Technical Information
- [HKLM\System\CurrentControlSet\Services\High-quality math calculator 7.6] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\High-quality math calculator 7.6] 'ImagePath' = '%ALLUSERSPROFILE%\High-quality math calculator 7.6\High-quality math calculator 7.6.exe'
- 'High-quality math calculator 7.6' %ALLUSERSPROFILE%\High-quality math calculator 7.6\High-quality math calculator 7.6.exe
- %TEMP%\is-p4ejg.tmp\<File name>.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-eqed6.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-5kt56.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-j77ib.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-a66uc.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-m44dr.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-n42rd.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-5vq0e.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\lessmsi\is-lvgvq.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-flrs2.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-c3i5g.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-6291v.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\plugins\internal\is-difgk.tmp
- %LOCALAPPDATA%\webchat small group\webchatsmallgroup.exe
- %LOCALAPPDATA%\webchat small group\bin\x86\plugins\internal\is-ui8v8.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-at21n.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-4f8c8.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-qtso8.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-s8i8d.tmp
- %LOCALAPPDATA%\webchat small group\stuff\is-01jud.tmp
- %LOCALAPPDATA%\webchat small group\stuff\is-juj6o.tmp
- %LOCALAPPDATA%\webchat small group\stuff\is-hg9jm.tmp
- %LOCALAPPDATA%\webchat small group\stuff\is-oo44m.tmp
- %LOCALAPPDATA%\webchat small group\is-t45aq.tmp
- %LOCALAPPDATA%\webchat small group\unins000.dat
- %LOCALAPPDATA%\webchat small group\bin\x86\is-139se.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-bk8ih.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-6qg0u.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-82eot.tmp
- %TEMP%\is-slfkf.tmp\_isetup\_regdll.tmp
- %TEMP%\is-slfkf.tmp\_isetup\_setup64.tmp
- %TEMP%\is-slfkf.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-slfkf.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-slfkf.tmp\_isetup\_iscrypt.dll
- %LOCALAPPDATA%\webchat small group\is-vra7i.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-41bka.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-s18m9.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-vjgbd.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-0ved6.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-9f3fe.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-a2ovd.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-forlc.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-u1ck7.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-c7q1g.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-bnsu8.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-1qih8.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-9ea0c.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-d90t9.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-s0345.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-p94ll.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-7q4pd.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-5m79h.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-ob5c9.tmp
- %LOCALAPPDATA%\webchat small group\bin\x86\is-mpib3.tmp
- %ALLUSERSPROFILE%\high-quality math calculator 7.6\high-quality math calculator 7.6.exe
- %LOCALAPPDATA%\webchat small group\stuff\date.txt
- %LOCALAPPDATA%\webchat small group\stuff\tagsreplace.txt
- from %LOCALAPPDATA%\webchat small group\is-vra7i.tmp to %LOCALAPPDATA%\webchat small group\unins000.exe
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-j77ib.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\da.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-a66uc.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\daiso.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-m44dr.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\dstt.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-n42rd.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\dsd2pcmt.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-5vq0e.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\pcm2dsd.exe
- from %LOCALAPPDATA%\webchat small group\bin\x86\lessmsi\is-lvgvq.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\lessmsi\lessmsi-v1.6.91.zip
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-flrs2.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\d_writer.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-eqed6.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\dsd2.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-5kt56.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\lame_enc.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-c3i5g.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\libwebp.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\plugins\internal\is-difgk.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\plugins\internal\peak_scanner_plugin_c.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\plugins\internal\is-ui8v8.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\plugins\internal\raw_decode_plugin_c.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-at21n.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\copying
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-4f8c8.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\7z.exe
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-qtso8.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\takdec.exe
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-s8i8d.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\tak_deco_lib.dll
- from %LOCALAPPDATA%\webchat small group\stuff\is-01jud.tmp to %LOCALAPPDATA%\webchat small group\stuff\date.txt
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-6291v.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\libwinpthread-1.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-bk8ih.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\sd.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-139se.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\libdtsdec.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-6qg0u.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\utils.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-mpib3.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\uchardet.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-s18m9.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\bassflac.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-vjgbd.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\bassmix.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-0ved6.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\bassopus.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-9f3fe.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\basswma.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-82eot.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\basswv.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-a2ovd.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\bass_fx.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-u1ck7.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\bassmidi.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-c7q1g.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\bass_tta.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-41bka.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\basscd.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-bnsu8.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\copying.lgplv2.1
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-9ea0c.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\gain_analysis.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-d90t9.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\libflac_dynamic.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-s0345.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\bass_ofr.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-p94ll.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\optimfrog.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-7q4pd.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\mp3gain.exe
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-5m79h.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\rg_ebur128.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-ob5c9.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\wavpackdll.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-forlc.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\libsoxr.dll
- from %LOCALAPPDATA%\webchat small group\bin\x86\is-1qih8.tmp to %LOCALAPPDATA%\webchat small group\bin\x86\ff_helper.dll
- from %LOCALAPPDATA%\webchat small group\stuff\is-juj6o.tmp to %LOCALAPPDATA%\webchat small group\stuff\tagsreplace.txt
- from %LOCALAPPDATA%\webchat small group\is-t45aq.tmp to %LOCALAPPDATA%\webchat small group\webchatsmallgroup.exe
- %LOCALAPPDATA%\webchat small group\stuff\date.txt
- %LOCALAPPDATA%\webchat small group\stuff\tagsreplace.txt
- ClassName: '' WindowName: 'L28f25_WCSG171FlashFixClass_L28f25'
- '%TEMP%\is-p4ejg.tmp\<File name>.tmp' /SL5="$E015C,4560153,337408,<Full path to file>"
- '%LOCALAPPDATA%\webchat small group\webchatsmallgroup.exe' -i
- '%LOCALAPPDATA%\webchat small group\webchatsmallgroup.exe' -s