hxxps://app-prntscr-com[.]translate[.]goog/en/index[.]html?_x_tr_sl=en&_x_tr_tl=lv&_x_tr_hl=lv&_x_tr_pto=sc

Analysis

max time kernel
300s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app-prntscr-com.translate.goog/en/index.html?_x_tr_sl=en&_x_tr_tl=lv&_x_tr_hl=lv&_x_tr_pto=sc

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	setup-lightshot.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	setupupdater.tmp

Executes dropped EXE 17 IoCs

pid	Process
4452	setup-lightshot.exe
664	setup-lightshot.tmp
1392	Lightshot.exe
2264	Lightshot.exe
1432	setupupdater.exe
756	setupupdater.tmp
1492	Updater.exe
2736	Updater.exe
760	Updater.exe
1244	Updater.exe
1924	Updater.exe
1492	updater.exe
2912	updater.exe
4596	updater.exe
2860	updater.exe
3880	setup-lightshot.exe
760	setup-lightshot.tmp

Loads dropped DLL 3 IoCs

pid	Process
2264	Lightshot.exe
2264	Lightshot.exe
2264	Lightshot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Lightshot = "C:\\Program Files (x86)\\Skillbrains\\lightshot\\Lightshot.exe"	setup-lightshot.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-EP9I0.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\MachineProducts.xml	Updater.exe
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.dll	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-VNMPV.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-7A3CL.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-QL4J8.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-H1UO5.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-73S6R.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-FH3EF.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-VOF8T.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-177RF.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\is-O4F5T.tmp	setupupdater.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\is-M01Q5.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-Q3EAP.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-3FA3T.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\info.xml	setupupdater.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\info.xml	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-V6Q82.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-4B3F4.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-MJSH8.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-BIFE4.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-3L9NP.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-421IF.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-53N1T.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-6P15J.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-5JLU2.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-9B0VC.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\Updater\MachineProducts.xml	Updater.exe
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-IUAK8.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-9MK90.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-QPGQL.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-DJKSG.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-N3JFF.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\DXGIODScreenshot.dll	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-SO03Q.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-8NRAM.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-M392B.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-B6QUL.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-MFP1L.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-INJ1B.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-7R0F5.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-BRVKQ.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-F4DPA.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-U7OO1.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-PD008.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-HKRPM.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\net.dll	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-DNP4V.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-P5F0H.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-PNU1R.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\Updater\Updater.exe	setupupdater.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-QEKLG.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-S0H6F.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-67PMD.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-3C3N3.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-0UM4D.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\is-7G9FG.tmp	setupupdater.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\unins000.dat	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-S7PC5.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-2CENJ.tmp	setup-lightshot.tmp
File opened for modification	C:\Program Files (x86)\Skillbrains\lightshot\unins000.dat	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\is-QSRSR.tmp	setup-lightshot.tmp
File created	C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\is-8MUPE.tmp	setup-lightshot.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\update-sys.job	Updater.exe
File created	C:\Windows\Tasks\update-S-1-5-21-2650514177-1034912467-4025611726-1000.job	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4344	taskkill.exe
1924	taskkill.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133658534368252193"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "88"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "4"	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5c00310000000000f358c04810004c49474854537e310000440009000400efbef358c048f358c0482e00000035340200000009000000000000000000000000000000cdafc2004c006900670068007400730068006f007400000018000000	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Lightshot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Lightshot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Lightshot.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2650514177-1034912467-4025611726-1000\{92B7A786-319C-4D1D-94FE-5352BDBF059D}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Lightshot.exe
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Lightshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Lightshot.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Lightshot.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
664	setup-lightshot.tmp
664	setup-lightshot.tmp
756	setupupdater.tmp
756	setupupdater.tmp
5680	msedge.exe
5680	msedge.exe
5360	msedge.exe
5360	msedge.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5204	Process not Found
3836	Process not Found
1188	Process not Found
472	Process not Found
3648	Process not Found
756	Process not Found
5216	Process not Found
2280	Process not Found
764	Process not Found
6068	Process not Found
1580	Process not Found
5792	Process not Found
5220	Process not Found
5312	Process not Found
4780	Process not Found
4356	Process not Found
1920	Process not Found
552	Process not Found
2064	Process not Found
1424	Process not Found
6112	Process not Found
5700	Process not Found
2392	Process not Found
1036	Process not Found
444	Process not Found
5424	Process not Found
1720	Process not Found
228	Process not Found
4520	Process not Found
812	Process not Found
1112	Process not Found
3064	Process not Found
6116	Process not Found
2252	Process not Found
2736	Process not Found
440	Process not Found
5024	Process not Found
5352	Process not Found
1164	Process not Found
4700	Process not Found
5564	Process not Found
3368	Process not Found
220	Process not Found
5620	Process not Found
3660	Process not Found
1656	Process not Found
5300	Process not Found
5784	Process not Found
1900	Process not Found
2156	Process not Found
5844	Process not Found
4996	Process not Found
5552	Process not Found
6104	Process not Found
5828	Process not Found
6088	Process not Found
6096	Process not Found
6016	Process not Found
5624	Process not Found
760	Process not Found
6032	Process not Found
996	Process not Found
2416	Process not Found
5152	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeDebugPrivilege	4344	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe
Token: SeShutdownPrivilege	3872	chrome.exe
Token: SeCreatePagefilePrivilege	3872	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
664	setup-lightshot.tmp
2264	Lightshot.exe
2264	Lightshot.exe
2264	Lightshot.exe
756	setupupdater.tmp
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of SendNotifyMessage 53 IoCs

pid	Process
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
2264	Lightshot.exe
2264	Lightshot.exe
2264	Lightshot.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
2264	Lightshot.exe
2264	Lightshot.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	Lightshot.exe
3532	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3580	3872	chrome.exe	84
PID 3872 wrote to memory of 3580	3872	chrome.exe	84
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 3632	3872	chrome.exe	85
PID 3872 wrote to memory of 4492	3872	chrome.exe	86
PID 3872 wrote to memory of 4492	3872	chrome.exe	86
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87
PID 3872 wrote to memory of 2112	3872	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app-prntscr-com.translate.goog/en/index.html?_x_tr_sl=en&_x_tr_tl=lv&_x_tr_hl=lv&_x_tr_pto=sc
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe2252cc40,0x7ffe2252cc4c,0x7ffe2252cc58
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4516,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4476,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4380,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4364,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5156,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3180,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5708,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5624,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5772,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4780
- C:\Users\Admin\Downloads\setup-lightshot.exe
  "C:\Users\Admin\Downloads\setup-lightshot.exe"
  2⤵
  - Executes dropped EXE
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\is-LDT4N.tmp\setup-lightshot.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LDT4N.tmp\setup-lightshot.tmp" /SL5="$B0054,2148280,486912,C:\Users\Admin\Downloads\setup-lightshot.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:664
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im lightshot.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /F /IM lightshot.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1924
  - - C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe
      "C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe"
      4⤵
      Executes dropped EXE
      PID:1392
    - - C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe
        
        "C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\is-APUNP.tmp\setupupdater.exe
      "C:\Users\Admin\AppData\Local\Temp\is-APUNP.tmp\setupupdater.exe" /verysilent
      4⤵
      Executes dropped EXE
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\is-6CSGK.tmp\setupupdater.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6CSGK.tmp\setupupdater.tmp" /SL5="$201EE,490430,120832,C:\Users\Admin\AppData\Local\Temp\is-APUNP.tmp\setupupdater.exe" /verysilent
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:756
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" START SCHEDULE
        6⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 START SCHEDULE
        7⤵
        
        PID:3784
      - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addsystask
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1492
      - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
        6⤵
        Executes dropped EXE
        
        PID:2736
        
        C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:760
      - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
        6⤵
        Executes dropped EXE
        
        PID:1244
        
        C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
        7⤵
        Executes dropped EXE
        
        PID:1924
  - - C:\Program Files (x86)\Skillbrains\Updater\updater.exe
      "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addtask
      4⤵
      Executes dropped EXE
      PID:1492
    - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addtask
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2912
  - - C:\Program Files (x86)\Skillbrains\Updater\updater.exe
      "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
        
        "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
        5⤵
        Executes dropped EXE
        
        PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://app.prntscr.com/thankyou_desktop.html#install_source=default
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe10bb46f8,0x7ffe10bb4708,0x7ffe10bb4718
        5⤵
        
        PID:5376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2264642017983989768,491773926689931383,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        5⤵
        
        PID:5672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2264642017983989768,491773926689931383,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2264642017983989768,491773926689931383,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2264642017983989768,491773926689931383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:5924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2264642017983989768,491773926689931383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2264642017983989768,491773926689931383,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
        5⤵
        
        PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=756,i,1129004529895692030,17695046914710658792,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2008

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:1784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5964

C:\Users\Admin\Desktop\setup-lightshot.exe
"C:\Users\Admin\Desktop\setup-lightshot.exe"
1⤵
- Executes dropped EXE
PID:3880
- C:\Users\Admin\AppData\Local\Temp\is-3I3MV.tmp\setup-lightshot.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3I3MV.tmp\setup-lightshot.tmp" /SL5="$30304,2148280,486912,C:\Users\Admin\Desktop\setup-lightshot.exe"
  2⤵
  - Executes dropped EXE
  PID:760

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38cc055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe

Filesize
854KB

MD5
fbe0664e1c333e36e3ce73d8bd5cc8a1

SHA1
d7f284e9a8d3a3b5a832c37b58382000b583fbc1

SHA256
c4ce15b1bc8adecbf20a655256aab267c1d72e7a33947598af48ea287cca5670

SHA512
7b7e34aa69e2e92590b79d2b9c9fd095d15fc5a2943335d0f59cdee15083a8bb1a66b669615ce716bb714a59a1be54e8fea88a5889bfa8e0371e7eb8902fa555

Download Submit
C:\Program Files (x86)\Skillbrains\Updater\Updater.exe

Filesize
405KB

MD5
3ec8f4bd54ef439a8fab6467122da0c4

SHA1
ee2e65cbbaa22db70d89b85db28ee955d4db12f9

SHA256
a5e3bdc3b0b0bd6455892e23008161b5478b24f4fe1801f43a8a01cfff1bcba7

SHA512
0f50ce35241d5d55f0f3bae6fb38de39213a48d356478efac76c0292b286b58ddb855e130fd03bdf3cd63e141aa14ffd5318671e9885b2c17411f8ba3aba6189

Download Submit
C:\Program Files (x86)\Skillbrains\Updater\info.xml

Filesize
276B

MD5
466b19bc0b21fe6667778a0c114a9d25

SHA1
3b930a9a836f39467b7bfce4a35499fef7803c36

SHA256
efce940e2e2504326dce91e1112dc19c31a9de49f0fc34886389d36997594ef0

SHA512
1d995818bed8c356aa691ef19a6ce3df54c2fa08c086304f32b0f963934ca6402f1890bdd376d2cb411c58561e3740b73125a4cf0187ff49172d57b3b712028a

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\DXGIODScreenshot.dll

Filesize
93KB

MD5
25c632cd2f529ba142fa706205ac00c9

SHA1
495b777348d26e5fa75dfbf6b50498428fe7748b

SHA256
6acdcd817cc5df637aa4cd101c25c9e0a69c778347a7a40ce7511eeea26fd6f0

SHA512
606e9856eb8153f9dab7f4c23ff967b2d9ce9fcf1902823a424ca4b4ee0a4f1a95bfdd316356dd65831c494f7e74ec4562bf684ab6a20c3376abef8ff10f6c7a

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.dll

Filesize
490KB

MD5
f256a9c7e68a249fe760019d19c022ce

SHA1
5a6279ef4f82270b756053cd34bba96d7fe0ce05

SHA256
04a27f0d1e89341722461119e00a10e00ec2a52f5e305961161ec4378e610e93

SHA512
a97f1cd4554d59ee0d69df6ebfc234e025c5e6e64c057f28c62f3743c8ccf8b502ce3eafc437a34a492b6b590fe62591293e551d0e7db5b6036890a64e6d8de9

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe

Filesize
487KB

MD5
1e1c83b9680029ad4a9f8d3b3ac93197

SHA1
fa7b69793454131a5b21b32867533305651e2dd4

SHA256
0b899508777d7ed5159e2a99a5eff60c54d0724493df3d630525b837fa43aa51

SHA512
fe6f8df3dbbcc7535ead60028ec3e45801a33ccc81c9137b2288bc0d18be42379564c907eb406ce9491f46930690efa9a86a9f6506414992b5dba75adb3d1136

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\EN.txt

Filesize
10KB

MD5
4d195562c84403dd347bd2c45403efc5

SHA1
4203bd1c9f0c0a2133ba7dc5ff1f9c86c942d131

SHA256
4a57246bd4ce9d387ec10f0ab2084c3d91e8463d03c1412f3665aee3885a85a5

SHA512
3de1ba358834c7d238e35f533a192c6e6e41fdf276a29b6714cf02636cad123eff571614a1185025757bec3e9f9f351d612598496600684e4ac676e576e8c601

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\uploader.dll

Filesize
215KB

MD5
08cf9e363d79c9379cabd75382131315

SHA1
22ce1f3506fc46976f2d5dcc5a5735ce8ede63bf

SHA256
037ee2f3243918fffa71b9e3fe0541245f75f89abcac0ccf2ea6a57020ddaad7

SHA512
cab0c8a5b8596054315c69f1ff858da1fad89ea1e3c28d4c90411c293b6b40438e2be67e029a51279637f2704e30903d0d4751e31fa1d1b2af0393af90c8907b

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe

Filesize
221KB

MD5
62eb961457df016fa3949e9601a1a845

SHA1
0c0a5fa4f6cb9e18c0e3431d5e1bf45fd2e05352

SHA256
8d4c4bcf7d7aedf0480e3eaac52138e63724ae83c419de8a98d6ab32d1c93645

SHA512
fb4fcb6a3f5b7a3eb35a1689a0d15e3d8f9f520180d6cc57857b90b8af3d576da179c30c18019da5500f58d6f86c07645090e0c75accbd87257e1b73d291ae81

Download Submit
C:\Program Files (x86)\Skillbrains\lightshot\info.xml

Filesize
362B

MD5
105b94bb4070848b67cc3c23ab32afbf

SHA1
4ff607984309dd4b9c0ebc03a610d0022fd565c2

SHA256
f2cbf4e10f5f71841842c75ab97d2dc59a902a095e4ab54a25ad692c1d3aa1f0

SHA512
9007822bb83f56518570a8acb3b42a1ec79be26fc0dabc22ec40f569a725cbb4bff9b0801ec5e51af8753bce54474107582b72fc8f37e8e305e22255a0793041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
1KB

MD5
e9081ec0f0762b0337510aec04ca4f29

SHA1
ce2e2e93d545d06810ea6a1ec5e95bf7248e0179

SHA256
79bd2022bd3b24e00eac77e79983ffff15e55159542afc5df1461cc0ed9cf58d

SHA512
17ed853f414f6c31f425d7bcc2b8309d383288fd745cd710c5788acc64a02ccea0f9bf6e30515e54bc0dd651027ce32270ac08c88ed6fd6db8738876f25c3e1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
1KB

MD5
b074ef6f74bbc94b0d17e75b8c240b71

SHA1
21b6e846eebb9b3d477d235e98fd9be35d376fed

SHA256
1703679f29d38ca19aa4038e0475a5cef4e658d49ded8fc840c5edbcc3822b30

SHA512
2564e3dee167c73e77c35f000a3fe73eea4e06b3879245acf249071eb8b37529f250ad260f0b164caf66d33f1f3f605f2506be1926ab06ab11eaa23ceae09632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_5ABD7D01BC4734045B6B5D27402C000C

Filesize
939B

MD5
1282e7dae2244cb44edaadf9a3fbe7d8

SHA1
aac88eaa7906e71cdbeee4421d05996d87834e10

SHA256
83ac4aa7240015a6b345a4c95897019e4156eee7079718d69c736278ea35d832

SHA512
a394fb5c2cda6635ed46295d57bd951f5f98367f42c8683fba9efb669333214b3fdf6d8e0c47cf6e06feb1a142d2cb2108eb79377ef7b191af2a0bf132ea50ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
512B

MD5
2e0bdbfc4e063272e619aac248fdadb3

SHA1
46eed30f873ec20a1315a7f291f62ca0ec9c832c

SHA256
36815781b839f3a62d068420a2df08ba246eb6fc2365c81112fa4b633b1862f3

SHA512
05b930175cb5b2cfc241dd23e8927fd45e552c200e8a177bf4e71d282e3f1a8dce4e126dc11693358f6b20a66fd96a43ed5045b9e77979a1028a5db2dcbfc3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB

Filesize
512B

MD5
7647e0b7ef9fda1b6bbdd6d466532e13

SHA1
437b4e06d7461dc26ca5881b2e6aa6fae356db1f

SHA256
4e83dc71d6ccea732f6e4b9206468c98f0161353e15fe68f9167ebb377bd459a

SHA512
c552683df98bd5bb7e80195f120248d3a6239c94368f5eccc5b561ae8c9e72cdb1c386a452135ee98c905ed4b5bc67c9f9d303647aada759514c857695467d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
502B

MD5
5189ba2eec362d2d03afc23a915fc2c5

SHA1
69df013bd5988b74553fb716aaf337bdd64e58ac

SHA256
1c678ed060f66ff708154a0a36e5e45154d6d75f8c2f505c8db36d1db3b7f1f8

SHA512
5f7af9addbcf02c8e56a5277c62146c66c6a35e1f0b93743eba263b6ff6ff89ae482b2d182d33d768f61962126ec7a439ee116cecf0af3a2e831b7a8c290e06d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046

Filesize
502B

MD5
9c9983203fbbe9bd429cbd6c798b2741

SHA1
bfda3e6031db5d1dacbb917bba3319c04878066d

SHA256
635c023049927cdb6b236f841f09bba2d28f8dd72d93a7097e97035eb20d4797

SHA512
e7ccd7aa0b4fe65be9fbbe6aeb035d6cc884fea7100b30320b492c01e7a6c16daf66ddfa86492b3da51f9916b54b5db198458e2fb9a041df0c38b4b0d6f9dba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_5ABD7D01BC4734045B6B5D27402C000C

Filesize
520B

MD5
abf0137fc1186cd37a27b4fe28d26080

SHA1
c495213d9dcfdb5a3fcef9ef2d02106851c839c7

SHA256
3ff8e59a8e9125914a7c72f157bd560b7c7d3c291226b8663d65d62f2d18e1bc

SHA512
ea780fba95c679e9abb6dca91640be1792d4317782cd35ca14db13366e30352fb75f766c56614b2e77ec92e97be4c3c6d2b29bf2c58439d0d9f157761c2102a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_5ABD7D01BC4734045B6B5D27402C000C

Filesize
520B

MD5
05eb2f36b754976a541829dfe1f0878c

SHA1
15a692d0a21c54911acab33a8cb0f1dc77fda00b

SHA256
0d7ad5df9136a42000ae812809d8989e30150840bcc3a015684df2304d40fbdc

SHA512
713a35052b1d5381337aa4c63e25f7262c1d4d56f89d47ada68e7d7bcf3c7c33f891d0dd7b60b74622c4da765c70278314e18ed9a86247aaea50555227b85172

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
1b595c218904bd2d104f8954d7b3d03e

SHA1
4f041780717c943bec99e436bebdd5999c557cab

SHA256
6f35a8662580fdce353df54decdf80023ef1de3a64fcb58988ba82d0308c61ad

SHA512
3594c1e5448db90982355d24dd3e96d4403f87d03bc427e15f784be09404a99a489343498efd35435ad4fdad51f82a6b5f9ecaeec52cfd19b605799d7a6d4e51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
cdf3e66e4df33dd45fc678bf72c49df9

SHA1
017c784c62dedfe090448b4d9b9a7c805cae0324

SHA256
94b8ecf88c60e999cf0fb86c9be4628c15a5ad6e6cbb2f1d44cd4381a9bba58b

SHA512
2ddbd7161b213f82f521ec306980ae4798b3cd8d20c9bbd078507a9ba09cfcb8a9ec6fe804d98f75e6c4987bf7bdcb6db8e97348cd936018feec3b7869a3487d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
41ab75955d30e59c9a524f79a58771fe

SHA1
173407dee8e5b1d39166180943cbd44f6fe96fe0

SHA256
069b1e1bf49ba1ed4daead9a87894353b4c348a820750ee406e24e4c451d8cc9

SHA512
439bf03c35af1679e23a6208a1e7b4078e65ca6b6e99a9284387dd3c6a08f5272c1ccdf4fbd4f2be1be63261bd5cf79adc0815a96510fada35045ccbb76d3f1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
17203e83564f0b982813bbc123a1bdca

SHA1
23c6a7a787327e4378d574462ec09a11174c6a6b

SHA256
0de7ee60f0cd68396802015d9586ae5beff89a1cd60179ce67fd92d7eb693cf3

SHA512
d9729eaee7d7d2d5677873d2228dd4229d9bcd90e633632b0a7a6955afc374122c0d2db3d1759fa717a284ff51b81f52b742522a920f6d0249cf8358a4b95be1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b64d801acb32f5abffebeb2667235c27

SHA1
cd08faf7f8cbcae845be561758155079e4778d9b

SHA256
cb7e76ae9c559d1a55bcd56728402111b3846281e55c665d86fa251d494aefca

SHA512
7d04c458f33ea5efcbabb3e0567bc50f62b8c7f25059d045b2a2cb9e0f3a55a014a62c6959c2db151349a7dc40f5e419e200342af399aca64b3ebc07d8204dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a53237e355dcdb3f7dec3d745cf21a5d

SHA1
4b653baf3dd6fbf53e2b1d9672793af96f26409f

SHA256
b6448866d8528ecbdbacd5b6d6b5ad2c33c671db441bfab11c70ee53bdce9afd

SHA512
58eb766b6466f2fa567b43346dd56a6b0429d20fa60ce2d7ad9faa0e0773f7b722292b5eb0f352d769f969463220a7dca5316679752b7c21bd89de19ea74724a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a0310b505a262d673b34e75740ee16bd

SHA1
d76190316ee571735cdc08324962edb6935d8e7f

SHA256
9d3c56cb0c5868fb70558904d48acfeb78dd3ffc304c8844bc6c9d646a3a1652

SHA512
1c94398b745c954067079629750c5a1611f2e0f979ee2c56f4bf8d408a4274256b626be989a509397f210db443e82cc8566c289f73b1a6e38f483fd0dbb54820

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a79c8daf180ec59221d68a4d9e8235d3

SHA1
29376dcbaa2cd3dbb317a48699a0033467d05955

SHA256
27b55e9668f900b956feb3d52add4447bda3ab09f4570febc86e81d5644de001

SHA512
4e5372024d674effffae3301cf4236c3993a9081892cb4f23bee012088b0b473f07cd3b7f7f092d79830ddca9d2fffd1a676b386780e923d0dbac25d2c186f94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4356997e863f96047b12eaf4a14dc01c

SHA1
5e977f424495653da91162a71e8a68310f4e8f9b

SHA256
d637acef0697ae497d2bea708faae678c95ee94c30a3b6065439ec46455a6070

SHA512
0400fb15ed73176bdca366829ea1cad243412c5d6b3ccb1d5244cc829ee426c1353c8307662a8a51f6761f5becdea7057d352ec03abcf6a9e6763297bd3bde23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7e42bfef3b415142cc336d1c63d8bd6e

SHA1
6a956908df3086de48958f0fdbed6db3f90d8167

SHA256
8139c67022db611380ada8ef59122688d07b9d7612c07fdc202e2ef9a9e6b14f

SHA512
679b28dbeb244164fc4ca930bbfb77199274ef39fb021b8df67eb49a14ec59ff76a667f7d5ca1a86e3b0aafbb533e4ba4d397e2b63315f863cdb565e186ddab1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b8aa9904b90fd36e2bc4a3ade3a63cff

SHA1
7932144b53782bd71faecaab9edbb687e841e7a9

SHA256
c3d14e2b6988b953501612af2578de3facb9bdbb07df9ffa3fd729c3029d96bf

SHA512
873e766293becf57ead05d187554d2c9c9b4a2bed269e332af290ed66302400f6502b78d14f6276aad2832068a8f53b11b896d1dac6a58028f6c053f7a7523d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1869df1b961b8f668bac8ecdfcd47094

SHA1
e80a5ff88ab608c24e7eca400b9055d77d6ba949

SHA256
0484afce33d5a4f265fe3d0992bf927e1afe13ae1bcd3554533c0eec3b437de1

SHA512
3e36c75dfcf3455e13198d89deae8ad79c64c59b10024673abded1fe604303c38feb3261ea545cb31de6dedf7c1c14dd7fd65d5027caa5d07866d85530eb3f86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6668255b15f85ec8dad2c783a92d7df4

SHA1
a02086e936efbd3e278f514cb4caf08f540d7b03

SHA256
d3ab03df857b379e6b5c9be0ddb26fcc4dd19f993e76f50e896a22f5c137f46b

SHA512
cb9ab1cefd2696f9a4753e12ba07c82a39ba6cde80c608a5bbf2b059d5aff5999deeeceb6d974a1f86dc56a3f28a9c60d37185919b0e754d061f43b8b7ad4130

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
67e2cee397a123ec8aa5a674cc938738

SHA1
7dc769d261d63255819ac327cf1bd689f355749b

SHA256
8c0dd7a0c8f0f5103915fc340084f5d446dab34e25e2f9216745553158072883

SHA512
365da11ee229d30050d42a6b7ffb78f2e40977cf2a1407662e6a68e7fa04555d86af1f2cc66063582825c273767ee21d88519ffc414b8eafc1ff1d8651bd1f46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
96B

MD5
cf7b227f2e971439a229088441b3b54a

SHA1
8d5a231493500d9a6b7ff0f7bf66206c5150a927

SHA256
4f9d8f6cce94630626d7fa6d31bf7d8b384d98e54f7a49408ed8d8d6cea75d37

SHA512
56827adc461284404fd743fddfd9a8757de5c97ce1a80c8819e74dbf8c3ef7e00fde89b61af6fe7a88678986637b08f4b5d320f23b2edceffadac598d3fbaba7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe57a103.TMP

Filesize
160B

MD5
eff6c5ce439d86e8f0af2d157686cb96

SHA1
6d4a10149fac389c04d71fe2c8f27ffdae8a1e6e

SHA256
de0a3db36f5d646d19a5371201b64e02a2bdff952d81e982616fd4310038f709

SHA512
c2d9457fd3e13d04af69746ff2972e998dc2e72e0a53624a0d507c2cd3cbbcbbe0359a0d08e007ecff6bf009cfe018b44454f156988723b6fe8311d0f3222c15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
0c1c6b29cb5ea2333dc8047ed695c6df

SHA1
15af4e20e976138a6559bfe6656da0fd5593ceaf

SHA256
0c576054964ad528d5f59f4031a738008e5871c74995bece2236cc53f85d1f2e

SHA512
357105016e67bf3800902d61606316f8fd18b1730ae9ba0cc15e6a3200d4d7e8f91bc874796bb0227ab19b447c218050482b9f3f5f16cd625fc417d5092afc4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
79775a7424cbc3553a16e672fa446af0

SHA1
e22c85a3ab31a3b888dc0853c71aee1bf04b8bae

SHA256
f2e38ca7e0378cb13220d5192a88885e67b1080973a9964a605fc15a442f4c46

SHA512
8ec0b685d7d1c29ee2c731a8ff1cd017166b62003f5a3fb948e2df19961f373868a6fd04a7b5358b211c2e146cb495398c46c154622697093bd761e52a895f59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
f930a151654a74e4fc1df11cd5c385d6

SHA1
159c59a98659e2375018d9227d560859e0bf40d8

SHA256
dbd8edaf95839ebfe7a5d43e73217eba66c7fad63742f187e49edeb1c7edfee7

SHA512
b28fd750769747b58ce53c20df26a101c536dc134960650636e331ca5260687a5c3f5ef48bc3496ac88df7caf14219e2a4254b7d2ec6209658747fb64d3478f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
c0e39e2d6c6bd32214a6d4121c0f343c

SHA1
25fd469a1630b88de2101fe892811f7962a8bd3b

SHA256
2b47898bc3823210aa303f23c4eb9feb5dccabf2a703fc1e4d7d7b786449aba4

SHA512
c6f89a1e9b3d973f423e2d67076b85aa5437c68a391af34c8fe67ff7d546aa1ce96a5d3a458e2bdba9127bbe254a4b060db593f4c643e7300e388f59cb0d1e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
3344e2716076f7772be56188d91a8a39

SHA1
e8b90fab140e8a9ec02f877a33f3315227187a57

SHA256
4ab90d1d40cd6ed7abc95d4da6ac17004f30e425b4ba69fb64bdc0f0406e08d7

SHA512
137f8040bcee9effec2c8e18f888dc0ff70030a8bc058b25bae341d4a68fb66f0679320e5a4236f66c189b37646808919a7211c39a1f1afbdf32735266da7ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
767B

MD5
dcb4cbd363f4bbeb6162071670ba6b71

SHA1
8227739b330cf125a6c8724b9acb5d971dfba41f

SHA256
8c0dec600ae0b976a77778cf71789c15856c87f9b9d39ff7eaed2462f771dfe8

SHA512
68a00da3d3537d624d069b86f092aa16578ab0dbaf9c52ba2038ab9fd20b0172590878ca777658f859881cc052a03912a23c7427ef17c281ebaed882ce602629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
df4bfd486d99705349fb50af97365168

SHA1
1eccbc8012019059258ed3441a7ea893cd534651

SHA256
1c2dce6e09b7ab6a2d57b738a1ac405d9c969f93969bfbfac466ceda7e1deba6

SHA512
7bcdcd90431e26a6e148e9f05d831d1c27cb09fb95d54197b7321991e37077af5a6e5d788351c54978117297516a3cb9f187b20750e6458c9a38e342b60fab93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
679a7f10aae1957f3bb417d2808a9d57

SHA1
aacd01687aa43560a0fe06da08af923a0112c1be

SHA256
078c56d119ebe097550a9b16aa592ac625b9d1d2e96175ba8b0f4e8aa938a946

SHA512
96dbe38f7e0c2bc9060ffd891660f913327f67bbe1a0c53f8b33011c2933d09c56d1186a3015b812340b0328f74f1e26c6f68bb6d7048ae52e64a3bbbe8bcf14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4bdbcdbdf51688e3bed40d65d192f71

SHA1
d8d189743a76b6152b5d9915012d9a55d6788743

SHA256
9041acd39d0ae1a937f13fcdfaa40c45bdecf193e3a59ba4cb6ae2bb95d7f5b8

SHA512
27e5380f8930fa526ef96e54046834acdab1e21a36bf9e3ad3b6a76292c8c0a802d7ed3b99f202af3ef3bc7ea245f4063765e0ef3ff70d4de26e873075472700

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9BZ4M0X6\1[2].gif

Filesize
43B

MD5
df3e567d6f16d040326c7a0ea29a4f41

SHA1
ea7df583983133b62712b5e73bffbcd45cc53736

SHA256
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

SHA512
b2ca25a3311dc42942e046eb1a27038b71d689925b7d6b3ebb4d7cd2c7b9a0c7de3d10175790ac060dc3f8acf3c1708c336626be06879097f4d0ecaa7f567041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9BZ4M0X6\__utm[2].gif

Filesize
35B

MD5
28d6814f309ea289f847c69cf91194c6

SHA1
0f4e929dd5bb2564f7ab9c76338e04e292a42ace

SHA256
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

SHA512
1d68b92e8d822fe82dc7563edd7b37f3418a02a89f1a9f0454cca664c2fc2565235e0d85540ff9be0b20175be3f5b7b4eae1175067465d5cca13486aab4c582c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6CSGK.tmp\setupupdater.tmp

Filesize
1.1MB

MD5
3613e29d2a7b90c1012ec676819cc1cd

SHA1
a18f7ab9710eefa0678981b0be9a429dc6f98d28

SHA256
fb5761640bb6d375345b780df0f1811f6ae6a1ddeae7c948299379f8bca822c8

SHA512
837f3aedcfd81cfc0fcebc9e135f72a55c0cac10860ca78d57cd910d6f039afd500bbbff1481637f21912e5eacbdbebfdc3a3bb8133db2cb37f444ef87e6347b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-APUNP.tmp\setupupdater.exe

Filesize
865KB

MD5
843d23f6aab075a3c032b06d30ce9c5d

SHA1
8e9f98e609db50ee6167a76b6ae1ca7886e6c866

SHA256
088f048ee972ef80bd527e301431c1ad7e46d0c994ad8a2b586c4fa6d86ac399

SHA512
101cc5a0a5c927adac497cf901ebfcb73bd92eec0b8855c8fa0aab0bb0411dcb5cc3271b6f73c0fdf6238a21df30871afcddf5bd8f0164ddaf8acd72d14a7db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LDT4N.tmp\setup-lightshot.tmp

Filesize
1.5MB

MD5
c6bffd4da620b07cb214f1bd8e7f21d2

SHA1
054221dc0c8a686e0d17edd6e02c06458b1395c3

SHA256
55dbb288d5df6df375487bae50661dbf530fd43a7e96017b7183a54db8fc376a

SHA512
91e50df87a6e42b01e24accead25726047a641c3960fa3336f560168ed68356e6992d289a0a71b629d74ad7b00bbdbf7e6e909a4c8b5b1616fbf3b0cc63210ab

Download Submit
C:\Users\Admin\AppData\Local\updater.log

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
C:\Users\Admin\Downloads\setup-lightshot.exe

Filesize
2.7MB

MD5
a1f6923e771b4ff0df9fec9555f97c65

SHA1
545359cd68d0ee37f4b15e1a22c2c9a5fda69e22

SHA256
928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1

SHA512
c9e54f48208151dcf60bf049d09a5c69f6ef7e4f046359fdfd50c61d49a6f9a37c3d3a2016d4beb70ae47270e9e9689e03064c02bee1e1d3d95998000e47f153

Download Submit
memory/664-654-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/664-450-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/664-194-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/756-434-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/760-704-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1432-435-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1432-395-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3880-705-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3880-698-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4452-655-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4452-189-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/4452-188-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/4452-449-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download