Overview

overview

6

Static

static

1

setup-lightshot.exe

windows10-2004-x64

6

setup-lightshot.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 02:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup-lightshot.exe
  • Size 2.7MB
  • Sample260924-dacbesybja
  • SHA256 928c2808421dfd487ffa697379548cbe682c0e13aeb595eb89973ba9c515b8a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryinstallerpersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

    installer
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup-lightshot.exe
    "C:\Users\Admin\AppData\Local\Temp\setup-lightshot.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Users\Admin\AppData\Local\Temp\is-NODFF.tmp\setup-lightshot.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NODFF.tmp\setup-lightshot.tmp" /SL5="$4011A,2148280,486912,C:\Users\Admin\AppData\Local\Temp\setup-lightshot.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im lightshot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill.exe" /F /IM lightshot.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
      • C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe
        "C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe
          "C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1916
      • C:\Users\Admin\AppData\Local\Temp\is-D2VH4.tmp\setupupdater.exe
        "C:\Users\Admin\AppData\Local\Temp\is-D2VH4.tmp\setupupdater.exe" /verysilent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3608
        • C:\Users\Admin\AppData\Local\Temp\is-PG6UJ.tmp\setupupdater.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-PG6UJ.tmp\setupupdater.tmp" /SL5="$801F2,490430,120832,C:\Users\Admin\AppData\Local\Temp\is-D2VH4.tmp\setupupdater.exe" /verysilent
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5900
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\system32\net.exe" START SCHEDULE
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3928
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 START SCHEDULE
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3452
          • C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
            "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addsystask
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2880
          • C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
            "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2292
            • C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
              "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\Updater\info.xml"
              6⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4980
          • C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
            "C:\Program Files (x86)\Skillbrains\Updater\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious use of WriteProcessMemory
            PID:3760
            • C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
              "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe" -runmode=ping -url="http://updater.prntscr.com/getver/updater?ping=true"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:5428
      • C:\Program Files (x86)\Skillbrains\Updater\updater.exe
        "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addtask
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3768
        • C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
          "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addtask
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4840
      • C:\Program Files (x86)\Skillbrains\Updater\updater.exe
        "C:\Program Files (x86)\Skillbrains\Updater\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe
          "C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\updater.exe" -runmode=addproduct -info="C:\Program Files (x86)\Skillbrains\lightshot\info.xml"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4212
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://app.prntscr.com/thankyou_desktop.html#install_source=default
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x33c,0x7ffd1612c188,0x7ffd1612c194,0x7ffd1612c1a0
          4⤵
            PID:5640
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,5170732094861594751,16445398605626922352,262144 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
            4⤵
              PID:3392
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,7360814150833449281,2617007249176228300,524288 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
              4⤵
              • System Time Discovery
              PID:6060
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,9091716090097665275,7423499466487484116,524288 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
              4⤵
                PID:4376
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9811217428443313463,12860613354538603054,2097152 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                4⤵
                  PID:2220
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,15790505853467751546,5913125344062126771,2097152 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
                  4⤵
                    PID:108
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,12634854807756941616,3585006142726166706,2097152 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
                    4⤵
                      PID:3168
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,7762671206163894312,8748585536430109219,2097152 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:9
                      4⤵
                        PID:4668
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,10454849776294835286,6040993557472341347,524288 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
                        4⤵
                          PID:5052
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5460,i,17536270399297686872,1950728232287716261,2097152 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
                          4⤵
                            PID:6096
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,12981816233861967786,4857563496426212156,524288 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
                            4⤵
                              PID:2360
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,2228228433416663982,4965695944090973727,524288 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
                              4⤵
                                PID:2008
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,15429969321304659155,15402679013182355961,524288 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
                                4⤵
                                  PID:1784
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,15429969321304659155,15402679013182355961,524288 --field-trial-handle=2304,i,18304530488203961310,17996283940317923998,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
                                  4⤵
                                    PID:3564
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                    4⤵
                                      PID:5084
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                1⤵
                                  PID:5248
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                  1⤵
                                  • Drops file in Windows directory
                                  • Enumerates system info in registry
                                  • Modifies data under HKEY_USERS
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4916
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x32c,0x7ffd1612c188,0x7ffd1612c194,0x7ffd1612c1a0
                                    2⤵
                                      PID:5664
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,2129104858582311118,13016391608537006456,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
                                      2⤵
                                      • System Time Discovery
                                      PID:2992
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,15788297764265930757,17004306200278544136,262144 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
                                      2⤵
                                        PID:1972
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,1506430069179070393,5371645110616372523,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
                                        2⤵
                                          PID:2276
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,14240448086477031944,18334395420467287944,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
                                          2⤵
                                            PID:2620
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,14240448086477031944,18334395420467287944,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
                                            2⤵
                                              PID:3864
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,9825743501768435850,1616287329334266983,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                                              2⤵
                                                PID:5856
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,3787281261807961994,6814028894156843262,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
                                                2⤵
                                                  PID:6032
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,10832400585560715413,9047429900284694238,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
                                                  2⤵
                                                    PID:2176
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,17351755871204958923,2989557886806400797,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:14
                                                    2⤵
                                                      PID:1484
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14517888395998712834,8877414582470402308,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
                                                      2⤵
                                                        PID:2732
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1411414597071897115,610920344920480002,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
                                                        2⤵
                                                          PID:3568
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,16640146114974858269,4043616530516409084,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
                                                          2⤵
                                                            PID:2868
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,15015591143344756354,14548034911979726957,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
                                                            2⤵
                                                              PID:2308
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,5757513890076657546,4484257490739435088,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
                                                              2⤵
                                                                PID:6124
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,17888492035370193438,6074309619801176052,524288 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
                                                                2⤵
                                                                  PID:3688
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4840,i,10312626450576265095,2852419927109688282,262144 --field-trial-handle=2412,i,3927112949549445386,13646193017087781588,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:10
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2244
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                1⤵
                                                                  PID:5500

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      Updater.exe
                                                                      • Path C:\Program Files (x86)\Skillbrains\Updater\1.8.0.0\Updater.exe
                                                                      • Size 854KB
                                                                      • SHA256 c4ce15b1bc8adecbf20a655256aab267c1d72e7a33947598af48ea287cca5670
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Updater.exe
                                                                      • Path C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
                                                                      • Size 405KB
                                                                      • SHA256 a5e3bdc3b0b0bd6455892e23008161b5478b24f4fe1801f43a8a01cfff1bcba7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      info.xml
                                                                      • Path C:\Program Files (x86)\Skillbrains\Updater\info.xml
                                                                      • Size 276B
                                                                      • SHA256 efce940e2e2504326dce91e1112dc19c31a9de49f0fc34886389d36997594ef0
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      DXGIODScreenshot.dll
                                                                      • Path C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\DXGIODScreenshot.dll
                                                                      • Size 93KB
                                                                      • SHA256 6acdcd817cc5df637aa4cd101c25c9e0a69c778347a7a40ce7511eeea26fd6f0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Lightshot.dll
                                                                      • Path C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.dll
                                                                      • Size 490KB
                                                                      • SHA256 04a27f0d1e89341722461119e00a10e00ec2a52f5e305961161ec4378e610e93
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Lightshot.exe
                                                                      • Path C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\Lightshot.exe
                                                                      • Size 487KB
                                                                      • SHA256 0b899508777d7ed5159e2a99a5eff60c54d0724493df3d630525b837fa43aa51
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      EN.txt
                                                                      • Path C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\locales\EN.txt
                                                                      • Size 10KB
                                                                      • SHA256 4a57246bd4ce9d387ec10f0ab2084c3d91e8463d03c1412f3665aee3885a85a5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      uploader.dll
                                                                      • Path C:\Program Files (x86)\Skillbrains\lightshot\5.5.0.7\uploader.dll
                                                                      • Size 215KB
                                                                      • SHA256 037ee2f3243918fffa71b9e3fe0541245f75f89abcac0ccf2ea6a57020ddaad7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Lightshot.exe
                                                                      • Path C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe
                                                                      • Size 221KB
                                                                      • SHA256 8d4c4bcf7d7aedf0480e3eaac52138e63724ae83c419de8a98d6ab32d1c93645
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      info.xml
                                                                      • Path C:\Program Files (x86)\Skillbrains\lightshot\info.xml
                                                                      • Size 362B
                                                                      • SHA256 f2cbf4e10f5f71841842c75ab97d2dc59a902a095e4ab54a25ad692c1d3aa1f0
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB
                                                                      • Size 1KB
                                                                      • SHA256 8aa550794fff0607116084cd4d961410a5f0e899716f311af29904cbdccc9c4c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                      • Size 4KB
                                                                      • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046
                                                                      • Size 1KB
                                                                      • SHA256 0162923f23664ad7c13d9e6f48f79be5356c1bdf8149454fc6c259997c3e03ff
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      81B9B36F9ABC4DA631A4713EE66FAEC6_412074E81637088159A0CBBB38324599
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_412074E81637088159A0CBBB38324599
                                                                      • Size 939B
                                                                      • SHA256 a920aae0014e9226a0f80c0050e3cc48ee5cc7509b2410d9dcde0e314a8d75f7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_7DAD5545724AA2C98C55095F428499FB
                                                                      • Size 512B
                                                                      • SHA256 ee52e30f700bbcf23fef21cbdce8124d4ed1fad62c710e1535d7bf137c582322
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                      • Size 342B
                                                                      • SHA256 25159db40f82e600a59e214fb7c67a6999a74fcc2e7c9258c6fa92abdd123919
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046
                                                                      • Size 502B
                                                                      • SHA256 fc33979223b4b6a094d71f13c78164710ce57fc0416ac56bdbb219d52892fd76
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      81B9B36F9ABC4DA631A4713EE66FAEC6_412074E81637088159A0CBBB38324599
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_412074E81637088159A0CBBB38324599
                                                                      • Size 524B
                                                                      • SHA256 1fc62675f10393d6a1c349f00863378ae218c1ca9732223516c41fd97d6ccb47
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      81B9B36F9ABC4DA631A4713EE66FAEC6_412074E81637088159A0CBBB38324599
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_412074E81637088159A0CBBB38324599
                                                                      • Size 524B
                                                                      • SHA256 0fe107dff53338c970929c54ac5c0232636ca4ede80be288696390a5c2adf7b4
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      3c03290c-e546-4f02-b12d-49e1847e53d1.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c03290c-e546-4f02-b12d-49e1847e53d1.tmp
                                                                      • Size 32KB
                                                                      • SHA256 67c1595a1152b953b63bc93621b7fb5d5688b658bb0919f1577acbc0e5a93e3b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      settings.dat
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      • Size 280B
                                                                      • SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      settings.dat
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      • Size 280B
                                                                      • SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      settings.dat
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                      • Size 280B
                                                                      • SHA256 5c8ccb1688d57ea6181ad0eaa62146196f3fa3f7d2cd948c7f3b774867640d30
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      2eadcb00-3496-4d3e-9777-46b1e7da0452.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2eadcb00-3496-4d3e-9777-46b1e7da0452.tmp
                                                                      • Size 6B
                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      92a4fba9-4778-461c-841f-c2d2f1b11673.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92a4fba9-4778-461c-841f-c2d2f1b11673.tmp
                                                                      • Size 414B
                                                                      • SHA256 3e339eef874230baab509ceb9eb3b54a417ca3a745600d34148261432314ef97
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      the-real-index
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                      • Size 3KB
                                                                      • SHA256 fa85df044d8a1991a546e9456b72c5cdc1f0a2b11f20f408217378e508055b53
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      the-real-index~RFe59641f.TMP
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59641f.TMP
                                                                      • Size 3KB
                                                                      • SHA256 a50b1cd9f822e4068e531227fa18a4b5042116f3978ef1d944f7bd07149690b1
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      SiteList-Enterprise.json
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                      • Size 2B
                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Edge Profile.ico
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                      • Size 70KB
                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      History
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
                                                                      • Size 224KB
                                                                      • SHA256 bc64b067c4d7e7806001a6db165271c99d8adf2d6fee0a33aa4f6aa2b7138648
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Network Persistent State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                      • Size 3KB
                                                                      • SHA256 391373a21229cbb65d29a3c6fdfbc0468fddc84a974fedae1fe2dbc2507ee7d9
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      Network Persistent State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                      • Size 3KB
                                                                      • SHA256 07ba1a8f8a355a87843a36d7129e66d3e8a0a29532f7358ade642db29823ef3b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      SCT Auditing Pending Reports
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                      • Size 2B
                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Sdch Dictionaries
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                      • Size 40B
                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      • Size 13KB
                                                                      • SHA256 c1d619aad57a00505b302bd8c96d77d3fdff66b4df1018605b8ca6137d758e87
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      • Size 13KB
                                                                      • SHA256 8da3a8c9d52bb3dcffe5643fb1158366254c4d7daca9e489032464eaff501ae4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      • Size 13KB
                                                                      • SHA256 412988a991ae8f4a92c85ccfc876d5e850e73aa6987fa61a19ffa5adc410a579
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                      • Size 13KB
                                                                      • SHA256 31701185f632c246616ba77b97fdc35db327cda7131b57c52ca82b565b7a7268
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Secure Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                      • Size 27KB
                                                                      • SHA256 7d5a44137188f66f0e81422f3981442772cbda88df51c1dcd54ef8d009002300
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      sync_diagnostic.log
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                      • Size 4KB
                                                                      • SHA256 c03491781de156637fc51a40056ebcc8c99c150b905db0e403e017c419810b35
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      OperationConfig
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                      • Size 22KB
                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      OperationConfig~RFe5a5351.TMP
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5351.TMP
                                                                      • Size 3KB
                                                                      • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      Last Version
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                      • Size 14B
                                                                      • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      • Size 35KB
                                                                      • SHA256 a26a78473d2096b611b06de21a173e7434e8c98e1d4527850cf4abc8202ee9d4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      • Size 43KB
                                                                      • SHA256 6484a02b13a9d71ba05cf4cd60406600458cb063c60fbb43c63c05358ed56e5f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      • Size 32KB
                                                                      • SHA256 9bb1ae1f7ff286751c324772b01c3a4c38a3eeaba8739cd3b08667bf8f6cc055
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      • Size 61KB
                                                                      • SHA256 5a320412a6fdbce61c4c40c82ac36f37cfadc1671895a50fa6511e903bbb3b35
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                      • Size 37KB
                                                                      • SHA256 285be3284ab09bbf67c244a417740df730b16959befb2cece81d72813f9d38a0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      data_1
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                      • Size 264KB
                                                                      • SHA256 f20c586896a094003885b8c3b6bf159af378753990240923930b4700eb35e5a2
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Variations
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
                                                                      • Size 86B
                                                                      • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      metadata.json
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                      • Size 132B
                                                                      • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      metadata.json
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                      • Size 252B
                                                                      • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      metadata.json
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                      • Size 372B
                                                                      • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      df3788f5-5408-4ad7-aca6-1c7151a72645.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df3788f5-5408-4ad7-aca6-1c7151a72645.tmp
                                                                      • Size 13B
                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      __utm[1].gif
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0ZRRKB0Q\__utm[1].gif
                                                                      • Size 35B
                                                                      • SHA256 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      1[1].gif
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q72YYD0X\1[1].gif
                                                                      • Size 43B
                                                                      • SHA256 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      7a62e9e6-b2cb-4b8b-8e5b-51e69ae14b5c.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a62e9e6-b2cb-4b8b-8e5b-51e69ae14b5c.tmp
                                                                      • Size 1B
                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      daa1b98c-aad5-45c2-bd87-2fe17501f2b9.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\daa1b98c-aad5-45c2-bd87-2fe17501f2b9.tmp
                                                                      • Size 10KB
                                                                      • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      setupupdater.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-D2VH4.tmp\setupupdater.exe
                                                                      • Size 865KB
                                                                      • SHA256 088f048ee972ef80bd527e301431c1ad7e46d0c994ad8a2b586c4fa6d86ac399
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      setup-lightshot.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-NODFF.tmp\setup-lightshot.tmp
                                                                      • Size 1.5MB
                                                                      • SHA256 55dbb288d5df6df375487bae50661dbf530fd43a7e96017b7183a54db8fc376a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      setupupdater.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-PG6UJ.tmp\setupupdater.tmp
                                                                      • Size 1.1MB
                                                                      • SHA256 fb5761640bb6d375345b780df0f1811f6ae6a1ddeae7c948299379f8bca822c8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      content_new.js
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4916_1266874048\CRX_INSTALL\content_new.js
                                                                      • Size 10KB
                                                                      • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      updater.log
                                                                      • Path C:\Users\Admin\AppData\Local\updater.log
                                                                      • Size 3B
                                                                      • SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      memory/972-6-0x0000000002370000-0x0000000002371000-memory.dmp
                                                                      Download

                                                                      memory/972-9-0x0000000000400000-0x0000000000587000-memory.dmp
                                                                      Download

                                                                      memory/972-10-0x0000000002370000-0x0000000002371000-memory.dmp
                                                                      Download

                                                                      memory/972-314-0x0000000000400000-0x0000000000587000-memory.dmp
                                                                      Download

                                                                      memory/972-333-0x0000000000400000-0x0000000000587000-memory.dmp
                                                                      Download

                                                                      memory/3608-224-0x0000000000400000-0x0000000000427000-memory.dmp
                                                                      Download

                                                                      memory/3608-183-0x0000000000400000-0x0000000000427000-memory.dmp
                                                                      Download

                                                                      memory/4952-8-0x0000000000400000-0x0000000000481000-memory.dmp
                                                                      Download

                                                                      memory/4952-336-0x0000000000400000-0x0000000000481000-memory.dmp
                                                                      Download

                                                                      memory/4952-0-0x0000000000400000-0x0000000000481000-memory.dmp
                                                                      Download

                                                                      memory/5900-223-0x0000000000400000-0x000000000052D000-memory.dmp
                                                                      Download