Trojan.Siggen12.42777

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Lightshot' = '%ProgramFiles(x86)%\Skillbrains\lightshot\Lightshot.exe'

Creates or modifies the following files

%WINDIR%\tasks\update-sys.job
<SYSTEM32>\tasks\update-sys
%WINDIR%\tasks\update-s-1-5-21-1960123792-2022915161-3775307078-1001.job
<SYSTEM32>\tasks\update-s-1-5-21-1960123792-2022915161-3775307078-1001

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im lightshot.exe

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\setup-lightshot.exe
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-bqn97.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ak0fi.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-2tdqm.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-oh4cu.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-jpf4e.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-g4sed.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-cevnr.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-1g5aj.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-43epc.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ih92c.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-2962r.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-8prqv.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-6csl8.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-32p7o.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-7cfqt.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-mum4d.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-rn6pb.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-b4qup.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ds4ja.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-m2gvr.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-n7rdj.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\info.xml
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-0kuef.tmp
%ProgramFiles(x86)%\skillbrains\updater\machineproducts.xml
%ProgramFiles(x86)%\skillbrains\updater\info.xml
%LOCALAPPDATA%\updater.log
%ProgramFiles(x86)%\skillbrains\updater\is-adfv6.tmp
%ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\is-uba6o.tmp
%TEMP%\is-gii0g.tmp\_isetup\_setup64.tmp
%TEMP%\is-oip3g.tmp\setupupdater.tmp
%TEMP%\is-01gbj.tmp\setupupdater.exe
%ProgramFiles(x86)%\skillbrains\lightshot\unins000.dat
%ProgramFiles(x86)%\skillbrains\lightshot\unins000.msg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\lightshot\screenshot history.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\lightshot\learn more.url
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\lightshot\lightshot.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\lightshot\uninstall lightshot.lnk
%ProgramFiles(x86)%\skillbrains\lightshot\is-ta524.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-mpfes.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-2mak9.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-umagq.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-a7n4v.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-beqh2.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-07003.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-rpcqs.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-p3dck.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-1e80b.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-mnda9.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-0a9va.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-3konv.tmp
%TEMP%\is-01gbj.tmp\is-vrlgb.tmp
%TEMP%\is-01gbj.tmp\is-on923.tmp
%TEMP%\is-01gbj.tmp\is-0ga9f.tmp
%TEMP%\is-01gbj.tmp\is-be8d0.tmp
%TEMP%\is-01gbj.tmp\is-7b8hv.tmp
%TEMP%\is-01gbj.tmp\is-81vdd.tmp
%TEMP%\is-01gbj.tmp\is-05ekb.tmp
%TEMP%\is-01gbj.tmp\is-751i6.tmp
%TEMP%\is-01gbj.tmp\is-etl0d.tmp
%TEMP%\is-01gbj.tmp\is-6v5ug.tmp
%TEMP%\is-01gbj.tmp\is-ntct5.tmp
%TEMP%\is-01gbj.tmp\is-ip0jo.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\is-pe5at.tmp
%TEMP%\is-01gbj.tmp\_isetup\_setup64.tmp
%TEMP%\is-loaus.tmp\setup-lightshot.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-pi7ar.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-412no.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-qiuja.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-q68qk.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-d4pf9.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-sla34.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-4aumo.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-1d4m4.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-p0vh8.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-d9vfa.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-vkmc6.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-8n4b0.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-c67d7.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-litgn.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-hnes8.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ahbl7.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-d7btf.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-m4eci.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-54rr7.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-hp3c0.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-1lq07.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-akvs3.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-17o1b.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ocpbm.tmp
%LOCALAPPDATA%\userproducts.xml

Deletes the following files

%TEMP%\is-gii0g.tmp\_isetup\_setup64.tmp
%TEMP%\7zipsfx.000\setup-lightshot.exe
%TEMP%\is-loaus.tmp\setup-lightshot.tmp
%TEMP%\is-01gbj.tmp\_isetup\_setup64.tmp
%TEMP%\is-01gbj.tmp\setupupdater.exe
%TEMP%\is-01gbj.tmp\browser-elements-eula-tr.rtf
%TEMP%\is-01gbj.tmp\browser-elements-eula-ru.rtf
%TEMP%\is-01gbj.tmp\elements-eula-tr.rtf
%TEMP%\is-01gbj.tmp\elements-eula-ru.rtf
%TEMP%\is-01gbj.tmp\browser-eula-tr.rtf
%TEMP%\is-01gbj.tmp\browser-eula-ru.rtf
%TEMP%\is-01gbj.tmp\browser-page-tr.rtf
%TEMP%\is-01gbj.tmp\browser-page-ru.rtf
%TEMP%\is-01gbj.tmp\yandex_browser_setup_tr.bmp
%TEMP%\is-01gbj.tmp\yandex_browser_setup_ru.bmp
%TEMP%\is-01gbj.tmp\yandex_logo_en.bmp
%TEMP%\is-01gbj.tmp\yandex_logo_ru.bmp
%TEMP%\is-oip3g.tmp\setupupdater.tmp
%ProgramFiles(x86)%\skillbrains\lightshot\info.xml
%ProgramFiles(x86)%\skillbrains\updater\info.xml

Moves the following files

from %ProgramFiles(x86)%\skillbrains\lightshot\is-pe5at.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\unins000.exe
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-2962r.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\nl.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-8prqv.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\nb-no.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-6csl8.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\mk.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-32p7o.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\lv.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-7cfqt.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\lt.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-mum4d.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ku.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-43epc.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\pt-br.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ih92c.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\pl.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ds4ja.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ja.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-beqh2.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\it.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-rpcqs.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ocpbm.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\id.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-qiuja.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\hy.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-d4pf9.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\hu.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-rn6pb.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ko.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-p3dck.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\net.dll
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-1g5aj.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\pt-pt.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\is-ta524.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\lightshot.exe
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-mpfes.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\zh-tw.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-2mak9.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\zh-cn.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-umagq.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\vi.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-a7n4v.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ur.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-0kuef.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\uk.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-n7rdj.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\tr.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-07003.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\th.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-m2gvr.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\sv.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-bqn97.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\sr.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ak0fi.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\sr-cyrl.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-2tdqm.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\sq.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-oh4cu.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\sl.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-jpf4e.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\sk.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-g4sed.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ru.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-sla34.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\hr.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-b4qup.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ka.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-4aumo.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\he.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-1d4m4.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\gl.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-p0vh8.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\fr.txt
from %TEMP%\is-01gbj.tmp\is-7b8hv.tmp to %TEMP%\is-01gbj.tmp\browser-eula-tr.rtf
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-0a9va.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\learnmore.url
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-3konv.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\dxgiodscreenshot.dll
from %TEMP%\is-01gbj.tmp\is-vrlgb.tmp to %TEMP%\is-01gbj.tmp\browser-elements-eula-tr.rtf
from %TEMP%\is-01gbj.tmp\is-on923.tmp to %TEMP%\is-01gbj.tmp\browser-elements-eula-ru.rtf
from %TEMP%\is-01gbj.tmp\is-0ga9f.tmp to %TEMP%\is-01gbj.tmp\elements-eula-tr.rtf
from %TEMP%\is-01gbj.tmp\is-be8d0.tmp to %TEMP%\is-01gbj.tmp\elements-eula-ru.rtf
from %TEMP%\is-01gbj.tmp\is-81vdd.tmp to %TEMP%\is-01gbj.tmp\browser-eula-ru.rtf
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-1e80b.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\lightshot.dll
from %TEMP%\is-01gbj.tmp\is-05ekb.tmp to %TEMP%\is-01gbj.tmp\browser-page-tr.rtf
from %TEMP%\is-01gbj.tmp\is-751i6.tmp to %TEMP%\is-01gbj.tmp\browser-page-ru.rtf
from %TEMP%\is-01gbj.tmp\is-etl0d.tmp to %TEMP%\is-01gbj.tmp\yandex_browser_setup_tr.bmp
from %TEMP%\is-01gbj.tmp\is-6v5ug.tmp to %TEMP%\is-01gbj.tmp\yandex_browser_setup_ru.bmp
from %TEMP%\is-01gbj.tmp\is-ntct5.tmp to %TEMP%\is-01gbj.tmp\yandex_logo_en.bmp
from %TEMP%\is-01gbj.tmp\is-ip0jo.tmp to %TEMP%\is-01gbj.tmp\yandex_logo_ru.bmp
from %ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\is-uba6o.tmp to %ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\updater.exe
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-cevnr.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ro.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-pi7ar.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\lightshot.exe
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-q68qk.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ar.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-mnda9.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\learnmore_ru.url
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-d9vfa.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\fi.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-vkmc6.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\fa.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-8n4b0.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\et.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-c67d7.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\es.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-litgn.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\en.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-hnes8.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\el.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-ahbl7.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\de.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-d7btf.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\da.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-m4eci.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\cs.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-54rr7.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\ca.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-hp3c0.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\bs.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-1lq07.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\bn-bd.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-akvs3.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\bg.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\is-17o1b.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\locales\be.txt
from %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\is-412no.tmp to %ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\uploader.dll
from %ProgramFiles(x86)%\skillbrains\updater\is-adfv6.tmp to %ProgramFiles(x86)%\skillbrains\updater\updater.exe

Network activity

Connects to

'up####r.prntscr.com':80
'go#####analytics.com':80
'mc.yandex.ru':443
'microsoft.com':80

TCP

'mc.yandex.ru':443

UDP

DNS ASK go#####analytics.com
DNS ASK up####r.prntscr.com
DNS ASK mc.yandex.ru
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Lightshot_Tray_Wnd'
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\setup-lightshot.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\updater.exe' -runmode=addsystask
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=addproduct -info="%ProgramFiles(x86)%\Skillbrains\lightshot\info.xml"
'%ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\updater.exe' -runmode=addtask
'%ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\updater.exe' -runmode=ping -url="http://up####r.prntscr.com/getver/updater?pi#######"
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=ping -url="http://up####r.prntscr.com/getver/updater?pi#######"
'%ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\updater.exe' -runmode=addproduct -info="%ProgramFiles(x86)%\Skillbrains\Updater\info.xml"
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=addtask
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=addproduct -info="%ProgramFiles(x86)%\Skillbrains\Updater\info.xml"
'%TEMP%\is-oip3g.tmp\setupupdater.tmp' /SL5="$3024E,490430,120832,%TEMP%\is-01GBJ.tmp\setupupdater.exe" /verysilent
'%TEMP%\is-01gbj.tmp\setupupdater.exe' /verysilent
'%ProgramFiles(x86)%\skillbrains\lightshot\lightshot.exe'
'%TEMP%\is-loaus.tmp\setup-lightshot.tmp' /SL5="$160224,2148280,486912,%TEMP%\7ZipSfx.000\setup-lightshot.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\updater.exe' -runmode=addproduct -info="%ProgramFiles(x86)%\Skillbrains\lightshot\info.xml"
'%ProgramFiles(x86)%\skillbrains\lightshot\5.5.0.7\lightshot.exe'
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=addtask' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im lightshot.exe' (with hidden window)
'%ProgramFiles(x86)%\skillbrains\updater\1.8.0.0\updater.exe' -runmode=addsystask' (with hidden window)
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=addproduct -info="%ProgramFiles(x86)%\Skillbrains\lightshot\info.xml"' (with hidden window)
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=addproduct -info="%ProgramFiles(x86)%\Skillbrains\Updater\info.xml"' (with hidden window)
'%TEMP%\is-01gbj.tmp\setupupdater.exe' /verysilent' (with hidden window)
'%ProgramFiles(x86)%\skillbrains\updater\updater.exe' -runmode=ping -url="http://up####r.prntscr.com/getver/updater?pi#######"' (with hidden window)
'%WINDIR%\syswow64\net.exe' START SCHEDULE' (with hidden window)

Executes the following

'%WINDIR%\syswow64\net.exe' START SCHEDULE
'%WINDIR%\syswow64\net1.exe' START SCHEDULE

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial