Trojan.Siggen29.16942

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\WiseBootAssistant] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\WiseBootAssistant] 'ImagePath' = '%ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe'

Creates the following services

'WiseBootAssistant' %ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe

Modifies file system

Creates the following files

%TEMP%\rarsfx0\activator.exe
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7ibtp.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-fmctq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-atra8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-9nq5k.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-t6f0q.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3eoct.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ea43u.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-vnvse.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-0lgdr.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-qn3c4.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-3kb7o.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-2t876.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-rodek.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-q5jt1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-f3lrq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ovfk1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cui3a.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-uk9v1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-auics.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ctq7l.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-kjtc5.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-c3q31.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-82imk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ii2ur.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-8rl74.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vq675.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3soip.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-um4mu.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-i5jse.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-309ad.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-uqo9d.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-19u2p.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vi9oq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-o0ih2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-a9lr9.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6j1ba.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ehutp.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-jg81r.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-p0q1q.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-5c5hb.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-d5o06.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\wise care 365.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\uninstall wise care 365.lnk
C:\users\public\desktop\wise care 365.lnk
%TEMP%\is-2cd3u.tmp\introduce.url
%ProgramFiles(x86)%\wise\wise care 365\is-gj03l.tmp
%ProgramFiles(x86)%\wise\wise care 365\unins000.msg
%TEMP%\etilqs_ht8bh6dtn9sgd53
%TEMP%\etilqs_admv6rfhqbbcuex
%TEMP%\etilqs_yz80jesf0qceohg
%TEMP%\etilqs_yqmqqhr88f7p79n
%TEMP%\etilqs_vtcyzennqgteftr
%TEMP%\etilqs_kxs77rfz87axwqx
%ProgramFiles(x86)%\wise\wise care 365\is-rf0ch.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ukamk.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-r4nsp.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-felat.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o4k3d.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-fv2ni.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-6146h.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-1b1sl.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-0ee3e.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-0o9um.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-6la8l.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-gqapn.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-lehgv.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-67n55.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-stk6g.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-r7eqg.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-1vvek.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-fnk4h.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-mob8d.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-phasl.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-efe6f.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-m89so.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-5jojv.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-qjhll.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2hkv8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u850v.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-hgsu1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-cufsk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-q0vnq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6gcb1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ov639.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-5gv9v.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gikls.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-al0g5.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-511vu.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-bkjk2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-to6j1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6ljh3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1qvge.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-9b158.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-oo7dj.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-69asl.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-pdai0.tmp
%TEMP%\rarsfx0\wisecare365.exe
%TEMP%\is-af0fg.tmp\wisecare365.tmp
%TEMP%\is-2cd3u.tmp\_isetup\_setup64.tmp
%TEMP%\is-2cd3u.tmp\license.txt
%TEMP%\is-2cd3u.tmp\icon_128.bmp
%ProgramFiles(x86)%\wise\wise care 365\is-vffki.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0d2nn.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-v5oju.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-a4ah1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-m0v3i.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-stfh4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-952v3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0bdj7.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-i2pv3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-htjun.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-hbre6.tmp
%TEMP%\rarsfx0\mawto.url
%ProgramFiles(x86)%\wise\wise care 365\headers\is-9m59p.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-toa9j.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-b68rh.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-qu5ab.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kiohd.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-j5a9v.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-gj5p3.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-la49v.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-j2eoh.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-fr617.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-oo62k.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-hiah5.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-mq44i.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vi15n.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-l15pq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-fe8rf.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-rrrm2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tmjm7.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-chsh0.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-a820g.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4cv45.tmp
%ProgramFiles(x86)%\wise\wise care 365\unins000.dat
%TEMP%\etilqs_whzs4w0zsbwnu0s
%ProgramFiles(x86)%\wise\wise care 365\headers\is-pbo0v.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-mtnua.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0raca.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vmddg.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-i56rm.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u41bs.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0nmb3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-11d39.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-cmuh2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ifpee.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4go1l.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2gqm7.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-pjlt7.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4mc1j.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-lj8tn.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1v89i.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3e3ic.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-86p1d.tmp
%TEMP%\etilqs_wywenxphfm7j3ql

Sets the 'hidden' attribute to the following files

%TEMP%\is-2cd3u.tmp\icon_128.bmp

Deletes the following files

%TEMP%\is-2cd3u.tmp\icon_128.bmp
%TEMP%\is-2cd3u.tmp\introduce.url
%TEMP%\is-2cd3u.tmp\license.txt
%TEMP%\is-2cd3u.tmp\_isetup\_setup64.tmp
%TEMP%\is-af0fg.tmp\wisecare365.tmp

Moves the following files

from %ProgramFiles(x86)%\wise\wise care 365\is-vffki.tmp to %ProgramFiles(x86)%\wise\wise care 365\unins000.exe
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-9nq5k.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\thai.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-atra8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\swedish(sweden).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-fmctq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\spanish(spain).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-7ibtp.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovenian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ovfk1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovak.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cui3a.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\serbian(cyrillic).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-q5jt1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\russian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-uk9v1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\romanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-auics.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(portugal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-a9lr9.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(brazil).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vi9oq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\polish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-19u2p.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\persian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-uqo9d.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(nynorsk).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-309ad.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(bokmal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-t6f0q.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\turkish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-i5jse.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\nepali.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-um4mu.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\kurdish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-3eoct.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\korean.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vq675.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\japanese.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ii2ur.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\italian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-82imk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\indonesian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-c3q31.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hungarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-kjtc5.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hebrew.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ctq7l.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\greek.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ehutp.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\german.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-o0ih2.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\georgian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-3soip.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\french.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-5jojv.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\finnish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-qjhll.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\english.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-2hkv8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(nederlands).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-6j1ba.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\lithuanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-0ee3e.tmp to %ProgramFiles(x86)%\wise\wise care 365\fileshredder.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-5c5hb.tmp to %ProgramFiles(x86)%\wise\wise care 365\themes_v6.txt
from %ProgramFiles(x86)%\wise\wise care 365\tools\is-vnvse.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv6.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-ukamk.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseturbo.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-rf0ch.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisetray.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-r4nsp.tmp to %ProgramFiles(x86)%\wise\wise care 365\wjslib.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-gj03l.tmp to %ProgramFiles(x86)%\wise\wise care 365\ssleay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-felat.tmp to %ProgramFiles(x86)%\wise\wise care 365\libeay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-mob8d.tmp to %ProgramFiles(x86)%\wise\wise care 365\dmanager.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-fnk4h.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseeraser.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-1vvek.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisedefrag.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-r7eqg.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-stk6g.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisebootbooster.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-m89so.tmp to %ProgramFiles(x86)%\wise\wise care 365\sqlite3.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-efe6f.tmp to %ProgramFiles(x86)%\wise\wise care 365\skin.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-phasl.tmp to %ProgramFiles(x86)%\wise\wise care 365\rate.info
from %ProgramFiles(x86)%\wise\wise care 365\is-67n55.tmp to %ProgramFiles(x86)%\wise\wise care 365\autoupdate.exe
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tmjm7.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(belgium).ini
from %ProgramFiles(x86)%\wise\wise care 365\is-0o9um.tmp to %ProgramFiles(x86)%\wise\wise care 365\license.txt
from %ProgramFiles(x86)%\wise\wise care 365\is-1b1sl.tmp to %ProgramFiles(x86)%\wise\wise care 365\defragoptions.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-6146h.tmp to %ProgramFiles(x86)%\wise\wise care 365\boottime.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-fv2ni.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootpack.wpk
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-p0q1q.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\reminder.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-gqapn.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\programuninstaller.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-lehgv.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\memoryoptimizer.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-6la8l.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\imagex.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-jg81r.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\gamebooster.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-8rl74.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\forcedeleter.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-rodek.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\folderhider.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-2t876.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\fastsearch.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-3kb7o.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\duplicatefinder.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-qn3c4.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\daterecovery.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-0lgdr.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\autoshutdown.svg
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ea43u.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\ukrainian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-f3lrq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\vietnamese.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-rrrm2.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\danish.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3e3ic.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-5gv9v.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-0d2nn.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6ljh3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-to6j1.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-bkjk2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-511vu.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-al0g5.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-a4ah1.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gikls.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ov639.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6gcb1.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-q0vnq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-cufsk.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-hgsu1.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-b68rh.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-u850v.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-toa9j.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-1qvge.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-9b158.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-69asl.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-pdai0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-htjun.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-i2pv3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-0bdj7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-952v3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\b5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-stfh4.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-9m59p.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-m0v3i.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-hbre6.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-v5oju.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-oo7dj.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-pbo0v.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-l15pq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\croatian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-mtnua.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h2.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vi15n.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(traditional).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-4cv45.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(simplified).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-a820g.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\catalan.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-chsh0.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\bulgarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-mq44i.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\belarusian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-j2eoh.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\azerbaijani(latin).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-la49v.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\arabic.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-gj5p3.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\abkhazian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-j5a9v.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-kiohd.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-hiah5.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-qu5ab.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-fr617.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-cmuh2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j1.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-fe8rf.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\czech.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-11d39.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-1v89i.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-lj8tn.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4mc1j.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-pjlt7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2gqm7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4go1l.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-86p1d.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-o4k3d.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ifpee.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-0nmb3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-u41bs.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-i56rm.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vmddg.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-0raca.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-oo62k.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g8.png
from %ProgramFiles(x86)%\wise\wise care 365\is-d5o06.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootlauncher.exe

Network activity

Connects to

'au######te.geo.opera.com':80
'au######te.geo.opera.com':443
'google.com':80
'se####.yahoo.com':80
'du###uckgo.com':443
'am##on.com':80
'bing.com':80
'am##on.com':443
'en.###ipedia.org':80
'se####.yahoo.com':443
'en.###ipedia.org':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://www.google.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.am##on.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico

Other

'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443

UDP

DNS ASK google.com
DNS ASK au######te.geo.opera.com
DNS ASK se####.yahoo.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK en.###ipedia.org

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'TFrmTrayMain' WindowName: ''
ClassName: 'TFrmWPMain' WindowName: ''
ClassName: 'TFrmMOMain' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\rarsfx0\wisecare365.exe' /SILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-af0fg.tmp\wisecare365.tmp' /SL5="$10262,19267920,857088,%TEMP%\RarSFX0\WiseCare365.exe" /SILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\rarsfx0\activator.exe' /verysilent /restorehosts /activate /product:1 /name:mawto /email:mawto@mawtoload.com /overwrite

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.11.1600461853\209053373" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.10.293952335\1039103673" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.9.1046298464\1568047384" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.8.478762423\1985193161" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.7.1371882188\542413876" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.6.1566456976\305371766" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.5.1418695119\2055789240" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.12.122556658\1904481862" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="916.4.1793476271\476280222" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1096
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="916.0.2127848768\952156145" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://mawtoload.com/ /crash-reporter-parent-id=916
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://mawtoload.com/
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://mawtoload.com/"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.4.1793476271\476280222" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="916.15.1493568356\1395466101" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней