9bb4971e729a2ad1612e8aa2fa490b69c33af7f42515f9b642c7d0f80f8c0fd3

Analysis

user interaction
yes
max time kernel
58s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Greenshot-INSTALLER-1.3.315-RELEASE.exe
Size 3.8MB
Sample260628-endbbae17k
SHA256 9bb4971e729a2ad1612e8aa2fa490b69c33af7f42515f9b642c7d0f80f8c0fd3
MD5 afd9ccf186d4924c01dcf84c7dcc19d4
SHA1 aba2ba820d6c0ac326550920faf989d103cdd144
SHA512 818456db19a5634b2c5ed291d8ec3d6f7996277cdbed6afb3e7715fce9f69bd041f4c66603ed0cc89c84c25612596ff2877fab8dfdb1934d738ddaa36058786b
SSDEEP 98304:4kL2uTrrAFmrCHwpXuuorCfreeUqSemT4iF:n2CrAaXcWRUD4iF
TLSH
T12106013FB268753ED9AE0B3245B39220997B7B61B41BCC1E57F0090CCF665602E3BA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence privilege_escalation

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Greenshot = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Greenshot\\Greenshot.exe\""	Greenshot-INSTALLER-1.3.315-RELEASE.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	Greenshot.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
2028	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
2672	Greenshot.exe
3616	Greenshot.exe
2680	Greenshot.exe

Loads dropped DLL 1 IoCs

pid	Process
2028	Greenshot-INSTALLER-1.3.315-RELEASE.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Greenshot-INSTALLER-1.3.315-RELEASE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Greenshot-INSTALLER-1.3.315-RELEASE.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4928-0-0x0000000000400000-0x00000000004CE000-memory.dmp	innosetup
behavioral1/memory/4928-11-0x0000000000400000-0x00000000004CE000-memory.dmp	innosetup
behavioral1/memory/4928-364-0x0000000000400000-0x00000000004CE000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270931942226742"	msedge.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.greenshot\ = "Greenshot"	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot\ = "Greenshot File"	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId	Greenshot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\Greenshot\IconBackgroundColor = "FFDDDDDD"	Greenshot.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47726565-6e73-686f-7400-000000000000}	Greenshot.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot\shell	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot\shell\open	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Greenshot\\Greenshot.EXE\" --openfile \"%1\""	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{47726565-6e73-686f-7400-000000000000}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Greenshot\\Greenshot.exe\" -ToastActivated"	Greenshot.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47726565-6e73-686f-7400-000000000000}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Greenshot\\Greenshot.exe\" -ToastActivated"	Greenshot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\Greenshot\DisplayName = "Greenshot"	Greenshot.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{1662BB3C-CFF7-4A0E-96E3-E757C9D003E8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{47726565-6e73-686f-7400-000000000000}	Greenshot.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\Greenshot\Has7.0.1Fix = "1"	Greenshot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\Greenshot\CustomActivator = "{47726565-6e73-686f-7400-000000000000}"	Greenshot.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{47726565-6e73-686f-7400-000000000000}\LocalServer32	Greenshot.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.greenshot	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot\DefaultIcon	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Greenshot\\Greenshot.EXE,0\""	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot\shell\open\command	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{47726565-6e73-686f-7400-000000000000}\RunAs = "Interactive User"	Greenshot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\Greenshot\IconUri = "C:\\Users\\Admin\\AppData\\Local\\ToastNotificationManagerCompat\\Apps\\Greenshot\\Icon.png"	Greenshot.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Greenshot	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID	Greenshot.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\AppUserModelId\Greenshot	Greenshot.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{47726565-6e73-686f-7400-000000000000}	Greenshot.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47726565-6e73-686f-7400-000000000000}\LocalServer32	Greenshot.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{47726565-6e73-686f-7400-000000000000}\AppId = "{47726565-6e73-686f-7400-000000000000}"	Greenshot.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2028	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
2028	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
3616	Greenshot.exe
3616	Greenshot.exe
2680	Greenshot.exe
2680	Greenshot.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	Greenshot.exe
Token: SeDebugPrivilege	3616	Greenshot.exe
Token: SeDebugPrivilege	2680	Greenshot.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2028	Greenshot-INSTALLER-1.3.315-RELEASE.tmp
1716	msedge.exe
1716	msedge.exe
2672	Greenshot.exe
1716	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2672	Greenshot.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2028	4928	Greenshot-INSTALLER-1.3.315-RELEASE.exe	85
PID 2028 wrote to memory of 1716	2028	Greenshot-INSTALLER-1.3.315-RELEASE.tmp	97
PID 1716 wrote to memory of 4212	1716	msedge.exe	98
PID 1716 wrote to memory of 4672	1716	msedge.exe	99
PID 1716 wrote to memory of 2196	1716	msedge.exe	100
PID 1716 wrote to memory of 2196	1716	msedge.exe	100
PID 1716 wrote to memory of 2196	1716	msedge.exe	100
PID 1716 wrote to memory of 2840	1716	msedge.exe	101
PID 1716 wrote to memory of 2840	1716	msedge.exe	101
PID 1716 wrote to memory of 1372	1716	msedge.exe	102
PID 1716 wrote to memory of 1372	1716	msedge.exe	102
PID 1716 wrote to memory of 3372	1716	msedge.exe	103
PID 1716 wrote to memory of 1372	1716	msedge.exe	102
PID 1716 wrote to memory of 3372	1716	msedge.exe	103
PID 1716 wrote to memory of 3372	1716	msedge.exe	103
PID 1716 wrote to memory of 4164	1716	msedge.exe	105
PID 1716 wrote to memory of 4164	1716	msedge.exe	105
PID 1716 wrote to memory of 4164	1716	msedge.exe	105
PID 1716 wrote to memory of 3976	1716	msedge.exe	106
PID 1716 wrote to memory of 3976	1716	msedge.exe	106
PID 1716 wrote to memory of 3976	1716	msedge.exe	106
PID 1716 wrote to memory of 2176	1716	msedge.exe	108
PID 1716 wrote to memory of 2176	1716	msedge.exe	108
PID 1716 wrote to memory of 3368	1716	msedge.exe	112
PID 1716 wrote to memory of 3368	1716	msedge.exe	112
PID 1716 wrote to memory of 2288	1716	msedge.exe	113
PID 1716 wrote to memory of 2288	1716	msedge.exe	113
PID 1716 wrote to memory of 2288	1716	msedge.exe	113
PID 1716 wrote to memory of 4088	1716	msedge.exe	114
PID 1716 wrote to memory of 3572	1716	msedge.exe	115
PID 1716 wrote to memory of 4088	1716	msedge.exe	114
PID 1716 wrote to memory of 3572	1716	msedge.exe	115
PID 2028 wrote to memory of 3616	2028	Greenshot-INSTALLER-1.3.315-RELEASE.tmp	116
PID 1716 wrote to memory of 5308	1716	msedge.exe	118
PID 1716 wrote to memory of 5624	1716	msedge.exe	119
PID 1716 wrote to memory of 5624	1716	msedge.exe	119
PID 1716 wrote to memory of 5724	1716	msedge.exe	120
PID 1716 wrote to memory of 5724	1716	msedge.exe	120
PID 1716 wrote to memory of 6000	1716	msedge.exe	121
PID 1716 wrote to memory of 6000	1716	msedge.exe	121
PID 1716 wrote to memory of 6008	1716	msedge.exe	122
PID 1716 wrote to memory of 6008	1716	msedge.exe	122
PID 1716 wrote to memory of 5172	1716	msedge.exe	123
PID 1716 wrote to memory of 5172	1716	msedge.exe	123

C:\Users\Admin\AppData\Local\Temp\Greenshot-INSTALLER-1.3.315-RELEASE.exe
"C:\Users\Admin\AppData\Local\Temp\Greenshot-INSTALLER-1.3.315-RELEASE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\is-OH2P2.tmp\Greenshot-INSTALLER-1.3.315-RELEASE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OH2P2.tmp\Greenshot-INSTALLER-1.3.315-RELEASE.tmp" /SL5="$80226,3032110,791552,C:\Users\Admin\AppData\Local\Temp\Greenshot-INSTALLER-1.3.315-RELEASE.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getgreenshot.org/thank-you/?language=en&version=1.3.315
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff8be2dc188,0x7ff8be2dc194,0x7ff8be2dc1a0
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,3395552031495782384,9412528549567309147,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      System Time Discovery
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,16151887467663321682,9859039907434510470,262144 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,1652911234201095182,17569084137259092843,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,349457963707742250,11016485304212285279,2097152 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,2206097410354837874,14012662507210022909,2097152 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,646414218474943764,4323084057743003103,2097152 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,4240921283452726566,15412759743309614391,2097152 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,16330183851678752998,8475821614247821219,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,12745319238720467751,6254958859220954421,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5376,i,822314110144521043,11423898399785609919,2097152 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,15440875279644904325,16952307669975518076,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,9679885132739294862,10822577615765238461,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1173184869441303650,17375965733210118440,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1173184869441303650,17375965733210118440,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,195019193642557280,3602779685714464982,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17259060679633527322,10815767680617866415,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,3710073490033659885,9890699342785459888,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,10270552806115957319,11852668390208293796,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,6359229058382572329,431034352783039237,524288 --field-trial-handle=2180,i,1070187600835287746,17865484684392556843,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
      4⤵
      PID:5172
- - C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe
    "C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe" /language en
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3616

C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe
"C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5036

C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe
"C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Greenshot.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Greenshot.exe.log
Size 2KB
SHA256 d6f24fd8b862b5dfe04c209af60ac510c7b9ac89b56dd0abbf24a69b99aaefbe
MD5 e8056c1894e4b4261f249cb64073b7e6
SHA1 34de5156a4287f3f60fd393933967d690689ac16
SHA512 4565d71a0c397715f010afe7f03595162bb278468db8aec79e0ffdcd21ce6e23d265164b2a280c19929b6bf748573651291beb674145665b93e4c12336d9111a
TLSH
T1BA41DE7122B5B0D88D173F52296D268453FF0339BA545F18B56C625EEE2A0175F232F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ef87265fb315ae353f8956fe1637a70ca75d0378e75d68dbf9b58fa31835c95
MD5 912bdf113fdea1155b0bb71c70fc62ce
SHA1 052925f70ca969f313ab3aaeed0df4da91409ba6
SHA512 5c32f1fa9e8a135369e8504b0a4a8e5eaf2a496ca55168f52d194647cc5d05ca5cd548a96e485542904dd958fd50a5f59b2b35eaebc4f4e67f470b7b723ae89a
TLSH
T1B8D023317B65AAD1D135357AA4304741BF250176239DC1176154840CDC7D4C65BC97C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fb7d2a8eb870be557cc28a16501fcfc698a8fae12bfe5261858d5b2b233ce47e
MD5 f1e94356fa7190869e25d24db034944a
SHA1 9424925f1313e98b13bdb246e8487af5247be262
SHA512 db181cd639399460c1d1c0cdb0cfb5a69144b1b1f9c7e54bbf67bb87e8c0b0ff321693b88ffd7eae87c212771a89e0958b6b6f933a23ee0d4491caf4cc8384b3
TLSH
T1D771F90BDEAE0842D371A4F1E0F50E9038B3895E3A634E32345884BE761FBD27EA5046
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 45cac3dbf32f577be2b85a0d8dc2dc06fa8ee07c7c0eb0ba3c33a60d01c518e5
MD5 bd32b62c5f7ad4db53b174839984ce04
SHA1 47c8111ebe249db5db638ca9d22c8007f193d687
SHA512 2a3264051326442f445b10aa904aec89edbcc5864a8d784f57f0d93885452fb7ecc430aee23eb6f0890832c8d6ccf54d3dfb321e497dd61df3e09638e51cd2db
SSDEEP 96:DhUqOhghQhHmvzXahYhEhvh0h/haVhjh6b5hqkhGhh8hIwaKl:DhUZhghQhHmvbahYhEhvh0h/hEhjh+5r
TLSH
T110A180FBC6E48A6D990197F0F6146E2BCE1E0915872C3C1985D8BF1BA3D3961E28065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 06c7447e6af015df6b043fb79776128ec7763a5f88525705125a464b7fb8adb5
MD5 dbf3632bc7a291275949b598c49a4f8a
SHA1 36256e78d6f38f278dbf0ec667d5dd55ad3c819e
SHA512 d157b117ba8e691c06961fe61e40c177e66b22ec98bfce4bf317d8cffb407b42af607c782e64cca5bda4517d458e4b6ede1d916a0987b35bf1b858aa32418ebe
SSDEEP 192:sxZMRDyM/jK1Ml8ljW/fBs1WpV1EHj3aIdpIzHW6+WN7mRKp2K/ne6NpCtmHQ2nN:sxZMZMW/fBs1Wv1EDDKHbfgK//MO
TLSH
T11762E8526A3459BB8CDBD219F955BF67D6F40466D2900D84AAFCCA1C01E7BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4e6856908e944a923afc8645ccdd62a082b9e1e62020a91f51bd4fadbe231e47
MD5 ce10aee9e2cff5bfdc233f4f3f1a5025
SHA1 f7ad35411afdff0a56d5172b571f0512ae4dad20
SHA512 0064ef2aa16d17ba28b123aec20e5f0c08e573ba9b9667505912ae8bcec90d21093fee3574add7966a34a87020b7d9a6c1add70bda30a88c93666eddb313914f
SSDEEP 768:vr8iJfv7pLuL7xNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJpQALl6opdQroD:vr8iJfpE7xNWvx76ru1ja0pQALocd7A2
TLSH
T156F2EA3B6C0CCB7E4F804E9CEC2A7E9A6DE801CF5A98895447FA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4bb4fe477a6917bbc79d1eb83c37044b8a8eeebe14dcf43a4ab7e482d923b841
MD5 2f8508330adf7e1585051aa5808547e8
SHA1 341971086f777ae53b184cdc0382b99c6b1476d7
SHA512 ea6ff16ca17c6ad5440f17a997ffc8c82afbede9121dcbebceb4f758d2c18b001f139f36b0343656e82b5e15c50383d0367e5ff17bc7838cc25e5879ad00d7ef
SSDEEP 96:KkOkKHK6TEPIkumW28mJ9Wk2K+TWi2yMERSwVG/rVvPh4LY8OzhKGIOVha9lgzvI:S3TEPIkumWlmJkk0TWi5MERSqT5
TLSH
T13C91720135BB53052D3E681A96518BEB47427963352EAC3B7BA800B54E27E250FFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4247aee8fa195d36b73e499315735e20d986b98d16f998d46c16c74c40c5f6e1
MD5 43c360bab317abdaab1ce9e0e737db96
SHA1 a8ebf9dfe71ea0e1ede87ed94261a838cd9a57da
SHA512 24857ac0e5562aafbf8a7ae47cbb4b1bec4a267d4200c60690ad650b7d6b54125a32649a189bb2ff630f98d8133a97f32a22a29fe052c43d1780ce0543cb8ebe
SSDEEP 384:n2tNn/s3n9SNsNKwy5E0gkhOp3VecqTAStiI1o0KWqx4379rqmn15wbAjEO8KJ:2j+9yk0HOp/7SuxWqx4374mn12bfZKJ
TLSH
T170C27C71D8691DFB0992D8CD7546F20B6EB4503B828C1A5CE6F87B3D318F6F81326925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 caf5bd229434030d3177c30abd0aa28aa094071e197aad21a29dca5bbfa8cf1f
MD5 bf03e96ef417b3406c539a3e4cfd3fac
SHA1 798bec88031f4b8fe12d5201dd6564a2f62b89a1
SHA512 f3743090dd4a6f18f3c90f197d7b70b3f0cb179f453c00447d8273b3a15a10f463b25ca4e35feb19a9fd40be9959bfaf73b2f9f755f777ceaf7a91f36ba06c40
SSDEEP 96:ZqONkIQsjpfmUTmDK5ih/cIPURHl8h4otop555D9BhPwivh50xy0SFYKEAxnO0BF:gONY6kDfQmiUyLjZ903yO4+TQi+Mo1U6
TLSH
T16202D7356C782CBB9EA3AE49F44737275FA5112FEAC52F84D9E81B1C01C734C2746826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2c3e3c8c0d7f4187b5343e3e22f15bd78353e0bf32f50e00c819fc4b9852bf0
MD5 82906e2a65cb1934981e62adc93181fa
SHA1 3932b77f0f5aa11da6125bf6a659150c0d7ee8b1
SHA512 615473cc0b924a0cd0f2b094cc20b09b5e8c8a1c80f1e76ed762634d38b6942327c2a2eced14519b21eae24d7c9f24cc4bbfebc968d5cfe8c9f68d4923221550
SSDEEP 192:wONb6kEQmiUyFSjA903yO4+R5pbr9encR+Eq33U6:wONb6lk+A9hOp3VeI+ZU6
TLSH
T1D512183168785C6B4DE3A509F48733679EA4207BEEC86FD5E5E81B1C05C734C2B4A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

74a0d7a2-b8f5-4c71-8c01-15c5ad4fbe1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\74a0d7a2-b8f5-4c71-8c01-15c5ad4fbe1f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 899e6cf878939fc30e54b0135c1f6ecb9d65640903dff8fa6ed6266807b0ff90
MD5 eb1abfc7d2c30cb418a7143545583883
SHA1 ffbce9b62d5735e3e13c1c5ea37237e349b57d04
SHA512 ba992364d15ef3c3220546bcfcf5ccc3879df8f60254e84ec302f6eaef7afbf63877b9989459b0998592fee2009cf7c93e5b627c2f0b2e6b3f2403fba2fa483e
TLSH
T17641C859A6EA1145B7776F566BF6B86E087EBD773F06C59D00110D4E0A62B00C871733
MD5 SHA1 SHA512 TLSH

Submit Download

Dapplo.HttpExtensions.JsonNet.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.HttpExtensions.JsonNet.dll
Size 13KB
SHA256 075cefacf12ba0d852000348077195a7f43ca8ee6c10e030139a4416cf878a59
MD5 22d34767b5f90c4e1f80523ac8343874
SHA1 32740f5387d8d4f1ae9215fd3b0d286eb4754bc1
SHA512 81b0ffd4df0bae5a12eaddc2869a727f835691980dc3d3a8bae5dbbbd1c0831221a09a1d1c5c7cfccb3d3098aa996a18c22a7fe31a56fd73f0f09db08bdcf2c5
SSDEEP 192:YHl6yR++MjEJXFavEpHQgUynAjWx22c+EFWpRCvoHzfEiq2buZVB2xFk/Q:c7R+HEHavEpwgxAjmjHmQMmuZV0u/Q
TLSH
T111523B3C7AD44337D97BDEB1EDF656832778BB019946EE2D0689034A8C017418EA1B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.HttpExtensions.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.HttpExtensions.dll
Size 123KB
SHA256 e532cbd5068c0247eff36fcf4414a44570f2aede9073a30101d1f4957f2ae0db
MD5 32d0607043fcc1739c287a813013d98a
SHA1 4e4ff6cca93d4dd2e8036c5b75d91dde2d0bce0a
SHA512 895d604e58cb36a640b8ee765ea688bd561f099a04389c9b75cd8794433c2aa7b94a11d87af6866664cf89c5c6d01c811c5f6445b34a56b91f81536e7fc24e38
SSDEEP 1536:WDRK1FU3Egi452ByDBlAc1IJdNoUr1PDqL1Lg2JQWyXfQNPR5az2/eoh:WAXU3cS7IDr1PDqL1LgyQLQNp0z2Woh
TLSH
T15EC35B7067A88B34D76EEFBAF5F452648B79D30AE812E78E5E4C90DD1C0238199113B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.Log.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.Log.dll
Size 33KB
SHA256 716eaa57ae46f64f6cf702bbff12e2fc83585605df4da7d705c4dc61ffbe371e
MD5 62fcbede69d8db8392043ffd10cea021
SHA1 8f6893b534e3693a7d88803d8641a4c44e4dbc5a
SHA512 b9a29b1136779b4f5e43469d9465739cd5507f131de83408ba2e90cf87fd9f1c5cd133513faadb76c0640572f9414a4fc7729fbb2b1e1ec886d033a52dd94f79
SSDEEP 768:4SwJDsfC5J1jKBsRTJeaySjrOQnWrtjrv56mc08UT2RW+bdNa:fwJp5JYmRgalrHnotjL5VhT20+xN
TLSH
T170E29D1DE7C8933BCBBE477B78F011425679D68E9A02CB8F4E9C31861E07B195613AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.Windows.Common.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.Windows.Common.dll
Size 45KB
SHA256 d50206943419fd331f0b34617a27c1c82fdbefc71a207f484b1de0688115503c
MD5 5dcf95ae41170a8480136f81bd52bdb4
SHA1 d3a0e97d997f94c037d48e879d89c694314f00c5
SHA512 44f951cff04ae68569aee5de8956c4b7c06a5526af6e54a8907bad823765ed8f5ce8c955be9c2bc1cb10879dfbec8e6d123f04bc49b59d4eccefd2d5c52fe939
SSDEEP 768:etgStOXL7EN2r9+VZhthKNy13sDtcjm3Ru6eLppF/ZdBax:etgKA7E1Zhtv2pcyQfF/nBax
TLSH
T145235C8C8764825FD7BDDA7571E202A8DB38C34B394BAB4B45C055B66C077EA180D3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.Windows.Dpi.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.Windows.Dpi.dll
Size 35KB
SHA256 f57fd686692f51eced2ddbaa6bfd6e954929be1630aa210b9f421e3935214ca7
MD5 14baf496cdabdae54aa78e893d76151a
SHA1 9fc21bd4bf0647b2aaa3f9183b67033f4443015e
SHA512 11c0cb51b3e99bb9ab5da26c7346f1e88cc072904586a45e7d473fb205b5be6ef510104d9640d9b7df3b5cefb041ab17e100a460e3e0746cfc91aeceba4738f5
SSDEEP 768:IH2niu/+2tmbo2WIA4mZimqps6awFVjmegot44JK/A1H:Ihl2ErzHmy5zyegoLJKIx
TLSH
T176F27D4277DCC732D3FF193978F11281A674EA927823D75D08CC122E9E6778629453B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.Windows.Icons.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.Windows.Icons.dll
Size 24KB
SHA256 3a13b2db0ae0038b7a074d21fddc0cc8b2d76e54fbcf9682d4e849fdad4df276
MD5 918706147d1b160eb34a87da9f5ce568
SHA1 1a558e22f84e46af78421f4d724c51ee8b4e1844
SHA512 a0a0f5b68a074a0bdd596a0c40ebe2b336398d01a444693f1891df5d0c1258986db710db2bb3504f5dd8af1bf7d5e518bf23a673ca71c9360e6c765f355c5b7a
SSDEEP 384:5rVaI+zDglS9GW3JmqoHYhK+yLAjmxqBt9diQTrJ9X1m8r7:LaIig0v+JnMjmEBrdRXJ9Fm8/
TLSH
T12EB25A19ABA88239C4BF4B7D6DF313024670D79E6E02CE2D29CD5109AD2735A5B023F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.Windows.Kernel32.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.Windows.Kernel32.dll
Size 29KB
SHA256 6cbc082b361a3ce6ecdf93b66ea29b65801b710db4bd45e5108b1bdb8f392aac
MD5 cd27f640e06dc6a91d967212a2dd8bd4
SHA1 293b6cd045944cf934993688582b3e0baa32fd04
SHA512 143dd9935ec50f73355cb0aaffa34b932501f149a2ef15d076c965fef065f9587aa236921f9241d96119ee7519a688c9b0ae768caccf5caa4d59b3e766f8c742
SSDEEP 768:C27+DpJGm71nWD7HkLT7pLXHOyBVjAwNKUEiVghhGCYtynLuaukUaBGMCeex9zzl:CTGo1nWD7HkLT7pLXHOyBVjAwNKUEiVt
TLSH
T1D8D23C86E7A2CA7DDA724BBE50730902D7BCD36854768F1C07C983029D57E4D1336AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.Windows.Messages.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.Windows.Messages.dll
Size 37KB
SHA256 8bc65a62a9b983fd740a1a39cc1fb2ef9fd68d9c229dbba718b3e4c284b6f0ea
MD5 678a30499e3e3d0067fa3bf64041f73b
SHA1 44e0263df15d356317b08ac891afb78ddbf18912
SHA512 bb3603016060a5430445d97cdf05caa66179030822f536a54dc90dfcba5941bd7978490abc0c9ffd8cfbd7cfcb2637813e35bf53c4574c6e882a51594eb33054
SSDEEP 768:Qa3VeYr2vwjS2eSsFzEJ07PxOIJk3tBwy3qFYRvu6GU2PTjmivYKkPlYbMXU:HIY2gS2eATIJW3i6GUITylptYoXU
TLSH
T1A1036C17FF3459E7CCBF0A7731AB511AC176DE42F00ADB47A88A9284E8B13454E637A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dapplo.Windows.User32.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Dapplo.Windows.User32.dll
Size 54KB
SHA256 f0ec81e0646237f9208993d1c4b3ad8e6396e8181ba1a1a595bd0fa23cc2806f
MD5 e7b8940db4ec3716eb94fef0e685300d
SHA1 a33779a55986d954757ead945cec0cd3462f3eab
SHA512 e1bb70179388bbc5880b71b10ccc31c85e2dd12fc70a8ec30971b9936d5c00d81f27e2c9991a9d6eaedcd1c7386b2784a1d582ba30f238cd67e532f9216f091e
SSDEEP 768:Jmauz7STmdlMIR2CQxCXL2CfFQIzoW78y/3JLqkWHJLkDjm+/pV97Kshf/30onHo:/uzmT1x+LXd8W78W3POkDy+P97f3l+N
TLSH
T1FB435D10839812F5C65F5EBB6FA30786A6B4F2C0251AFF554A97A319E837FCF1219390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.Base.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.Base.dll
Size 391KB
SHA256 c8c46dfeb3a6df5dca59973764647c2f3d5df52a2d24266fd00ee429222de212
MD5 55fc38aaa7950d743ff947a295578f50
SHA1 ce97cd395ce45191ff1b96d2f3e9940987013039
SHA512 860f5be2095990a1f4440417aec74f23c2ceee7b2ae04b42dcbf8b5a55be80e80ff9673507f38c4e92c4e764b12fae6c13a8404802674624f909cbb4ecca0d89
SSDEEP 6144:bBZaWN74W91MylOrp3ZT3+XccFIjfFTyfozj9R9KGHu2ZBEeyE5an3:NH4W9pkpJ5ce1zjRBBw
TLSH
T11A845B0027E5C61BD4EF1B39B430971807B5F906B6EADB2F5E50A89D2C977828D607E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.Editor.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.Editor.dll
Size 322KB
SHA256 550a7c35debe1d1b038e0ca0b4b207080ccf17c8ffb6cea70eec6aba46574589
MD5 74d2223cd6c1592df0f116399ddf619b
SHA1 bd6049b66ff73f0bd4ad6bb0b7fbf3199a70d0ba
SHA512 a16903ee1f83df06f6378e45facee60f9ba6967f4a5b518e13cef7dd56157a6d4eb189831a653774de391c4378cb53a3d8b4973c38f9447262c15890b88fa94c
SSDEEP 6144:jJP5w6kS5VH3CxRsVCJkH10OcPAU7wDdIPx+LtFBjE2A6L4SHDixD1:jJRwQVHesJtoAMV+LFPpzI1
TLSH
T1816439A133F98A5EF5EF83B8503095809732BA5BA5DEDB8C4D85A0EC1CE7790D641327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.exe

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe
Size 256KB
SHA256 2214ebe320c7064b0fe6198db428b8033b9fd9f97743770ab01132a3daacd253
MD5 e47f8a304364122de4978ba4fcc9952d
SHA1 969df503f96e1ae178dffa7bd02625eaa00c670f
SHA512 f87a980d5e896a4cf4df6945a8fbebf5dc174ad4d7abbbf865cc77b1e243b8305e5d3b2cbe87d2136191106fbd9b884083f0b453c7ce3f46ffbd2becf6ddc4c4
SSDEEP 6144:ZlKLf1GOgtPOUF/2xZzxZQ2qkFs4bIGKiR:Zkf14T2qzoKu
TLSH
T1CA445C5033F8450DF1BF6B34A4725A005B72B947D17ADB4D1EA0A8CE18F7B90EA523A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.exe.config

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Greenshot.exe.config
Size 1KB
SHA256 3b2ca2c542228a612eec384901732d22d5a4b62720a726eba38d857fec8e850a
MD5 25dace2922ba39f7fbcf04103f073fdf
SHA1 3ada2660a98d15125464021bf1b33d5894c620b0
SHA512 1a5fe8efb0a7729810836a157308459c5aa6612fc09b4d520a797ba37cba44d6ce54f996dd66aba4e78f173db39f98083ba96dd0c9f9f70e5c31fc932358f851
TLSH
T16421CA3190C8AB658B3256A37D779014CB7803B7288C049CB4BEA99B9F369995217037
MD5 SHA1 SHA512 TLSH

Submit Download

language_externalcommand-en-US.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Languages\Plugins\ExternalCommand\language_externalcommand-en-US.xml
Size 883B
SHA256 05294e8492524ab887d8613282d36c975dc7ddd357a567e7bcfa4fb26b5f1324
MD5 5cd11277a5a86626c845b2e3fe42e036
SHA1 27236f7d90e6f138959345ed9cfaf97df9e39d70
SHA512 2040a071382d3cc1b92e10617d896e642e5d9e2fca5d95e2131aeea525f68d40e7a96c52091c2e874518dda1bdfbb6f5933fea12389cf652c839e88171c575ef
TLSH
T10F117C3B2CC84C3AC63601299B65A556EE2A8362D039640DF0EDF6171BF77CAD593C46
MD5 SHA1 SHA512 TLSH

Submit Download

language_externalcommand-kab-DZ.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Languages\Plugins\ExternalCommand\language_externalcommand-kab-DZ.xml
Size 896B
SHA256 6a6475bff84a8cf05fef36f4e53da99a4c2183420f83502f52b5597c9c3b2b7c
MD5 550e4dac5a508aaccefe61acf070272e
SHA1 b110ced1df1acfae4576703753a76866f62551f7
SHA512 30025da44a96b109813822118ea933a515150ff53bc9c682fb1452a2f6d2f2be758dba918d883e9ae679fd2d2210afc93471fda23de6b0c6196d13aa495957a0
TLSH
T14F11AC3B2CC44C7AC672412A8B65D445EA1AD222E538540CF0EDF6275BFB7DAE2D3C06
MD5 SHA1 SHA512 TLSH

Submit Download

language_externalcommand-sr-RS.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Languages\Plugins\ExternalCommand\language_externalcommand-sr-RS.xml
Size 888B
SHA256 2c8ea171b86daee5addfd998a775f538a5b7ee93395b85f0aba0fb175dcf5d85
MD5 c2752ca676af6de4d7f68b97aef685f5
SHA1 c6c98ca9050bda9174885ea60c63ee45580d826a
SHA512 10d095431017689ec838c737939341999558e793d7bb85cb8e19e1b50557cdade2c3ed46af36f2bc664634d516f69d0c927f90a07f793fb8e4dfccb19bfce1ae
TLSH
T14A11C13B3DD04CB9C52240678B6AD904AA5A56B5F139941CC0E8B77E32F73C9C260C4A
MD5 SHA1 SHA512 TLSH

Submit Download

language_imgur-en-US.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Languages\Plugins\Imgur\language_imgur-en-US.xml
Size 1KB
SHA256 a7d029469a85fb279ffd007056199291b268c547921466f403dc06fac25660fb
MD5 d440ec5f9014b33dff0a27a9c81611ea
SHA1 5984a181440f3062ea08dc33dd26696b4037289c
SHA512 26827ae7e94db84cdda3eb1301e0f7e05bb2d2406f2bd0f463023d367bf3ac39de2b0a8d5db6802f5cccac953e0ca06bdb34b9eeee01a708519b3411d69ad732
TLSH
T1D221B92B2DD15C39C13600278A7B61969D598A34D139B10CF5E9F07B21FF7CAF222C61
MD5 SHA1 SHA512 TLSH

Submit Download

language_imgur-kab-DZ.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Languages\Plugins\Imgur\language_imgur-kab-DZ.xml
Size 1KB
SHA256 b4c3df31a4f86a06509236d2c8bc465b80709463f199642a2f8107b866ab5120
MD5 3d8f78731c597f0d40a6d08f77daa4ea
SHA1 aeb9fd7575f61440aea90883158d6f3beec336f2
SHA512 17fa63fb3ad41d51be7d24af40e0ba69ea89d050ecece93f132533866c1af59480804b9a4dcfedf02fba2169d4ae91b11a7e621e69428053338f1ed542ad29b6
TLSH
T1C43190273DD94EB8D072402B8A799095842FDE21F138E00CE4D8F57B22FB7DA9921D62
MD5 SHA1 SHA512 TLSH

Submit Download

language_imgur-sr-RS.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Languages\Plugins\Imgur\language_imgur-sr-RS.xml
Size 1KB
SHA256 d3895bf7b1da2e4b6ccc23ed3fd871b43aa413e612a002920274a421fb9e3521
MD5 13fd5aae4aaef56a1f0bc5d6aa3e3501
SHA1 50f040477163ca03e2a3da51d3cad738a387d6b6
SHA512 32d4369d0310e12c6d18fa0dc71ecbcfe9d325b0aaeb383a37f2cfabfdd2e33730341f6656bec261eedea4381f47cac73ff3bdf7a7b535846806cccf666cdbcf
TLSH
T18A3124273DD419F98172402B8A19B941641A9B7DFE36E61CC1D4B47D32F73E88074E0E
MD5 SHA1 SHA512 TLSH

Submit Download

language-en-US.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Languages\language-en-US.xml
Size 22KB
SHA256 8e68afb307371bd298ff70da89777c1bb54d4992f0f0bd32cd75d8003c2ac50f
MD5 95461984b5297c8caa8a44a09de8a40a
SHA1 9494057ed63200dfcd0e8090791c4389ab29e17e
SHA512 308dc09725d83b80baac70def7695a418d867a4387dd5825b0136c7686d3a8a9bcfd63e36afd027cbee8270a321b706167416de32f2d862c158866307741e261
SSDEEP 384:/DdVIAxoJhREHu5HXJ3D8bxgg6D1HBwWOop:/DrIAWLRmu5VDBfD1HBwVo
TLSH
T195B2FC7B3CC44E79C172052B9A2EA145D51A86B4F178B15CD4E8F53B32FB3CAC266C92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Newtonsoft.Json.dll
Size 685KB
SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
MD5 081d9558bbb7adce142da153b2d5577a
SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
TLSH
T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.Plugin.ExternalCommand.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Plugins\ExternalCommand\Greenshot.Plugin.ExternalCommand.dll
Size 31KB
SHA256 9403e47e4c7ca6f16ea218d85eae64eeea416618738817ce12ba393c7b5aa294
MD5 6019acfcf2843fc6ae52a9cdfd81defe
SHA1 1e588c09fbc64694725f146dbfd82dabedab44e7
SHA512 69cfe698d2b91fcd42366992fb60c981db3100dae2f033ad3b84c2a3d261c145ca61df34ad8dcda42e783bc8cb60c907db30fda5c1c71e05107c38644d8947f9
SSDEEP 768:beUJoIQyrKPXt5wWX8VTaMWfWMy5iUQrj:beTDDuRTvgWMy5J0
TLSH
T164E2C51477FE9327D6FF0BFA697150100BF4BA292821DB8D0E857ACB1CE2B440621B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.Plugin.Imgur.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Plugins\Imgur\Greenshot.Plugin.Imgur.dll
Size 38KB
SHA256 cbd69eefef73e2d758f18f3ba770a55b4f4c7d3717fe30b2b622261f8a3c7805
MD5 d955627c6aee9ea0430fd458f9143726
SHA1 c09ea94b7c38f1002bce0e1d2571e7bc856e9c75
SHA512 f2a8972daa209e3a4f38ec8c0683deb919057d7a57757b1b6a1aa0404c3a0c94690dddf79486f81b41b23185010fd40b23f7d5297b6aa9982825ff7067a93079
SSDEEP 768:8WtBWKiTKVDzp6b4avxq9yVNHOZGEG4DSJ9VoYSFBGB7Ph0ioH7zbU:HVVVDz4bpv88NHOZGPkSzvBDh1UQ
TLSH
T1CA03D48573B8D37AE6BA0EBAB871954007B1B6572921EB9C0DC174CF59F3B408222777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.Plugin.Office.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Plugins\Office\Greenshot.Plugin.Office.dll
Size 92KB
SHA256 6d86d582be0ac6add247e6b672a39c305dba222271af25dc1373571d5f9c2156
MD5 450f3273b755b09bc231285dfe84de3d
SHA1 4417795a06ef22f22aac5d98e7b0bbb26777c25f
SHA512 790a957701113d0a7f3c6cf90dc4227f00d48452fe778d61149c0cfa5e0204f4ff8ca4bf239f993bed17c9f2c14187a73a81b7a87f76eb0e2f50a58c9fa44ab6
SSDEEP 1536:gAH5w0d2rBpxOVj+ud7Mcjpoj9GjQlLVH1ogdWjqbXuZHCU:tv2dp+jvM2poRSGLVH1ogn2F
TLSH
T17D933D4163A9876BD5AE4BB864F17640177AF58B25F2F70F0C5DEAE70813390DAA0363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.Plugin.Win10.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Plugins\Win10\Greenshot.Plugin.Win10.dll
Size 38KB
SHA256 34ea314edb15164dea70d7537c58655be2bd0974f846003e50704aac3d1478b4
MD5 5e7bd5ba5f31ef9f6da1178472385c83
SHA1 026d054376b3cdbb63dc775c18c64b184094bc5c
SHA512 5fbfd91f46fe1b0318cd762500649ad8b63525720a1524d576d462b9e219bed7924f5eddc866d74c3021eb59a4dbe991a87466760507b382a63bbdcf61158256
SSDEEP 768:meQC+MNzqHgtrpm7f0BnmgHbZqIvND1xJl3Rq2AF:emY7Qnj0IvNNl5O
TLSH
T17F032B92A3AD8317C6BF2FBDBDB553060732EA066411E74D1D8CA5DA5893B412F103EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Toolkit.Uwp.Notifications.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\Plugins\Win10\Microsoft.Toolkit.Uwp.Notifications.dll
Size 140KB
SHA256 51eebdb28f042f6169e3c71cec16d3fa95634c4284a20ed1d4e4d182de5f4bec
MD5 f58e9ca60368433534c420b054b01cd3
SHA1 598b9280153e53c6fff56af80d2c59d087809612
SHA512 14e180a029a81c777e2b4e938891de578203ef01ac2f187280e87fc161a2b7de9e36cff5fbd810ff5ca5bbc5cc84bdbce68f120014813c8e5ed17ee200e7f573
SSDEEP 1536:IRdbKFBNaWYYK8gwb+zPws86WGkGaBb6ktu4YLHwYfJe5K+Q7ieK7I/62tWIj9X1:89ENDYz2GLm6MBYLHr1+r97Off
TLSH
T1BCE37D2023B84BA9EBEF573AF4F404260EB7E96B7425E7694704F4DE2847B428251377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.dll

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\log4net.dll
Size 264KB
SHA256 1d45a6afa38f0b10814063f2a42e6efce45752853667650e765844b8566b3332
MD5 46319a38ce5d09020d2ac56b67829c6c
SHA1 ffe64ca4d4bc9e1dab1d195982d22121a6baa058
SHA512 0de61771a92ee71470e51bccf66d3a39c105ae23d60e73d8e4e7d44135dff4c8d1dddff9bbb6be72ff083d51c784e5ca829a6adefee87fd901d2de58db0ddb03
SSDEEP 3072:h+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWn:c1N8LLI/PK0scnodG1RS1T93caL
TLSH
T13544065477F84A19F2FF6BB8A475011587B6F956B87EE35E0A80A4FC2C33B1089117A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.xml

Path C:\Users\Admin\AppData\Local\Programs\Greenshot\log4net.xml
Size 1KB
SHA256 6a9bc3fe8a9bfb27fc9455c861ebfe0bac3c4e93906f50fb69caab5f1a57901c
MD5 70f1547fdd92a3c9e20fbdfc23d2681d
SHA1 a64d2e3c997480e90e713f1e346384c07d51b74e
SHA512 2e056c3d637b938132aab54e22757671d0782ebd3f38a8bc7afae35080b8c0c45f1c08f599238db200e1283aff2b99fd909eaff6c4f25d378205c43be424a1aa
TLSH
T146115951FA6CFD6543070A8BA4330918DA3FFC9B157409CEB08291BF746F9A41AB53A7
MD5 SHA1 SHA512 TLSH

Submit Download

151c7fc5-fb4d-4dfe-becd-4d26969e4154.tmp

Path C:\Users\Admin\AppData\Local\Temp\151c7fc5-fb4d-4dfe-becd-4d26969e4154.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ad13787-13e2-4dc7-9947-3affad02114a.tmp

Path C:\Users\Admin\AppData\Local\Temp\4ad13787-13e2-4dc7-9947-3affad02114a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

isxdl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-MUBF0.tmp\isxdl.dll
Size 121KB
SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
MD5 48ad1a1c893ce7bf456277a0a085ed01
SHA1 803997ef17eedf50969115c529a2bf8de585dc91
SHA512 7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
SSDEEP 1536:dohlISko4eZHOMazWpdYoEWSekaDnXUq5o5dInL:dkIM4ehDaqEpMXUq5o5dIL
TLSH
T18FC36B317350D433C06B193A191A87BA637FBA3195B5984B7B840FBE6F30691DA3631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot-INSTALLER-1.3.315-RELEASE.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-OH2P2.tmp\Greenshot-INSTALLER-1.3.315-RELEASE.tmp
Size 3.0MB
SHA256 62e844e18f245ed6432cb49a71a6e461b983be86c401e0281a3b1abe5adac204
MD5 f8280862d4bc630163de64f452aca57b
SHA1 98aa73071f05dcf754506cd09b0fdb157c459223
SHA512 7cd5fdbb54ef4b1d4b9b934859823f0965166be5e446e050a52727335166265915c74f68a11d996eff347daa59ca7190cf3d59629e07ed39881573f391d8cc77
SSDEEP 49152:Vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEju333eP:WHDYsqiPRhINnq95FoHVBu333W
TLSH
T136E54B17F389723ED06B1A364A3386909837B6617916CCA797FC384C8F3D5942A3E746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32de9eb2-965a-4aa2-90d1-349044f144b2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1716_1500907908\32de9eb2-965a-4aa2-90d1-349044f144b2.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1716_1624953691\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.ini

Path C:\Users\Admin\AppData\Roaming\Greenshot\Greenshot.ini
Size 8KB
SHA256 ca85bb8f84e657e328795e81722e8931f38bc2e46d5a2142b3058406c50289e7
MD5 a1e376fb60da986d9e14753f10d8cafc
SHA1 1197784e667747585d5488273646667415bebe48
SHA512 e5461650ba08f7252b68a46ee5e3cfa20e20cf2a002c9fe9eab3d9e988c76b52fdb630240f88307a0e8c1048b2d020465c372d77f4494e4995be086643a21add
SSDEEP 192:JmBLDN2tSZhn36p84NxL3l4w6IbAYnsOIOeruHs940tpKnP:JmBLx2UZV36p84NxL3l4XCnsaKx9RenP
TLSH
T10D02086B7788633B167302D29B0FD2E5DFBA446846BA6A51B0694E8C300D036D37F8F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenshot.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Greenshot\Greenshot.lnk
Size 1KB
SHA256 d5b22749842f3d6b93c2a55e0b276b03a35a683056adf4925761b007265a6ed7
MD5 09898d73f31199af4e7441fad60ac6fa
SHA1 7b392e834e86990e6ad3527e544c688d2318a43d
SHA512 889bc18859d3f1e8e334ab843d5608e14565815485a9926fcc23b46d4c4a91e7d78620143343f5c17348b70f58693973e5435e7c46e1a7526deb39cec9d2b3a9
TLSH
T11921213247F92715D6B5CAF494B796678232FC45EE4A5F0C010483451D25602EFA8F2F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2028-363-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2028-5-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/2028-13-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/2028-12-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2028-328-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2672-749-0x000001ECF17C0000-0x000001ECF17CA000-memory.dmp

Download

memory/2672-221-0x000001ECD4AE0000-0x000001ECD4B26000-memory.dmp

Download

memory/2672-872-0x000001ECF1A40000-0x000001ECF1A62000-memory.dmp

Download

memory/2672-739-0x000001ECF0E20000-0x000001ECF0E48000-memory.dmp

Download

memory/2672-740-0x000001ECEF060000-0x000001ECEF06A000-memory.dmp

Download

memory/2672-741-0x000001ECF0E50000-0x000001ECF0E76000-memory.dmp

Download

memory/2672-729-0x000001ECEEA20000-0x000001ECEEA2C000-memory.dmp

Download

memory/2672-276-0x000001ECEE9E0000-0x000001ECEE9F0000-memory.dmp

Download

memory/2672-746-0x000001ECF1110000-0x000001ECF1120000-memory.dmp

Download

memory/2672-747-0x000001ECF17B0000-0x000001ECF17B8000-memory.dmp

Download

memory/2672-751-0x000001ECF18E0000-0x000001ECF1906000-memory.dmp

Download

memory/2672-731-0x000001ECEEA30000-0x000001ECEEA40000-memory.dmp

Download

memory/2672-727-0x000001ECEE0B0000-0x000001ECEE0BE000-memory.dmp

Download

memory/2672-230-0x000001ECED0A0000-0x000001ECED0B4000-memory.dmp

Download

memory/2672-753-0x000001ECF18B0000-0x000001ECF18BE000-memory.dmp

Download

memory/2672-737-0x000001ECEF030000-0x000001ECEF040000-memory.dmp

Download

memory/2672-755-0x000001ECF1AC0000-0x000001ECF1B70000-memory.dmp

Download

memory/2672-226-0x000001ECED080000-0x000001ECED09C000-memory.dmp

Download

memory/2672-223-0x000001ECD4AB0000-0x000001ECD4AC2000-memory.dmp

Download

memory/2672-225-0x000001ECD4A90000-0x000001ECD4A9E000-memory.dmp

Download

memory/2672-219-0x000001ECED150000-0x000001ECED160000-memory.dmp

Download

memory/2672-218-0x000001ECECFF0000-0x000001ECED058000-memory.dmp

Download

memory/2672-216-0x000001ECD2B80000-0x000001ECD2BC4000-memory.dmp

Download

memory/2672-733-0x000001ECEF040000-0x000001ECEF05E000-memory.dmp

Download

memory/2672-725-0x000001ECEEA50000-0x000001ECEEAA8000-memory.dmp

Download

memory/2672-868-0x000001ECF17D0000-0x000001ECF17DC000-memory.dmp

Download

memory/2672-866-0x000001ECED150000-0x000001ECED160000-memory.dmp

Download

memory/4928-11-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/4928-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

memory/4928-364-0x0000000000400000-0x00000000004CE000-memory.dmp

Download