Trojan.Siggen18.13635

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'ImagePath' = '%ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe'

Creates the following services

'WiseBootAssistant' %ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe

Modifies file system

Creates the following files

%TEMP%\rarsfx0\wisecare365_.exe
%ProgramFiles(x86)%\wise\wise care 365\languages\is-f2qku.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ckn9b.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-51aqk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-pja9c.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vc4ca.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ei4tf.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7b44g.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-13up6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-0q3mk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-340nq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cq70v.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-0bnv1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-n8c6l.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-sc2gs.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-c8rrk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-69hvk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-o9n2u.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2h5d8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-rment.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-pe0pv.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cdbmj.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-9jt0t.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-haqho.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-irfua.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-lumeg.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-t91sn.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tv77u.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-5h9o2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-910iu.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7ceck.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-299h1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-lc44s.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tonfb.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4h7q7.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-vtmrb.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-u3hgi.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-f7ibn.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-2jtpq.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-jhb5h.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-5fqqa.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-cce5e.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-t3h5e.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gi16i.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-91d66.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\wise care 365.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\uninstall wise care 365.lnk
C:\users\public\desktop\wise care 365.lnk
%TEMP%\is-i3dnu.tmp\introduce.url
%ProgramFiles(x86)%\wise\wise care 365\is-7phdb.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-vdv1r.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-a34oi.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-0bkvj.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ednkj.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-bufsb.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-jc7s9.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-f6h6q.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-for9o.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-bkuvm.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-0jfhj.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vi10e.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-d31lk.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-h5pku.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ba5f2.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-rvcip.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ej9bk.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-blv72.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-m6ice.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-pi644.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-b23ei.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-le2gh.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-v6a9o.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-suc1g.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-9k9ma.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-965e8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ge1hu.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-sl3nm.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ui2kl.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6hme5.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ihe8k.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-hs5fi.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ob96n.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2vjsk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-carvr.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6v2r7.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-534s8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-bse79.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-p0499.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3vbfk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-33jsg.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-mli6g.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kilqo.tmp
%TEMP%\rarsfx0\activator.7z
%TEMP%\is-1jr25.tmp\wisecare365_.tmp
%TEMP%\is-i3dnu.tmp\_isetup\_setup64.tmp
%TEMP%\is-i3dnu.tmp\license.txt
%TEMP%\is-i3dnu.tmp\icon_128.bmp
%ProgramFiles(x86)%\wise\wise care 365\is-ppkmb.tmp
%TEMP%\rarsfx0\cybermania.url
%ProgramFiles(x86)%\wise\wise care 365\headers\is-p1jhj.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-isqm3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-n9583.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6slhc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-k2oc2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-jc5em.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-in9e4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4h2a4.tmp
%ProgramFiles(x86)%\wise\wise care 365\unins000.msg
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-gvf34.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-i9khf.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-v0plq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-oqc2c.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4gl8s.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-7gb5i.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-94829.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-mqifl.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-v8dk3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-i6tdo.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ndr6a.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-qr3sq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vrob2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-gam6f.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7c9kn.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-faqoe.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3ebdm.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-hfv51.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-7g34f.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6mchu.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-5cpsl.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-fgk72.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2ccde.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-aeeuj.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-i6jan.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-827mf.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u1gvq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2idtf.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-56thr.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6r6h6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-dr2m5.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6f3o8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vbmh0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gavk0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-plmtr.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-i8d78.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ougq9.tmp
%ProgramFiles(x86)%\wise\wise care 365\unins000.dat

Sets the 'hidden' attribute to the following files

%TEMP%\is-i3dnu.tmp\icon_128.bmp

Deletes the following files

%TEMP%\is-i3dnu.tmp\icon_128.bmp
%TEMP%\is-i3dnu.tmp\introduce.url
%TEMP%\is-i3dnu.tmp\license.txt
%TEMP%\is-i3dnu.tmp\_isetup\_setup64.tmp
%TEMP%\is-1jr25.tmp\wisecare365_.tmp
%TEMP%\rarsfx0\activator.7z
%TEMP%\rarsfx0\cybermania.url
%TEMP%\rarsfx0\wisecare365_.exe

Moves the following files

from %ProgramFiles(x86)%\wise\wise care 365\is-ppkmb.tmp to %ProgramFiles(x86)%\wise\wise care 365\unins000.exe
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-340nq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\spanish(spain).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-0q3mk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovenian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-c8rrk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovak.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-sc2gs.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\serbian(cyrillic).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-13up6.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\russian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vc4ca.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\romanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-pja9c.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(portugal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-51aqk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(brazil).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ckn9b.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\polish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-f2qku.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\persian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-7b44g.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(nynorsk).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ei4tf.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(bokmal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-lumeg.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\nepali.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-haqho.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\lithuanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-2h5d8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\kurdish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-7ceck.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\korean.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-910iu.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\japanese.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-5h9o2.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\italian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tv77u.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\indonesian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tonfb.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hungarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-lc44s.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hebrew.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-299h1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\greek.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-t91sn.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\german.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-9jt0t.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\georgian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cdbmj.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\french.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-pe0pv.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\finnish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-rment.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\english.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-le2gh.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(nederlands).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-irfua.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(belgium).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cq70v.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\swedish(sweden).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-0bnv1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\thai.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-n8c6l.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\turkish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-o9n2u.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\ukrainian.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-7phdb.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseturbo.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-t3h5e.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisetray.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-5fqqa.tmp to %ProgramFiles(x86)%\wise\wise care 365\wjslib.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-jhb5h.tmp to %ProgramFiles(x86)%\wise\wise care 365\ssleay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-2jtpq.tmp to %ProgramFiles(x86)%\wise\wise care 365\libeay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-f7ibn.tmp to %ProgramFiles(x86)%\wise\wise care 365\dmanager.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-gi16i.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseeraser.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-u3hgi.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisedefrag.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-cce5e.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-vdv1r.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisebootbooster.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-0bkvj.tmp to %ProgramFiles(x86)%\wise\wise care 365\sqlite3.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-ednkj.tmp to %ProgramFiles(x86)%\wise\wise care 365\skin.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-m6ice.tmp to %ProgramFiles(x86)%\wise\wise care 365\rate.info
from %ProgramFiles(x86)%\wise\wise care 365\is-blv72.tmp to %ProgramFiles(x86)%\wise\wise care 365\autoupdate.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-rvcip.tmp to %ProgramFiles(x86)%\wise\wise care 365\fileshredder.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-ej9bk.tmp to %ProgramFiles(x86)%\wise\wise care 365\license.txt
from %ProgramFiles(x86)%\wise\wise care 365\is-ba5f2.tmp to %ProgramFiles(x86)%\wise\wise care 365\defragoptions.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-b23ei.tmp to %ProgramFiles(x86)%\wise\wise care 365\boottime.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-h5pku.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootpack.wpk
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vi10e.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\reminder.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-0jfhj.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\programuninstaller.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-bkuvm.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\memoryoptimizer.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-for9o.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\gamebooster.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-f6h6q.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\forcedeleter.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-jc7s9.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\fastsearch.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-d31lk.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\duplicatefinder.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-bufsb.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\daterecovery.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-gvf34.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\autoshutdown.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\is-vtmrb.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv6.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-69hvk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\vietnamese.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-91d66.tmp to %ProgramFiles(x86)%\wise\wise care 365\themes_v6.txt
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-pi644.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\danish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-v6a9o.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\czech.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-suc1g.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\croatian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4h7q7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-i9khf.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-kilqo.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-534s8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6v2r7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-carvr.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2vjsk.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3vbfk.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-p0499.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-bse79.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ob96n.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ui2kl.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-sl3nm.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ge1hu.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-965e8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-hs5fi.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3ebdm.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6hme5.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-33jsg.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ihe8k.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-mli6g.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-in9e4.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-jc5em.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-k2oc2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\b5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6slhc.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-n9583.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-isqm3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4h2a4.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-p1jhj.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ougq9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-u1gvq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-v0plq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-fgk72.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h1.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-7c9kn.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(simplified).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-gam6f.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\catalan.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vrob2.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\bulgarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-qr3sq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\belarusian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-hfv51.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\azerbaijani(latin).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ndr6a.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\arabic.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-faqoe.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\abkhazian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-v8dk3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-94829.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-7gb5i.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4gl8s.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-oqc2c.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-i6tdo.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-7g34f.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6mchu.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-mqifl.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-5cpsl.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-i8d78.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gavk0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vbmh0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6f3o8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-dr2m5.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6r6h6.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-56thr.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-plmtr.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2idtf.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-827mf.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-i6jan.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-aeeuj.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2ccde.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h2.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-9k9ma.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(traditional).ini
from %ProgramFiles(x86)%\wise\wise care 365\is-a34oi.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootlauncher.exe

Modifies the following files

Network activity

Connects to

'cy###mania.ws':443
'pa#####.#ooglesyndication.com':443
'go#####agmanager.com':443
'fo###.#oogleapis.com':443
'fo###.gstatic.com':443
'rf.###olvermaps.com':443

TCP

Other

'cy###mania.ws':443
'pa#####.#ooglesyndication.com':443
'go#####agmanager.com':443
'fo###.#oogleapis.com':443
'fo###.gstatic.com':443
'rf.###olvermaps.com':443

UDP

DNS ASK cy###mania.ws
DNS ASK pa#####.#ooglesyndication.com
DNS ASK go#####agmanager.com
DNS ASK fo###.#oogleapis.com
DNS ASK fo###.gstatic.com
DNS ASK rf.###olvermaps.com
DNS ASK microsoft.com
DNS ASK st####.rapidssl.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'TFrmTrayMain' WindowName: ''
ClassName: 'TFrmWPMain' WindowName: ''
ClassName: 'TFrmMOMain' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\wisecare365_.exe' /silent
'%TEMP%\is-1jr25.tmp\wisecare365_.tmp' /SL5="$1023E,16361886,857088,%TEMP%\RarSFX0\WiseCare365_.exe" /silent
'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "User Name" /t REG_SZ /d "Cyber" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "User Email" /t REG_SZ /d "1@1.com" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "License Key" /t REG_SZ /d "8E97-AE93-A19E93-8F89-94BC" /f

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней