Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\tcpsvcs.exe' bundle.js
- '<SYSTEM32>\tcpsvcs.exe' backupbox.ahk
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\tcpsvcs.exe
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\3bc90bb6be2ccc0b79ba09a3314a9c5182c7eab28fc0ba4191548c56c0cf6a81\1de9197d76fcbb767d17cdc3cc4c537b8d3720795b4eb729418c5e753c37740f.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\0aeeab8f41db4917ed8f9039a09306d4e3664d06d35a4c83558726602df3f2d9\0602f3143cb21ff8a6db32f66b1c1add90da612f10ac82616141013c4289208d.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\9d1945265eaea66e1a7a598f929d8a6626574fa461cb56b14ddda47694064022\ff415691b9dd33296bda66ec113fd95cedbac1f6abdc0f123e3084aa2645b5e9.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\baade55b99e89bc2743d03a589a43c0099cdba44edac2045a85eb61f668b04ad\c98f609c518dea51dad3a9b1abcdbcfffefa3de83215f75d6a65c497f8935bd6.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\de0e08df8ec952696198e2ebd9c40ccdc6123a6bc6dde7b7daf342ce7b4e88df\60a71a4246f13fc3a3a3903ef339e5d09af9a255f2d9a79d48e4c2f4b7a849fa.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\a5efb099c7b0d3e7f244c1244f9d7fbcffe62cecf0b39263ad4f85c980792895\1caa4d332cd229a6ec78ae1b73907de973b0ff30b7df3abc2432e276daa0aea0.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\3305f854bda8eac27e4aa1777d84e3c18b838f2c379c64b6c0300afb09b130c9\c86302776360e5cc2cdd0fcb24d7f37c01d7d615e1c3cb7b32b0d681a5c247d2.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\208954c05f8b5acc0fc064a20840cbdbe9fafcb47f8177c6898d1a205d4daa82\4fd9e2c076dba3639e501e100811c6a75ea30c9426d9fe8b321d4f5b356c9f0e.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\efe9ca35248c13d238f3bbb7adda6188557d96c1067fa581b177114305ec1d91\8793e45cd83e220dd1449d79c28afb8980295475be0e8d2389c3300abac5e812.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\8e44e0824afaff1c23aa255ee0c1ed45d4cf1ef36a350bcd7ce468f838c46233\636e774e70ec446d2a27549b1f21a0422b5eb746a7cd3c20d4ace5d9d2ba3c77.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\635d6ef73250767bf895a69e0d0b1fb0a929b68250ef6ecd864bcbf060ad4e09\be7afd887993258117fcd640104fa09d0416b3c34baaa42580ec1e1af693924b.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\4f51e41ab6f9a7abf571de2f2aa08291a358889b8f49cefa4d8bd9136bb8f8c2\3b1b9673e7bcb89eb3dc8c345ee5f6ff567e838736c0f38e965281658421a30a.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\e774b8ec7f87c95e409404fe91b6db820417d6064b8642d9e0a76975686a8c52\417534610502a8e613bb27e8ddad3605ac60a04e6ee32f2fe148cf20ab91763e.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\a1d61d4352bc87d3b2310e144293d08bbbec2c49410591d2f5c006fd7e74ad67\ba4a65f3dda7128ae81266771aa4e9e492bc846e6ede8c94e35ca7d45bc591f5.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\98d121ec59f6750e6eae657583675b93dd890a36091214d43ecc260ee92b461a\af1da6b371a64ab57882d10e58764358439244126b44e40fd7bb4ab78d0ec68a.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\cd1a072b7944da22c5c30e2d76203d375a8d1dec7a142677f2c9d7c0ade4fa81\90d5cb4c3ca980fee8a293a41b11acd5980638d718bbf7f79b421f441aa66e0b.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\95ab71cf58af65c7164e4477bb62fc5629dddb8ac71ee0874fd213470d77f67f\082c336af3baf5ebd5476f1fd27a0bae5e68edefca2c34570888e1a150f964d7.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\80822902ef2a72260ff4eb9b0543e9bce4a38b79d532f7ca3e0decb9511a93ad\d89d0e1d93deafebd0aa067d20d9029d9914ccde244920d9dd09ea51944e1c6c.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\de282628ee6a8557f881e69c9f4bb8ec6e8431f909b70ef91e2d6b93e2c59977\cfd7c2503471e6f6dcfcb4488c2472118fcad5663c9f4cadd1b9868087d96467.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\ca8064d12f363f981e4824a5790b975deb8fe90679d0b4a093a0453e5c83834d\f62dbeb1a280056ee55e00425b880fa7e360d84238c980cad49d8e012533df29.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\98e37174d901a5858223102702ec406c0585339931dfb0fffb3c04d2896ba24e\b5365d00eb33ded16dc26810314037c15aeea677c9a5e719569d0b6298cdb4aa.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\2bbd41830bd33a138a50bc8a54c858ef4a579351770735417b8b321b4354fc97\07bf0057b3778c9c37b2ff047ed8b78052889fe2aa87e78b600c9a9a556ce4c0.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\50e73884509335656add66b588faf7475c8fab59acacc4ea68a3774f4ce303f4\75b9cdc07cbc8fb16bc8cf130fa43c4ece445efb943bd01492ff73a0806166e9.inprogress
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\d630638773e6d6ce1f825011911079a31dd6059dbfd1ffea7764082df400f80a\7ea5ac65bd2e255a48e70926c5e32088e9f549c4e2134fb67d9782b357f53f45.inprogress
Перемещает следующие файлы:
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\3bc90bb6be2ccc0b79ba09a3314a9c5182c7eab28fc0ba4191548c56c0cf6a81\1de9197d76fcbb767d17cdc3cc4c537b8d3720795b4eb729418c5e753c37740f.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\3bc90bb6be2ccc0b79ba09a3314a9c5182c7eab28fc0ba4191548c56c0cf6a81\1de9197d76fcbb767d17cdc3cc4c537b8d3720795b4eb729418c5e753c37740f
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\0aeeab8f41db4917ed8f9039a09306d4e3664d06d35a4c83558726602df3f2d9\0602f3143cb21ff8a6db32f66b1c1add90da612f10ac82616141013c4289208d.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\0aeeab8f41db4917ed8f9039a09306d4e3664d06d35a4c83558726602df3f2d9\0602f3143cb21ff8a6db32f66b1c1add90da612f10ac82616141013c4289208d
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\9d1945265eaea66e1a7a598f929d8a6626574fa461cb56b14ddda47694064022\ff415691b9dd33296bda66ec113fd95cedbac1f6abdc0f123e3084aa2645b5e9.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\9d1945265eaea66e1a7a598f929d8a6626574fa461cb56b14ddda47694064022\ff415691b9dd33296bda66ec113fd95cedbac1f6abdc0f123e3084aa2645b5e9
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\baade55b99e89bc2743d03a589a43c0099cdba44edac2045a85eb61f668b04ad\c98f609c518dea51dad3a9b1abcdbcfffefa3de83215f75d6a65c497f8935bd6.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\baade55b99e89bc2743d03a589a43c0099cdba44edac2045a85eb61f668b04ad\c98f609c518dea51dad3a9b1abcdbcfffefa3de83215f75d6a65c497f8935bd6
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\de0e08df8ec952696198e2ebd9c40ccdc6123a6bc6dde7b7daf342ce7b4e88df\60a71a4246f13fc3a3a3903ef339e5d09af9a255f2d9a79d48e4c2f4b7a849fa.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\de0e08df8ec952696198e2ebd9c40ccdc6123a6bc6dde7b7daf342ce7b4e88df\60a71a4246f13fc3a3a3903ef339e5d09af9a255f2d9a79d48e4c2f4b7a849fa
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\a5efb099c7b0d3e7f244c1244f9d7fbcffe62cecf0b39263ad4f85c980792895\1caa4d332cd229a6ec78ae1b73907de973b0ff30b7df3abc2432e276daa0aea0.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\a5efb099c7b0d3e7f244c1244f9d7fbcffe62cecf0b39263ad4f85c980792895\1caa4d332cd229a6ec78ae1b73907de973b0ff30b7df3abc2432e276daa0aea0
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\3305f854bda8eac27e4aa1777d84e3c18b838f2c379c64b6c0300afb09b130c9\c86302776360e5cc2cdd0fcb24d7f37c01d7d615e1c3cb7b32b0d681a5c247d2.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\3305f854bda8eac27e4aa1777d84e3c18b838f2c379c64b6c0300afb09b130c9\c86302776360e5cc2cdd0fcb24d7f37c01d7d615e1c3cb7b32b0d681a5c247d2
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\208954c05f8b5acc0fc064a20840cbdbe9fafcb47f8177c6898d1a205d4daa82\4fd9e2c076dba3639e501e100811c6a75ea30c9426d9fe8b321d4f5b356c9f0e.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\208954c05f8b5acc0fc064a20840cbdbe9fafcb47f8177c6898d1a205d4daa82\4fd9e2c076dba3639e501e100811c6a75ea30c9426d9fe8b321d4f5b356c9f0e
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\efe9ca35248c13d238f3bbb7adda6188557d96c1067fa581b177114305ec1d91\8793e45cd83e220dd1449d79c28afb8980295475be0e8d2389c3300abac5e812.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\efe9ca35248c13d238f3bbb7adda6188557d96c1067fa581b177114305ec1d91\8793e45cd83e220dd1449d79c28afb8980295475be0e8d2389c3300abac5e812
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\8e44e0824afaff1c23aa255ee0c1ed45d4cf1ef36a350bcd7ce468f838c46233\636e774e70ec446d2a27549b1f21a0422b5eb746a7cd3c20d4ace5d9d2ba3c77.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\8e44e0824afaff1c23aa255ee0c1ed45d4cf1ef36a350bcd7ce468f838c46233\636e774e70ec446d2a27549b1f21a0422b5eb746a7cd3c20d4ace5d9d2ba3c77
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\635d6ef73250767bf895a69e0d0b1fb0a929b68250ef6ecd864bcbf060ad4e09\be7afd887993258117fcd640104fa09d0416b3c34baaa42580ec1e1af693924b.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\635d6ef73250767bf895a69e0d0b1fb0a929b68250ef6ecd864bcbf060ad4e09\be7afd887993258117fcd640104fa09d0416b3c34baaa42580ec1e1af693924b
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\4f51e41ab6f9a7abf571de2f2aa08291a358889b8f49cefa4d8bd9136bb8f8c2\3b1b9673e7bcb89eb3dc8c345ee5f6ff567e838736c0f38e965281658421a30a.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\4f51e41ab6f9a7abf571de2f2aa08291a358889b8f49cefa4d8bd9136bb8f8c2\3b1b9673e7bcb89eb3dc8c345ee5f6ff567e838736c0f38e965281658421a30a
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\e774b8ec7f87c95e409404fe91b6db820417d6064b8642d9e0a76975686a8c52\417534610502a8e613bb27e8ddad3605ac60a04e6ee32f2fe148cf20ab91763e.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\e774b8ec7f87c95e409404fe91b6db820417d6064b8642d9e0a76975686a8c52\417534610502a8e613bb27e8ddad3605ac60a04e6ee32f2fe148cf20ab91763e
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\a1d61d4352bc87d3b2310e144293d08bbbec2c49410591d2f5c006fd7e74ad67\ba4a65f3dda7128ae81266771aa4e9e492bc846e6ede8c94e35ca7d45bc591f5.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\a1d61d4352bc87d3b2310e144293d08bbbec2c49410591d2f5c006fd7e74ad67\ba4a65f3dda7128ae81266771aa4e9e492bc846e6ede8c94e35ca7d45bc591f5
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\98d121ec59f6750e6eae657583675b93dd890a36091214d43ecc260ee92b461a\af1da6b371a64ab57882d10e58764358439244126b44e40fd7bb4ab78d0ec68a.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\98d121ec59f6750e6eae657583675b93dd890a36091214d43ecc260ee92b461a\af1da6b371a64ab57882d10e58764358439244126b44e40fd7bb4ab78d0ec68a
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\cd1a072b7944da22c5c30e2d76203d375a8d1dec7a142677f2c9d7c0ade4fa81\90d5cb4c3ca980fee8a293a41b11acd5980638d718bbf7f79b421f441aa66e0b.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\cd1a072b7944da22c5c30e2d76203d375a8d1dec7a142677f2c9d7c0ade4fa81\90d5cb4c3ca980fee8a293a41b11acd5980638d718bbf7f79b421f441aa66e0b
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\95ab71cf58af65c7164e4477bb62fc5629dddb8ac71ee0874fd213470d77f67f\082c336af3baf5ebd5476f1fd27a0bae5e68edefca2c34570888e1a150f964d7.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\95ab71cf58af65c7164e4477bb62fc5629dddb8ac71ee0874fd213470d77f67f\082c336af3baf5ebd5476f1fd27a0bae5e68edefca2c34570888e1a150f964d7
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\80822902ef2a72260ff4eb9b0543e9bce4a38b79d532f7ca3e0decb9511a93ad\d89d0e1d93deafebd0aa067d20d9029d9914ccde244920d9dd09ea51944e1c6c.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\80822902ef2a72260ff4eb9b0543e9bce4a38b79d532f7ca3e0decb9511a93ad\d89d0e1d93deafebd0aa067d20d9029d9914ccde244920d9dd09ea51944e1c6c
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\de282628ee6a8557f881e69c9f4bb8ec6e8431f909b70ef91e2d6b93e2c59977\cfd7c2503471e6f6dcfcb4488c2472118fcad5663c9f4cadd1b9868087d96467.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\de282628ee6a8557f881e69c9f4bb8ec6e8431f909b70ef91e2d6b93e2c59977\cfd7c2503471e6f6dcfcb4488c2472118fcad5663c9f4cadd1b9868087d96467
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\ca8064d12f363f981e4824a5790b975deb8fe90679d0b4a093a0453e5c83834d\f62dbeb1a280056ee55e00425b880fa7e360d84238c980cad49d8e012533df29.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\ca8064d12f363f981e4824a5790b975deb8fe90679d0b4a093a0453e5c83834d\f62dbeb1a280056ee55e00425b880fa7e360d84238c980cad49d8e012533df29
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\98e37174d901a5858223102702ec406c0585339931dfb0fffb3c04d2896ba24e\b5365d00eb33ded16dc26810314037c15aeea677c9a5e719569d0b6298cdb4aa.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\98e37174d901a5858223102702ec406c0585339931dfb0fffb3c04d2896ba24e\b5365d00eb33ded16dc26810314037c15aeea677c9a5e719569d0b6298cdb4aa
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\2bbd41830bd33a138a50bc8a54c858ef4a579351770735417b8b321b4354fc97\07bf0057b3778c9c37b2ff047ed8b78052889fe2aa87e78b600c9a9a556ce4c0.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\2bbd41830bd33a138a50bc8a54c858ef4a579351770735417b8b321b4354fc97\07bf0057b3778c9c37b2ff047ed8b78052889fe2aa87e78b600c9a9a556ce4c0
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\50e73884509335656add66b588faf7475c8fab59acacc4ea68a3774f4ce303f4\75b9cdc07cbc8fb16bc8cf130fa43c4ece445efb943bd01492ff73a0806166e9.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\50e73884509335656add66b588faf7475c8fab59acacc4ea68a3774f4ce303f4\75b9cdc07cbc8fb16bc8cf130fa43c4ece445efb943bd01492ff73a0806166e9
- %TEMP%\FF3EF9353CC449a49582F3784A729FD8\d630638773e6d6ce1f825011911079a31dd6059dbfd1ffea7764082df400f80a\7ea5ac65bd2e255a48e70926c5e32088e9f549c4e2134fb67d9782b357f53f45.inprogress в %TEMP%\FF3EF9353CC449a49582F3784A729FD8\d630638773e6d6ce1f825011911079a31dd6059dbfd1ffea7764082df400f80a\7ea5ac65bd2e255a48e70926c5e32088e9f549c4e2134fb67d9782b357f53f45
