Trojan.Siggen12.30947

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'ImagePath' = '%ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe'

Creates the following services

'WiseBootAssistant' %ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop WiseBootAssistant

Modifies file system

Creates the following files

C:\kinghaze\kur.exe
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2h0il.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cs3lt.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-80ihd.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jb1j8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-v4clk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4h7nk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-khev8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6tavs.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3f11j.tmp
%ProgramFiles(x86)%\wise\wise care 365\themes\is-82a6k.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-am830.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-p6m15.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-lgu98.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-n3da9.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cfmik.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jsfeu.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3ijpr.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ck1ms.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-r6jq8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-trbk6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ct925.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-nu456.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6rr6l.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ea496.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4bhhn.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-8l6u3.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-8f7n2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ls728.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7c9ud.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-lkv0g.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-umhl8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-c05g4.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-nf6fs.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-dls7s.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-a51g9.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-toh6j.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vkijb.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-kghet.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-483m8.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-unci4.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-n25hq.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-pc9lf.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gha23.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-88f4f.tmp
%TEMP%\is-3sm22.tmp\is-cu00f.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-mahto.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\wise care 365.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\uninstall wise care 365.lnk
C:\users\public\desktop\wise care 365.lnk
%TEMP%\is-3sm22.tmp\introduce.url
%ProgramFiles(x86)%\wise\wise care 365\unins000.msg
%ProgramFiles(x86)%\wise\wise care 365\unins000.dat
%ProgramFiles(x86)%\wise\wise care 365\is-0hn09.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-mrg54.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-9gglk.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gsjn9.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-cb05d.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-p8cqt.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-l10el.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-88fql.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-st74u.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-77nvj.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-1q193.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-6m1dt.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-q22g7.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gghf3.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-tfk9m.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-a52fs.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-prhl2.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ciee6.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-3cr85.tmp
%APPDATA%\wise care 365\config.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-i1jqr.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ips6h.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-n49c4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u2tea.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-36c6i.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-olu42.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-078cn.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ccn28.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2m07v.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-r1hha.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-j4h17.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-51slm.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-qji9e.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-she8c.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-56hgb.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-43uqd.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u5ds9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-33d4q.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-f2lko.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-akbc5.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ikcft.tmp
%TEMP%\is-cda3k.tmp\setup.tmp
%TEMP%\is-3sm22.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-2i5nq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-m662p.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-fr9gp.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ipbb3.tmp
C:\kinghaze\setup.exe
%ProgramFiles(x86)%\wise\wise care 365\headers\is-nifjs.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kl5sk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-samp8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vbspl.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kmqi1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o4lr1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-el6k9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ibkq4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-44qo0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o1d44.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-19iq3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3i864.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1i1r8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gjum6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3i8t2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6q60q.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cshpq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ssnm1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3ajva.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-il3r0.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-eo77l.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2r4i6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-otsv6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1grpc.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1alqg.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-aovne.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-11vse.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0vg04.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6lhpt.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-obsso.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-codq6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-e2npk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ee5f9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-30g0p.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-77bik.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-k3vf2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-d1tdi.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ipvn6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-enhtk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-n3md3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-th46n.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-js641.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1088t.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4elsf.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gsg6h.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-peb23.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-qihqm.tmp
%APPDATA%\wise care 365\config_tray.ini

Deletes the following files

%TEMP%\is-3sm22.tmp\cstask.exe
%TEMP%\is-3sm22.tmp\introduce.url
%TEMP%\is-3sm22.tmp\_isetup\_setup64.tmp
%TEMP%\is-cda3k.tmp\setup.tmp
%ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe.bak
C:\kinghaze\kur.exe
C:\kinghaze\setup.exe

Moves the following files

from %ProgramFiles(x86)%\wise\wise care 365\is-2i5nq.tmp to %ProgramFiles(x86)%\wise\wise care 365\unins000.exe
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ck1ms.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\polish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-3ijpr.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(brazil).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-jsfeu.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(portugal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-4h7nk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\romanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-khev8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\russian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-2h0il.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\serbian(cyrillic).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-80ihd.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovenian.ini
from %ProgramFiles(x86)%\wise\wise care 365\tools\is-am830.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv5.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-jb1j8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\spanish(spain).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-v4clk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\swedish(sweden).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-6tavs.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\thai.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-n3da9.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\turkish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cfmik.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\ukrainian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-3f11j.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\vietnamese.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cs3lt.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovak.ini
from %ProgramFiles(x86)%\wise\wise care 365\themes\is-82a6k.tmp to %ProgramFiles(x86)%\wise\wise care 365\themes\default.wskn
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-lkv0g.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(bokmal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-7c9ud.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\nepali.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ls728.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\lithuanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-8f7n2.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\kurdish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-nf6fs.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\korean.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-8l6u3.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\japanese.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ea496.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\italian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-6rr6l.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\indonesian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-nu456.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hungarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ct925.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hebrew.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-trbk6.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\greek.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-r6jq8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\german.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-4bhhn.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\georgian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-i1jqr.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\french.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-c05g4.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\persian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-th46n.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i3.png
from %ProgramFiles(x86)%\wise\wise care 365\tools\is-p6m15.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv5.zip
from %TEMP%\is-3sm22.tmp\is-cu00f.tmp to %TEMP%\is-3sm22.tmp\cstask.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-prhl2.tmp to %ProgramFiles(x86)%\wise\wise care 365\sqlite3.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-ciee6.tmp to %ProgramFiles(x86)%\wise\wise care 365\uninstalltp.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-3cr85.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisebootbooster.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-gsjn9.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-mrg54.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisedefrag.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-9gglk.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseeraser.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-kghet.tmp to %ProgramFiles(x86)%\wise\wise care 365\libeay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-lgu98.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\autoshutdown.png
from %ProgramFiles(x86)%\wise\wise care 365\is-483m8.tmp to %ProgramFiles(x86)%\wise\wise care 365\ssleay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-unci4.tmp to %ProgramFiles(x86)%\wise\wise care 365\wjslib.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-n25hq.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisetray.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-pc9lf.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseturbo.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-gha23.tmp to %ProgramFiles(x86)%\wise\wise care 365\geo.db
from %ProgramFiles(x86)%\wise\wise care 365\is-88f4f.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootlauncher.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-a52fs.tmp to %ProgramFiles(x86)%\wise\wise care 365\skin.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-tfk9m.tmp to %ProgramFiles(x86)%\wise\wise care 365\rate.info
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-dls7s.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\daterecovery.png
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-88fql.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\reminder.png
from %ProgramFiles(x86)%\wise\wise care 365\is-gghf3.tmp to %ProgramFiles(x86)%\wise\wise care 365\autoupdate.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-q22g7.tmp to %ProgramFiles(x86)%\wise\wise care 365\license.txt
from %ProgramFiles(x86)%\wise\wise care 365\is-6m1dt.tmp to %ProgramFiles(x86)%\wise\wise care 365\fileshredder.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-1q193.tmp to %ProgramFiles(x86)%\wise\wise care 365\defragoptions.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-77nvj.tmp to %ProgramFiles(x86)%\wise\wise care 365\boottime.exe
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-umhl8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(nynorsk).ini
from %ProgramFiles(x86)%\wise\wise care 365\is-st74u.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootpack.wpk
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ips6h.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\finnish.ini
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-p8cqt.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\memoryoptimizer.png
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-cb05d.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\jetsearch.png
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vkijb.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\gamebooster.png
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-toh6j.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\forcedeleter.png
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-a51g9.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\duplicatefinder.png
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-l10el.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\programuninstaller.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-n49c4.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\english.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-qihqm.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(nederlands).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-11vse.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(belgium).ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-r1hha.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-44qo0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-43uqd.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-56hgb.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-she8c.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-qji9e.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-51slm.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-33d4q.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-u5ds9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-j4h17.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ccn28.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-078cn.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-olu42.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-36c6i.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-u2tea.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2m07v.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vbspl.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-f2lko.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-akbc5.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ikcft.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-el6k9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-o4lr1.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-kmqi1.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d1.png
from %ProgramFiles(x86)%\wise\wise care 365\is-mahto.tmp to %ProgramFiles(x86)%\wise\wise care 365\wise.fkn
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-samp8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-kl5sk.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\b5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ibkq4.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-nifjs.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ipbb3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-fr9gp.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-m662p.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-19iq3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g8.png
from %ProgramFiles(x86)%\wise\wise care 365\is-0hn09.tmp to %ProgramFiles(x86)%\wise\wise care 365\dmanager.dll
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3i864.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-codq6.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-3ajva.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\belarusian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-1i1r8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gjum6.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3i8t2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6q60q.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j8.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cshpq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\arabic.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ssnm1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\azerbaijani(latin).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-il3r0.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\bulgarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-o1d44.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g7.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-eo77l.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\catalan.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-2r4i6.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(simplified).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-otsv6.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(traditional).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-1grpc.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\croatian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-1alqg.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\czech.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-aovne.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\danish.ini
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-0vg04.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-obsso.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-peb23.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gsg6h.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4elsf.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-1088t.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-js641.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-n3md3.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ee5f9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-e2npk.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ipvn6.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-d1tdi.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-k3vf2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-77bik.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-30g0p.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6lhpt.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-enhtk.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i1.png
from %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe to %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe.bak

Substitutes the following files

%ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe

Miscellaneous

Searches for the following windows

ClassName: 'TFrmTrayMain' WindowName: ''
ClassName: 'TFrmWPMain' WindowName: ''
ClassName: 'TFrmMOMain' WindowName: ''

Creates and executes the following

'C:\kinghaze\kur.exe'
'C:\kinghaze\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-cda3k.tmp\setup.tmp' /SL5="$C0216,12986409,257024,C:\Kinghaze\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop WiseBootAssistant' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c sc delete WiseBootAssistant' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f
'%WINDIR%\syswow64\cmd.exe' /c net stop WiseBootAssistant
'%WINDIR%\syswow64\net1.exe' stop WiseBootAssistant
'%WINDIR%\syswow64\cmd.exe' /c sc delete WiseBootAssistant
'%WINDIR%\syswow64\sc.exe' delete WiseBootAssistant

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial