Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe
Modifies file system
Moves the following files
- from <Full path to file> to %TEMP%\_@16cb.tmp
- from %TEMP%\_@16cb.tmp to %TEMP%\661194\....\ВЎВЎ
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@166d.tmp
- from %TEMP%\_@166d.tmp to %TEMP%\661147\....\ВЎВЎ
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe' (with hidden window)
