Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Classes\LW.Dict\shell\open\command] '' = '"%ProgramFiles(x86)%\LearnWords\LearnWords.exe" "%1"'
Modifies file system
Creates the following files
- %TEMP%\7zs4a5.tmp\setup.exe
- %ProgramFiles(x86)%\learnwords\dictionaries\is-ssnhf.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-5qdki.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-hv817.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-9efiq.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-u8f5v.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-cime0.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-8vgvd.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-ihd4n.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-lpn6h.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-vt3jq.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-9vf28.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-droct.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-lrcbh.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-ecgpp.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-css8c.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-1vanj.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-pd52t.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-q1anl.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-olocm.tmp
- %WINDIR%\fonts\is-duro2.tmp
- %HOMEPATH%\desktop\learnwords.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\learnwords\uninstall learnwords.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\learnwords\learnwords.lnk
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-8ilcd.tmp
- %ProgramFiles(x86)%\learnwords\learnwords editor\is-aot3t.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-ea0no.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-pojca.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-ovjd9.tmp
- %TEMP%\is-n97t8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-n97t8.tmp\_isetup\_shfoldr.dll
- %ProgramFiles(x86)%\learnwords\is-eb3ae.tmp
- %ProgramFiles(x86)%\learnwords\is-287lk.tmp
- %ProgramFiles(x86)%\learnwords\is-1edrr.tmp
- %ProgramFiles(x86)%\learnwords\is-aa726.tmp
- %ProgramFiles(x86)%\learnwords\is-ckg65.tmp
- %ProgramFiles(x86)%\learnwords\is-pgtf5.tmp
- %ProgramFiles(x86)%\learnwords\is-9966d.tmp
- %ProgramFiles(x86)%\learnwords\is-p7pdv.tmp
- %ProgramFiles(x86)%\learnwords\is-tm7jv.tmp
- %TEMP%\is-fte8l.tmp\setup.tmp
- %ProgramFiles(x86)%\learnwords\is-dhsjb.tmp
- %ProgramFiles(x86)%\learnwords\is-6gm5a.tmp
- %ProgramFiles(x86)%\learnwords\is-lmlbn.tmp
- %ProgramFiles(x86)%\learnwords\is-2qnp1.tmp
- %ProgramFiles(x86)%\learnwords\is-i3btq.tmp
- %ProgramFiles(x86)%\learnwords\is-gu10v.tmp
- %ProgramFiles(x86)%\learnwords\is-n4493.tmp
- %ProgramFiles(x86)%\learnwords\is-86tat.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-ebei5.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-mpgdn.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-8jsbr.tmp
- %ProgramFiles(x86)%\learnwords\dictionaries\is-2od7n.tmp
- %ProgramFiles(x86)%\learnwords\is-06jmf.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\learnwords\learnwords editor.lnk
- %ProgramFiles(x86)%\learnwords\unins000.dat
Deletes the following files
- %TEMP%\is-n97t8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-n97t8.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-fte8l.tmp\setup.tmp
- %TEMP%\7zs4a5.tmp\setup.exe
Moves the following files
- from %ProgramFiles(x86)%\learnwords\is-eb3ae.tmp to %ProgramFiles(x86)%\learnwords\unins000.exe
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-9vf28.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\demo.pdb
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-droct.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\demo.snd
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-ssnhf.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\demo2.dsc
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-5qdki.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\demo2.img
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-hv817.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\demo2.pdb
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-9efiq.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\demo2.snd
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-u8f5v.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\eng-tur-301-idioms.pdb
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-cime0.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\eng-tur-3640-words.pdb
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-8vgvd.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\mycontext.pdb
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-lpn6h.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\private.pdb
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-olocm.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\silence1.wav
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-vt3jq.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\assoc.lst
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-lrcbh.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\assoc_img.lst
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-8ilcd.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\bass.dll
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-aot3t.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\lame.exe
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-ecgpp.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\learnwordseditor.exe
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-css8c.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\lemma_num.txt
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-1vanj.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\lwe_rus.dll
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-pd52t.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\mfc42d.dll
- from %ProgramFiles(x86)%\learnwords\learnwords editor\is-q1anl.tmp to %ProgramFiles(x86)%\learnwords\learnwords editor\msvcrtd.dll
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-ea0no.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\demo.dsc
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-ihd4n.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\mydict.pdb
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-pojca.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\category.snd
- from %ProgramFiles(x86)%\learnwords\is-06jmf.tmp to %ProgramFiles(x86)%\learnwords\lw_rus.dll
- from %ProgramFiles(x86)%\learnwords\is-287lk.tmp to %ProgramFiles(x86)%\learnwords\bass.dll
- from %ProgramFiles(x86)%\learnwords\is-1edrr.tmp to %ProgramFiles(x86)%\learnwords\dtrepeat.ini
- from %ProgramFiles(x86)%\learnwords\is-aa726.tmp to %ProgramFiles(x86)%\learnwords\learnwords.chm
- from %ProgramFiles(x86)%\learnwords\is-ckg65.tmp to %ProgramFiles(x86)%\learnwords\learnwords.exe
- from %ProgramFiles(x86)%\learnwords\is-pgtf5.tmp to %ProgramFiles(x86)%\learnwords\learnwords.reg
- from %ProgramFiles(x86)%\learnwords\is-9966d.tmp to %ProgramFiles(x86)%\learnwords\learnwords.tip
- from %ProgramFiles(x86)%\learnwords\is-p7pdv.tmp to %ProgramFiles(x86)%\learnwords\lw_cze.dll
- from %ProgramFiles(x86)%\learnwords\is-tm7jv.tmp to %ProgramFiles(x86)%\learnwords\lw_ger.dll
- from %ProgramFiles(x86)%\learnwords\is-dhsjb.tmp to %ProgramFiles(x86)%\learnwords\lw_pol.dll
- from %ProgramFiles(x86)%\learnwords\is-6gm5a.tmp to %ProgramFiles(x86)%\learnwords\lw_tur.dll
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-2od7n.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\category.dsc
- from %ProgramFiles(x86)%\learnwords\is-lmlbn.tmp to %ProgramFiles(x86)%\learnwords\lwlaunch.exe
- from %ProgramFiles(x86)%\learnwords\is-2qnp1.tmp to %ProgramFiles(x86)%\learnwords\lwrepeat.pdb
- from %ProgramFiles(x86)%\learnwords\is-i3btq.tmp to %ProgramFiles(x86)%\learnwords\lwrepeat.snd
- from %ProgramFiles(x86)%\learnwords\is-gu10v.tmp to %ProgramFiles(x86)%\learnwords\mfc42d.dll
- from %ProgramFiles(x86)%\learnwords\is-n4493.tmp to %ProgramFiles(x86)%\learnwords\msvcrtd.dll
- from %ProgramFiles(x86)%\learnwords\is-86tat.tmp to %ProgramFiles(x86)%\learnwords\profile.ini
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-ebei5.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\activedict.dsc
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-mpgdn.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\activedict.pdb
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-8jsbr.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\activedict.snd
- from %ProgramFiles(x86)%\learnwords\dictionaries\is-ovjd9.tmp to %ProgramFiles(x86)%\learnwords\dictionaries\category.pdb
- from %WINDIR%\fonts\is-duro2.tmp to %WINDIR%\fonts\lucide_u.ttf
Miscellaneous
Creates and executes the following
- '%TEMP%\7zs4a5.tmp\setup.exe' /VERYSILENT /NORESTART
- '%TEMP%\is-fte8l.tmp\setup.tmp' /SL5="$6023C,7116606,140800,%TEMP%\7zS4A5.tmp\setup.exe" /VERYSILENT /NORESTART
