Trojan.Siggen18.46267

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'ImagePath' = '%ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe'

Creates the following services

'WiseBootAssistant' %ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe

Modifies file system

Creates the following files

%TEMP%\rarsfx0\wisecare365_.exe
%ProgramFiles(x86)%\wise\wise care 365\languages\is-osut6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-k8e43.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6qknu.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-kb2ha.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-i6evf.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-o0mj9.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-h2bv2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-lkqih.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-o2af3.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3sqjj.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-0mgjb.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ri10c.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cp78p.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-bbvf1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ahmfr.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-a2rjj.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-90jn1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-g0bna.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ick9m.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ch0ma.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jkflq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2hnkh.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jnuvf.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-m1c4b.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-lhksi.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-o8okc.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-8husb.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-r28hj.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-bplk6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tceqa.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-023iq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-87076.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-t2kqb.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-hl0fn.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-5trcl.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-n2soi.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ap3i6.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-177ni.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-u9gdp.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-j2754.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-8vfnu.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-3gp33.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-6aq7u.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-af333.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\wise care 365.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\uninstall wise care 365.lnk
C:\users\public\desktop\wise care 365.lnk
%TEMP%\is-56dgu.tmp\introduce.url
%ProgramFiles(x86)%\wise\wise care 365\is-u9s77.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-9plke.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ov1in.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-15kbd.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-jl56l.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-feegk.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-qfd2g.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-fh5hc.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vfko3.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-5oh6v.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-7cpji.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-r3dtq.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-k43ii.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-0uf97.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ecelm.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-iqhfa.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gl43o.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-8r0f5.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-9ai2h.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ooj3e.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-6n8rj.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-627u6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-de7ag.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-0k20i.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-dacr1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-cd286.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-s0ol2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0laep.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-nnkdi.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-l9f0a.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-j41b4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-pntgr.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-tj2uq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-17np8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-k4t0g.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-nprls.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-dbjn2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vb397.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-e932f.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-fa0r2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-i1nkk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-63mfg.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2fdc9.tmp
%TEMP%\rarsfx0\activator.7z
%TEMP%\is-f1q38.tmp\wisecare365_.tmp
%TEMP%\is-56dgu.tmp\_isetup\_setup64.tmp
%TEMP%\is-56dgu.tmp\license.txt
%TEMP%\is-56dgu.tmp\icon_128.bmp
%ProgramFiles(x86)%\wise\wise care 365\is-8atkt.tmp
%TEMP%\rarsfx0\cybermania.url
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gl2i0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-khhno.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-p4vq0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-p6eqd.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ocd6m.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gldnd.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-7m3b7.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6r8ho.tmp
%ProgramFiles(x86)%\wise\wise care 365\unins000.msg
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-85rt9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vgt2l.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-jq1rf.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-8htuc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-v264c.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6i4si.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-itjon.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-058m2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vcflp.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-chu4k.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-0fnrm.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-rrq63.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-monos.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3aj93.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-u4alc.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cqqod.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-okj81.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-kodrc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-f3c9u.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-jtco4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-pejac.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-tl1ap.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-boj5k.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-9fqj3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-reeqm.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-v87lq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-dc50l.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-19e7m.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-93ak0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-a4cjg.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1o8n8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gio97.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-chsv8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-8neqm.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-f3akc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2pk63.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-mu23b.tmp
%ProgramFiles(x86)%\wise\wise care 365\unins000.dat

Sets the 'hidden' attribute to the following files

%TEMP%\is-56dgu.tmp\icon_128.bmp

Deletes the following files

%TEMP%\is-56dgu.tmp\icon_128.bmp
%TEMP%\is-56dgu.tmp\introduce.url
%TEMP%\is-56dgu.tmp\license.txt
%TEMP%\is-56dgu.tmp\_isetup\_setup64.tmp
%TEMP%\is-f1q38.tmp\wisecare365_.tmp
%TEMP%\rarsfx0\activator.7z
%TEMP%\rarsfx0\cybermania.url
%TEMP%\rarsfx0\wisecare365_.exe

Moves the following files

from %ProgramFiles(x86)%\wise\wise care 365\is-8atkt.tmp to %ProgramFiles(x86)%\wise\wise care 365\unins000.exe
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-3sqjj.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\spanish(spain).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-o2af3.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovenian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ahmfr.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovak.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-bbvf1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\serbian(cyrillic).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-lkqih.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\russian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-i6evf.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\romanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-kb2ha.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(portugal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-6qknu.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(brazil).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-k8e43.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\polish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-osut6.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\persian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-h2bv2.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(nynorsk).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-o0mj9.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(bokmal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-lhksi.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\nepali.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-jnuvf.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\lithuanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-g0bna.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\kurdish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tceqa.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\korean.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-bplk6.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\japanese.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-r28hj.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\italian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-8husb.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\indonesian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-t2kqb.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hungarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-87076.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hebrew.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-023iq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\greek.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-o8okc.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\german.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-2hnkh.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\georgian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-jkflq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\french.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ch0ma.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\finnish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ick9m.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\english.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-627u6.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(nederlands).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-m1c4b.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(belgium).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-0mgjb.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\swedish(sweden).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ri10c.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\thai.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cp78p.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\turkish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-90jn1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\ukrainian.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-u9s77.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseturbo.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-3gp33.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisetray.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-j2754.tmp to %ProgramFiles(x86)%\wise\wise care 365\wjslib.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-u9gdp.tmp to %ProgramFiles(x86)%\wise\wise care 365\ssleay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-177ni.tmp to %ProgramFiles(x86)%\wise\wise care 365\libeay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-ap3i6.tmp to %ProgramFiles(x86)%\wise\wise care 365\dmanager.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-6aq7u.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseeraser.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-n2soi.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisedefrag.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-8vfnu.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-9plke.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisebootbooster.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-15kbd.tmp to %ProgramFiles(x86)%\wise\wise care 365\sqlite3.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-jl56l.tmp to %ProgramFiles(x86)%\wise\wise care 365\skin.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-9ai2h.tmp to %ProgramFiles(x86)%\wise\wise care 365\rate.info
from %ProgramFiles(x86)%\wise\wise care 365\is-8r0f5.tmp to %ProgramFiles(x86)%\wise\wise care 365\autoupdate.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-iqhfa.tmp to %ProgramFiles(x86)%\wise\wise care 365\fileshredder.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-gl43o.tmp to %ProgramFiles(x86)%\wise\wise care 365\license.txt
from %ProgramFiles(x86)%\wise\wise care 365\is-ecelm.tmp to %ProgramFiles(x86)%\wise\wise care 365\defragoptions.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-6n8rj.tmp to %ProgramFiles(x86)%\wise\wise care 365\boottime.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-0uf97.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootpack.wpk
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-r3dtq.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\reminder.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-7cpji.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\programuninstaller.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-5oh6v.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\memoryoptimizer.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vfko3.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\gamebooster.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-fh5hc.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\forcedeleter.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-qfd2g.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\fastsearch.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-k43ii.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\duplicatefinder.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-feegk.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\daterecovery.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-85rt9.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\autoshutdown.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\is-5trcl.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv6.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-a2rjj.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\vietnamese.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-af333.tmp to %ProgramFiles(x86)%\wise\wise care 365\themes_v6.txt
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ooj3e.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\danish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-de7ag.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\czech.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-0k20i.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\croatian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-hl0fn.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vgt2l.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2fdc9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-dbjn2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-nprls.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-k4t0g.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-17np8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-fa0r2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-e932f.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vb397.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-tj2uq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-nnkdi.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-0laep.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-s0ol2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-cd286.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-pntgr.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-okj81.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-l9f0a.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-i1nkk.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-j41b4.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-63mfg.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-7m3b7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gldnd.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ocd6m.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\b5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-p6eqd.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-p4vq0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-khhno.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6r8ho.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gl2i0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-mu23b.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-dc50l.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-jq1rf.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-tl1ap.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h1.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-u4alc.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(simplified).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-3aj93.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\catalan.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-monos.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\bulgarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-rrq63.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\belarusian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-kodrc.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\azerbaijani(latin).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-0fnrm.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\arabic.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cqqod.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\abkhazian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vcflp.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-itjon.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6i4si.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-v264c.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-8htuc.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-chu4k.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-f3c9u.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-jtco4.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-058m2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-pejac.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2pk63.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-8neqm.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-chsv8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gio97.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-1o8n8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-a4cjg.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-93ak0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-f3akc.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-19e7m.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-v87lq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-reeqm.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-9fqj3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-boj5k.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h2.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-dacr1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(traditional).ini
from %ProgramFiles(x86)%\wise\wise care 365\is-ov1in.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootlauncher.exe

Network activity

Connects to

'cy###mania.ws':443

TCP

Other

'cy###mania.ws':443

UDP

DNS ASK cy###mania.ws
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'TFrmTrayMain' WindowName: ''
ClassName: 'TFrmWPMain' WindowName: ''
ClassName: 'TFrmMOMain' WindowName: ''
ClassName: 'Static' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\wisecare365_.exe' /silent
'%TEMP%\is-f1q38.tmp\wisecare365_.tmp' /SL5="$110224,16386298,857088,%TEMP%\RarSFX0\WiseCare365_.exe" /silent
'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "User Name" /t REG_SZ /d "Cyber" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "User Email" /t REG_SZ /d "1@1.com" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "License Key" /t REG_SZ /d "8E97-AE93-A19E93-8F89-94BC" /f

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней