Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-0R3EA.tmp\1.tmp' /SL5="$3001E,803047,186880,<SYSTEM32>\1.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '<SYSTEM32>\1.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- '<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-8KTO8.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-OPQFK.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-V1IH4.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-BMSU1.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-4C8P1.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-ITVKL.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-I7RUS.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-GDJIQ.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-C2C12.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-1M0LP.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-U7DQ3.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-2N3JP.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-KAB9P.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-AJA39.tmp
- C:\Users\Public\Desktop\Wise Auto Shutdown.lnk
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Auto Shutdown\Wise Auto Shutdown.lnk
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-QJ2J2.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\unins000.dat
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\unins000.msg
- %TEMP%\is-EQBK5.tmp\introduce.url
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-8I09I.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-CR77O.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-TR235.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-0PTQT.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-FGKLA.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-H59CA.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-C3O6V.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-C38JO.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\is-4IJPS.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\is-2VH0U.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-6AF1E.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-UTL52.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-7HR7E.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\is-ISRUD.tmp
- %TEMP%\autB49F.tmp
- %TEMP%\bejlezn
- %TEMP%\autB450.tmp
- %TEMP%\is-EQBK5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-0R3EA.tmp\1.tmp
- <SYSTEM32>\1.exe
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-CJHOI.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-3COKR.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-OSG9J.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-65M0P.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-QVJ55.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-I34TM.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-GS39E.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-0OPJF.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-NII3C.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-09AB8.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-GVDQF.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-AGB48.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-V8118.tmp
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-33UHA.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\1.exe
Удаляет следующие файлы:
- %TEMP%\is-EQBK5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-0R3EA.tmp\1.tmp
- <SYSTEM32>\1.exe
- %TEMP%\is-EQBK5.tmp\introduce.url
- %TEMP%\autB450.tmp
- %TEMP%\bejlezn
- %TEMP%\autB49F.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-V1IH4.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Persian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-I7RUS.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Kurdish.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-OPQFK.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Polish.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-ITVKL.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Portuguese(Portugal).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-8KTO8.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Portuguese (Brazil).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-GDJIQ.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Italian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-C2C12.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Hungarian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-KAB9P.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Japanese.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-U7DQ3.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Kurdish(Kurmanci).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-2N3JP.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Korean.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-4C8P1.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Romanian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-H59CA.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Thai.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-C3O6V.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Swedish(Sweden).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-FGKLA.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Turkish.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-QJ2J2.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Vietnamese.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-8I09I.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Ukrainian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-AJA39.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Serbian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-BMSU1.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Russian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-0PTQT.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Slovak.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-CR77O.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Spanish(Spain).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-TR235.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Slovenian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-1M0LP.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Greek.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-6AF1E.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Belarusian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-UTL52.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Azeri.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-CJHOI.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Bengali(India).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-09AB8.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Chinese(Simplified).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-GVDQF.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Bulgarian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\is-2VH0U.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\WiseAutoShutdown.exe
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\is-ISRUD.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\unins000.exe
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\is-4IJPS.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\License.txt
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-7HR7E.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Arabic.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-C38JO.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Albanian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-NII3C.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Chinese(Traditional).ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-3COKR.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Finnish.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-OSG9J.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Estonian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-GS39E.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\French.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-QVJ55.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\German.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-I34TM.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Georgian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-V8118.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Czech.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-33UHA.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Croatian.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-AGB48.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Danish.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-65M0P.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\English.ini
- %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\is-0OPJF.tmp в %PROGRAM_FILES%\Wise\Wise Auto Shutdown\Languages\Dutch (Nederlands).ini
Сетевая активность:
UDP:
- DNS ASK www.google.com
Другое:
Ищет следующие окна:
- ClassName: 'TWiseInstaller' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
