Trojan.Siggen12.30947

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'ImagePath' = '%ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe'

Создает следующие сервисы

'WiseBootAssistant' %ProgramFiles(x86)%\Wise\Wise Care 365\BootTime.exe

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop WiseBootAssistant

Изменения в файловой системе

Создает следующие файлы

C:\kinghaze\kur.exe
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2h0il.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cs3lt.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-80ihd.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jb1j8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-v4clk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4h7nk.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-khev8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6tavs.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3f11j.tmp
%ProgramFiles(x86)%\wise\wise care 365\themes\is-82a6k.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-am830.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\is-p6m15.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-lgu98.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-n3da9.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cfmik.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jsfeu.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3ijpr.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ck1ms.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-r6jq8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-trbk6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ct925.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-nu456.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6rr6l.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ea496.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4bhhn.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-8l6u3.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-8f7n2.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ls728.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7c9ud.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-lkv0g.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-umhl8.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-c05g4.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-nf6fs.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-dls7s.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-a51g9.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-toh6j.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vkijb.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-kghet.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-483m8.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-unci4.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-n25hq.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-pc9lf.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gha23.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-88f4f.tmp
%TEMP%\is-3sm22.tmp\is-cu00f.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-mahto.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\wise care 365.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\wise care 365\uninstall wise care 365.lnk
C:\users\public\desktop\wise care 365.lnk
%TEMP%\is-3sm22.tmp\introduce.url
%ProgramFiles(x86)%\wise\wise care 365\unins000.msg
%ProgramFiles(x86)%\wise\wise care 365\unins000.dat
%ProgramFiles(x86)%\wise\wise care 365\is-0hn09.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-mrg54.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-9gglk.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gsjn9.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-cb05d.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-p8cqt.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-l10el.tmp
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-88fql.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-st74u.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-77nvj.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-1q193.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-6m1dt.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-q22g7.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-gghf3.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-tfk9m.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-a52fs.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-prhl2.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-ciee6.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-3cr85.tmp
%APPDATA%\wise care 365\config.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-i1jqr.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ips6h.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-n49c4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u2tea.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-36c6i.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-olu42.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-078cn.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ccn28.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2m07v.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-r1hha.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-j4h17.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-51slm.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-qji9e.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-she8c.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-56hgb.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-43uqd.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u5ds9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-33d4q.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-f2lko.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-akbc5.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ikcft.tmp
%TEMP%\is-cda3k.tmp\setup.tmp
%TEMP%\is-3sm22.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\wise\wise care 365\is-2i5nq.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-m662p.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-fr9gp.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ipbb3.tmp
C:\kinghaze\setup.exe
%ProgramFiles(x86)%\wise\wise care 365\headers\is-nifjs.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kl5sk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-samp8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vbspl.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kmqi1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o4lr1.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-el6k9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ibkq4.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-44qo0.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o1d44.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-19iq3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3i864.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1i1r8.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gjum6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3i8t2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6q60q.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cshpq.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ssnm1.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3ajva.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-il3r0.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-eo77l.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2r4i6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-otsv6.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1grpc.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1alqg.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-aovne.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-11vse.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0vg04.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6lhpt.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-obsso.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-codq6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-e2npk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ee5f9.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-30g0p.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-77bik.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-k3vf2.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-d1tdi.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ipvn6.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-enhtk.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-n3md3.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-th46n.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-js641.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1088t.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4elsf.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gsg6h.tmp
%ProgramFiles(x86)%\wise\wise care 365\headers\is-peb23.tmp
%ProgramFiles(x86)%\wise\wise care 365\languages\is-qihqm.tmp
%APPDATA%\wise care 365\config_tray.ini

Удаляет следующие файлы

%TEMP%\is-3sm22.tmp\cstask.exe
%TEMP%\is-3sm22.tmp\introduce.url
%TEMP%\is-3sm22.tmp\_isetup\_setup64.tmp
%TEMP%\is-cda3k.tmp\setup.tmp
%ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe.bak
C:\kinghaze\kur.exe
C:\kinghaze\setup.exe

Перемещает следующие файлы

%ProgramFiles(x86)%\wise\wise care 365\is-2i5nq.tmp в %ProgramFiles(x86)%\wise\wise care 365\unins000.exe
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ck1ms.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\polish.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3ijpr.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(brazil).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jsfeu.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\portuguese(portugal).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4h7nk.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\romanian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-khev8.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\russian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2h0il.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\serbian(cyrillic).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-80ihd.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\slovenian.ini
%ProgramFiles(x86)%\wise\wise care 365\tools\is-am830.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv5.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-jb1j8.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\spanish(spain).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-v4clk.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\swedish(sweden).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6tavs.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\thai.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-n3da9.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\turkish.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cfmik.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\ukrainian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3f11j.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\vietnamese.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cs3lt.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\slovak.ini
%ProgramFiles(x86)%\wise\wise care 365\themes\is-82a6k.tmp в %ProgramFiles(x86)%\wise\wise care 365\themes\default.wskn
%ProgramFiles(x86)%\wise\wise care 365\languages\is-lkv0g.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(bokmal).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-7c9ud.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\nepali.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ls728.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\lithuanian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-8f7n2.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\kurdish.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-nf6fs.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\korean.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-8l6u3.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\japanese.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ea496.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\italian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-6rr6l.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\indonesian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-nu456.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\hungarian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ct925.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\hebrew.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-trbk6.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\greek.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-r6jq8.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\german.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-4bhhn.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\georgian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-i1jqr.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\french.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-c05g4.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\persian.ini
%ProgramFiles(x86)%\wise\wise care 365\headers\is-th46n.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i3.png
%ProgramFiles(x86)%\wise\wise care 365\tools\is-p6m15.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\toolsv5.zip
%TEMP%\is-3sm22.tmp\is-cu00f.tmp в %TEMP%\is-3sm22.tmp\cstask.exe
%ProgramFiles(x86)%\wise\wise care 365\is-prhl2.tmp в %ProgramFiles(x86)%\wise\wise care 365\sqlite3.dll
%ProgramFiles(x86)%\wise\wise care 365\is-ciee6.tmp в %ProgramFiles(x86)%\wise\wise care 365\uninstalltp.exe
%ProgramFiles(x86)%\wise\wise care 365\is-3cr85.tmp в %ProgramFiles(x86)%\wise\wise care 365\wisebootbooster.exe
%ProgramFiles(x86)%\wise\wise care 365\is-gsjn9.tmp в %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe
%ProgramFiles(x86)%\wise\wise care 365\is-mrg54.tmp в %ProgramFiles(x86)%\wise\wise care 365\wisedefrag.dll
%ProgramFiles(x86)%\wise\wise care 365\is-9gglk.tmp в %ProgramFiles(x86)%\wise\wise care 365\wiseeraser.dll
%ProgramFiles(x86)%\wise\wise care 365\is-kghet.tmp в %ProgramFiles(x86)%\wise\wise care 365\libeay32.dll
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-lgu98.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\autoshutdown.png
%ProgramFiles(x86)%\wise\wise care 365\is-483m8.tmp в %ProgramFiles(x86)%\wise\wise care 365\ssleay32.dll
%ProgramFiles(x86)%\wise\wise care 365\is-unci4.tmp в %ProgramFiles(x86)%\wise\wise care 365\wjslib.dll
%ProgramFiles(x86)%\wise\wise care 365\is-n25hq.tmp в %ProgramFiles(x86)%\wise\wise care 365\wisetray.exe
%ProgramFiles(x86)%\wise\wise care 365\is-pc9lf.tmp в %ProgramFiles(x86)%\wise\wise care 365\wiseturbo.exe
%ProgramFiles(x86)%\wise\wise care 365\is-gha23.tmp в %ProgramFiles(x86)%\wise\wise care 365\geo.db
%ProgramFiles(x86)%\wise\wise care 365\is-88f4f.tmp в %ProgramFiles(x86)%\wise\wise care 365\bootlauncher.exe
%ProgramFiles(x86)%\wise\wise care 365\is-a52fs.tmp в %ProgramFiles(x86)%\wise\wise care 365\skin.ico
%ProgramFiles(x86)%\wise\wise care 365\is-tfk9m.tmp в %ProgramFiles(x86)%\wise\wise care 365\rate.info
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-dls7s.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\daterecovery.png
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-88fql.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\reminder.png
%ProgramFiles(x86)%\wise\wise care 365\is-gghf3.tmp в %ProgramFiles(x86)%\wise\wise care 365\autoupdate.exe
%ProgramFiles(x86)%\wise\wise care 365\is-q22g7.tmp в %ProgramFiles(x86)%\wise\wise care 365\license.txt
%ProgramFiles(x86)%\wise\wise care 365\is-6m1dt.tmp в %ProgramFiles(x86)%\wise\wise care 365\fileshredder.ico
%ProgramFiles(x86)%\wise\wise care 365\is-1q193.tmp в %ProgramFiles(x86)%\wise\wise care 365\defragoptions.ini
%ProgramFiles(x86)%\wise\wise care 365\is-77nvj.tmp в %ProgramFiles(x86)%\wise\wise care 365\boottime.exe
%ProgramFiles(x86)%\wise\wise care 365\languages\is-umhl8.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\norwegian(nynorsk).ini
%ProgramFiles(x86)%\wise\wise care 365\is-st74u.tmp в %ProgramFiles(x86)%\wise\wise care 365\bootpack.wpk
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ips6h.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\finnish.ini
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-p8cqt.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\memoryoptimizer.png
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-cb05d.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\jetsearch.png
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-vkijb.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\gamebooster.png
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-toh6j.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\forcedeleter.png
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-a51g9.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\duplicatefinder.png
%ProgramFiles(x86)%\wise\wise care 365\tools\img\is-l10el.tmp в %ProgramFiles(x86)%\wise\wise care 365\tools\img\programuninstaller.png
%ProgramFiles(x86)%\wise\wise care 365\languages\is-n49c4.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\english.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-qihqm.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(nederlands).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-11vse.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\dutch(belgium).ini
%ProgramFiles(x86)%\wise\wise care 365\headers\is-r1hha.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\e9.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-44qo0.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g6.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-43uqd.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g5.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-56hgb.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g4.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-she8c.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g3.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-qji9e.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g2.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-51slm.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g1.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-33d4q.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u5ds9.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f6.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-j4h17.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f5.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ccn28.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f4.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-078cn.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f3.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-olu42.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f2.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-36c6i.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f1.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-u2tea.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\f0.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-2m07v.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\e8.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-vbspl.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\c7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-f2lko.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\e7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-akbc5.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\d7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ikcft.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\d4.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-el6k9.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\d3.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o4lr1.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\d2.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kmqi1.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\d1.png
%ProgramFiles(x86)%\wise\wise care 365\is-mahto.tmp в %ProgramFiles(x86)%\wise\wise care 365\wise.fkn
%ProgramFiles(x86)%\wise\wise care 365\headers\is-samp8.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\c4.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-kl5sk.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\b5.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ibkq4.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\a9.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-nifjs.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\a7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ipbb3.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\a6.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-fr9gp.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\a2.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-m662p.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\a1.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-19iq3.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g8.png
%ProgramFiles(x86)%\wise\wise care 365\is-0hn09.tmp в %ProgramFiles(x86)%\wise\wise care 365\dmanager.dll
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3i864.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h1.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-codq6.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j.png
%ProgramFiles(x86)%\wise\wise care 365\languages\is-3ajva.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\belarusian.ini
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1i1r8.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j4.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gjum6.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j6.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-3i8t2.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6q60q.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j8.png
%ProgramFiles(x86)%\wise\wise care 365\languages\is-cshpq.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\arabic.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-ssnm1.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\azerbaijani(latin).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-il3r0.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\bulgarian.ini
%ProgramFiles(x86)%\wise\wise care 365\headers\is-o1d44.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\g7.png
%ProgramFiles(x86)%\wise\wise care 365\languages\is-eo77l.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\catalan.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-2r4i6.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(simplified).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-otsv6.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\chinese(traditional).ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1grpc.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\croatian.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-1alqg.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\czech.ini
%ProgramFiles(x86)%\wise\wise care 365\languages\is-aovne.tmp в %ProgramFiles(x86)%\wise\wise care 365\languages\danish.ini
%ProgramFiles(x86)%\wise\wise care 365\headers\is-0vg04.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j3.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-obsso.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j1.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-peb23.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i8.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-gsg6h.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-4elsf.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i6.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-1088t.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i5.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-js641.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i4.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-n3md3.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i2.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ee5f9.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h3.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-e2npk.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h2.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-ipvn6.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h8.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-d1tdi.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h7.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-k3vf2.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h6.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-77bik.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h5.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-30g0p.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\h4.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-6lhpt.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\j0.png
%ProgramFiles(x86)%\wise\wise care 365\headers\is-enhtk.tmp в %ProgramFiles(x86)%\wise\wise care 365\headers\i1.png
%ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe в %ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe.bak

Подменяет следующие файлы

%ProgramFiles(x86)%\wise\wise care 365\wisecare365.exe

Другое

Ищет следующие окна

ClassName: 'TFrmTrayMain' WindowName: ''
ClassName: 'TFrmWPMain' WindowName: ''
ClassName: 'TFrmMOMain' WindowName: ''

Создает и запускает на исполнение

'C:\kinghaze\kur.exe'
'C:\kinghaze\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-cda3k.tmp\setup.tmp' /SL5="$C0216,12986409,257024,C:\Kinghaze\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c net stop WiseBootAssistant' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c sc delete WiseBootAssistant' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f
'%WINDIR%\syswow64\cmd.exe' /c net stop WiseBootAssistant
'%WINDIR%\syswow64\net1.exe' stop WiseBootAssistant
'%WINDIR%\syswow64\cmd.exe' /c sc delete WiseBootAssistant
'%WINDIR%\syswow64\sc.exe' delete WiseBootAssistant

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней