423eff9f75de1ecb2d6ad2db77fb4b28c3d5b7fdb7c0cd49c26cfac533904c6a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe
Size

2.7MB
MD5

a1f6923e771b4ff0df9fec9555f97c65
SHA1

545359cd68d0ee37f4b15e1a22c2c9a5fda69e22
SHA256

928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1
SHA512

c9e54f48208151dcf60bf049d09a5c69f6ef7e4f046359fdfd50c61d49a6f9a37c3d3a2016d4beb70ae47270e9e9689e03064c02bee1e1d3d95998000e47f153
SSDEEP

49152:/i85nVhfVnQiGmEwZbyVKf3tOOr/o2rm0mMXgT11rNjiG0C+0LRzasw:a85nVZarmEwZecPzJWDLN+GwOnw

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Lightshot = "C:\\Program Files (x86)\\Skillbrains\\lightshot\\Lightshot.exe"	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-TPS4B.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-AHQPJ.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\is-OPNTM.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\is-E685V.tmp	setupupdater.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.dll	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-U6PE3.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-JTPHM.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-7KR0D.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-N5RPC.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-T912B.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-GAS4I.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-IBH3J.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\info.xml	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-9NK0S.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-QPQ8I.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\info.xml	setupupdater.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\net.dll	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-RDCN3.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-U0FRJ.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\is-BPEH7.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-3V403.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-VVMRI.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-VFPQQ.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-6V3NR.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-UHQ8C.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\unins000.dat	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-DGS66.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-D6QR9.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-0BAV1.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\unins000.dat	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-6D0H3.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-H93CB.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-QR8RB.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-S7AH7.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-IG2TP.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-9OHBE.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-9PRN1.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-GUHOK.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-5IK3C.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-71N2A.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-5Q0KL.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-72PQH.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-RA05Q.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe	setupupdater.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\MachineProducts.xml	Updater.exe
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-56956.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-3V1C3.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-P7L7F.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-T05GP.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-KQM59.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\Updater\Updater.exe	setupupdater.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-GJ0IG.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-JFGS6.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-7RD7F.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-UHITQ.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-GIKVA.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-EPP3M.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-1EQUA.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-79172.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-6SJQI.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-JDTEV.tmp	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\uploader.dll	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\update-sys.job	Updater.exe
File created	C:\Windows\Tasks\update-S-1-5-21-940600906-3464502421-4240639183-1000.job	updater.exe

Executes dropped EXE 14 IoCs

pid	Process
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2064	Lightshot.exe
2428	Lightshot.exe
2464	setupupdater.exe
1052	setupupdater.tmp
1744	Updater.exe
2032	Updater.exe
2080	Updater.exe
1472	Updater.exe
2340	Updater.exe
380	updater.exe
2696	updater.exe
2808	updater.exe
2784	updater.exe

Loads dropped DLL 19 IoCs

pid	Process
2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2064	Lightshot.exe
2064	Lightshot.exe
2428	Lightshot.exe
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2464	setupupdater.exe
2428	Lightshot.exe
1052	setupupdater.tmp
1052	setupupdater.tmp
2032	Updater.exe
1052	setupupdater.tmp
1472	Updater.exe
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
380	updater.exe
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2808	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
2692	taskkill.exe
1156	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000009c5689e4d712924587e02955631cdc68276563db9fe6fc00efcfd0596426305e000000000e8000000002000020000000eaa572c5cade14fe2b7f27933eac56e2a1bb4c9f74bcd205ac35219b8d0113fe2000000072146740307c5f535e1dda48e74f2f5e0297a488a74a00d55335b97d0492e4bd4000000001f954825551f3615a42e76a0b9dc650804570a663eb094f8616b6d192f4bde65b90195dedd431e28bc6cd3f53c11062d3741c9ea60ed91c2a4f1ca0d214defa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000073421ba2de49c0eebb86a9cd4dfdd6f61fda4f7f1b479a754b60dec34134f933000000000e8000000002000020000000dd3a6097c361fdccf2e430d1021581e92ebcd416ec5a7e608b30653f0b0f0c1690000000612a456c1166da868f3dcb23bc0c45d53383be64196a7e725bf275cb406b2d0b54c19cead2290f7c5dd33c611b2d20e390a6064f0b2639617e5e735c364922d782d4ad5d97722fcacdf4dcc5cc51a2026b99bd8965bbf5169a9b9acd2f524304dac696fc81017aa88e2f4ac5095293335d22f224e8c752d5131b99cbcaacc04c5ff1e0129ff362c70d98ae2e25f5ff8f40000000ee59fe37a84478fb09c29f30bbbc656edcce2262ae501bc3c17ec7b9b5d16860adec8720587a573c14114faeb8729090f800b2d39f1b45ab7c5907a3a497757d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20befa4a0fd2da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75B36AE1-3E02-11EF-9EB8-6A2ECC9B5790} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
1052	setupupdater.tmp
1052	setupupdater.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
2428	Lightshot.exe
2428	Lightshot.exe
2428	Lightshot.exe
1052	setupupdater.tmp
2196	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2428	Lightshot.exe
2428	Lightshot.exe
2428	Lightshot.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2704	2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe	30
PID 2212 wrote to memory of 2704	2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe	30
PID 2212 wrote to memory of 2704	2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe	30
PID 2212 wrote to memory of 2704	2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe	30
PID 2212 wrote to memory of 2704	2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe	30
PID 2212 wrote to memory of 2704	2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe	30
PID 2212 wrote to memory of 2704	2212	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe	30
PID 2704 wrote to memory of 2692	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	31
PID 2704 wrote to memory of 2692	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	31
PID 2704 wrote to memory of 2692	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	31
PID 2704 wrote to memory of 2692	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	31
PID 2704 wrote to memory of 1156	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	34
PID 2704 wrote to memory of 1156	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	34
PID 2704 wrote to memory of 1156	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	34
PID 2704 wrote to memory of 1156	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	34
PID 2704 wrote to memory of 2064	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	36
PID 2704 wrote to memory of 2064	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	36
PID 2704 wrote to memory of 2064	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	36
PID 2704 wrote to memory of 2064	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	36
PID 2064 wrote to memory of 2428	2064	Lightshot.exe	37
PID 2064 wrote to memory of 2428	2064	Lightshot.exe	37
PID 2064 wrote to memory of 2428	2064	Lightshot.exe	37
PID 2064 wrote to memory of 2428	2064	Lightshot.exe	37
PID 2704 wrote to memory of 2464	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	38
PID 2704 wrote to memory of 2464	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	38
PID 2704 wrote to memory of 2464	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	38
PID 2704 wrote to memory of 2464	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	38
PID 2704 wrote to memory of 2464	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	38
PID 2704 wrote to memory of 2464	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	38
PID 2704 wrote to memory of 2464	2704	928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp	38
PID 2464 wrote to memory of 1052	2464	setupupdater.exe	39
PID 2464 wrote to memory of 1052	2464	setupupdater.exe	39
PID 2464 wrote to memory of 1052	2464	setupupdater.exe	39
PID 2464 wrote to memory of 1052	2464	setupupdater.exe	39
PID 2464 wrote to memory of 1052	2464	setupupdater.exe	39
PID 2464 wrote to memory of 1052	2464	setupupdater.exe	39
PID 2464 wrote to memory of 1052	2464	setupupdater.exe	39
PID 1052 wrote to memory of 1800	1052	setupupdater.tmp	40
PID 1052 wrote to memory of 1800	1052	setupupdater.tmp	40
PID 1052 wrote to memory of 1800	1052	setupupdater.tmp	40
PID 1052 wrote to memory of 1800	1052	setupupdater.tmp	40
PID 1800 wrote to memory of 872	1800	net.exe	42
PID 1800 wrote to memory of 872	1800	net.exe	42
PID 1800 wrote to memory of 872	1800	net.exe	42
PID 1800 wrote to memory of 872	1800	net.exe	42
PID 1052 wrote to memory of 1744	1052	setupupdater.tmp	43
PID 1052 wrote to memory of 1744	1052	setupupdater.tmp	43
PID 1052 wrote to memory of 1744	1052	setupupdater.tmp	43
PID 1052 wrote to memory of 1744	1052	setupupdater.tmp	43
PID 1052 wrote to memory of 1744	1052	setupupdater.tmp	43
PID 1052 wrote to memory of 1744	1052	setupupdater.tmp	43
PID 1052 wrote to memory of 1744	1052	setupupdater.tmp	43
PID 1052 wrote to memory of 2032	1052	setupupdater.tmp	44
PID 1052 wrote to memory of 2032	1052	setupupdater.tmp	44
PID 1052 wrote to memory of 2032	1052	setupupdater.tmp	44
PID 1052 wrote to memory of 2032	1052	setupupdater.tmp	44
PID 1052 wrote to memory of 2032	1052	setupupdater.tmp	44
PID 1052 wrote to memory of 2032	1052	setupupdater.tmp	44
PID 1052 wrote to memory of 2032	1052	setupupdater.tmp	44
PID 2032 wrote to memory of 2080	2032	Updater.exe	45
PID 2032 wrote to memory of 2080	2032	Updater.exe	45
PID 2032 wrote to memory of 2080	2032	Updater.exe	45
PID 2032 wrote to memory of 2080	2032	Updater.exe	45
PID 2032 wrote to memory of 2080	2032	Updater.exe	45

C:\Users\Admin\AppData\Local\Temp\928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe
"C:\Users\Admin\AppData\Local\Temp\928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\is-KAS5S.tmp\928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KAS5S.tmp\928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp" /SL5="$40150,2148280,486912,C:\Users\Admin\AppData\Local\Temp\928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im lightshot.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill.exe" /F /IM lightshot.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe
    "C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe
      "C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2428
- - C:\Users\Admin\AppData\Local\Temp\is-24PV8.tmp\setupupdater.exe
    "C:\Users\Admin\AppData\Local\Temp\is-24PV8.tmp\setupupdater.exe" /verysilent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\is-OQEFG.tmp\setupupdater.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-OQEFG.tmp\setupupdater.tmp" /SL5="$901AE,490430,120832,C:\Users\Admin\AppData\Local\Temp\is-24PV8.tmp\setupupdater.exe" /verysilent
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" START SCHEDULE
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1800
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START SCHEDULE
        6⤵
        
        PID:872
    - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addsystask
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        
        PID:1744
    - - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2032
      - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
        6⤵
        Drops file in Program Files directory
        Executes dropped EXE
        
        PID:2080
    - - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1472
      - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
        6⤵
        Executes dropped EXE
        
        PID:2340
- - C:\Program Files (x86)\Skillbrains\Updater\updater.exe
    "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addtask
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:380
  - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
      "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addtask
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      PID:2696
- - C:\Program Files (x86)\Skillbrains\Updater\updater.exe
    "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2808
  - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
      "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
      4⤵
      Executes dropped EXE
      PID:2784
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://app.prntscr.com/thankyou_desktop.html#install_source=default
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2196
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Skillbrains\Updater\info.xml

Filesize
276B

MD5
466b19bc0b21fe6667778a0c114a9d25

SHA1
3b930a9a836f39467b7bfce4a35499fef7803c36

SHA256
efce940e2e2504326dce91e1112dc19c31a9de49f0fc34886389d36997594ef0

SHA512
1d995818bed8c356aa691ef19a6ce3df54c2fa08c086304f32b0f963934ca6402f1890bdd376d2cb411c58561e3740b73125a4cf0187ff49172d57b3b712028a

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.dll

Filesize
490KB

MD5
f256a9c7e68a249fe760019d19c022ce

SHA1
5a6279ef4f82270b756053cd34bba96d7fe0ce05

SHA256
04a27f0d1e89341722461119e00a10e00ec2a52f5e305961161ec4378e610e93

SHA512
a97f1cd4554d59ee0d69df6ebfc234e025c5e6e64c057f28c62f3743c8ccf8b502ce3eafc437a34a492b6b590fe62591293e551d0e7db5b6036890a64e6d8de9

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\EN.txt

Filesize
10KB

MD5
4d195562c84403dd347bd2c45403efc5

SHA1
4203bd1c9f0c0a2133ba7dc5ff1f9c86c942d131

SHA256
4a57246bd4ce9d387ec10f0ab2084c3d91e8463d03c1412f3665aee3885a85a5

SHA512
3de1ba358834c7d238e35f533a192c6e6e41fdf276a29b6714cf02636cad123eff571614a1185025757bec3e9f9f351d612598496600684e4ac676e576e8c601

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\uploader.dll

Filesize
215KB

MD5
08cf9e363d79c9379cabd75382131315

SHA1
22ce1f3506fc46976f2d5dcc5a5735ce8ede63bf

SHA256
037ee2f3243918fffa71b9e3fe0541245f75f89abcac0ccf2ea6a57020ddaad7

SHA512
cab0c8a5b8596054315c69f1ff858da1fad89ea1e3c28d4c90411c293b6b40438e2be67e029a51279637f2704e30903d0d4751e31fa1d1b2af0393af90c8907b

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\info.xml

Filesize
362B

MD5
105b94bb4070848b67cc3c23ab32afbf

SHA1
4ff607984309dd4b9c0ebc03a610d0022fd565c2

SHA256
f2cbf4e10f5f71841842c75ab97d2dc59a902a095e4ab54a25ad692c1d3aa1f0

SHA512
9007822bb83f56518570a8acb3b42a1ec79be26fc0dabc22ec40f569a725cbb4bff9b0801ec5e51af8753bce54474107582b72fc8f37e8e305e22255a0793041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
1KB

MD5
15d1677d993e94470db3f85c72391eda

SHA1
613bb8fba42cc750e1afc2ea25831f1f59c0100b

SHA256
7b61ab5b1447f7324cfc796ef51ae1d7631ff0e8d5bba16d04f55e6539840814

SHA512
282a52b8844b31225f8359f7be47db7d9def84146bd82814dcd5a856dddcd2bb3ff66243ec45f18046e2dd21ca8197214f694286ecc93e6e69b74b47e2aee90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
1KB

MD5
0971a028b5f19a45e24c424c771bd7b6

SHA1
6abd615a3845ad0a5af21323b4739696b4052f18

SHA256
7396fdb6e67f38d5a43f8940a7bd4846b927e16771a4e73499f408188659bd6d

SHA512
c3bdf9fb7603da43824d3c28875d976bab9231c84893bb8b9c1b4c082fc2adebdd921a0de546ab811996c3d0d79f1db595ba687a9c560ec75ac8c4fea8482e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
1KB

MD5
54cb01b97ac3b60f60323c9e5e229679

SHA1
19b3464ce47460c13add4c9096ab19f45717f164

SHA256
3dafff16748df1896b14130ba53d4ca0541194bd5fab1be46bfd03f002580686

SHA512
bf24638e4714193d112704c4a4677c5ba7be42486bc1a2cb94016e5f1f5e154ced4b09793c98c5f892c1cd88b93609542ae0e7faee97cfcbdfb0472ff0b0604b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_5ABD7D01BC4734045B6B5D27402C000C

Filesize
940B

MD5
0e1b2d2bdd6f6e35e7520e34250b4bab

SHA1
0135c04b26eb84ed2caefb09aa95417fa0ec8ba3

SHA256
ed84c9f8370f791573102104d58f5644990354924c4316913980e349c3128091

SHA512
ce30c90e618433e037715548cdd728d94e90368ea23663bbeaceb0c10e6844e3e5c919ad714dbcddbd172516dbe781e9cdf8a222d288c08b13220f67b76f90a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
512B

MD5
15e8c35d1886af27217c937d1b527f82

SHA1
97e11f516d6a4c1fc13aaf42d7628dde29a514bf

SHA256
06e0facca0224d880c3a16ef994e4f9464fc4e769ba74e5f444732b17965bb66

SHA512
2b96fa875b6d40c2581f52f3b9f11739e7cfbcadf57cf90791c41ed0e6f565d38dba1ece11cac5fcfce99df8e89ea302389bd79492670029fae191f7c86924b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
502B

MD5
7b075029c7be549a67a66dce093b3465

SHA1
134eaef13d6ad1a890d2a3f59b7afc6cfc3ae4b3

SHA256
8a8f32864c1804049cc7bac3e8d46eb06edd088509306dd36cfe97a8afcf913c

SHA512
10ef14f48bea12a06051e7e3eef3751557eefc7c65b50d52dcd79e52ec8ed680e0b4fea9e5225561abe5ff73acf0caff8205167314a89574368321f1d3d4d9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
502B

MD5
8042ff510529ca5637deffcf498d476a

SHA1
e035c1f0fc5f208d4c54a1647d1ac93669cf903f

SHA256
a62e18be8046f5b8ef752ef63fe35b8274969141ede2c1e3218543f86850b1eb

SHA512
6819daba896a57cacd263bda734d5a910a12f64f995cd799b3be7de043fc98adc2b5bc3cdee1915d4fdd5ac758f90c4e32c5595182d60c2976213f4d816894c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_5ABD7D01BC4734045B6B5D27402C000C

Filesize
520B

MD5
40e3119cdc48abbaf8d8612abd51adc8

SHA1
1fb62f6eded639d2290248b811f80aad37a284b7

SHA256
6a72700563d65d2cf3dab514e73d4f1aa4ac17a6aa70febf7d66077ecc77683f

SHA512
23e829d16780e157e12279d9c9a535bdcae04f4ec5bbe41a29d5592796df76abb875a104f32f4c5d9468ee151c29d70c11b5a51530c97b1e1276ff5cb4f6b02e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b690e981502ef6e54e9f99ec88a95ade

SHA1
715ee6796f5e49f5d1d4e188d3fcc08876ab529d

SHA256
e91b42c6190376dafbd294b3d824c97ad8d1c7fc9b9aa5ee8f9c791d7ce87fb4

SHA512
0499872586d4c3cdfa3b07f6d860bf12525c12fb257a5d26ba66a2b129d8faca254736cf1ac6431929b64e863af9d16ae0c34a9a561995cce26ebdea6783fcc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dfcff527c92e84035c152b2cfd46ff9

SHA1
6a84eb49a2c31316213f045bdf93819e5a0e0bae

SHA256
c46850a1f24d2d43147cb8404f521cfacf0a78ec28780dccc4181ac9229f8428

SHA512
ec3272d0d778ccaf3e4ebfbdc67cc29768a55b51a71a179d41bcdd80033cc001dd4716e5524c1ee77969723fb1d905e969aa71edd76b32c2fb8838ab7d751ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55a265709b4a16fed873d3cefe2b8414

SHA1
f406cf9be88b1519366af6489addc0ef5f117982

SHA256
632024dc7abafcea396ca8506a593d91920b708350aff82826ee1cadefeb1ad2

SHA512
b401ce68e629711446296c9ca23d773a96cc0b2b8361fbe6a5d91ff713b525b2e549dfb696e507b21847f4450bae21df2a153de554ea02094124640c116b3f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f8ead5a32f4a3125759f26cd22b97f6

SHA1
c6204387c47a73620e7e2d1e53c499a4867f1017

SHA256
4423392cae2cea6cfe499783226efb836c3b70f2d64ef078164d76263c330ea1

SHA512
13d7da6693db376237d9e545b71d71d8b7a5a94c25b5d25302a9537ff18cfc05328b615438fd2b46e2cf1526da2e883a837060d74ccebbe5c047c9bc0c7ed94a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baed194c43b6ece897004afeae9bfd46

SHA1
7ae18db412f2c4bd34b11392ee1a7d6e39dc8d0e

SHA256
1c396f9488b80ff539e73276ba9229a4911e11f5c4d91276a5fba9c24ab7e965

SHA512
8878cac9d0b037174e39ff42593773868d2c6e49804023000c8e0917d692e5e9ef0f00728dbffa1377ca46ba3d547ad432adcb437817ffc8334efc8383be7fce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f389d309571d633c341b7f7a813ff08

SHA1
b94d8976dc07be8f5082361c86dcfc69f061e13b

SHA256
d632122927d687dac05fd3a11541787fdc5f7014ebdb54b9fc86b89c0bcdb8ff

SHA512
f604a67b4d890bc1ffdfd14be93262bb9e3867ee117c3ca9735aa29a70f30a00e4a9201da168b2559f978d107005d64f2b74743ce892d92f0fe6022fee902203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0f5b5bb64fc39b8c2f88873466d4463

SHA1
0d17596584472c33bcf959c660eb7f3eaab06c87

SHA256
0bc4a45c07b1191c11025d97a54bc93d1c63cc94b1f10beff5f7d586027a4fa9

SHA512
5fa0f45307c0a1257d7247aef8a6dacca2421613449db6861c81aa58584c573cc24b7a69078248eaaaee7ef07d9c834029dde1170384dc586654b10e3b5e55b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9fc7deabb60b96f34af32d3a22a02c

SHA1
c1da2ef44e8eb527901d69c20751953c62498ec4

SHA256
0a2bb9cdb3e08f467164ae23e3757d2b0a56e4443d621fe8f66cc6bb8fe38f08

SHA512
b70cec8b74ee83d18daf290b8c48a93ecbf00d87037f24752783206d1e9c884b2764d4bbceb084387f216477a02fbf844851f632209b9b42d8af5beaedcb9af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
101a0763d0071d0c546e97e834615991

SHA1
c47f253905a6b5c2d35504f8313ee2057d40f9f8

SHA256
3744cbc13195ecf35058db1ce95403367455a0545ff973514971bd8778629c30

SHA512
3e93525bed4f7cf6c0353a379500460a703aca6b8247f372fed4bdade6f45ce770d63d8922d2ed0ba88a3269a20de24bcd80a43d89b6c2bde271ef77b42e2656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65c0f3b8164191e3ddacfad6e65f66c8

SHA1
aac37f9b1b80b294546bcfb96aa1a8c18135629b

SHA256
81a2b1f673f4f10ab5e96b98d417c69ed5237b70ffbcf877be549ab158db2f44

SHA512
aaad708101e5611f79bf8d96bbaa851c1a56ad1baa01cc3441eb4883e25cdf6fa8b2e11f75c956c4683938f0065bbe71e258229c71c0f4c3c0400d01c920d14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\n4uupnw\imagestore.dat

Filesize
5KB

MD5
c0cc11e71891fb0f2d4fe71c40da32fe

SHA1
c5b6eb8ef26f15a5e83e54e42b73919176458029

SHA256
b53f8e53e985b6ffddde913b3c048d5c573039160a02df15aaba57cf53323ee4

SHA512
6697e1bf085e939a89ac27042b2dd7cdb1264be444376f18ece739abb06b931dcbca2a9da85305706c918ec42d0191a5e89404e6dd9da03253f7908cf36a5739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT8UAXPK\__utm[1].gif

Filesize
35B

MD5
28d6814f309ea289f847c69cf91194c6

SHA1
0f4e929dd5bb2564f7ab9c76338e04e292a42ace

SHA256
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

SHA512
1d68b92e8d822fe82dc7563edd7b37f3418a02a89f1a9f0454cca664c2fc2565235e0d85540ff9be0b20175be3f5b7b4eae1175067465d5cca13486aab4c582c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XY2E4O3P\favicon[2].ico

Filesize
5KB

MD5
feb7ca0515d4660fc15fc4f42c8904ef

SHA1
4cf8b8a1bff5df3e74a7461913b502eaee0a4937

SHA256
b50109bb17a40d032cb6ee83163e10d220e0d19a19192cb71950063070888570

SHA512
a6d02aef62f841795a1f7ee6567072f625c31f6bf61dd73d2ffbd022ce429864b5c94e9c1b7a1d20110adccb0fa496898c186cebbf529c69dd9e6cc5d1a4a036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YUF3ZB4A\1[1].gif

Filesize
43B

MD5
df3e567d6f16d040326c7a0ea29a4f41

SHA1
ea7df583983133b62712b5e73bffbcd45cc53736

SHA256
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

SHA512
b2ca25a3311dc42942e046eb1a27038b71d689925b7d6b3ebb4d7cd2c7b9a0c7de3d10175790ac060dc3f8acf3c1708c336626be06879097f4d0ecaa7f567041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YUF3ZB4A\js[1].js

Filesize
256KB

MD5
ab04b68c718934f6569d16c37ff20f9d

SHA1
ff73dc2bb4726b9ac2bc3e1228e638e559558d18

SHA256
42baf9c76a8ef78f1168156313170f444ec50ff9562fd549b04ee9be73a4a827

SHA512
24be0804cb221b6bf93ec25a57509114a72199854bb2809a8310f014c26cf4040eeeff4b50c95477f0f74f8d8dc0f88740003af8f560ddcb2e3a209956a8dccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B50.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B51.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\updater.log

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ADR2Z06O.txt

Filesize
356B

MD5
e0edda7fde8ccf823650983fe4c5115c

SHA1
044988c372bc3962ed827c2095f51ae57e2a77c6

SHA256
2415a7fb3f7c3ae2a402feda2c8399c163885e5a424ed31f0f2ecf326b593260

SHA512
b0e9a6845e313e43a31d7a9742d5271ec1690aabbeaeb44d0b748fd848ba78f40cab506bd0394e8447a6cb4f145c4a2ac73bf8c967db38ebaaf76ad97cae1d64

Download Submit
\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe

Filesize
854KB

MD5
fbe0664e1c333e36e3ce73d8bd5cc8a1

SHA1
d7f284e9a8d3a3b5a832c37b58382000b583fbc1

SHA256
c4ce15b1bc8adecbf20a655256aab267c1d72e7a33947598af48ea287cca5670

SHA512
7b7e34aa69e2e92590b79d2b9c9fd095d15fc5a2943335d0f59cdee15083a8bb1a66b669615ce716bb714a59a1be54e8fea88a5889bfa8e0371e7eb8902fa555

Download Submit
\Program Files (x86)\Skillbrains\Updater\Updater.exe

Filesize
405KB

MD5
3ec8f4bd54ef439a8fab6467122da0c4

SHA1
ee2e65cbbaa22db70d89b85db28ee955d4db12f9

SHA256
a5e3bdc3b0b0bd6455892e23008161b5478b24f4fe1801f43a8a01cfff1bcba7

SHA512
0f50ce35241d5d55f0f3bae6fb38de39213a48d356478efac76c0292b286b58ddb855e130fd03bdf3cd63e141aa14ffd5318671e9885b2c17411f8ba3aba6189

Download Submit
\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe

Filesize
487KB

MD5
1e1c83b9680029ad4a9f8d3b3ac93197

SHA1
fa7b69793454131a5b21b32867533305651e2dd4

SHA256
0b899508777d7ed5159e2a99a5eff60c54d0724493df3d630525b837fa43aa51

SHA512
fe6f8df3dbbcc7535ead60028ec3e45801a33ccc81c9137b2288bc0d18be42379564c907eb406ce9491f46930690efa9a86a9f6506414992b5dba75adb3d1136

Download Submit
\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe

Filesize
221KB

MD5
62eb961457df016fa3949e9601a1a845

SHA1
0c0a5fa4f6cb9e18c0e3431d5e1bf45fd2e05352

SHA256
8d4c4bcf7d7aedf0480e3eaac52138e63724ae83c419de8a98d6ab32d1c93645

SHA512
fb4fcb6a3f5b7a3eb35a1689a0d15e3d8f9f520180d6cc57857b90b8af3d576da179c30c18019da5500f58d6f86c07645090e0c75accbd87257e1b73d291ae81

Download Submit
\Users\Admin\AppData\Local\Temp\is-24PV8.tmp\setupupdater.exe

Filesize
865KB

MD5
843d23f6aab075a3c032b06d30ce9c5d

SHA1
8e9f98e609db50ee6167a76b6ae1ca7886e6c866

SHA256
088f048ee972ef80bd527e301431c1ad7e46d0c994ad8a2b586c4fa6d86ac399

SHA512
101cc5a0a5c927adac497cf901ebfcb73bd92eec0b8855c8fa0aab0bb0411dcb5cc3271b6f73c0fdf6238a21df30871afcddf5bd8f0164ddaf8acd72d14a7db4

Download Submit
\Users\Admin\AppData\Local\Temp\is-KAS5S.tmp\928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1.tmp

Filesize
1.5MB

MD5
c6bffd4da620b07cb214f1bd8e7f21d2

SHA1
054221dc0c8a686e0d17edd6e02c06458b1395c3

SHA256
55dbb288d5df6df375487bae50661dbf530fd43a7e96017b7183a54db8fc376a

SHA512
91e50df87a6e42b01e24accead25726047a641c3960fa3336f560168ed68356e6992d289a0a71b629d74ad7b00bbdbf7e6e909a4c8b5b1616fbf3b0cc63210ab

Download Submit
\Users\Admin\AppData\Local\Temp\is-OQEFG.tmp\setupupdater.tmp

Filesize
1.1MB

MD5
3613e29d2a7b90c1012ec676819cc1cd

SHA1
a18f7ab9710eefa0678981b0be9a429dc6f98d28

SHA256
fb5761640bb6d375345b780df0f1811f6ae6a1ddeae7c948299379f8bca822c8

SHA512
837f3aedcfd81cfc0fcebc9e135f72a55c0cac10860ca78d57cd910d6f039afd500bbbff1481637f21912e5eacbdbebfdc3a3bb8133db2cb37f444ef87e6347b

Download Submit
memory/1052-234-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2212-10-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2212-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2212-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2212-901-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2464-190-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2464-236-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2704-450-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2704-11-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2704-8-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2704-900-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download