Technical Information
To ensure autorun and distribution
Substitutes the following executable system files
- %WINDIR%\SysWOW64\ctl3d32.dll with %WINDIR%\syswow64\temp.000
- %WINDIR%\SysWOW64\stdole32.tlb with %WINDIR%\syswow64\temp.004
Modifies file system
Creates the following files
- %TEMP%\glc13af.tmp
- %WINDIR%\syswow64\~glh0015.tmp
- %WINDIR%\syswow64\~glh0016.tmp
- %WINDIR%\syswow64\temp.006
- %WINDIR%\syswow64\~glh0017.tmp
- %WINDIR%\syswow64\~glh0018.tmp
- %WINDIR%\syswow64\temp.007
- %WINDIR%\syswow64\~glh0019.tmp
- %WINDIR%\syswow64\~glh0006.tmp
- %WINDIR%\syswow64\temp.008
- %WINDIR%\syswow64\temp.009
- %WINDIR%\syswow64\~glh001b.tmp
- %WINDIR%\syswow64\temp.00a
- %WINDIR%\syswow64\~glh001d.tmp
- %WINDIR%\syswow64\~glh001e.tmp
- %WINDIR%\syswow64\temp.00b
- %WINDIR%\syswow64\~glh0020.tmp
- %WINDIR%\syswow64\temp.005
- %WINDIR%\syswow64\~glh0014.tmp
- %WINDIR%\syswow64\~glh0012.tmp
- %WINDIR%\syswow64\temp.004
- %WINDIR%\syswow64\~glh0011.tmp
- %TEMP%\glk15f2.tmp
- %TEMP%\glg25db.tmp
- %WINDIR%\speech\~glh0000.tmp
- %WINDIR%\syswow64\~glh0001.tmp
- %WINDIR%\syswow64\temp.000
- %WINDIR%\syswow64\~glh0002.tmp
- %WINDIR%\syswow64\temp.001
- %WINDIR%\speech\unwise.ini
- %WINDIR%\syswow64\~glh001a.tmp
- %WINDIR%\syswow64\~glh0004.tmp
- %WINDIR%\syswow64\temp.002
- %WINDIR%\syswow64\~glh0009.tmp
- %WINDIR%\syswow64\~glh000b.tmp
- %WINDIR%\syswow64\~glh000d.tmp
- %WINDIR%\syswow64\~glh000f.tmp
- %WINDIR%\syswow64\~glh0010.tmp
- %WINDIR%\syswow64\temp.003
- %TEMP%\glj13ee.tmp
- %WINDIR%\syswow64\~glh0007.tmp
- %WINDIR%\speech\installac.log
Deletes the following files
- %WINDIR%\syswow64\~glh0001.tmp
- %TEMP%\glk15f2.tmp
- %TEMP%\glg25db.tmp
- %WINDIR%\syswow64\~glh0020.tmp
- %WINDIR%\syswow64\~glh001e.tmp
- %WINDIR%\syswow64\~glh001d.tmp
- %WINDIR%\syswow64\~glh001b.tmp
- %WINDIR%\syswow64\~glh001a.tmp
- %WINDIR%\syswow64\~glh0019.tmp
- %WINDIR%\syswow64\~glh0018.tmp
- %WINDIR%\syswow64\~glh0017.tmp
- %WINDIR%\syswow64\~glh0016.tmp
- %WINDIR%\syswow64\~glh0015.tmp
- %WINDIR%\syswow64\~glh0012.tmp
- %WINDIR%\syswow64\~glh0011.tmp
- %WINDIR%\syswow64\~glh0010.tmp
- %WINDIR%\syswow64\~glh000f.tmp
- %WINDIR%\syswow64\~glh000d.tmp
- %WINDIR%\syswow64\~glh000b.tmp
- %WINDIR%\syswow64\~glh0009.tmp
- %WINDIR%\syswow64\~glh0007.tmp
- %WINDIR%\syswow64\~glh0006.tmp
- %WINDIR%\syswow64\~glh0004.tmp
- %WINDIR%\syswow64\~glh0002.tmp
- %TEMP%\glj13ee.tmp
- %TEMP%\glc13af.tmp
Moves the following files
- from %WINDIR%\speech\~glh0000.tmp to %WINDIR%\speech\unwise.exe
- from %WINDIR%\syswow64\~glh001f.tmp to %WINDIR%\syswow64\comctl32.ocx
- from %WINDIR%\syswow64\temp.00b to %WINDIR%\syswow64\~glh001f.tmp
- from %WINDIR%\syswow64\~glh001c.tmp to %WINDIR%\syswow64\comct232.ocx
- from %WINDIR%\syswow64\temp.00a to %WINDIR%\syswow64\~glh001c.tmp
- from %WINDIR%\syswow64\temp.006 to %WINDIR%\syswow64\riched.dll
- from %WINDIR%\syswow64\~glh0014.tmp to %WINDIR%\syswow64\richtext.srg
- from %WINDIR%\syswow64\~glh0013.tmp to %WINDIR%\syswow64\richtx32.ocx
- from %WINDIR%\syswow64\temp.005 to %WINDIR%\syswow64\~glh0013.tmp
- from %WINDIR%\syswow64\~glh000e.tmp to %WINDIR%\syswow64\msvbvm50.dll
- from %WINDIR%\syswow64\temp.00b to %WINDIR%\syswow64\~glh0021.tmp
- from %WINDIR%\syswow64\temp.002 to %WINDIR%\syswow64\~glh000e.tmp
- from %WINDIR%\syswow64\temp.002 to %WINDIR%\syswow64\~glh000c.tmp
- from %WINDIR%\syswow64\~glh000a.tmp to %WINDIR%\syswow64\vbame.dll
- from %WINDIR%\syswow64\temp.002 to %WINDIR%\syswow64\~glh000a.tmp
- from %WINDIR%\syswow64\~glh0008.tmp to %WINDIR%\syswow64\vbar2232.dll
- from %WINDIR%\syswow64\temp.002 to %WINDIR%\syswow64\~glh0008.tmp
- from %WINDIR%\syswow64\~glh0005.tmp to %WINDIR%\syswow64\vb5stkit.dll
- from %WINDIR%\syswow64\temp.001 to %WINDIR%\syswow64\~glh0005.tmp
- from %WINDIR%\syswow64\~glh0003.tmp to %WINDIR%\syswow64\vb5db.dll
- from %WINDIR%\syswow64\temp.001 to %WINDIR%\syswow64\~glh0003.tmp
- from %WINDIR%\syswow64\~glh000c.tmp to %WINDIR%\syswow64\mci32.ocx
- from %WINDIR%\syswow64\~glh0021.tmp to %WINDIR%\syswow64\msmapi32.ocx
Substitutes the following files
- %WINDIR%\syswow64\temp.001
- %WINDIR%\syswow64\temp.002
- %WINDIR%\syswow64\temp.005
- %WINDIR%\syswow64\temp.006
- %WINDIR%\syswow64\temp.00a
- %WINDIR%\syswow64\temp.00b
Miscellaneous
Creates and executes the following
- '%TEMP%\glj13ee.tmp' <SYSTEM32>\Mci32.ocx
- '%TEMP%\glj13ee.tmp' <SYSTEM32>\Msvbvm50.dll
- '%TEMP%\glj13ee.tmp' <SYSTEM32>\Richtx32.ocx
- '%TEMP%\glj13ee.tmp' <SYSTEM32>\olepro32.dll
- '%TEMP%\glj13ee.tmp' <SYSTEM32>\Comct232.ocx
- '%TEMP%\glj13ee.tmp' <SYSTEM32>\Comctl32.ocx
- '%TEMP%\glj13ee.tmp' <SYSTEM32>\Msmapi32.ocx
