Техническая информация
Вредоносные функции
Патчит код
в динамической библиотеке
- Процесс ~lwgxbks.tmp, модуль UxTheme.dll
- Процесс ~lwgxbks.tmp, модуль USER32.dll
- Процесс ~lwgxbks.tmp, модуль COMDLG32.dll
Изменения в файловой системе
Создает следующие файлы
- %CommonProgramFiles(x86)%\~ahrpdsx.tmp
- %TEMP%\aut9972.tmp
- %CommonProgramFiles(x86)%\~lwgxbks.tmp
- %TEMP%\is-b2tbq.tmp\~lwgxbks.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_regdll.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ke56a.tmp\istask.dll
- %TEMP%\is-ke56a.tmp\vclstylesinno.dll
- %TEMP%\is-ke56a.tmp\metroblue.vsf
- %TEMP%\is-ke56a.tmp\wizardform.bitmapimage1.bmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qas8f.tmp
- %TEMP%\is-ke56a.tmp\is-4jsvh.tmp
- %TEMP%\is-ke56a.tmp\is-lkbg1.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qsikr.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qtn83.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-7uqgj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-1tg4b.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-25ulc.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-ghrhp.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-94p41.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d4mkj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-182hl.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ctvm9.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-k01dk.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ap23i.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b95ng.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-170qc.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-c5t53.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-akr7v.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qrboi.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-3h8mq.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-esl67.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-vb6cj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-812am.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-bmjoa.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-8afgo.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-7ipg5.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d2f7h.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ohmvl.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kdd8d.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fti5e.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-53ucu.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ne61i.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ac8ku.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-adbj6.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-odfsi.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fdp6p.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qgj24.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-1lkk3.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hj5s7.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-pijc3.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-dpivn.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kq5n0.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-veill.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-nu828.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-uo21e.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hqmuj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ep6mj.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-4m1dv.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b3av1.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-brm1k.tmp
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-fnugq.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise disk cleaner\wise disk cleaner.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise disk cleaner\clean disk with 1-click.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise disk cleaner\uninstall.lnk
- %HOMEPATH%\desktop\wise disk cleaner.lnk
- %APPDATA%\wise disk cleaner\config.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\unins000.dat
- %TEMP%\{f72030fa-49bf-4166-8b6f-50d983c56a71}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{41bb2875-7db4-98f6-7442-1eb2635e4b9e}.png
Присваивает атрибут 'скрытый' для следующих файлов
- %CommonProgramFiles(x86)%\~lwgxbks.tmp
Удаляет файлы, которые сам же создал
- %TEMP%\aut9972.tmp
- %TEMP%\is-ke56a.tmp\syspin.exe
- %TEMP%\is-ke56a.tmp\istask.dll
- %TEMP%\is-ke56a.tmp\metroblue.vsf
- %TEMP%\is-ke56a.tmp\vclstylesinno.dll
- %TEMP%\is-ke56a.tmp\wizardform.bitmapimage1.bmp
- %TEMP%\is-ke56a.tmp\_isetup\_regdll.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ke56a.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-b2tbq.tmp\~lwgxbks.tmp
- %CommonProgramFiles(x86)%\~lwgxbks.tmp
- %CommonProgramFiles(x86)%\~ahrpdsx.tmp
- %TEMP%\{f72030fa-49bf-4166-8b6f-50d983c56a71}.png
- %LOCALAPPDATA%\microsoft\windows\explorer\notifyicon\microsoft.explorer.notification.{41bb2875-7db4-98f6-7442-1eb2635e4b9e}.png
Перемещает следующие файлы
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qas8f.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\unins000.exe
- %TEMP%\is-ke56a.tmp\is-4jsvh.tmp в %TEMP%\is-ke56a.tmp\syspin.exe
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qsikr.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\1c.ico
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-qtn83.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\7z.dll
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-7uqgj.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\sqlite3.dll
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-1tg4b.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\wisedefrag.dll
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-25ulc.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\wisediskcleaner.exe
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-ghrhp.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\wjslib.dll
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-94p41.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\belarusian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d4mkj.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\english.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-182hl.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\russian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ctvm9.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\ukrainian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-k01dk.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\abkhazian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ap23i.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\arabic.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b95ng.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\azerbaijani.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-170qc.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\bulgarian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-c5t53.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\catalan(spain).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-akr7v.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\chinese(simplified).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qrboi.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\chinese(traditional).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-3h8mq.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\czech.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-esl67.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\danish.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-vb6cj.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\dutch (nederlands).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-812am.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\finnish.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-bmjoa.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\french.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-8afgo.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\german.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-7ipg5.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\greek.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-d2f7h.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\hebrew.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ohmvl.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\hungarian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kdd8d.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\indonesian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fti5e.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\italian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-53ucu.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\japanese.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ne61i.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\korean.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ac8ku.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\nepali.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-adbj6.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\norwegian (bokmal).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-odfsi.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\norwegian (nynorsk).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-fdp6p.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\persian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-qgj24.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\polish.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-1lkk3.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\portuguese(brasil).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hj5s7.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\portuguese(portugal).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-pijc3.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\romanian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-dpivn.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\serbian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-kq5n0.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\slovak.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-veill.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\slovenian.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-nu828.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\spanish (colombia).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-uo21e.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\spanish (spain).ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-hqmuj.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\swedish.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-ep6mj.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\thai.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-4m1dv.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\turkish.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-b3av1.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\vietnamese.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\languages\is-brm1k.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\languages\welsh.ini
- %ProgramFiles(x86)%\wise\wise disk cleaner\is-fnugq.tmp в %ProgramFiles(x86)%\wise\wise disk cleaner\defragoptions.ini
Подменяет следующие файлы
- %TEMP%\is-ke56a.tmp\syspin.exe
Другое
Ищет следующие окна
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Создает и запускает на исполнение
- '%CommonProgramFiles(x86)%\~lwgxbks.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~ahrpdsx.tmp"
- '%TEMP%\is-b2tbq.tmp\~lwgxbks.tmp' /SL5="$1001DE,6423015,67072,%CommonProgramFiles(x86)%\~lwgxbks.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~ahrpdsx.tmp"
Запускает на исполнение
- '%WINDIR%\syswow64\regedit.exe' /S "%CommonProgramFiles(x86)%\settings.reg"
- '%CommonProgramFiles(x86)%\~lwgxbks.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP- /LOADINF="%CommonProgramFiles(x86)%\~ahrpdsx.tmp" (со скрытым окном)
