Technical Information
Malicious functions
Patches code
in dll
- ~lwgxbks.tmp process, UxTheme.dll module
- ~lwgxbks.tmp process, USER32.dll module
- ~lwgxbks.tmp process, COMDLG32.dll module
Modifies file system
Creates the following files
- %CommonProgramFiles(x86)%\~ahrpdsx.tmp
- %TEMP%\aut9972.tmp
- %CommonProgramFiles(x86)%\~lwgxbks.tmp
- %TEMP%\is-b2tbq.tmp\~lwgxbks.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_regdll.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ke56a.tmp\istask.dll
- %TEMP%\is-ke56a.tmp\vclstylesinno.dll
- %TEMP%\is-ke56a.tmp\metroblue.vsf
- %TEMP%\is-ke56a.tmp\wizardform.bitmapimage1.bmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qas8f.tmp
- %TEMP%\is-ke56a.tmp\is-4jsvh.tmp
- %TEMP%\is-ke56a.tmp\is-lkbg1.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qsikr.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qtn83.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-7uqgj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-1tg4b.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-25ulc.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-ghrhp.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-94p41.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d4mkj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-182hl.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ctvm9.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-k01dk.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ap23i.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b95ng.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-170qc.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-c5t53.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-akr7v.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qrboi.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-3h8mq.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-esl67.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-vb6cj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-812am.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-bmjoa.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-8afgo.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-7ipg5.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d2f7h.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ohmvl.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kdd8d.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fti5e.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-53ucu.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ne61i.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ac8ku.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-adbj6.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-odfsi.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fdp6p.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qgj24.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-1lkk3.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hj5s7.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-pijc3.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-dpivn.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kq5n0.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-veill.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-nu828.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-uo21e.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hqmuj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ep6mj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-4m1dv.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b3av1.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-brm1k.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-fnugq.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise disk cleaner\wise disk cleaner.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise disk cleaner\clean disk with 1-click.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise disk cleaner\uninstall.lnk
- %HOMEPATH%\desktop\wise disk cleaner.lnk
- %APPDATA%\wise disk cleaner\config.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\unins000.dat
- %TEMP%\{f72030fa-49bf-4166-8b6f-50d983c56a71}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{41bb2875-7db4-98f6-7442-1eb2635e4b9e}.png
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles(x86)%\~lwgxbks.tmp
Deletes following files that it created itself
- %TEMP%\aut9972.tmp
- %TEMP%\is-ke56a.tmp\syspin.exe
- %TEMP%\is-ke56a.tmp\istask.dll
- %TEMP%\is-ke56a.tmp\metroblue.vsf
- %TEMP%\is-ke56a.tmp\vclstylesinno.dll
- %TEMP%\is-ke56a.tmp\wizardform.bitmapimage1.bmp
- %TEMP%\is-ke56a.tmp\_isetup\_regdll.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-b2tbq.tmp\~lwgxbks.tmp
- %CommonProgramFiles(x86)%\~lwgxbks.tmp
- %CommonProgramFiles(x86)%\~ahrpdsx.tmp
- %TEMP%\{f72030fa-49bf-4166-8b6f-50d983c56a71}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{41bb2875-7db4-98f6-7442-1eb2635e4b9e}.png
Moves the following files
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-qas8f.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\unins000.exe
- from %TEMP%\is-ke56a.tmp\is-4jsvh.tmp to %TEMP%\is-ke56a.tmp\syspin.exe
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-qsikr.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\1c.ico
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-qtn83.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\7z.dll
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-7uqgj.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\sqlite3.dll
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-1tg4b.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\wisedefrag.dll
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-25ulc.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\wisediskcleaner.exe
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-ghrhp.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\wjslib.dll
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-94p41.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\belarusian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d4mkj.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\english.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-182hl.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\russian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ctvm9.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\ukrainian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-k01dk.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\abkhazian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ap23i.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\arabic.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b95ng.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\azerbaijani.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-170qc.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\bulgarian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-c5t53.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\catalan(spain).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-akr7v.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\chinese(simplified).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qrboi.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\chinese(traditional).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-3h8mq.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\czech.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-esl67.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\danish.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-vb6cj.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\dutch (nederlands).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-812am.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\finnish.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-bmjoa.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\french.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-8afgo.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\german.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-7ipg5.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\greek.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d2f7h.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\hebrew.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ohmvl.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\hungarian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kdd8d.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\indonesian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fti5e.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\italian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-53ucu.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\japanese.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ne61i.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\korean.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ac8ku.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\nepali.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-adbj6.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\norwegian (bokmal).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-odfsi.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\norwegian (nynorsk).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fdp6p.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\persian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qgj24.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\polish.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-1lkk3.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\portuguese(brasil).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hj5s7.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\portuguese(portugal).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-pijc3.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\romanian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-dpivn.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\serbian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kq5n0.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\slovak.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-veill.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\slovenian.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-nu828.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\spanish (colombia).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-uo21e.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\spanish (spain).ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hqmuj.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\swedish.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ep6mj.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\thai.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-4m1dv.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\turkish.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b3av1.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\vietnamese.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-brm1k.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\languages\welsh.ini
- from %ProgramFiles(x86)%\wise\wise disk cleaner\is-fnugq.tmp to %ProgramFiles(x86)%\wise\wise disk cleaner\defragoptions.ini
Substitutes the following files
- %TEMP%\is-ke56a.tmp\syspin.exe
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles(x86)%\~lwgxbks.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~ahrpdsx.tmp"
- '%TEMP%\is-b2tbq.tmp\~lwgxbks.tmp' /SL5="$1001DE,6423015,67072,%CommonProgramFiles(x86)%\~lwgxbks.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~ahrpdsx.tmp"
Executes the following
- '%WINDIR%\syswow64\regedit.exe' /S "%CommonProgramFiles(x86)%\settings.reg"
- '%CommonProgramFiles(x86)%\~lwgxbks.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~ahrpdsx.tmp"' (with hidden window)
