Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe
Modifies file system
Moves the following files
- from <Full path to file> to %TEMP%\_@b7b.tmp
- from %TEMP%\_@b7b.tmp to %TEMP%\854921\....\ВЎВЎ
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@b7a.tmp
- from %TEMP%\_@b7a.tmp to %TEMP%\854906\....\ВЎВЎ
Network activity
TCP
Other
- '15#.#01.193.91':443
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe' (with hidden window)
