Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe
Modifies file system
Moves the following files
- from <Full path to file> to %TEMP%\_@a450.tmp
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@a44f.tmp
- from %TEMP%\_@a44f.tmp to %TEMP%\894031\....\ВЎВЎ
Network activity
UDP
- DNS ASK fi#####.###tings.services.mozilla.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe' (with hidden window)
