Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe
Modifies file system
Moves the following files
- from <Full path to file> to %TEMP%\_@4db3.tmp
- from %TEMP%\_@4db3.tmp to %TEMP%\937425\....\ВЎВЎ
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@4d35.tmp
- from %TEMP%\_@4d35.tmp to %TEMP%\937300\....\ВЎВЎ
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPHelper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TASLogin.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TP3Helper.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im GameLoader.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TGuardSvc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im txplatform.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im TPSvc.exe' (with hidden window)
