Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 10:34
Behavioral task
behavioral1
Sample
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe
Resource
win10v2004-20220901-en
General
-
Target
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe
-
Size
76KB
-
MD5
73ea051ff30775f2414ed0cbc8f705e0
-
SHA1
ffb035f8c2c01af455c169a4792bc82670567308
-
SHA256
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11
-
SHA512
45bb8c690c339d5b4d7286e38fc3719d6f44796c380342771f42c3fbe20824921b2a2aed205ade966e6379c46822de0bdd5113bb992bfd95735050fb889dd9e0
-
SSDEEP
1536:bpvF99rQswQ25+9Pn9tbfoBQy6XKEYo8+uHOdRdSBuGJOT:9vN8VQ/nn06hvSHmdFGJ6
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe TXP1atform.exe -
Executes dropped EXE 64 IoCs
pid Process 1940 TXP1atform.exe 980 TXP1atform.exe 1552 TXP1atform.exe 1720 TXP1atform.exe 1976 TXP1atform.exe 524 TXP1atform.exe 1224 TXP1atform.exe 1180 TXP1atform.exe 340 TXP1atform.exe 560 TXP1atform.exe 1884 TXP1atform.exe 2040 TXP1atform.exe 1416 TXP1atform.exe 1484 TXP1atform.exe 932 TXP1atform.exe 856 TXP1atform.exe 240 TXP1atform.exe 872 TXP1atform.exe 1604 TXP1atform.exe 964 TXP1atform.exe 1480 TXP1atform.exe 1940 TXP1atform.exe 832 TXP1atform.exe 1968 TXP1atform.exe 1776 TXP1atform.exe 1720 TXP1atform.exe 1692 TXP1atform.exe 1516 TXP1atform.exe 1676 TXP1atform.exe 1680 TXP1atform.exe 1092 TXP1atform.exe 1912 TXP1atform.exe 1772 TXP1atform.exe 340 TXP1atform.exe 1468 TXP1atform.exe 1044 TXP1atform.exe 1948 TXP1atform.exe 2020 TXP1atform.exe 2024 TXP1atform.exe 1416 TXP1atform.exe 840 TXP1atform.exe 432 TXP1atform.exe 1628 TXP1atform.exe 808 TXP1atform.exe 1900 TXP1atform.exe 1608 TXP1atform.exe 1476 TXP1atform.exe 1580 TXP1atform.exe 1604 TXP1atform.exe 1372 TXP1atform.exe 980 TXP1atform.exe 1088 TXP1atform.exe 2008 TXP1atform.exe 1164 TXP1atform.exe 1552 TXP1atform.exe 1976 TXP1atform.exe 1720 TXP1atform.exe 1728 TXP1atform.exe 1516 TXP1atform.exe 1676 TXP1atform.exe 1760 TXP1atform.exe 580 TXP1atform.exe 1768 TXP1atform.exe 1068 TXP1atform.exe -
Sets file execution options in registry 2 TTPs 13 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GOOGLEUPDATE.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACCICONS.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DW20.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DWTRIG20.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCEL.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXCELCNV.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXTEXPORT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GROOVE.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IE4UINIT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLVIEW.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CNFNOT32.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DLLNXOPTIONS b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe -
resource yara_rule behavioral1/memory/896-55-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-56.dat upx behavioral1/files/0x00140000000054ab-57.dat upx behavioral1/files/0x00140000000054ab-59.dat upx behavioral1/files/0x00140000000054ab-61.dat upx behavioral1/files/0x00140000000054ab-62.dat upx behavioral1/files/0x00140000000054ab-63.dat upx behavioral1/files/0x00140000000054ab-65.dat upx behavioral1/memory/1940-67-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/896-68-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/980-69-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-70.dat upx behavioral1/files/0x00140000000054ab-71.dat upx behavioral1/files/0x00140000000054ab-73.dat upx behavioral1/memory/980-75-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-79.dat upx behavioral1/files/0x00140000000054ab-77.dat upx behavioral1/files/0x00140000000054ab-76.dat upx behavioral1/memory/1552-81-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/1720-82-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-83.dat upx behavioral1/files/0x00140000000054ab-84.dat upx behavioral1/files/0x00140000000054ab-86.dat upx behavioral1/memory/1720-88-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-90.dat upx behavioral1/files/0x00140000000054ab-89.dat upx behavioral1/files/0x00140000000054ab-92.dat upx behavioral1/memory/1976-94-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/524-95-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-96.dat upx behavioral1/files/0x00140000000054ab-97.dat upx behavioral1/files/0x00140000000054ab-99.dat upx behavioral1/memory/524-101-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-102.dat upx behavioral1/files/0x00140000000054ab-103.dat upx behavioral1/files/0x00140000000054ab-105.dat upx behavioral1/memory/1224-109-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/1180-108-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-110.dat upx behavioral1/files/0x00140000000054ab-111.dat upx behavioral1/files/0x00140000000054ab-113.dat upx behavioral1/memory/1180-115-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/340-116-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-117.dat upx behavioral1/files/0x00140000000054ab-118.dat upx behavioral1/files/0x00140000000054ab-120.dat upx behavioral1/memory/340-122-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-123.dat upx behavioral1/files/0x00140000000054ab-124.dat upx behavioral1/files/0x00140000000054ab-126.dat upx behavioral1/memory/560-128-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/1884-129-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-130.dat upx behavioral1/files/0x00140000000054ab-131.dat upx behavioral1/files/0x00140000000054ab-133.dat upx behavioral1/memory/1884-135-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-136.dat upx behavioral1/files/0x00140000000054ab-137.dat upx behavioral1/files/0x00140000000054ab-139.dat upx behavioral1/memory/2040-141-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/memory/1416-142-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral1/files/0x00140000000054ab-143.dat upx behavioral1/files/0x00140000000054ab-144.dat upx behavioral1/files/0x00140000000054ab-146.dat upx -
Loads dropped DLL 64 IoCs
pid Process 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 1224 TXP1atform.exe 1224 TXP1atform.exe 1180 TXP1atform.exe 1180 TXP1atform.exe 340 TXP1atform.exe 340 TXP1atform.exe 560 TXP1atform.exe 560 TXP1atform.exe 1884 TXP1atform.exe 1884 TXP1atform.exe 2040 TXP1atform.exe 2040 TXP1atform.exe 1416 TXP1atform.exe 1416 TXP1atform.exe 1484 TXP1atform.exe 1484 TXP1atform.exe 932 TXP1atform.exe 932 TXP1atform.exe 856 TXP1atform.exe 856 TXP1atform.exe 240 TXP1atform.exe 240 TXP1atform.exe 872 TXP1atform.exe 872 TXP1atform.exe 1604 TXP1atform.exe 1604 TXP1atform.exe 964 TXP1atform.exe 964 TXP1atform.exe 1480 TXP1atform.exe 1480 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 832 TXP1atform.exe 832 TXP1atform.exe 1968 TXP1atform.exe 1968 TXP1atform.exe 1776 TXP1atform.exe 1776 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1692 TXP1atform.exe 1692 TXP1atform.exe 1516 TXP1atform.exe 1516 TXP1atform.exe 1676 TXP1atform.exe 1676 TXP1atform.exe 1680 TXP1atform.exe 1680 TXP1atform.exe 1092 TXP1atform.exe 1092 TXP1atform.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 1940 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 980 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1552 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1720 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 1976 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 524 TXP1atform.exe 1224 TXP1atform.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 896 wrote to memory of 1940 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 27 PID 896 wrote to memory of 1940 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 27 PID 896 wrote to memory of 1940 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 27 PID 896 wrote to memory of 1940 896 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 27 PID 1940 wrote to memory of 980 1940 TXP1atform.exe 28 PID 1940 wrote to memory of 980 1940 TXP1atform.exe 28 PID 1940 wrote to memory of 980 1940 TXP1atform.exe 28 PID 1940 wrote to memory of 980 1940 TXP1atform.exe 28 PID 980 wrote to memory of 1552 980 TXP1atform.exe 29 PID 980 wrote to memory of 1552 980 TXP1atform.exe 29 PID 980 wrote to memory of 1552 980 TXP1atform.exe 29 PID 980 wrote to memory of 1552 980 TXP1atform.exe 29 PID 1552 wrote to memory of 1720 1552 TXP1atform.exe 30 PID 1552 wrote to memory of 1720 1552 TXP1atform.exe 30 PID 1552 wrote to memory of 1720 1552 TXP1atform.exe 30 PID 1552 wrote to memory of 1720 1552 TXP1atform.exe 30 PID 1720 wrote to memory of 1976 1720 TXP1atform.exe 31 PID 1720 wrote to memory of 1976 1720 TXP1atform.exe 31 PID 1720 wrote to memory of 1976 1720 TXP1atform.exe 31 PID 1720 wrote to memory of 1976 1720 TXP1atform.exe 31 PID 1976 wrote to memory of 524 1976 TXP1atform.exe 32 PID 1976 wrote to memory of 524 1976 TXP1atform.exe 32 PID 1976 wrote to memory of 524 1976 TXP1atform.exe 32 PID 1976 wrote to memory of 524 1976 TXP1atform.exe 32 PID 524 wrote to memory of 1224 524 TXP1atform.exe 33 PID 524 wrote to memory of 1224 524 TXP1atform.exe 33 PID 524 wrote to memory of 1224 524 TXP1atform.exe 33 PID 524 wrote to memory of 1224 524 TXP1atform.exe 33 PID 1224 wrote to memory of 1180 1224 TXP1atform.exe 34 PID 1224 wrote to memory of 1180 1224 TXP1atform.exe 34 PID 1224 wrote to memory of 1180 1224 TXP1atform.exe 34 PID 1224 wrote to memory of 1180 1224 TXP1atform.exe 34 PID 1180 wrote to memory of 340 1180 TXP1atform.exe 35 PID 1180 wrote to memory of 340 1180 TXP1atform.exe 35 PID 1180 wrote to memory of 340 1180 TXP1atform.exe 35 PID 1180 wrote to memory of 340 1180 TXP1atform.exe 35 PID 340 wrote to memory of 560 340 TXP1atform.exe 36 PID 340 wrote to memory of 560 340 TXP1atform.exe 36 PID 340 wrote to memory of 560 340 TXP1atform.exe 36 PID 340 wrote to memory of 560 340 TXP1atform.exe 36 PID 560 wrote to memory of 1884 560 TXP1atform.exe 37 PID 560 wrote to memory of 1884 560 TXP1atform.exe 37 PID 560 wrote to memory of 1884 560 TXP1atform.exe 37 PID 560 wrote to memory of 1884 560 TXP1atform.exe 37 PID 1884 wrote to memory of 2040 1884 TXP1atform.exe 38 PID 1884 wrote to memory of 2040 1884 TXP1atform.exe 38 PID 1884 wrote to memory of 2040 1884 TXP1atform.exe 38 PID 1884 wrote to memory of 2040 1884 TXP1atform.exe 38 PID 2040 wrote to memory of 1416 2040 TXP1atform.exe 39 PID 2040 wrote to memory of 1416 2040 TXP1atform.exe 39 PID 2040 wrote to memory of 1416 2040 TXP1atform.exe 39 PID 2040 wrote to memory of 1416 2040 TXP1atform.exe 39 PID 1416 wrote to memory of 1484 1416 TXP1atform.exe 40 PID 1416 wrote to memory of 1484 1416 TXP1atform.exe 40 PID 1416 wrote to memory of 1484 1416 TXP1atform.exe 40 PID 1416 wrote to memory of 1484 1416 TXP1atform.exe 40 PID 1484 wrote to memory of 932 1484 TXP1atform.exe 41 PID 1484 wrote to memory of 932 1484 TXP1atform.exe 41 PID 1484 wrote to memory of 932 1484 TXP1atform.exe 41 PID 1484 wrote to memory of 932 1484 TXP1atform.exe 41 PID 932 wrote to memory of 856 932 TXP1atform.exe 42 PID 932 wrote to memory of 856 932 TXP1atform.exe 42 PID 932 wrote to memory of 856 932 TXP1atform.exe 42 PID 932 wrote to memory of 856 932 TXP1atform.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe"C:\Users\Admin\AppData\Local\Temp\b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe"1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe10⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe12⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe16⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe18⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe22⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe33⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe34⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe35⤵
- Executes dropped EXE
PID:340 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe36⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe37⤵
- Executes dropped EXE
PID:1044 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe38⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe39⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe40⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe41⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe42⤵
- Executes dropped EXE
PID:840 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe43⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe44⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe45⤵
- Executes dropped EXE
PID:808 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe46⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe47⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe48⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe49⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe50⤵
- Executes dropped EXE
PID:1604 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe51⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe52⤵
- Executes dropped EXE
PID:980 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe53⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe54⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2008 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe55⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe56⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe57⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe58⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe59⤵
- Executes dropped EXE
PID:1728 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe60⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe61⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe62⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe63⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:580 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe64⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe65⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe66⤵
- Drops file in Drivers directory
PID:2012 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe67⤵PID:1496
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe68⤵
- Drops file in Drivers directory
PID:2036 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe69⤵
- Drops file in Drivers directory
PID:316 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe70⤵PID:1948
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe71⤵
- Drops file in Drivers directory
PID:472 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe72⤵PID:2024
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe73⤵PID:1484
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe74⤵
- Drops file in Drivers directory
PID:1672 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe75⤵
- Drops file in Drivers directory
PID:840 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe76⤵PID:856
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe77⤵PID:1612
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe78⤵
- Drops file in Drivers directory
PID:1932 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe79⤵PID:1488
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe80⤵
- Drops file in Drivers directory
PID:1448 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe81⤵PID:1756
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe82⤵PID:1476
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe83⤵PID:1076
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe84⤵
- Drops file in Drivers directory
PID:996 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe85⤵PID:1480
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe86⤵
- Drops file in Drivers directory
PID:1128 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe87⤵PID:980
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe88⤵PID:1380
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe89⤵PID:760
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe90⤵PID:1012
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe91⤵PID:1564
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe92⤵PID:1692
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe93⤵
- Drops file in Drivers directory
PID:1708 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe94⤵
- Drops file in Drivers directory
PID:272 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe95⤵PID:1180
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe96⤵
- Drops file in Drivers directory
PID:1516 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe97⤵
- Drops file in Drivers directory
PID:1992 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe98⤵
- Drops file in Drivers directory
PID:1680 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe99⤵PID:1032
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe100⤵
- Drops file in Drivers directory
PID:580 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe101⤵
- Drops file in Drivers directory
PID:1400 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe102⤵
- Drops file in Drivers directory
PID:1068 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe103⤵PID:1044
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe104⤵
- Drops file in Drivers directory
PID:2044 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe105⤵
- Drops file in Drivers directory
PID:688 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe106⤵
- Drops file in Drivers directory
PID:1144 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe107⤵
- Drops file in Drivers directory
PID:1924 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe108⤵PID:1948
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe109⤵PID:1572
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe110⤵PID:2024
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe111⤵PID:916
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe112⤵
- Drops file in Drivers directory
PID:1616 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe113⤵PID:1492
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe114⤵PID:856
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe115⤵PID:1632
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe116⤵PID:1932
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe117⤵PID:1368
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe118⤵PID:1124
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe119⤵PID:1580
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe120⤵
- Drops file in Drivers directory
PID:1340 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe121⤵PID:964
-
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe122⤵PID:1140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-