Trojan.DownLoader49.35835

Technical Information

Malicious functions

Patches code

in dll

szpurbo.exe process, MZP module
8928442b.exe process, MZP module

Modifies file system

Creates the following files

D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\8928442b.exe
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0100.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0101.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0102.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0103.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0104.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0105.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0106.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0107.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0108.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0109.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0110.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0111.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0112.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0113.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0114.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0115.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0116.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0117.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0118.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0119.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0120.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0121.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0122.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0123.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0124.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0125.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0126.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0127.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0128.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0129.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0130.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0131.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0132.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0133.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0134.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0135.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0136.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0137.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0138.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0139.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0140.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0141.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0142.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0143.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0144.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0145.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0146.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0147.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0148.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0149.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0150.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0151.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0152.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0153.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0154.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0155.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0156.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0157.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0158.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0159.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0160.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0161.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\0162.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1001.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1002.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1003.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1004.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1005.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1006.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\1007.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\11.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\12.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\2.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\3.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\4.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\5.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\b341.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\bcc.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\d2078.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\d5071.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\d515.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\d608.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\d701.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\d71608.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dgsz.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\disimu.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz021.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz022.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz023.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz030.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz031.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz032.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz034.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz035.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz036.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz053.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz054.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz055.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz073.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz074.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\dz075.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\ey1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\hdsc.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\m001.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\m100.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\m101.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\mlcd.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\mz.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\n0139.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\n0159.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\nd5071.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\newhy.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\q004.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\q004x.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\t118.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\t1343.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\t218.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\t219.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\t232.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\t315.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\t339.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\tdt1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\tdt2.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\thgd.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\x3.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt01.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt02.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt03.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt04.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt05.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt06.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt07.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt08.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt09.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt10.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt11.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt12.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt13.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt14.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt15.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt16.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt17.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt18.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt19-1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt19-2.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt19-3.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt19-4.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt19.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt20.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt21.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt22-1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt22.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt23.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt24.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt25.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt26.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt27.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt28.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt29.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt30.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt31.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt32.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt33.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt34.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt35.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt36.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt37.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xdt38.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xtc.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\xzmw.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\ywgm.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\01\map\zlxyzz.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\二大陆.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\创意j.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\创意泡点1.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\卧龙.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\另类9.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\城堡.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\天之痕.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\恶魔之路1.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\矿区6.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\矿区7.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\矿区8.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\雪原村落.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\01\map\龙之谷.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\data\esp-b.dat
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0100.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0101.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0102.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0103.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0104.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0105.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0106.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0107.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0108.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0109.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0110.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0111.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0112.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0113.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0114.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0115.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0116.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0117.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0118.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0119.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0120.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0121.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0122.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0123.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0124.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0125.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0126.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0127.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0128.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0129.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0130.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0131.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0132.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0133.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0134.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0135.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0136.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0137.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0138.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0139.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0140.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0141.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0142.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0143.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0144.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0145.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0146.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0147.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0148.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0149.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0150.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0151.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0152.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0153.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0154.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0155.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0156.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0157.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0158.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0159.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0160.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0161.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\0162.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1001.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1002.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1003.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1004.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1005.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1006.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\1007.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\11.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\12.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\2.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\3.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\4.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\5.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\b341.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\bcc.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\d2078.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\d5071.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\d515.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\d608.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\d701.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\d71608.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dgsz.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\disimu.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz021.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz022.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz023.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz030.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz031.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz032.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz034.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz035.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz036.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz053.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz054.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz055.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz073.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz074.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\dz075.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\ey1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\hdsc.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\m001.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\m100.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\m101.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\mlcd.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\mz.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\n0139.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\n0159.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\nd5071.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\newhy.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\q004.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\q004x.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\t118.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\t1343.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\t218.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\t219.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\t232.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\t315.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\t339.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\tdt1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\tdt2.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\thgd.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\x3.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt01.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt02.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt03.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt04.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt05.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt06.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt07.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt08.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt09.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt10.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt11.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt12.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt13.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt14.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt15.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt16.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt17.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt18.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt19-1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt19-2.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt19-3.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt19-4.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt19.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt20.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt21.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt22-1.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt22.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt23.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt24.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt25.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt26.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt27.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt28.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt29.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt30.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt31.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt32.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt33.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt34.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt35.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt36.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt37.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xdt38.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xtc.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\xzmw.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\ywgm.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\map\zlxyzz.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\二大陆.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\创意j.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\创意泡点1.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\卧龙.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\另类9.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\城堡.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\天之痕.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\恶魔之路1.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\矿区6.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\矿区7.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\矿区8.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\雪原村落.map
D:\ÐÂ»ÐÂ«ÐÒÐÒÐÂ©ÐÂ±ÐÂ¦ÐÂ·ÐÂ®ÐÑÐÂ¶ÐÂ«\map\龙之谷.map
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\wav\sound.lst
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\libssl-3.dll
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\libcrypto-3.dll
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\d3dx81ab.dll
D:\В»Г«ГґВґГ©Г±Г¦Г·Г®ВўВ¶Г«\data\newopui.pak
%HOMEPATH%\desktop\В»Г«ГґВґГ©Г±Г¦Г·.lnk

Deletes itself.

Network activity

Connects to

'87###572.com':6565

TCP

HTTP GET requests

http://www.92####58.com:6565/%C2%BB%C3%AB%C3%94%C2%B4%C3%89%C3%B1%C3%86%C3%B7.txt

UDP

DNS ASK 87###572.com
DNS ASK 92###658.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial