Trojan.Siggen31.37023

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\WiseBootAssistant] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\WiseBootAssistant] 'ImagePath' = '%ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe'

Creates the following services

'WiseBootAssistant' %ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe

Modifies file system

Creates the following files

%TEMP%\rarsfx0\cybermania.url
%TEMP%\rarsfx0\activator.7z
%TEMP%\rarsfx0\wisecare365.exe
%TEMP%\rarsfx0\newpatch.7z
%TEMP%\is-tkt29.tmp\wisecare365.tmp
%TEMP%\is-o2sra.tmp\_isetup\_setup64.tmp
%TEMP%\is-o2sra.tmp\license.txt
%TEMP%\is-o2sra.tmp\icon_128.bmp
%ProgramFiles(x86)%\wise\wise care 365\is-0akf8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-10nm5.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u7h8v.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-er8ob.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-nfrrc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6enpq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3npu9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-p2shq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-rk95p.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-l7e4q.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-anc87.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-j852g.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-eikk6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gebjs.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-sckmh.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3iop4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0o6gc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o7hno.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-nkit0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-jvdof.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-8f582.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-cbol8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-47njc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-fofn9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-cq3d1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ghl51.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-e82lc.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-arm08.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vgdl0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-rrujt.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-p812o.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vspi7.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-9bopo.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4sl2k.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2qav9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-qlavs.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kmfp0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3t75t.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-jr1in.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ch8fv.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-9b1kh.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-cro6h.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-81d8p.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-g8jt9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-lkfi2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ad617.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-rarh7.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-am8mh.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-7vqrb.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-bkf6n.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kesvq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-trhug.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4eiu6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-tuorq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-cc3c9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-c10bt.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-9q3c8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-kkkp8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ptvid.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-g409h.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1o1rc.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7g7bo.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-hbvhu.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-p1fm3.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vfs57.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-q8dk3.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-f1cej.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tdk4c.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-oh67k.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-61370.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cu8g4.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-58gr4.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ar848.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6g8d7.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ahd2a.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-evsl1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-c5c0t.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-k883h.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-mb8kt.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tdo0u.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-5oc7b.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tmtqm.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-gpsrk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4431h.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-89159.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-o9rnd.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7tse7.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-fljdi.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-b3fcg.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-b7gif.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-j898f.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-fbafq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-inlin.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-tddoj.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vhia4.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-dnb70.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1mqhn.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-o3dah.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1phmt.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-dkg5t.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-vhr77.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-njnt2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-h0ami.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-931j8.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-98ol0.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-boaou.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-e87ks.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-nib9q.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-6r60p.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-hctqs.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-ago1j.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-97iob.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-99mkb.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-mm9jl.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-1qegd.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-chd1h.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-sobtd.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-3ed80.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-b3up5.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-roks7.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-223do.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-75kgl.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-4frnh.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-nu0j3.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-bd4r3.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-m8tqd.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-b3lb9.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-uko4t.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-vgfv7.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-7t060.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-mfmo6.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gab4e.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-eqanr.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-duh85.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-mg460.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-4b6od.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-e7f6o.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-8nb9l.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\wise care 365.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\uninstall wise care 365.lnk
C:\users\public\desktop\wise care 365.lnk
%TEMP%\is-o2sra.tmp\introduce.url
%ProgramFiles(x86)%\wise\wise care 365\unins000.msg
%ProgramFiles(x86)%\wise\wise care 365\unins000.dat
%TEMP%\etilqs_r5gmp5wjafccahh
%TEMP%\etilqs_9jg0es55aucypdb
%TEMP%\etilqs_docpngwuwfkweqt
%TEMP%\etilqs_idfwc577te8kawo
%TEMP%\etilqs_vumj6wdyobc4lab
%TEMP%\etilqs_3kqxklpckp5vgby
%TEMP%\etilqs_u9mvlv2e6vxcpfw
%TEMP%\etilqs_wdwdjf34o42mb3z
%TEMP%\etilqs_6bquuenby2zqv2z

Sets the 'hidden' attribute to the following files

%TEMP%\is-o2sra.tmp\icon_128.bmp

Deletes the following files

%TEMP%\is-o2sra.tmp\icon_128.bmp
%TEMP%\is-o2sra.tmp\introduce.url
%TEMP%\is-o2sra.tmp\license.txt
%TEMP%\is-o2sra.tmp\_isetup\_setup64.tmp
%TEMP%\is-tkt29.tmp\wisecare365.tmp

Moves the following files

from %ProgramFiles(x86)%\wise\wise care 365\is-0akf8.tmp to %ProgramFiles(x86)%\wise\wise care 365\unins000.exe
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-10nm5.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-u7h8v.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-er8ob.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-nfrrc.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-6enpq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\a9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3npu9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\b5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-p2shq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-rk95p.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\c7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-l7e4q.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-anc87.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-j852g.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-eikk6.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-gebjs.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\d7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-sckmh.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3iop4.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-0o6gc.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\e9.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-o7hno.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-nkit0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-jvdof.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-8f582.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-cbol8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-47njc.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-fofn9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-cq3d1.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\f7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ghl51.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-e82lc.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-arm08.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vgdl0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-rrujt.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-p812o.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-vspi7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-9bopo.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\g8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4sl2k.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-2qav9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-qlavs.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-kmfp0.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-3t75t.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-jr1in.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ch8fv.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-9b1kh.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\h8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-cro6h.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-81d8p.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i2.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-g8jt9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-lkfi2.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-ad617.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i5.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-rarh7.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-am8mh.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-7vqrb.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\i8.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-bkf6n.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-kesvq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j0.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-trhug.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j1.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-4eiu6.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j3.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-tuorq.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j4.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-cc3c9.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j6.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-c10bt.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j7.png
from %ProgramFiles(x86)%\wise\wise care 365\headers\is-9q3c8.tmp to %ProgramFiles(x86)%\wise\wise care 365\headers\j8.png
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-kkkp8.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\abkhazian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ptvid.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\arabic.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-g409h.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\azerbaijani(latin).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-1o1rc.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\belarusian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-7g7bo.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\bulgarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-hbvhu.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\catalan.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-p1fm3.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(simplified).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vfs57.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(traditional).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-q8dk3.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\croatian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-f1cej.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\czech.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tdk4c.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\danish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-oh67k.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(belgium).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-61370.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(nederlands).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-cu8g4.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\english.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-58gr4.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\finnish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ar848.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\french.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-6g8d7.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\georgian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-ahd2a.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\german.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-evsl1.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\greek.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-c5c0t.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hebrew.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-k883h.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\hungarian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-mb8kt.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\indonesian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tdo0u.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\italian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-5oc7b.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\japanese.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tmtqm.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\korean.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-gpsrk.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\kurdish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-4431h.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\lithuanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-89159.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\nepali.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-o9rnd.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(bokmal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-7tse7.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(nynorsk).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-fljdi.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\persian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-b3fcg.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\polish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-b7gif.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(brazil).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-j898f.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(portugal).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-fbafq.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\romanian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-inlin.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\russian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-tddoj.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\serbian(cyrillic).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vhia4.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovak.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-dnb70.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\slovenian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-1mqhn.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\spanish(mexico).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-o3dah.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\spanish(spain).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-1phmt.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\swedish(sweden).ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-dkg5t.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\thai.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-vhr77.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\turkish.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-njnt2.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\ukrainian.ini
from %ProgramFiles(x86)%\wise\wise care 365\languages\is-h0ami.tmp to %ProgramFiles(x86)%\wise\wise care 365\languages\vietnamese.ini
from %ProgramFiles(x86)%\wise\wise care 365\tools\is-931j8.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv6.ini
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-98ol0.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\autoshutdown.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-boaou.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\daterecovery.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-e87ks.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\duplicatefinder.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-nib9q.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\fastsearch.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-6r60p.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\folderhider.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-hctqs.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\forcedeleter.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-ago1j.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\gamebooster.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-97iob.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\imagex.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-99mkb.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\memoryoptimizer.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-mm9jl.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\programuninstaller.svg
from %ProgramFiles(x86)%\wise\wise care 365\tools\img\is-1qegd.tmp to %ProgramFiles(x86)%\wise\wise care 365\tools\img\reminder.svg
from %ProgramFiles(x86)%\wise\wise care 365\is-chd1h.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootpack.wpk
from %ProgramFiles(x86)%\wise\wise care 365\is-sobtd.tmp to %ProgramFiles(x86)%\wise\wise care 365\boottime.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-3ed80.tmp to %ProgramFiles(x86)%\wise\wise care 365\defragoptions.ini
from %ProgramFiles(x86)%\wise\wise care 365\is-b3up5.tmp to %ProgramFiles(x86)%\wise\wise care 365\fileshredder.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-roks7.tmp to %ProgramFiles(x86)%\wise\wise care 365\license.txt
from %ProgramFiles(x86)%\wise\wise care 365\is-223do.tmp to %ProgramFiles(x86)%\wise\wise care 365\autoupdate.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-75kgl.tmp to %ProgramFiles(x86)%\wise\wise care 365\rate.info
from %ProgramFiles(x86)%\wise\wise care 365\is-4frnh.tmp to %ProgramFiles(x86)%\wise\wise care 365\skin.ico
from %ProgramFiles(x86)%\wise\wise care 365\is-nu0j3.tmp to %ProgramFiles(x86)%\wise\wise care 365\sqlite3.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-bd4r3.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisebootbooster.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-m8tqd.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-b3lb9.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisedefrag.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-uko4t.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseeraser.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-vgfv7.tmp to %ProgramFiles(x86)%\wise\wise care 365\dmanager.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-7t060.tmp to %ProgramFiles(x86)%\wise\wise care 365\libeay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-mfmo6.tmp to %ProgramFiles(x86)%\wise\wise care 365\ssleay32.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-gab4e.tmp to %ProgramFiles(x86)%\wise\wise care 365\wjslib.dll
from %ProgramFiles(x86)%\wise\wise care 365\is-eqanr.tmp to %ProgramFiles(x86)%\wise\wise care 365\wisetray.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-duh85.tmp to %ProgramFiles(x86)%\wise\wise care 365\wiseturbo.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-mg460.tmp to %ProgramFiles(x86)%\wise\wise care 365\themes_v7.txt
from %ProgramFiles(x86)%\wise\wise care 365\is-4b6od.tmp to %ProgramFiles(x86)%\wise\wise care 365\bootlauncher.exe
from %ProgramFiles(x86)%\wise\wise care 365\is-e7f6o.tmp to %ProgramFiles(x86)%\wise\wise care 365\protect.db
from %ProgramFiles(x86)%\wise\wise care 365\is-8nb9l.tmp to %ProgramFiles(x86)%\wise\wise care 365\webview2loader.dll

Network activity

Connects to

'google.com':80
'au######te.geo.opera.com':80
'se####.yahoo.com':80
'du###uckgo.com':443
'am##on.com':80
'bing.com':80
'am##on.com':443
'se####.yahoo.com':443
'au######te.geo.opera.com':443
'en.###ipedia.org':80
'en.###ipedia.org':443
'si#####ck2.opera.com':80
're###.opera.com':80

TCP

HTTP GET requests

http://www.google.com/favicon.ico
http://au######te.geo.opera.com/geolocation/
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico
http://si#####ck2.opera.com/?ho###################################################
http://re###.opera.com/www.opera.com/firstrun/

Other

'du###uckgo.com':443
'am##on.com':443
'au######te.geo.opera.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443

UDP

DNS ASK google.com
DNS ASK au######te.geo.opera.com
DNS ASK se####.yahoo.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK en.###ipedia.org
DNS ASK si#####ck2.opera.com
DNS ASK re###.opera.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'TFrmTrayMain' WindowName: ''
ClassName: 'TFrmWPMain' WindowName: ''
ClassName: 'TFrmMOMain' WindowName: ''
ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\rarsfx0\wisecare365.exe' /silent
'%TEMP%\is-tkt29.tmp\wisecare365.tmp' /SL5="$1025C,16742742,857088,%TEMP%\RarSFX0\WiseCare365.exe" /silent

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "User Name" /t REG_SZ /d "Cyber" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "User Email" /t REG_SZ /d "1@1.com" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{1999F9DE-571D-455B-B7C9-C1E9DB51589F}" /v "License Key" /t REG_SZ /d "8E97-AE93-A19E93-8F89-94BC" /f
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://ftuapps.dev/"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://ftuapps.dev/
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://ftuapps.dev/ /crash-reporter-parent-id=2956
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2956.0.259644790\1187546039" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.4.1970360740\428604680" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.5.598080433\757015136" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.6.541907665\922899130" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.7.1825590023\2063806584" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.8.1581351296\555403058" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.9.1868232245\1967197454" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2956.4.1970360740\428604680" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2860
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.10.294949292\854676384" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.11.466463664\1112077383" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.12.401530634\695699676" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.15.687354159\222706728" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2956.16.791519809\1434300589" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial