File scan report

Verdict Safe

Analyzed Sep 11, 20261 month ago

Is Greenshot-INSTALLER-1.3.315-RELEASE.exe safe? Yes, no threats found.

This Greenshot installer has a valid signature from Thomas Braun, none of the 71 antivirus engines that checked it flag it, and it is widely submitted.

Read the whole reasonShow less

Strong evidence · A verified publisher signature, and no engine flags it.

Install it as usual if it came from the official source

This installer can be used as normal; obtain it from the official Greenshot website and confirm the Thomas Braun signature before running it.

Good practice2 tips

We found nothing harmful in this file.

Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 71 flagged

Flagged 0
No detection 71
No result 4

FileGreenshot-INSTALLER-1.3.315-RELEASE.exe4.0 MBSHA-256 9bb4971e729a…8c0fd3

Code signing Thomas Braun
Test run Completed
First seen 7mo ago

7 community detection rules on YARAify matched this file.

Chapter 02

Why we think so

0 points against it and 4 in its favour, checked against the scan evidence.

Analyst conclusion

It carries a valid code signature from Thomas Braun, the Greenshot maintainer, and has been submitted by nearly 2,800 distinct sources. The sandbox runs show the expected installer flow: it installs Greenshot, opens the vendor's thank-you page and checks the official update feed.

Where this verdict could be wrong2 caveats

Our history holds only one prior sample from this signer, so the signature is not backed by an established track record with us.
The sandbox recorded traffic to many raw IP addresses, but it fits the browser loading the vendor's thank-you page through content-delivery and Google infrastructure.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

31sandbox rule tags
9spawned processes
21network contacts
33filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1003· Credential theft
T1005
T1012
T1027· Obfuscated code
T1027.002· Obfuscated code
T1036
T1055· Process injection
T1059· Runs commands
T1070· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1106
T1112
T1114
T1129· Loads modules
T1134
T1485
T1497· Sandbox evasion
T1529
T1539
T1547· Auto-start
T1547.001· Auto-start
T1548
T1552· Credential search
T1552.001· Credential search
T1562· Disables security
T1562.001· Disables security
T1573
T1614
T1614.001

Observed activity

Processes started

Programs the file ran, with their command lines.

Greenshot-INSTALLER-1.3.315-RELEASE.exe"C:\Users\<USER>\Desktop\Greenshot-INSTALLER-1.3.315-RELEASE.exe"
Greenshot-INSTALLER-1.3.315-RELEASE.tmp"C:\Users\<USER>\AppData\Local\Temp\is-DCPMS.tmp\Greenshot-INSTALLER-1.3.315-RELEASE.tmp" /SL5="$50178,3032110,791552,C:\Users\<USER>\Desktop\Greenshot-INSTALLER-1.3.315-RELEASE.exe"
msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getgreenshot.org/thank-you/?language=en&version=1.3.315
Greenshot.exe"C:\Users\<USER>\AppData\Local\Programs\Greenshot\Greenshot.exe" /language en
msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument https://getgreenshot.org/thank-you/?language=en&version=1.3.315
identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6724 --field-trial-handle=2148,i,4896523064891287267,5593676354975097398,262144 --variations-seed-version /prefetch:8

Show all 9 entries

Greenshot-INSTALLER-1.3.315-RELEASE.exeC:\Users\<USER>\AppData\Local\Temp\is-89I2U.tmp\Greenshot-INSTALLER-1.3.315-RELEASE.tmp /SL5=$201AA,3032110,791552,C:\Users\<USER>\Downloads\Greenshot-INSTALLER-1.3.315-RELEASE.exe
Greenshot-INSTALLER-1.3.315-RELEASE.exe"C:\Users\user\Desktop\Greenshot-INSTALLER-1.3.315-RELEASE.exe"
Greenshot-INSTALLER-1.3.315-RELEASE.tmp"C:\Users\user\AppData\Local\Temp\is-V7JFJ.tmp\Greenshot-INSTALLER-1.3.315-RELEASE.tmp" /SL5="$303DC,3032110,791552,C:\Users\user\Desktop\Greenshot-INSTALLER-1.3.315-RELEASE.exe"

Network contacts

21 hosts, listed as 20 addresses, 1 link. Links show the host and path only.

IP address13.107.226.70
IP address104.21.10.247
IP address150.171.73.13
IP address23.216.147.194
IP address104.18.34.93
IP address104.92.251.90

Show all 21 entries

IP address192.0.77.2
IP address104.16.80.73
IP address173.194.203.132
IP address172.253.117.94
IP address173.194.202.132
IP address74.125.20.138
IP address74.125.142.139
IP address142.250.99.139
IP address173.194.203.102
IP address74.125.20.132
IP address23.216.147.205
IP address104.18.87.42
IP address23.216.147.30
IP address104.18.66.57
URLhttps://getgreenshot.org/update-feed.json

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Temp\is-DCPMS.tmp\Greenshot-INSTALLER-1.3.315-RELEASE.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-RHNNF.tmp\_isetup\_setup64.tmp
WrittenC:\Users\<USER>\AppData\Local\Temp\is-RHNNF.tmp\isxdl.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Dapplo.Windows.Clipboard.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\HtmlAgilityPack.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Dapplo.Windows.dll

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Greenshot.exe
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Greenshot.Base.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\System.Runtime.CompilerServices.Unsafe.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Dapplo.Log.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Greenshot.Editor.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\log4net.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Dapplo.HttpExtensions.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\System.Buffers.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Greenshot\Dapplo.HttpExtensions.JsonNet.dll
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\Plugins
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-U008N.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-H85L9.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-9JE3C.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-CF3M4.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-3UGH2.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-P9TA2.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-6L428.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-CBG3E.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-E37IK.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-9IDCR.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-JF4N6.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-T24F5.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Greenshot\is-OU2S5.tmp

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Greenshot
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash
DeletedHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Greenshot

Show all 8 entries

DeletedHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Greenshot
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

cversions.3.m
C__Users_Bruno_AppData_Local_Greenshot_Greenshot.log_rolling
Local\F48E86D3-E34C-4DB7-8F8F-9A0EA55F0D08

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processExplorer.EXEC:\Windows\Explorer.EXE

Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.

9 not checked

1d3ef8698281e7cf7371…ba1183Not checked
no saved verdict
be1068d1af240549afcd…029834Not checked
no saved verdict
f53d719cf57e098fa366…086d59Not checked
no saved verdict
a059e2749d4ee647c185…c3084bNot checked
no saved verdict
b624949df8b0e3a6153f…6610f3Not checked
no saved verdict
14638b5b3a694ad5ded1…828afcNot checked
no saved verdict
bd42daf25165e3deaa7b…458060Not checked
no saved verdict
550a7c35debe1d1b038e…574589Not checked
no saved verdict
f0ec81e0646237f92089…c2806fNot checked
no saved verdict

Chapter 04

Technical details

None of the 71 antivirus engines that checked it flag it; signed by Thomas Braun.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 71 engines flagged it · 4 gave no result DetailsSep 9, 2026

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsOct 21, 2026

Contacted hostsMalwareTips URL scannerPartial1 of 21 contacted hosts were cross-checked; coverage is incomplete DetailsOct 21, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete7 community YARA rules · 2 MalwareTips behaviour rules DetailsOct 21, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedSep 11, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchSep 11, 2026

File fingerprint

Last analyzed: Sep 11, 2026, 3:25 PM UTC

SHA-256: 9bb4971e729a2ad1612e8aa2fa490b69c33af7f42515f9b642c7d0f80f8c0fd3
SHA-1: aba2ba820d6c0ac326550920faf989d103cdd144
MD5: afd9ccf186d4924c01dcf84c7dcc19d4

About this file

Greenshot-INSTALLER-1.3.315-RELEASE.exe is a Win32 EXE file of 4.0 MB.

Type and size: Win32 EXE · 4.0 MB
Signer: Thomas BraunValid code signature.
First seen: Mar 20, 2026On VirusTotal.
Submitted by: 2,776 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned Sep 11, 2026Updated Oct 21, 2026

Verdict history

Sep 11, 2026Suspicious
Oct 21, 2026Safeafter a re-check of the saved evidence

Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.

Antivirus consensus

0 of 71 engines flagged this file

0 malicious0 suspicious71 not flagged4 no result

4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-236 engines
0flagged
Low-trust17 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.

7 YARA2 heuristics

MITRE ATT&CK profile

Defense evasion× 1Cred access× 1

Community YARA rules

Researcher-authored signatures reported by YARAify

Showing the 5 saved rule names of 7 matched.

Borlandgeneric
certum_issuergeneric
detect_certum_issuergeneric
HUNTING_SUSP_TLS_SECTIONgeneric
pe_detect_tls_callbacksgeneric

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)
CredentialDumper
T1003 T1003.001
low
VirusTotal's sandbox summary maps this run to MITRE T1003 (OS Credential Dumping), but no process targeting LSASS or another credential store was recorded. VirusTotal maps T1003 on clean files more often than on detected ones, so the mapping alone is not evidence of credential theft.
Evidence
T1003 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy10 sections

.text

6.36

.itext

5.97

.data

5.05

.bss

0.00

.idata

5.03

.didata

2.75

.edata

1.88

.tls

0.00

.rdata

1.38

.rsrc

5.39

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

2,776

Hundreds of people have uploaded this — common.

Total submissions

3,609

Includes repeat uploads by the same source.

First seen

7mo ago

Mar 20, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is Greenshot-INSTALLER-1.3.315-RELEASE.exe safe?

We found nothing harmful in Greenshot-INSTALLER-1.3.315-RELEASE.exe. None of the 71 antivirus engines that checked it flag it. It has a valid digital signature from Thomas Braun. Install it only if it came from the developer's own website or an official app store.

What is Greenshot-INSTALLER-1.3.315-RELEASE.exe?

Greenshot-INSTALLER-1.3.315-RELEASE.exe is a software installer, about 4.0 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Mar 20, 2026.

How many antivirus engines detected Greenshot-INSTALLER-1.3.315-RELEASE.exe?

None of the 71 antivirus engines that checked it flag Greenshot-INSTALLER-1.3.315-RELEASE.exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

Is Greenshot-INSTALLER-1.3.315-RELEASE.exe digitally signed?

Yes. Greenshot-INSTALLER-1.3.315-RELEASE.exe has a valid digital signature from Thomas Braun, which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of Greenshot-INSTALLER-1.3.315-RELEASE.exe?

The SHA-256 fingerprint of Greenshot-INSTALLER-1.3.315-RELEASE.exe is 9bb4971e729a2ad1612e8aa2fa490b69c33af7f42515f9b642c7d0f80f8c0fd3, and its MD5 is afd9ccf186d4924c01dcf84c7dcc19d4. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to install Greenshot-INSTALLER-1.3.315-RELEASE.exe?

We found nothing harmful in Greenshot-INSTALLER-1.3.315-RELEASE.exe, and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of Greenshot-INSTALLER-1.3.315-RELEASE.exe?

This report reflects the scan on Sep 11, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is Greenshot-INSTALLER-1.3.315-RELEASE.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

Verdict history

0 of 71 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is Greenshot-INSTALLER-1.3.315-RELEASE.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Verdict history

Related file reports