Trojan.DownLoader47.52015

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-7pk18.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-4njfv.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-gimmt.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-vq7gh.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-82hk4.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-g7bn3.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-2t0uh.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-rb1ls.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-9m0pp.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-mvuqd.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-5v2rp.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-4iefh.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-7fl6n.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-go6f7.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-a7piv.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-i3i4o.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\platforms\is-52195.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\mediaservice\is-dmnum.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-u21c8.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-pvtgq.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-nke64.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vejjc.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-95vbf.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-s1ec9.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-m73tf.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-n1r4n.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-0cd3j.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-8dhok.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-hqg13.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-r83a1.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-cml0f.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-p057q.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-coehh.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-n2nr9.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-f1j2b.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-b9bjc.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-ccpu1.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-t6ms7.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-6jr5a.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-so4bi.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-sht9s.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-kpppj.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-f4e3p.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-8c44l.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-denju.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vm82u.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vi8rj.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-chk9m.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-usal3.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-aocik.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-d1ou0.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-3nqtg.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-elqss.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-8blc0.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-p0b58.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-nbl1v.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-2n9nv.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-84ovj.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-8pskv.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vfpba.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-qe6tk.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-1hvbo.tmp
%TEMP%\is-rtq6d.tmp\_isetup\_iscrypt.dll
%TEMP%\is-rtq6d.tmp\_isetup\_shfoldr.dll
%TEMP%\is-rtq6d.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ocop9.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-shjtd.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-tkcpt.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-3fvm9.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-0bjmp.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-din7q.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-u7sq9.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-7m9ud.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-k2ts3.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-o4cls.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-0smjg.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-f9lqf.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ve1j3.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ee0sm.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-ds0l4.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\unins000.dat
%LOCALAPPDATA%\qvidal broadcast 1.33\is-e872s.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-7l5oe.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ln43j.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-m9nl9.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-itnhl.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-q78ad.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-qven0.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-mg26i.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ak49n.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\is-mmhnr.tmp
%LOCALAPPDATA%\qvidal broadcast 1.33\qvidalbroadcast32_64.exe

Перемещает следующие файлы

%LOCALAPPDATA%\qvidal broadcast 1.33\is-1hvbo.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\unins000.exe
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-vq7gh.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_fi.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-82hk4.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_et.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-g7bn3.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_es.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-2t0uh.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_en.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-rb1ls.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_el.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-9m0pp.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_de.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-mvuqd.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_da.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-5v2rp.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_cs.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-7fl6n.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_bg.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-4njfv.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_fr.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-go6f7.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_be.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-a7piv.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_ar.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-i3i4o.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_af.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\platforms\is-52195.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\platforms\qwindows.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\mediaservice\is-dmnum.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\mediaservice\dsengine.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-u21c8.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\vcruntime140.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-pvtgq.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\vccorlib140.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-4iefh.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_bs.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ee0sm.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\libcrypto-1_1.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-95vbf.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_ga.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-0cd3j.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_pl.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-8dhok.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_nl.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-hqg13.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_nb_no.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-r83a1.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_my.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-cml0f.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_mt.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-p057q.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_ms.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-coehh.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_mn.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-ds0l4.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_lv.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vejjc.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\swscale-6.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-gimmt.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_fil.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-ccpu1.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_kk.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-t6ms7.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_ka.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-6jr5a.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_ja.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-so4bi.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_it.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-sht9s.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_is.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-kpppj.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_id.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-f4e3p.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_hy.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-8c44l.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_hu.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-b9bjc.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_ko.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-s1ec9.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_hr.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\is-nke64.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\swresample-4.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-denju.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\qt5winextras.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vm82u.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\qt5svg.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-elqss.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-shjtd.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ocop9.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-tkcpt.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-chk9m.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-usal3.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-aocik.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-d1ou0.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-xstate-l2-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-n1r4n.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_pt.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\is-din7q.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-8blc0.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-p0b58.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-nbl1v.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-2n9nv.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-84ovj.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-8pskv.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vfpba.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-qe6tk.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-3nqtg.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\translations\is-n2nr9.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\translations\slideshowmaker_lt.qm
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ak49n.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-q78ad.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-mg26i.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-vi8rj.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\qt5networkauth.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-0bjmp.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\qt5network.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-u7sq9.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\qt5multimedia.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-7m9ud.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\openh264.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-k2ts3.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\msvcr120.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-o4cls.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\msvcp140_1.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-0smjg.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\msvcp140.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-qven0.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-f9lqf.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\libssl-1_1.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-3fvm9.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-mmhnr.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\dbghelp.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-f1j2b.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\crashrpt1403.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-e872s.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\concrt140.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-7l5oe.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\avdevice-59.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ln43j.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-m9nl9.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-itnhl.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-ve1j3.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\libcurl.dll
%LOCALAPPDATA%\qvidal broadcast 1.33\is-m73tf.tmp в %LOCALAPPDATA%\qvidal broadcast 1.33\qvidalbroadcast32_64.exe

Сетевая активность

Подключается к

'st###7345724.ru':80

TCP

Запросы HTTP POST

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Другое

Ищет следующие окна

ClassName: 'f%x_MovitonWnd_10313ca7645' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-7pk18.tmp\<Имя файла>.tmp' /SL5="$130184,8392760,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\qvidal broadcast 1.33\qvidalbroadcast32_64.exe' 2386d3523124ef516f787f26df500558

Запускает на исполнение

'%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "qvidal_broadcast_10313"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней