SHA512
fdc9bcda62afd849afab0e5d5722a930e0b3bc5b8610f2e2ded85b4448c70545e3857e69937215411d85e2b79d1e5c84bf01dcc9b3e7106e174eb54f90a1f0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
512B

MD5
02cd68f969f4e36da82a9847240fc5dc

SHA1
1da9abe5bc6959d20d671221855c06be3ca2091d

SHA256
c4d63a14abb05118f760a622448ac920b0ed8518c317e1a2a6c80980c19fae8b

SHA512
5ca250449d546a7f1075b335cbc990fdc2be2a90b52bce3b13cb7125e09c5799d47a3564773f8c983bb8d9a05d832ecd5905250a7b37cb8c006815cb3ad8a928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
502B

MD5
05b8e16a73f8c54010c017f7a4199aa8

SHA1
b20dc1b68284f67b29022d185dbb6c77d7e5f1d6

SHA256
34f30ba244f44b62a459692d7d7da9ef9fcf4270310766285d8cfa4e06fa7ecf

SHA512
d93609ce2bea8ea1135fa7d2b2d7b89bfd404074d2a29caeaa1d10208d61e820402fad2e2deb7066d053fb228b747bc60547f009333d24da51f1e20139d8d904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
502B

MD5
51a175de8e4012fbb7aac7341b69efd8

SHA1
e08a1cb9aa24b9094a05647575a36f9d760602ba

SHA256
dd8e826fcadaa758ba57cb303eae4ba47ab63de6a3d0200e01f29f7d7d6ccbf3

SHA512
f38af5396b72601ec7d330dca4500293019cbddb9146e20556c73285ba06f3a1e632b31e0d48c17a6e577740cd68a1d33c3b9d348fb8514acbab1e42b13ae29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
502B

MD5
af3639d8b0e78d64f7e4c49093bab3e2

SHA1
6ae04aba14dcb30c43dd037812592816b6d0f152

SHA256
d1f60a3a571f390454eb21acef683beb12346b46598c2250826823ae977e9e14

SHA512
3e1d75ec0a54701fa2bd52a882f74a120a5c12322ec5ecdca386c6dcb6800be46da042f2793e0cfd1faf7d58f4f7c1a61e5c958d8519e1250a008a082d24461d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D391C1D03A63B66863342F8A4B64298F

Filesize
524B

MD5
3571da1518407e5a5d53759786ca08d9

SHA1
92d3d802b566d33cc1e47fbcca08368bb3d001c4

SHA256
98f32ca865bf423532f4cbcc46f2b2ddde708426aa0184a33230cbe15809eafd

SHA512
cdddb2f03dd12344fb3422cb2cc6c728770878fadfe1346392e8ce1c798e8f96dfe3cca4f188a3b2aac06493aaf1c65bcbc907e7ef444e1a294cc4702f6796a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D391C1D03A63B66863342F8A4B64298F

Filesize
524B

MD5
8469d723b6b5b3b51078e97772a8868f

SHA1
7266b9db196f289272ecc2de8de5e691a44dca61

SHA256
5caf17d2e5008b6c72532823db2b81fd1f9aa262e037873ad79d1086752c190c

SHA512
331245dbb4758fba8325a87ff2b888eea7edc57402ab63874ba4c58925625d77db61b9fd78334589cf7d0824f3d138fbe090a234bf679e58ba27acdf6bae54af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
01e96b8102878dd58985875a3def9530

SHA1
8619367bf9bb387cb3f1c3fec88253d37f05652b

SHA256
bc5e9b28854ef3d8a38c2393035df48bcf999ec2971384463e1a9d93341cb58d

SHA512
df2963e21bb142cba9da756a31982b0ee69c1b4b4b237b01005a76964edc5e22179994795715e2841c51140581d013ce8a2ef447f0c869f0fbcf3c47928a141e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
80b4e6428f1de066aacea0d75d111c69

SHA1
21f7ac5203c7150092c92f3edbd9db50081ab250

SHA256
9ee65b7ddb72def55bcd503e42957d6ca06c2a8f5592b9d64495afa7b4702574

SHA512
2923ebd24da353e71fc7e62dac897f7dafc46777850b282fc8a866f7e0bbb5eec257eb09ebdf07285df455adb386bcbcf4aa99961c09a8cde76ef302e20ecb52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbb6c090e1f421cf6b3efd8202ec9de4

SHA1
91fc080394836fd13e4871499bf199c7e5ee8725

SHA256
c152dc8c3a2877e6baf19671d280cfb6fe2422fd97f4afd5435c25ecc261a880

SHA512
03c3f92df4b5fc6530fd48554fa6cd73f0fc69e8e2b1db53c9ca2c4a4f9636ce60cba24a0ad8c3e86ba827edfaed4de5716fabf6f5d8886b8ed270369c3b020b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
39059553f5dc5e33555d37176620bb9e

SHA1
4c2a96d1a527def928ba5fbd493ca5928042bb42

SHA256
68f33ec6e438a229c60eae52df580dae7ddb19bb6f238246fffebcac64c2cb33

SHA512
735be261523f58b27916f929e644f038157c3d63f4689c48e195a20ed1738dd0d88e059c296d1cf72b83f6fa15c9dcd2b7a5686c8a39d8622a09bbd57b7ffb43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f028753d7ab923cefe32a40a0c4a545

SHA1
8297e6e1112e6b745c9b6cffa6d60b7247f1c8f8

SHA256
62e8c645408a38c997e792042554b9607e76fdede6192030fdd41bbaff8e4394

SHA512
ae79d89fdea227eee0d09d80afca5a60d7f0c4b163ac43c7ca81ceef30bbf2fa8333ee51860fe58f2509f120d36a56891f3177493cef378a33d7917773a684ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P7A8EDPX\1[2].gif

Filesize
43B

MD5
df3e567d6f16d040326c7a0ea29a4f41

SHA1
ea7df583983133b62712b5e73bffbcd45cc53736

SHA256
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

SHA512
b2ca25a3311dc42942e046eb1a27038b71d689925b7d6b3ebb4d7cd2c7b9a0c7de3d10175790ac060dc3f8acf3c1708c336626be06879097f4d0ecaa7f567041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P7A8EDPX\__utm[1].gif

Filesize
35B

MD5
28d6814f309ea289f847c69cf91194c6

SHA1
0f4e929dd5bb2564f7ab9c76338e04e292a42ace

SHA256
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

SHA512
1d68b92e8d822fe82dc7563edd7b37f3418a02a89f1a9f0454cca664c2fc2565235e0d85540ff9be0b20175be3f5b7b4eae1175067465d5cca13486aab4c582c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0VC5I.tmp\setup-lightshot.tmp

Filesize
1.5MB

MD5
c6bffd4da620b07cb214f1bd8e7f21d2

SHA1
054221dc0c8a686e0d17edd6e02c06458b1395c3

SHA256
55dbb288d5df6df375487bae50661dbf530fd43a7e96017b7183a54db8fc376a

SHA512
91e50df87a6e42b01e24accead25726047a641c3960fa3336f560168ed68356e6992d289a0a71b629d74ad7b00bbdbf7e6e909a4c8b5b1616fbf3b0cc63210ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8OU1T.tmp\setupupdater.exe

Filesize
865KB

MD5
843d23f6aab075a3c032b06d30ce9c5d

SHA1
8e9f98e609db50ee6167a76b6ae1ca7886e6c866

SHA256
088f048ee972ef80bd527e301431c1ad7e46d0c994ad8a2b586c4fa6d86ac399

SHA512
101cc5a0a5c927adac497cf901ebfcb73bd92eec0b8855c8fa0aab0bb0411dcb5cc3271b6f73c0fdf6238a21df30871afcddf5bd8f0164ddaf8acd72d14a7db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8VE0J.tmp\setupupdater.tmp

Filesize
1.1MB

MD5
3613e29d2a7b90c1012ec676819cc1cd

SHA1
a18f7ab9710eefa0678981b0be9a429dc6f98d28

SHA256
fb5761640bb6d375345b780df0f1811f6ae6a1ddeae7c948299379f8bca822c8

SHA512
837f3aedcfd81cfc0fcebc9e135f72a55c0cac10860ca78d57cd910d6f039afd500bbbff1481637f21912e5eacbdbebfdc3a3bb8133db2cb37f444ef87e6347b

Download Submit
C:\Users\Admin\AppData\Local\updater.log

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
memory/1072-352-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1072-471-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1072-5-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1072-8-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1072-338-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2804-192-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/2804-226-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/3572-180-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3572-184-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3572-228-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4796-7-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4796-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4796-472-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download