Trojan.Hosts.46559

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\WiseBootAssistant] 'ImagePath' = '%ProgramFiles%\Wise\Wise Care 365\BootTime.exe'

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im WiseCare365.exe

Modifies file system

Creates the following files

%TEMP%\aut1.tmp
%ProgramFiles%\wise\wise care 365\languages\is-esiae.tmp
%ProgramFiles%\wise\wise care 365\languages\is-nnj6i.tmp
%ProgramFiles%\wise\wise care 365\languages\is-c4a5g.tmp
%ProgramFiles%\wise\wise care 365\languages\is-3q1rc.tmp
%ProgramFiles%\wise\wise care 365\languages\is-6ooh0.tmp
%ProgramFiles%\wise\wise care 365\languages\is-4a95f.tmp
%ProgramFiles%\wise\wise care 365\languages\is-vbl48.tmp
%ProgramFiles%\wise\wise care 365\languages\is-0sj6c.tmp
%ProgramFiles%\wise\wise care 365\tools\is-r731u.tmp
%ProgramFiles%\wise\wise care 365\tools\is-dr5a4.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-1esta.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-egogi.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-jh6h1.tmp
%ProgramFiles%\wise\wise care 365\languages\is-2kevh.tmp
%ProgramFiles%\wise\wise care 365\themes\is-fpi4i.tmp
%ProgramFiles%\wise\wise care 365\languages\is-8slrv.tmp
%ProgramFiles%\wise\wise care 365\languages\is-nguug.tmp
%ProgramFiles%\wise\wise care 365\languages\is-lbq2f.tmp
%ProgramFiles%\wise\wise care 365\languages\is-qioqi.tmp
%ProgramFiles%\wise\wise care 365\languages\is-o4vih.tmp
%ProgramFiles%\wise\wise care 365\languages\is-72b9j.tmp
%ProgramFiles%\wise\wise care 365\languages\is-m7vp3.tmp
%ProgramFiles%\wise\wise care 365\languages\is-j6fjs.tmp
%ProgramFiles%\wise\wise care 365\languages\is-3vls0.tmp
%ProgramFiles%\wise\wise care 365\languages\is-d4da7.tmp
%ProgramFiles%\wise\wise care 365\languages\is-lbgfs.tmp
%ProgramFiles%\wise\wise care 365\languages\is-2sffb.tmp
%ProgramFiles%\wise\wise care 365\languages\is-hmg0f.tmp
%ProgramFiles%\wise\wise care 365\languages\is-s4pd8.tmp
%ProgramFiles%\wise\wise care 365\languages\is-48i1f.tmp
%ProgramFiles%\wise\wise care 365\languages\is-i55bq.tmp
%ProgramFiles%\wise\wise care 365\languages\is-3i6pn.tmp
%ProgramFiles%\wise\wise care 365\languages\is-pv6bj.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-7f8kj.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-06e45.tmp
%APPDATA%\wise care 365\config_tray.ini
%ProgramFiles%\wise\wise care 365\tools\img\is-qlom0.tmp
%ProgramFiles%\wise\wise care 365\is-07bi4.tmp
%ProgramFiles%\wise\wise care 365\is-vqpic.tmp
%ProgramFiles%\wise\wise care 365\is-d3qqs.tmp
%ProgramFiles%\wise\wise care 365\is-i7h9k.tmp
%TEMP%\is-58497.tmp\is-hmq8h.tmp
%ProgramFiles%\wise\wise care 365\is-dhim2.tmp
%ProgramFiles%\wise\wise care 365\is-ebreh.tmp
%ALLUSERSPROFILE%\start menu\programs\wise care 365\wise care 365.lnk
%ProgramFiles%\wise\wise care 365\unins000.msg
%ProgramFiles%\wise\wise care 365\unins000.dat
%TEMP%\aut2.tmp
%ProgramFiles%\wise\wise care 365\languages\hebrew.ini
%APPDATA%\wise care 365\config.ini
%ALLUSERSPROFILE%\desktop\wise care 365.lnk
%TEMP%\is-58497.tmp\introduce.url
%ProgramFiles%\wise\wise care 365\is-37gp7.tmp
%ProgramFiles%\wise\wise care 365\is-oel5n.tmp
%ProgramFiles%\wise\wise care 365\is-quubr.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-fitv7.tmp
%ProgramFiles%\wise\wise care 365\is-eioo3.tmp
%ProgramFiles%\wise\wise care 365\is-bueck.tmp
%ProgramFiles%\wise\wise care 365\is-mnhck.tmp
%ProgramFiles%\wise\wise care 365\is-8fqar.tmp
%ProgramFiles%\wise\wise care 365\is-8lgp3.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-e21sg.tmp
%ProgramFiles%\wise\wise care 365\is-3epkl.tmp
%ProgramFiles%\wise\wise care 365\is-dne96.tmp
%ProgramFiles%\wise\wise care 365\is-n177u.tmp
%ProgramFiles%\wise\wise care 365\is-9s7hq.tmp
%ProgramFiles%\wise\wise care 365\is-le2kf.tmp
%ProgramFiles%\wise\wise care 365\is-gmho3.tmp
%ProgramFiles%\wise\wise care 365\is-2bbpb.tmp
%ProgramFiles%\wise\wise care 365\is-rp93m.tmp
%ProgramFiles%\wise\wise care 365\languages\is-sgudj.tmp
%ProgramFiles%\wise\wise care 365\tools\img\is-2q7cl.tmp
%ProgramFiles%\wise\wise care 365\languages\is-gtseb.tmp
%ProgramFiles%\wise\wise care 365\headers\is-ou30s.tmp
%ProgramFiles%\wise\wise care 365\headers\is-lapun.tmp
%ProgramFiles%\wise\wise care 365\headers\is-qp3kj.tmp
%ProgramFiles%\wise\wise care 365\headers\is-47vm4.tmp
%ProgramFiles%\wise\wise care 365\headers\is-uje30.tmp
%ProgramFiles%\wise\wise care 365\headers\is-kv8tn.tmp
%ProgramFiles%\wise\wise care 365\headers\is-akskf.tmp
%ProgramFiles%\wise\wise care 365\headers\is-3mbbq.tmp
%ProgramFiles%\wise\wise care 365\headers\is-ipl6h.tmp
%ProgramFiles%\wise\wise care 365\headers\is-b2jj7.tmp
%ProgramFiles%\wise\wise care 365\headers\is-ljhp2.tmp
%ProgramFiles%\wise\wise care 365\headers\is-src2i.tmp
%ProgramFiles%\wise\wise care 365\headers\is-hm8f8.tmp
%ProgramFiles%\wise\wise care 365\headers\is-n4r10.tmp
%ProgramFiles%\wise\wise care 365\headers\is-b4p2t.tmp
%ProgramFiles%\wise\wise care 365\headers\is-fol1t.tmp
%ProgramFiles%\wise\wise care 365\headers\is-snkef.tmp
%ProgramFiles%\wise\wise care 365\headers\is-q49og.tmp
%ProgramFiles%\wise\wise care 365\headers\is-jmi9i.tmp
%TEMP%\is-l6ilb.tmp\~bdrdsle.tmp
%ProgramFiles%\wise\wise care 365\is-s4oea.tmp
%ProgramFiles%\wise\wise care 365\headers\is-uclh1.tmp
%ProgramFiles%\wise\wise care 365\headers\is-e18ct.tmp
%ProgramFiles%\wise\wise care 365\headers\is-5vlvh.tmp
%ProgramFiles%\wise\wise care 365\headers\is-ose0t.tmp
%CommonProgramFiles%\~bdrdsle.ibo
%ProgramFiles%\wise\wise care 365\headers\is-rfisu.tmp
%ProgramFiles%\wise\wise care 365\headers\is-hstmm.tmp
%ProgramFiles%\wise\wise care 365\headers\is-hjs7k.tmp
%ProgramFiles%\wise\wise care 365\headers\is-jhvth.tmp
%ProgramFiles%\wise\wise care 365\headers\is-eahh9.tmp
%ProgramFiles%\wise\wise care 365\headers\is-itdjd.tmp
%ProgramFiles%\wise\wise care 365\headers\is-qrlq7.tmp
%ProgramFiles%\wise\wise care 365\headers\is-itijb.tmp
%ProgramFiles%\wise\wise care 365\headers\is-vgmku.tmp
%ProgramFiles%\wise\wise care 365\headers\is-kbk5q.tmp
%ProgramFiles%\wise\wise care 365\languages\is-5kb38.tmp
%ProgramFiles%\wise\wise care 365\headers\is-rlicp.tmp
%ProgramFiles%\wise\wise care 365\headers\is-e3o20.tmp
%ProgramFiles%\wise\wise care 365\headers\is-9de46.tmp
%ProgramFiles%\wise\wise care 365\languages\is-ib00e.tmp
%ProgramFiles%\wise\wise care 365\languages\is-9pj3r.tmp
%ProgramFiles%\wise\wise care 365\languages\is-96r45.tmp
%ProgramFiles%\wise\wise care 365\headers\is-nlb0t.tmp
%ProgramFiles%\wise\wise care 365\headers\is-bfeb7.tmp
%ProgramFiles%\wise\wise care 365\languages\is-4lli0.tmp
%ProgramFiles%\wise\wise care 365\languages\is-fg75l.tmp
%ProgramFiles%\wise\wise care 365\languages\is-lf4ce.tmp
%ProgramFiles%\wise\wise care 365\languages\is-8q4nj.tmp
%ProgramFiles%\wise\wise care 365\languages\is-0kltl.tmp
%ProgramFiles%\wise\wise care 365\languages\is-d1137.tmp
%ProgramFiles%\wise\wise care 365\languages\is-8itkd.tmp
%ProgramFiles%\wise\wise care 365\languages\is-ma1io.tmp
%ProgramFiles%\wise\wise care 365\headers\is-kkin9.tmp
%ProgramFiles%\wise\wise care 365\headers\is-hd3md.tmp
%ProgramFiles%\wise\wise care 365\headers\is-3up73.tmp
%ProgramFiles%\wise\wise care 365\headers\is-6sddj.tmp
%ProgramFiles%\wise\wise care 365\headers\is-odtkb.tmp
%ProgramFiles%\wise\wise care 365\headers\is-s5d0b.tmp
%ProgramFiles%\wise\wise care 365\headers\is-ncpfl.tmp
%ProgramFiles%\wise\wise care 365\headers\is-h6tsd.tmp
%ProgramFiles%\wise\wise care 365\headers\is-krpth.tmp
%ProgramFiles%\wise\wise care 365\headers\is-hsrms.tmp
%ProgramFiles%\wise\wise care 365\headers\is-f8c9d.tmp
%ProgramFiles%\wise\wise care 365\headers\is-lc855.tmp
%ProgramFiles%\wise\wise care 365\headers\is-4e3o7.tmp
%ProgramFiles%\wise\wise care 365\headers\is-o9dpo.tmp
%ProgramFiles%\wise\wise care 365\headers\is-cm8cl.tmp
%ProgramFiles%\wise\wise care 365\headers\is-fuv3h.tmp
%ProgramFiles%\wise\wise care 365\headers\is-0lhf3.tmp
%ProgramFiles%\wise\wise care 365\headers\is-caf40.tmp
%ProgramFiles%\wise\wise care 365\languages\is-0cvon.tmp
%ProgramFiles%\wise\wise care 365\wisecare365.exe

Sets the 'hidden' attribute to the following files

%CommonProgramFiles%\~bdrdsle.ibo

Deletes the following files

%TEMP%\aut1.tmp
%TEMP%\is-58497.tmp\cstask.exe
%TEMP%\is-58497.tmp\introduce.url
%TEMP%\is-l6ilb.tmp\~bdrdsle.tmp
%TEMP%\aut2.tmp
%CommonProgramFiles%\~bdrdsle.ibo

Moves the following files

from %ProgramFiles%\wise\wise care 365\is-s4oea.tmp to %ProgramFiles%\wise\wise care 365\unins000.exe
from %ProgramFiles%\wise\wise care 365\languages\is-0sj6c.tmp to %ProgramFiles%\wise\wise care 365\languages\ukrainian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-6ooh0.tmp to %ProgramFiles%\wise\wise care 365\languages\turkish.ini
from %ProgramFiles%\wise\wise care 365\languages\is-3q1rc.tmp to %ProgramFiles%\wise\wise care 365\languages\thai.ini
from %ProgramFiles%\wise\wise care 365\languages\is-c4a5g.tmp to %ProgramFiles%\wise\wise care 365\languages\swedish(sweden).ini
from %ProgramFiles%\wise\wise care 365\languages\is-nnj6i.tmp to %ProgramFiles%\wise\wise care 365\languages\spanish(spain).ini
from %ProgramFiles%\wise\wise care 365\languages\is-esiae.tmp to %ProgramFiles%\wise\wise care 365\languages\slovenian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-vbl48.tmp to %ProgramFiles%\wise\wise care 365\languages\slovak.ini
from %ProgramFiles%\wise\wise care 365\languages\is-4a95f.tmp to %ProgramFiles%\wise\wise care 365\languages\serbian(cyrillic).ini
from %ProgramFiles%\wise\wise care 365\languages\is-8slrv.tmp to %ProgramFiles%\wise\wise care 365\languages\russian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-nguug.tmp to %ProgramFiles%\wise\wise care 365\languages\romanian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-lbq2f.tmp to %ProgramFiles%\wise\wise care 365\languages\portuguese(portugal).ini
from %ProgramFiles%\wise\wise care 365\languages\is-3i6pn.tmp to %ProgramFiles%\wise\wise care 365\languages\portuguese(brazil).ini
from %ProgramFiles%\wise\wise care 365\languages\is-i55bq.tmp to %ProgramFiles%\wise\wise care 365\languages\polish.ini
from %ProgramFiles%\wise\wise care 365\languages\is-48i1f.tmp to %ProgramFiles%\wise\wise care 365\languages\persian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-hmg0f.tmp to %ProgramFiles%\wise\wise care 365\languages\norwegian(bokmal).ini
from %ProgramFiles%\wise\wise care 365\themes\is-fpi4i.tmp to %ProgramFiles%\wise\wise care 365\themes\default.wskn
from %ProgramFiles%\wise\wise care 365\languages\is-2sffb.tmp to %ProgramFiles%\wise\wise care 365\languages\nepali.ini
from %ProgramFiles%\wise\wise care 365\languages\is-pv6bj.tmp to %ProgramFiles%\wise\wise care 365\languages\kurdish.ini
from %ProgramFiles%\wise\wise care 365\languages\is-lbgfs.tmp to %ProgramFiles%\wise\wise care 365\languages\korean.ini
from %ProgramFiles%\wise\wise care 365\languages\is-3vls0.tmp to %ProgramFiles%\wise\wise care 365\languages\japanese.ini
from %ProgramFiles%\wise\wise care 365\languages\is-j6fjs.tmp to %ProgramFiles%\wise\wise care 365\languages\italian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-m7vp3.tmp to %ProgramFiles%\wise\wise care 365\languages\indonesian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-72b9j.tmp to %ProgramFiles%\wise\wise care 365\languages\hungarian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-o4vih.tmp to %ProgramFiles%\wise\wise care 365\languages\greek.ini
from %ProgramFiles%\wise\wise care 365\languages\is-qioqi.tmp to %ProgramFiles%\wise\wise care 365\languages\german.ini
from %ProgramFiles%\wise\wise care 365\languages\is-d4da7.tmp to %ProgramFiles%\wise\wise care 365\languages\georgian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-sgudj.tmp to %ProgramFiles%\wise\wise care 365\languages\french.ini
from %ProgramFiles%\wise\wise care 365\languages\is-gtseb.tmp to %ProgramFiles%\wise\wise care 365\languages\finnish.ini
from %ProgramFiles%\wise\wise care 365\languages\is-0cvon.tmp to %ProgramFiles%\wise\wise care 365\languages\english.ini
from %ProgramFiles%\wise\wise care 365\languages\is-s4pd8.tmp to %ProgramFiles%\wise\wise care 365\languages\norwegian(nynorsk).ini
from %ProgramFiles%\wise\wise care 365\headers\is-0lhf3.tmp to %ProgramFiles%\wise\wise care 365\headers\j.png
from %ProgramFiles%\wise\wise care 365\tools\is-r731u.tmp to %ProgramFiles%\wise\wise care 365\tools\toolsv5.ini
from %ProgramFiles%\wise\wise care 365\is-d3qqs.tmp to %ProgramFiles%\wise\wise care 365\geo.db
from %ProgramFiles%\wise\wise care 365\is-vqpic.tmp to %ProgramFiles%\wise\wise care 365\wiseturbo.exe
from %ProgramFiles%\wise\wise care 365\is-07bi4.tmp to %ProgramFiles%\wise\wise care 365\wisetray.exe
from %ProgramFiles%\wise\wise care 365\is-ebreh.tmp to %ProgramFiles%\wise\wise care 365\wjslib.dll
from %ProgramFiles%\wise\wise care 365\is-dhim2.tmp to %ProgramFiles%\wise\wise care 365\ssleay32.dll
from %ProgramFiles%\wise\wise care 365\is-37gp7.tmp to %ProgramFiles%\wise\wise care 365\libeay32.dll
from %ProgramFiles%\wise\wise care 365\is-oel5n.tmp to %ProgramFiles%\wise\wise care 365\dmanager.dll
from %ProgramFiles%\wise\wise care 365\is-quubr.tmp to %ProgramFiles%\wise\wise care 365\wiseeraser.dll
from %ProgramFiles%\wise\wise care 365\is-2bbpb.tmp to %ProgramFiles%\wise\wise care 365\wisedefrag.dll
from %ProgramFiles%\wise\wise care 365\is-gmho3.tmp to %ProgramFiles%\wise\wise care 365\wisecare365.exe
from %ProgramFiles%\wise\wise care 365\is-le2kf.tmp to %ProgramFiles%\wise\wise care 365\wisebootbooster.exe
from %ProgramFiles%\wise\wise care 365\is-9s7hq.tmp to %ProgramFiles%\wise\wise care 365\uninstalltp.exe
from %ProgramFiles%\wise\wise care 365\is-n177u.tmp to %ProgramFiles%\wise\wise care 365\sqlite3.dll
from %ProgramFiles%\wise\wise care 365\is-dne96.tmp to %ProgramFiles%\wise\wise care 365\skin.ico
from %ProgramFiles%\wise\wise care 365\languages\is-5kb38.tmp to %ProgramFiles%\wise\wise care 365\languages\dutch(nederlands).ini
from %ProgramFiles%\wise\wise care 365\languages\is-2kevh.tmp to %ProgramFiles%\wise\wise care 365\languages\vietnamese.ini
from %ProgramFiles%\wise\wise care 365\is-8lgp3.tmp to %ProgramFiles%\wise\wise care 365\license.txt
from %ProgramFiles%\wise\wise care 365\is-8fqar.tmp to %ProgramFiles%\wise\wise care 365\fileshredder.ico
from %ProgramFiles%\wise\wise care 365\is-mnhck.tmp to %ProgramFiles%\wise\wise care 365\defragoptions.ini
from %ProgramFiles%\wise\wise care 365\is-bueck.tmp to %ProgramFiles%\wise\wise care 365\boottime.exe
from %ProgramFiles%\wise\wise care 365\is-eioo3.tmp to %ProgramFiles%\wise\wise care 365\bootpack.wpk
from %ProgramFiles%\wise\wise care 365\tools\img\is-fitv7.tmp to %ProgramFiles%\wise\wise care 365\tools\img\reminder.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-e21sg.tmp to %ProgramFiles%\wise\wise care 365\tools\img\programuninstaller.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-qlom0.tmp to %ProgramFiles%\wise\wise care 365\tools\img\memoryoptimizer.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-06e45.tmp to %ProgramFiles%\wise\wise care 365\tools\img\jetsearch.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-2q7cl.tmp to %ProgramFiles%\wise\wise care 365\tools\img\gamebooster.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-7f8kj.tmp to %ProgramFiles%\wise\wise care 365\tools\img\forcedeleter.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-jh6h1.tmp to %ProgramFiles%\wise\wise care 365\tools\img\duplicatefinder.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-egogi.tmp to %ProgramFiles%\wise\wise care 365\tools\img\daterecovery.png
from %ProgramFiles%\wise\wise care 365\tools\img\is-1esta.tmp to %ProgramFiles%\wise\wise care 365\tools\img\autoshutdown.png
from %ProgramFiles%\wise\wise care 365\is-3epkl.tmp to %ProgramFiles%\wise\wise care 365\autoupdate.exe
from %ProgramFiles%\wise\wise care 365\tools\is-dr5a4.tmp to %ProgramFiles%\wise\wise care 365\tools\toolsv5.zip
from %ProgramFiles%\wise\wise care 365\languages\is-d1137.tmp to %ProgramFiles%\wise\wise care 365\languages\dutch(belgium).ini
from %ProgramFiles%\wise\wise care 365\languages\is-0kltl.tmp to %ProgramFiles%\wise\wise care 365\languages\danish.ini
from %ProgramFiles%\wise\wise care 365\languages\is-8q4nj.tmp to %ProgramFiles%\wise\wise care 365\languages\czech.ini
from %ProgramFiles%\wise\wise care 365\headers\is-snkef.tmp to %ProgramFiles%\wise\wise care 365\headers\e8.png
from %ProgramFiles%\wise\wise care 365\headers\is-hm8f8.tmp to %ProgramFiles%\wise\wise care 365\headers\g5.png
from %ProgramFiles%\wise\wise care 365\headers\is-src2i.tmp to %ProgramFiles%\wise\wise care 365\headers\g4.png
from %ProgramFiles%\wise\wise care 365\headers\is-ljhp2.tmp to %ProgramFiles%\wise\wise care 365\headers\g3.png
from %ProgramFiles%\wise\wise care 365\headers\is-b2jj7.tmp to %ProgramFiles%\wise\wise care 365\headers\g2.png
from %ProgramFiles%\wise\wise care 365\headers\is-fol1t.tmp to %ProgramFiles%\wise\wise care 365\headers\g1.png
from %ProgramFiles%\wise\wise care 365\headers\is-b4p2t.tmp to %ProgramFiles%\wise\wise care 365\headers\f7.png
from %ProgramFiles%\wise\wise care 365\headers\is-ipl6h.tmp to %ProgramFiles%\wise\wise care 365\headers\f6.png
from %ProgramFiles%\wise\wise care 365\headers\is-kv8tn.tmp to %ProgramFiles%\wise\wise care 365\headers\f5.png
from %ProgramFiles%\wise\wise care 365\headers\is-uje30.tmp to %ProgramFiles%\wise\wise care 365\headers\f4.png
from %ProgramFiles%\wise\wise care 365\headers\is-47vm4.tmp to %ProgramFiles%\wise\wise care 365\headers\f3.png
from %ProgramFiles%\wise\wise care 365\headers\is-qp3kj.tmp to %ProgramFiles%\wise\wise care 365\headers\f2.png
from %ProgramFiles%\wise\wise care 365\headers\is-lapun.tmp to %ProgramFiles%\wise\wise care 365\headers\f1.png
from %ProgramFiles%\wise\wise care 365\headers\is-3mbbq.tmp to %ProgramFiles%\wise\wise care 365\headers\f0.png
from %ProgramFiles%\wise\wise care 365\is-i7h9k.tmp to %ProgramFiles%\wise\wise care 365\bootlauncher.exe
from %ProgramFiles%\wise\wise care 365\headers\is-vgmku.tmp to %ProgramFiles%\wise\wise care 365\headers\g7.png
from %ProgramFiles%\wise\wise care 365\headers\is-q49og.tmp to %ProgramFiles%\wise\wise care 365\headers\e7.png
from %ProgramFiles%\wise\wise care 365\headers\is-jmi9i.tmp to %ProgramFiles%\wise\wise care 365\headers\d7.png
from %ProgramFiles%\wise\wise care 365\headers\is-qrlq7.tmp to %ProgramFiles%\wise\wise care 365\headers\d4.png
from %ProgramFiles%\wise\wise care 365\headers\is-itdjd.tmp to %ProgramFiles%\wise\wise care 365\headers\d3.png
from %ProgramFiles%\wise\wise care 365\headers\is-eahh9.tmp to %ProgramFiles%\wise\wise care 365\headers\d2.png
from %ProgramFiles%\wise\wise care 365\headers\is-jhvth.tmp to %ProgramFiles%\wise\wise care 365\headers\d1.png
from %ProgramFiles%\wise\wise care 365\headers\is-hjs7k.tmp to %ProgramFiles%\wise\wise care 365\headers\c7.png
from %ProgramFiles%\wise\wise care 365\headers\is-hstmm.tmp to %ProgramFiles%\wise\wise care 365\headers\c4.png
from %ProgramFiles%\wise\wise care 365\headers\is-itijb.tmp to %ProgramFiles%\wise\wise care 365\headers\b5.png
from %ProgramFiles%\wise\wise care 365\headers\is-rfisu.tmp to %ProgramFiles%\wise\wise care 365\headers\a9.png
from %ProgramFiles%\wise\wise care 365\headers\is-ose0t.tmp to %ProgramFiles%\wise\wise care 365\headers\a7.png
from %ProgramFiles%\wise\wise care 365\headers\is-5vlvh.tmp to %ProgramFiles%\wise\wise care 365\headers\a6.png
from %ProgramFiles%\wise\wise care 365\headers\is-e18ct.tmp to %ProgramFiles%\wise\wise care 365\headers\a2.png
from %ProgramFiles%\wise\wise care 365\headers\is-uclh1.tmp to %ProgramFiles%\wise\wise care 365\headers\a1.png
from %ProgramFiles%\wise\wise care 365\headers\is-akskf.tmp to %ProgramFiles%\wise\wise care 365\headers\e9.png
from %ProgramFiles%\wise\wise care 365\is-rp93m.tmp to %ProgramFiles%\wise\wise care 365\rate.info
from %ProgramFiles%\wise\wise care 365\headers\is-ou30s.tmp to %ProgramFiles%\wise\wise care 365\headers\g8.png
from %ProgramFiles%\wise\wise care 365\headers\is-hsrms.tmp to %ProgramFiles%\wise\wise care 365\headers\h3.png
from %ProgramFiles%\wise\wise care 365\headers\is-kbk5q.tmp to %ProgramFiles%\wise\wise care 365\headers\h1.png
from %ProgramFiles%\wise\wise care 365\languages\is-lf4ce.tmp to %ProgramFiles%\wise\wise care 365\languages\chinese(traditional).ini
from %ProgramFiles%\wise\wise care 365\languages\is-fg75l.tmp to %ProgramFiles%\wise\wise care 365\languages\chinese(simplified).ini
from %ProgramFiles%\wise\wise care 365\languages\is-ma1io.tmp to %ProgramFiles%\wise\wise care 365\languages\catalan.ini
from %ProgramFiles%\wise\wise care 365\languages\is-8itkd.tmp to %ProgramFiles%\wise\wise care 365\languages\bulgarian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-4lli0.tmp to %ProgramFiles%\wise\wise care 365\languages\belarusian.ini
from %ProgramFiles%\wise\wise care 365\languages\is-96r45.tmp to %ProgramFiles%\wise\wise care 365\languages\azerbaijani(latin).ini
from %ProgramFiles%\wise\wise care 365\languages\is-9pj3r.tmp to %ProgramFiles%\wise\wise care 365\languages\azerbaijan(latin).ini
from %ProgramFiles%\wise\wise care 365\languages\is-ib00e.tmp to %ProgramFiles%\wise\wise care 365\languages\arabic.ini
from %ProgramFiles%\wise\wise care 365\headers\is-9de46.tmp to %ProgramFiles%\wise\wise care 365\headers\j8.png
from %ProgramFiles%\wise\wise care 365\headers\is-e3o20.tmp to %ProgramFiles%\wise\wise care 365\headers\j7.png
from %ProgramFiles%\wise\wise care 365\headers\is-bfeb7.tmp to %ProgramFiles%\wise\wise care 365\headers\j6.png
from %ProgramFiles%\wise\wise care 365\headers\is-nlb0t.tmp to %ProgramFiles%\wise\wise care 365\headers\j4.png
from %ProgramFiles%\wise\wise care 365\headers\is-kkin9.tmp to %ProgramFiles%\wise\wise care 365\headers\j3.png
from %ProgramFiles%\wise\wise care 365\headers\is-rlicp.tmp to %ProgramFiles%\wise\wise care 365\headers\h2.png
from %ProgramFiles%\wise\wise care 365\headers\is-hd3md.tmp to %ProgramFiles%\wise\wise care 365\headers\j1.png
from %ProgramFiles%\wise\wise care 365\headers\is-n4r10.tmp to %ProgramFiles%\wise\wise care 365\headers\g6.png
from %ProgramFiles%\wise\wise care 365\headers\is-fuv3h.tmp to %ProgramFiles%\wise\wise care 365\headers\i8.png
from %ProgramFiles%\wise\wise care 365\headers\is-cm8cl.tmp to %ProgramFiles%\wise\wise care 365\headers\i7.png
from %ProgramFiles%\wise\wise care 365\headers\is-o9dpo.tmp to %ProgramFiles%\wise\wise care 365\headers\i6.png
from %ProgramFiles%\wise\wise care 365\headers\is-4e3o7.tmp to %ProgramFiles%\wise\wise care 365\headers\i5.png
from %ProgramFiles%\wise\wise care 365\headers\is-lc855.tmp to %ProgramFiles%\wise\wise care 365\headers\i4.png
from %ProgramFiles%\wise\wise care 365\headers\is-caf40.tmp to %ProgramFiles%\wise\wise care 365\headers\i3.png
from %ProgramFiles%\wise\wise care 365\headers\is-f8c9d.tmp to %ProgramFiles%\wise\wise care 365\headers\i2.png
from %ProgramFiles%\wise\wise care 365\headers\is-krpth.tmp to %ProgramFiles%\wise\wise care 365\headers\i1.png
from %ProgramFiles%\wise\wise care 365\headers\is-h6tsd.tmp to %ProgramFiles%\wise\wise care 365\headers\h8.png
from %ProgramFiles%\wise\wise care 365\headers\is-ncpfl.tmp to %ProgramFiles%\wise\wise care 365\headers\h7.png
from %ProgramFiles%\wise\wise care 365\headers\is-s5d0b.tmp to %ProgramFiles%\wise\wise care 365\headers\h6.png
from %ProgramFiles%\wise\wise care 365\headers\is-odtkb.tmp to %ProgramFiles%\wise\wise care 365\headers\h5.png
from %ProgramFiles%\wise\wise care 365\headers\is-6sddj.tmp to %ProgramFiles%\wise\wise care 365\headers\h4.png
from %ProgramFiles%\wise\wise care 365\headers\is-3up73.tmp to %ProgramFiles%\wise\wise care 365\headers\j0.png
from %TEMP%\is-58497.tmp\is-hmq8h.tmp to %TEMP%\is-58497.tmp\cstask.exe

Modifies the HOSTS file.

Miscellaneous

Searches for the following windows

ClassName: 'TFrmTrayMain' WindowName: ''
ClassName: 'TFrmWPMain' WindowName: ''
ClassName: 'TFrmMOMain' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%CommonProgramFiles%\~bdrdsle.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-l6ilb.tmp\~bdrdsle.tmp' /SL5="$200142,9626247,131584,%CommonProgramFiles%\~bdrdsle.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'<SYSTEM32>\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f' (with hidden window)
'<SYSTEM32>\taskkill.exe' /f /im WiseCare365.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc stop WiseBootAssistant' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc delete WiseBootAssistant' (with hidden window)

Executes the following

'<SYSTEM32>\schtasks.exe' /delete /tn \WiseCleaner\W365SkipUAC /f
'<SYSTEM32>\cmd.exe' /c sc stop WiseBootAssistant
'<SYSTEM32>\sc.exe' stop WiseBootAssistant
'<SYSTEM32>\cmd.exe' /c sc delete WiseBootAssistant
'<SYSTEM32>\sc.exe' delete WiseBootAssistant

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней