Technical Information
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'ZaxarLoader' = '"%ProgramFiles(x86)%\Zaxar\ZaxarLoader.exe" /verysilent'
- '%WINDIR%\syswow64\taskkill.exe' /f /im "ZaxarLoader.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "ZaxarGameBrowser.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "gamesdepartupdate.exe"
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %ProgramFiles(x86)%\zaxar\chm\libegl.dlltmp
- %ProgramFiles(x86)%\zaxar\chm\cef_200_percent.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\nl.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\zh-tw.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\ro.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\ar.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\hr.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\he.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\fil.paktmp
- %ProgramFiles(x86)%\zaxar\chm\devtools_resources.paktmp
- %ProgramFiles(x86)%\zaxar\chm\libjsons.dlltmp
- %ProgramFiles(x86)%\zaxar\chm\locales\bg.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\hu.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\th.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\vi.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\sk.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\fa.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\tr.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\da.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\gu.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\pl.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\id.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\ml.paktmp
- %ProgramFiles(x86)%\zaxar\chm\cef_100_percent.paktmp
- %ProgramFiles(x86)%\zaxar\chm\cef_extensions.paktmp
- %ProgramFiles(x86)%\zaxar\calling.wavtmp
- %TEMP%\zaxarsetup.4.001.1827.exe
- %TEMP%\nsab60f.tmp\nsexec.dll
- %TEMP%\nsab60f.tmp\accesscontrol.dll
- %ProgramFiles(x86)%\zaxar\zaxarloader.exe
- %ProgramFiles(x86)%\zaxar\cancelbutton.bmp
- %ProgramFiles(x86)%\zaxar\uninstall.exe
- %TEMP%\nsab60f.tmp\uac.dll
- %PROGRAMDATA%\microsoft\windows\start menu\programs\zaxargamebrowser\zaxargamebrowser.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\zaxargamebrowser\zaxarupdate.lnk
- %TEMP%\gamesdepart.000.1827.0.exe
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\is-cas31.tmp\gamesdepart.000.1827.0.tmp
- %TEMP%\is-v7dsm.tmp\idp.dll
- %TEMP%\is-34is5.tmp\gamesdepart.000.1827.0.tmp
- %TEMP%\is-oskqh.tmp\_isetup\_setup64.tmp
- %TEMP%\is-oskqh.tmp\idp.dll
- %TEMP%\is-oskqh.tmp\gamesdepart.zip
- %ProgramFiles(x86)%\zaxar\civ
- %ProgramFiles(x86)%\zaxar\chm\zaxarsteam.exetmp
- %ProgramFiles(x86)%\zaxar\zaxargamebrowser.exetmp
- %ProgramFiles(x86)%\zaxar\cef_extensions.paktmp
- %ProgramFiles(x86)%\zaxar\gameslist.dattmp
- %TEMP%\is-v7dsm.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\zaxar\chm\locales\sr.paktmp
- %ProgramFiles(x86)%\zaxar\chm\locales\lv.paktmp
- %TEMP%\nsab60f.tmp\accesscontrol.dll
- %TEMP%\nsab60f.tmp\nsexec.dll
- %TEMP%\nsab60f.tmp\uac.dll
- %TEMP%\is-v7dsm.tmp\idp.dll
- %TEMP%\is-v7dsm.tmp\_isetup\_setup64.tmp
- %TEMP%\is-cas31.tmp\gamesdepart.000.1827.0.tmp
- from %ProgramFiles(x86)%\zaxar\chm\zaxarsteam.exetmp to %ProgramFiles(x86)%\zaxar\chm\zaxarsteam.exe
- from %ProgramFiles(x86)%\zaxar\chm\locales\pl.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\pl.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\gu.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\gu.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\da.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\da.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\tr.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\tr.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\fa.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\fa.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\sk.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\sk.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\vi.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\vi.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\th.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\th.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\hu.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\hu.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\ml.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\ml.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\id.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\id.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\bg.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\bg.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\fil.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\fil.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\he.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\he.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\hr.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\hr.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\ar.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\ar.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\ro.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\ro.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\zh-tw.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\zh-tw.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\nl.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\nl.pak
- from %ProgramFiles(x86)%\zaxar\chm\cef_200_percent.paktmp to %ProgramFiles(x86)%\zaxar\chm\cef_200_percent.pak
- from %ProgramFiles(x86)%\zaxar\chm\libegl.dlltmp to %ProgramFiles(x86)%\zaxar\chm\libegl.dll
- from %ProgramFiles(x86)%\zaxar\chm\libjsons.dlltmp to %ProgramFiles(x86)%\zaxar\chm\libjsons.dll
- from %ProgramFiles(x86)%\zaxar\chm\devtools_resources.paktmp to %ProgramFiles(x86)%\zaxar\chm\devtools_resources.pak
- from %ProgramFiles(x86)%\zaxar\chm\cef_100_percent.paktmp to %ProgramFiles(x86)%\zaxar\chm\cef_100_percent.pak
- from %ProgramFiles(x86)%\zaxar\chm\cef_extensions.paktmp to %ProgramFiles(x86)%\zaxar\chm\cef_extensions.pak
- from %ProgramFiles(x86)%\zaxar\calling.wavtmp to %ProgramFiles(x86)%\zaxar\calling.wav
- from %ProgramFiles(x86)%\zaxar\gameslist.dattmp to %ProgramFiles(x86)%\zaxar\gameslist.dat
- from %ProgramFiles(x86)%\zaxar\cef_extensions.paktmp to %ProgramFiles(x86)%\zaxar\cef_extensions.pak
- from %ProgramFiles(x86)%\zaxar\zaxargamebrowser.exetmp to %ProgramFiles(x86)%\zaxar\zaxargamebrowser.exe
- from %ProgramFiles(x86)%\zaxar\chm\locales\sr.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\sr.pak
- from %ProgramFiles(x86)%\zaxar\chm\locales\lv.paktmp to %ProgramFiles(x86)%\zaxar\chm\locales\lv.pak
- http://ip###ger.org/11SVE
- /client/current_version4_2/chm/locales/ar.pak via zx###dia.com
- /client/current_version4_2/chm/locales/hr.pak via zx###dia.com
- /client/current_version4_2/chm/locales/he.pak via zx###dia.com
- /client/current_version4_2/chm/locales/fil.pak via zx###dia.com
- /client/current_version4_2/chm/locales/bg.pak via zx###dia.com
- /client/current_version4_2/chm/locales/id.pak via zx###dia.com
- /client/current_version4_2/chm/locales/ml.pak via zx###dia.com
- /client/current_version4_2/chm/locales/th.pak via zx###dia.com
- /client/current_version4_2/chm/locales/sr.pak via zx###dia.com
- /client/current_version4_2/chm/locales/vi.pak via zx###dia.com
- /client/current_version4_2/chm/locales/sk.pak via zx###dia.com
- /client/current_version4_2/chm/locales/fa.pak via zx###dia.com
- /client/current_version4_2/chm/locales/tr.pak via zx###dia.com
- /client/current_version4_2/chm/locales/da.pak via zx###dia.com
- /client/current_version4_2/chm/locales/gu.pak via zx###dia.com
- /client/current_version4_2/chm/locales/pl.pak via zx###dia.com
- /client/current_version4_2/chm/locales/ro.pak via zx###dia.com
- /client/current_version4_2/chm/locales/hu.pak via zx###dia.com
- /client/current_version4_2/chm/locales/zh-TW.pak via zx###dia.com
- http://ga###depart.com/client/get_build.php
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://me#####wnloader25.tk/click.php?cn#######################
- http://za###store2.com/download.php?ad######
- http://ip###ger.org/11ACE
- http://me#####wnloader25.tk/click.php?cn#######################################
- http://on#####game-group.ru/download.php?ad######
- /client/update.php?c=################################################################################################### via za###store2.com
- /client/current_version4_2/chm/zaxarsteam.exe via zx###dia.com
- /client/current_version4_2/chm/cef_200_percent.pak via zx###dia.com
- /client/current_version4_2/ZaxarGameBrowser.exe via zx###dia.com
- /client/current_version4_2/cef_extensions.pak via zx###dia.com
- /client/current_version4_2/gameslist.dat via zx###dia.com
- /client/current_version4_2/calling.wav via zx###dia.com
- /client/current_version4_2/chm/cef_extensions.pak via zx###dia.com
- /client/current_version4_2/chm/cef_100_percent.pak via zx###dia.com
- /client/current_version4_2/chm/devtools_resources.pak via zx###dia.com
- /client/current_version4_2/chm/locales/nl.pak via zx###dia.com
- /client/current_version4_2/chm/locales/lv.pak via zx###dia.com
- DNS ASK ip###ger.org
- DNS ASK me#####wnloader25.tk
- DNS ASK za###store2.com
- DNS ASK za###games.com
- DNS ASK on#####game-group.ru
- DNS ASK ga###depart.com
- DNS ASK zx###dia.com
- ClassName: '' WindowName: ''
- '%TEMP%\zaxarsetup.4.001.1827.exe' /S
- '%ProgramFiles(x86)%\zaxar\zaxarloader.exe' /verysilent /install
- '%TEMP%\gamesdepart.000.1827.0.exe' /S
- '%TEMP%\is-cas31.tmp\gamesdepart.000.1827.0.tmp' /SL5="$70236,1011219,721408,%TEMP%\Gamesdepart.000.1827.0.exe" /S
- '%TEMP%\gamesdepart.000.1827.0.exe' /VERYSILENT /adv=1827 /subadv=0
- '%TEMP%\is-34is5.tmp\gamesdepart.000.1827.0.tmp' /SL5="$E020A,1011219,721408,%TEMP%\Gamesdepart.000.1827.0.exe" /VERYSILENT /adv=1827 /subadv=0
- '%WINDIR%\syswow64\taskkill.exe' /f /im "ZaxarLoader.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im "ZaxarGameBrowser.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im "gamesdepartupdate.exe"' (with hidden window)