Analysis
-
max time kernel
67s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 02:44
Behavioral task
behavioral1
Sample
0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe
Resource
win10v2004-20220812-en
General
-
Target
0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe
-
Size
92KB
-
MD5
52a2a2cd1dc33a17a255128776988b50
-
SHA1
78353eef17110a595e8a14c383cdad4265c7bdeb
-
SHA256
0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366
-
SHA512
79801f618ca4986db9a09621828f8897819e4c651676f13df3950c099efe33b28bba0b0f2cdc8ad2e39a845b303692c7604d037328ca55e57b9f9c163c7006b2
-
SSDEEP
1536:uQJLnsoOE9loTD0ru16Ns7SKaZNv2m8KwZ0ZR3AJ03pvP9ITQsgu:uQJrOjTDZ0u7SKqOquIRPaTWu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3628 bCDVtTL.exe 816 bCDVtTL.exe 4848 bCDVtTL.exe 3596 bCDVtTL.exe 900 bCDVtTL.exe 3136 bCDVtTL.exe 2808 bCDVtTL.exe 3096 bCDVtTL.exe 4976 bCDVtTL.exe 5040 bCDVtTL.exe 3200 bCDVtTL.exe 4700 bCDVtTL.exe 2976 bCDVtTL.exe 1440 bCDVtTL.exe 2404 bCDVtTL.exe 1420 bCDVtTL.exe 3616 bCDVtTL.exe 4288 bCDVtTL.exe 4284 bCDVtTL.exe 4932 bCDVtTL.exe 5012 bCDVtTL.exe 3944 bCDVtTL.exe 2224 bCDVtTL.exe 2828 bCDVtTL.exe 4036 bCDVtTL.exe 4572 bCDVtTL.exe 628 bCDVtTL.exe 796 bCDVtTL.exe 2240 bCDVtTL.exe 2372 bCDVtTL.exe 4548 bCDVtTL.exe 308 bCDVtTL.exe 32 bCDVtTL.exe 2464 bCDVtTL.exe 4616 bCDVtTL.exe 1776 bCDVtTL.exe 3112 bCDVtTL.exe 2004 bCDVtTL.exe 608 bCDVtTL.exe 4044 bCDVtTL.exe 4308 bCDVtTL.exe 3088 bCDVtTL.exe 2664 bCDVtTL.exe 856 bCDVtTL.exe 2164 bCDVtTL.exe 2284 bCDVtTL.exe 2928 bCDVtTL.exe 2888 bCDVtTL.exe 4292 bCDVtTL.exe 2868 bCDVtTL.exe 4452 bCDVtTL.exe 4656 bCDVtTL.exe 5076 bCDVtTL.exe 3212 bCDVtTL.exe 3908 bCDVtTL.exe 1260 bCDVtTL.exe 532 bCDVtTL.exe 1952 bCDVtTL.exe 1908 bCDVtTL.exe 1096 bCDVtTL.exe 1884 bCDVtTL.exe 3812 bCDVtTL.exe 3936 bCDVtTL.exe 2624 bCDVtTL.exe -
resource yara_rule behavioral2/memory/2040-132-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/2040-133-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-135.dat upx behavioral2/files/0x000a000000022f5d-136.dat upx behavioral2/files/0x000a000000022f5d-138.dat upx behavioral2/files/0x000a000000022f5d-140.dat upx behavioral2/files/0x000a000000022f5d-142.dat upx behavioral2/files/0x000a000000022f5d-144.dat upx behavioral2/files/0x000a000000022f5d-146.dat upx behavioral2/files/0x000a000000022f5d-148.dat upx behavioral2/files/0x000a000000022f5d-150.dat upx behavioral2/files/0x000a000000022f5d-152.dat upx behavioral2/files/0x000a000000022f5d-154.dat upx behavioral2/files/0x000a000000022f5d-156.dat upx behavioral2/files/0x000a000000022f5d-158.dat upx behavioral2/memory/816-161-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-162.dat upx behavioral2/memory/3596-165-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/4848-163-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/3628-159-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/2808-172-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-173.dat upx behavioral2/memory/4976-176-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/5040-177-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-181.dat upx behavioral2/files/0x000a000000022f5d-178.dat upx behavioral2/memory/3096-174-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/3136-170-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-169.dat upx behavioral2/memory/900-167-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-166.dat upx behavioral2/files/0x000a000000022f5d-186.dat upx behavioral2/files/0x000a000000022f5d-188.dat upx behavioral2/files/0x000a000000022f5d-184.dat upx behavioral2/memory/4700-182-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/3200-179-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-190.dat upx behavioral2/files/0x000a000000022f5d-192.dat upx behavioral2/files/0x000a000000022f5d-194.dat upx behavioral2/files/0x000a000000022f5d-196.dat upx behavioral2/files/0x000a000000022f5d-198.dat upx behavioral2/files/0x000a000000022f5d-200.dat upx behavioral2/files/0x000a000000022f5d-202.dat upx behavioral2/files/0x000a000000022f5d-204.dat upx behavioral2/files/0x000a000000022f5d-206.dat upx behavioral2/files/0x000a000000022f5d-208.dat upx behavioral2/memory/2976-209-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/1440-212-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-211.dat upx behavioral2/memory/2404-214-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/3616-218-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/4288-220-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-223.dat upx behavioral2/files/0x000a000000022f5d-225.dat upx behavioral2/memory/4932-226-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/4284-222-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-219.dat upx behavioral2/memory/1420-216-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-215.dat upx behavioral2/files/0x000a000000022f5d-230.dat upx behavioral2/memory/2224-231-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/4036-234-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/files/0x000a000000022f5d-236.dat upx behavioral2/files/0x000a000000022f5d-239.dat upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: bCDVtTL.exe File opened (read-only) \??\l: bCDVtTL.exe File opened (read-only) \??\i: bCDVtTL.exe File opened (read-only) \??\q: bCDVtTL.exe File opened (read-only) \??\i: bCDVtTL.exe File opened (read-only) \??\r: bCDVtTL.exe File opened (read-only) \??\t: bCDVtTL.exe File opened (read-only) \??\k: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\t: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\w: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\k: bCDVtTL.exe File opened (read-only) \??\g: bCDVtTL.exe File opened (read-only) \??\w: bCDVtTL.exe File opened (read-only) \??\h: bCDVtTL.exe File opened (read-only) \??\g: bCDVtTL.exe File opened (read-only) \??\h: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\j: bCDVtTL.exe File opened (read-only) \??\n: bCDVtTL.exe File opened (read-only) \??\y: bCDVtTL.exe File opened (read-only) \??\x: bCDVtTL.exe File opened (read-only) \??\s: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\o: bCDVtTL.exe File opened (read-only) \??\l: bCDVtTL.exe File opened (read-only) \??\y: bCDVtTL.exe File opened (read-only) \??\o: bCDVtTL.exe File opened (read-only) \??\h: bCDVtTL.exe File opened (read-only) \??\l: bCDVtTL.exe File opened (read-only) \??\e: bCDVtTL.exe File opened (read-only) \??\w: bCDVtTL.exe File opened (read-only) \??\k: bCDVtTL.exe File opened (read-only) \??\o: bCDVtTL.exe File opened (read-only) \??\e: bCDVtTL.exe File opened (read-only) \??\k: bCDVtTL.exe File opened (read-only) \??\z: bCDVtTL.exe File opened (read-only) \??\q: bCDVtTL.exe File opened (read-only) \??\x: bCDVtTL.exe File opened (read-only) \??\x: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\o: bCDVtTL.exe File opened (read-only) \??\q: bCDVtTL.exe File opened (read-only) \??\x: bCDVtTL.exe File opened (read-only) \??\w: bCDVtTL.exe File opened (read-only) \??\p: bCDVtTL.exe File opened (read-only) \??\i: bCDVtTL.exe File opened (read-only) \??\h: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\e: bCDVtTL.exe File opened (read-only) \??\i: bCDVtTL.exe File opened (read-only) \??\e: bCDVtTL.exe File opened (read-only) \??\u: bCDVtTL.exe File opened (read-only) \??\x: bCDVtTL.exe File opened (read-only) \??\n: bCDVtTL.exe File opened (read-only) \??\e: bCDVtTL.exe File opened (read-only) \??\z: bCDVtTL.exe File opened (read-only) \??\m: bCDVtTL.exe File opened (read-only) \??\l: bCDVtTL.exe File opened (read-only) \??\x: bCDVtTL.exe File opened (read-only) \??\r: bCDVtTL.exe File opened (read-only) \??\t: bCDVtTL.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe File created C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exe bCDVtTL.exe File created C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exe bCDVtTL.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 2040 0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe Token: SeLoadDriverPrivilege 3628 bCDVtTL.exe Token: SeLoadDriverPrivilege 816 bCDVtTL.exe Token: SeLoadDriverPrivilege 4848 bCDVtTL.exe Token: SeLoadDriverPrivilege 3596 bCDVtTL.exe Token: SeLoadDriverPrivilege 900 bCDVtTL.exe Token: SeLoadDriverPrivilege 3136 bCDVtTL.exe Token: SeLoadDriverPrivilege 2808 bCDVtTL.exe Token: SeLoadDriverPrivilege 3096 bCDVtTL.exe Token: SeLoadDriverPrivilege 4976 bCDVtTL.exe Token: SeLoadDriverPrivilege 5040 bCDVtTL.exe Token: SeLoadDriverPrivilege 3200 bCDVtTL.exe Token: SeLoadDriverPrivilege 4700 bCDVtTL.exe Token: SeLoadDriverPrivilege 2976 bCDVtTL.exe Token: SeLoadDriverPrivilege 1440 bCDVtTL.exe Token: SeLoadDriverPrivilege 2404 bCDVtTL.exe Token: SeLoadDriverPrivilege 1420 bCDVtTL.exe Token: SeLoadDriverPrivilege 3616 bCDVtTL.exe Token: SeLoadDriverPrivilege 4288 bCDVtTL.exe Token: SeLoadDriverPrivilege 4284 bCDVtTL.exe Token: SeLoadDriverPrivilege 4932 bCDVtTL.exe Token: SeLoadDriverPrivilege 5012 bCDVtTL.exe Token: SeLoadDriverPrivilege 3944 bCDVtTL.exe Token: SeLoadDriverPrivilege 2224 bCDVtTL.exe Token: SeLoadDriverPrivilege 2828 bCDVtTL.exe Token: SeLoadDriverPrivilege 4036 bCDVtTL.exe Token: SeLoadDriverPrivilege 4572 bCDVtTL.exe Token: SeLoadDriverPrivilege 628 bCDVtTL.exe Token: SeLoadDriverPrivilege 796 bCDVtTL.exe Token: SeLoadDriverPrivilege 2240 bCDVtTL.exe Token: SeLoadDriverPrivilege 2372 bCDVtTL.exe Token: SeLoadDriverPrivilege 4548 bCDVtTL.exe Token: SeLoadDriverPrivilege 308 bCDVtTL.exe Token: SeLoadDriverPrivilege 32 bCDVtTL.exe Token: SeLoadDriverPrivilege 2464 bCDVtTL.exe Token: SeLoadDriverPrivilege 4616 bCDVtTL.exe Token: SeLoadDriverPrivilege 1776 bCDVtTL.exe Token: SeLoadDriverPrivilege 3112 bCDVtTL.exe Token: SeLoadDriverPrivilege 2004 bCDVtTL.exe Token: SeLoadDriverPrivilege 608 bCDVtTL.exe Token: SeLoadDriverPrivilege 4044 bCDVtTL.exe Token: SeLoadDriverPrivilege 4308 bCDVtTL.exe Token: SeLoadDriverPrivilege 3088 bCDVtTL.exe Token: SeLoadDriverPrivilege 2664 bCDVtTL.exe Token: SeLoadDriverPrivilege 856 bCDVtTL.exe Token: SeLoadDriverPrivilege 2164 bCDVtTL.exe Token: SeLoadDriverPrivilege 2284 bCDVtTL.exe Token: SeLoadDriverPrivilege 2928 bCDVtTL.exe Token: SeLoadDriverPrivilege 2888 bCDVtTL.exe Token: SeLoadDriverPrivilege 4292 bCDVtTL.exe Token: SeLoadDriverPrivilege 2868 bCDVtTL.exe Token: SeLoadDriverPrivilege 4452 bCDVtTL.exe Token: SeLoadDriverPrivilege 4656 bCDVtTL.exe Token: SeLoadDriverPrivilege 5076 bCDVtTL.exe Token: SeLoadDriverPrivilege 3212 bCDVtTL.exe Token: SeLoadDriverPrivilege 3908 bCDVtTL.exe Token: SeLoadDriverPrivilege 1260 bCDVtTL.exe Token: SeLoadDriverPrivilege 532 bCDVtTL.exe Token: SeLoadDriverPrivilege 1952 bCDVtTL.exe Token: SeLoadDriverPrivilege 1908 bCDVtTL.exe Token: SeLoadDriverPrivilege 1096 bCDVtTL.exe Token: SeLoadDriverPrivilege 1884 bCDVtTL.exe Token: SeLoadDriverPrivilege 3812 bCDVtTL.exe Token: SeLoadDriverPrivilege 3936 bCDVtTL.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3628 2040 0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe 77 PID 2040 wrote to memory of 3628 2040 0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe 77 PID 2040 wrote to memory of 3628 2040 0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe 77 PID 3628 wrote to memory of 816 3628 bCDVtTL.exe 78 PID 3628 wrote to memory of 816 3628 bCDVtTL.exe 78 PID 3628 wrote to memory of 816 3628 bCDVtTL.exe 78 PID 816 wrote to memory of 4848 816 bCDVtTL.exe 79 PID 816 wrote to memory of 4848 816 bCDVtTL.exe 79 PID 816 wrote to memory of 4848 816 bCDVtTL.exe 79 PID 4848 wrote to memory of 3596 4848 bCDVtTL.exe 80 PID 4848 wrote to memory of 3596 4848 bCDVtTL.exe 80 PID 4848 wrote to memory of 3596 4848 bCDVtTL.exe 80 PID 3596 wrote to memory of 900 3596 bCDVtTL.exe 81 PID 3596 wrote to memory of 900 3596 bCDVtTL.exe 81 PID 3596 wrote to memory of 900 3596 bCDVtTL.exe 81 PID 900 wrote to memory of 3136 900 bCDVtTL.exe 82 PID 900 wrote to memory of 3136 900 bCDVtTL.exe 82 PID 900 wrote to memory of 3136 900 bCDVtTL.exe 82 PID 3136 wrote to memory of 2808 3136 bCDVtTL.exe 83 PID 3136 wrote to memory of 2808 3136 bCDVtTL.exe 83 PID 3136 wrote to memory of 2808 3136 bCDVtTL.exe 83 PID 2808 wrote to memory of 3096 2808 bCDVtTL.exe 84 PID 2808 wrote to memory of 3096 2808 bCDVtTL.exe 84 PID 2808 wrote to memory of 3096 2808 bCDVtTL.exe 84 PID 3096 wrote to memory of 4976 3096 bCDVtTL.exe 85 PID 3096 wrote to memory of 4976 3096 bCDVtTL.exe 85 PID 3096 wrote to memory of 4976 3096 bCDVtTL.exe 85 PID 4976 wrote to memory of 5040 4976 bCDVtTL.exe 86 PID 4976 wrote to memory of 5040 4976 bCDVtTL.exe 86 PID 4976 wrote to memory of 5040 4976 bCDVtTL.exe 86 PID 5040 wrote to memory of 3200 5040 bCDVtTL.exe 87 PID 5040 wrote to memory of 3200 5040 bCDVtTL.exe 87 PID 5040 wrote to memory of 3200 5040 bCDVtTL.exe 87 PID 3200 wrote to memory of 4700 3200 bCDVtTL.exe 88 PID 3200 wrote to memory of 4700 3200 bCDVtTL.exe 88 PID 3200 wrote to memory of 4700 3200 bCDVtTL.exe 88 PID 4700 wrote to memory of 2976 4700 bCDVtTL.exe 89 PID 4700 wrote to memory of 2976 4700 bCDVtTL.exe 89 PID 4700 wrote to memory of 2976 4700 bCDVtTL.exe 89 PID 2976 wrote to memory of 1440 2976 bCDVtTL.exe 90 PID 2976 wrote to memory of 1440 2976 bCDVtTL.exe 90 PID 2976 wrote to memory of 1440 2976 bCDVtTL.exe 90 PID 1440 wrote to memory of 2404 1440 bCDVtTL.exe 91 PID 1440 wrote to memory of 2404 1440 bCDVtTL.exe 91 PID 1440 wrote to memory of 2404 1440 bCDVtTL.exe 91 PID 2404 wrote to memory of 1420 2404 bCDVtTL.exe 92 PID 2404 wrote to memory of 1420 2404 bCDVtTL.exe 92 PID 2404 wrote to memory of 1420 2404 bCDVtTL.exe 92 PID 1420 wrote to memory of 3616 1420 bCDVtTL.exe 95 PID 1420 wrote to memory of 3616 1420 bCDVtTL.exe 95 PID 1420 wrote to memory of 3616 1420 bCDVtTL.exe 95 PID 3616 wrote to memory of 4288 3616 bCDVtTL.exe 94 PID 3616 wrote to memory of 4288 3616 bCDVtTL.exe 94 PID 3616 wrote to memory of 4288 3616 bCDVtTL.exe 94 PID 4288 wrote to memory of 4284 4288 bCDVtTL.exe 93 PID 4288 wrote to memory of 4284 4288 bCDVtTL.exe 93 PID 4288 wrote to memory of 4284 4288 bCDVtTL.exe 93 PID 4284 wrote to memory of 4932 4284 bCDVtTL.exe 97 PID 4284 wrote to memory of 4932 4284 bCDVtTL.exe 97 PID 4284 wrote to memory of 4932 4284 bCDVtTL.exe 97 PID 4932 wrote to memory of 5012 4932 bCDVtTL.exe 96 PID 4932 wrote to memory of 5012 4932 bCDVtTL.exe 96 PID 4932 wrote to memory of 5012 4932 bCDVtTL.exe 96 PID 5012 wrote to memory of 3944 5012 bCDVtTL.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe"C:\Users\Admin\AppData\Local\Temp\0534f2587a9a7adf6d9c94a3b677edb432220f203625d5167fe0855edf78a366.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe19⤵PID:15200
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe20⤵PID:15628
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe21⤵PID:16076
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe18⤵PID:15140
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe17⤵PID:14960
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe18⤵PID:15224
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe16⤵PID:14868
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe15⤵PID:14512
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe14⤵PID:14552
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe15⤵PID:14744
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe13⤵PID:14372
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe14⤵PID:14452
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe12⤵PID:4884
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵PID:14652
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe11⤵PID:14324
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe10⤵PID:14192
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵PID:13764
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵PID:14604
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe9⤵PID:14216
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵PID:3600
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵PID:14480
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵PID:14700
-
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe8⤵PID:14132
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵PID:14240
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵PID:13504
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵PID:14636
-
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe7⤵PID:13952
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe6⤵PID:13912
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe5⤵PID:13864
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵PID:13964
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe4⤵PID:13816
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe3⤵PID:13748
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:13804
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe2⤵PID:13656
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵PID:13696
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:13732
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵PID:13768
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵PID:13832
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe7⤵PID:13888
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵PID:13976
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵PID:14108
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe3⤵PID:14392
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:16240
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe2⤵PID:5016
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵PID:15656
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:4256
-
-
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe2⤵PID:15312
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵PID:15664
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:16088
-
-
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4036 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:628 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4548 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:308 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:32 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4616 -
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe16⤵PID:16844
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe17⤵PID:17264
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe15⤵PID:17084
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe14⤵PID:16756
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe15⤵PID:17300
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe13⤵PID:16708
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe14⤵PID:17288
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe12⤵PID:16672
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵PID:16920
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe11⤵PID:16656
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵PID:16928
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe10⤵PID:16484
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe9⤵PID:16520
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵PID:17016
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe8⤵PID:16232
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe7⤵PID:16528
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵PID:16992
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe5⤵PID:15872
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵PID:16220
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe4⤵PID:364
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe3⤵PID:15640
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:16144
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵PID:16468
-
-
-
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3112 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe4⤵PID:17440
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe3⤵PID:17336
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe2⤵PID:16860
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:608 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4044 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3088 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2164 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2888 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4292 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2868 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4656 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe15⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5076 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe16⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe12⤵PID:18864
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe11⤵PID:18924
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe10⤵PID:18884
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵PID:19352
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe9⤵PID:18856
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe7⤵PID:18524
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe6⤵PID:18348
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe5⤵PID:17932
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe4⤵PID:17940
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵PID:18200
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵PID:18780
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe3⤵PID:17608
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe2⤵PID:17532
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3908 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1260 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:532 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
-
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3936 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:1764
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵PID:3496
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵
- Enumerates connected drives
PID:1732 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe7⤵
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵PID:4400
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵PID:4236
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵PID:3836
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵PID:3568
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵PID:1108
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵PID:4512
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe14⤵PID:1716
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe15⤵PID:2296
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe16⤵
- Enumerates connected drives
PID:1200 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe17⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3848 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe18⤵
- Drops file in System32 directory
PID:1876 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe19⤵PID:2324
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe20⤵
- Enumerates connected drives
PID:3176 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe21⤵PID:1728
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe22⤵PID:1564
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe23⤵
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe24⤵
- Drops file in System32 directory
PID:4596
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe16⤵PID:23876
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe17⤵PID:25324
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe15⤵PID:23884
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe16⤵PID:25332
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\bCDVtTL\HpGgEAy.exeC:\Windows\system32\bCDVtTL\HpGgEAy.exe10⤵PID:21348
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵
- Drops file in System32 directory
PID:4212 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵PID:4760
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵PID:3576
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4940 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵PID:4740
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵PID:3264
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe7⤵
- Enumerates connected drives
PID:4100 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵PID:2644
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵
- Enumerates connected drives
PID:1508 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵
- Drops file in System32 directory
PID:4224 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵PID:4916
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵PID:1724
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵PID:4724
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe1⤵PID:3480
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe2⤵
- Drops file in System32 directory
PID:340 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe3⤵PID:100
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe4⤵PID:4516
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe5⤵PID:4996
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe6⤵PID:2720
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe7⤵
- Drops file in System32 directory
PID:4188 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe8⤵PID:396
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe9⤵
- Enumerates connected drives
PID:1348 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe10⤵PID:2176
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe11⤵PID:4380
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe12⤵PID:4468
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe13⤵
- Enumerates connected drives
PID:2088 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe14⤵
- Drops file in System32 directory
PID:3224 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe15⤵
- Enumerates connected drives
PID:1344 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe16⤵PID:2700
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe17⤵PID:3892
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe18⤵
- Enumerates connected drives
PID:4352 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe19⤵PID:4988
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe20⤵PID:1848
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe21⤵
- Drops file in System32 directory
PID:1700 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe22⤵PID:1736
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe23⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:1392 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe24⤵
- Enumerates connected drives
PID:3148 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe25⤵
- Drops file in System32 directory
PID:3660 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe26⤵PID:1584
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe27⤵PID:4092
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe28⤵PID:2228
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe29⤵
- Drops file in System32 directory
PID:736 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe30⤵PID:5000
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe31⤵
- Enumerates connected drives
PID:4372 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe32⤵
- Drops file in System32 directory
PID:2368 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe33⤵PID:2556
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe34⤵PID:3476
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe35⤵PID:3784
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe36⤵PID:5128
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe37⤵PID:5156
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe38⤵PID:5172
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe39⤵
- Drops file in System32 directory
PID:5192 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe40⤵PID:5220
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe41⤵PID:5240
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe42⤵PID:5260
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe43⤵PID:5284
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe44⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5312 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe45⤵PID:5328
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe46⤵PID:5348
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe47⤵PID:5376
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe48⤵PID:5392
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe49⤵PID:5416
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe50⤵PID:5444
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe51⤵PID:5460
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe52⤵PID:5476
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe53⤵
- Drops file in System32 directory
PID:5492 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe54⤵PID:5508
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe55⤵PID:5524
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe56⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5540 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe57⤵PID:5552
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe58⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5572 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe59⤵
- Enumerates connected drives
PID:5588 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe60⤵PID:5604
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe61⤵PID:5620
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe62⤵PID:5636
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe63⤵PID:5652
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe64⤵PID:5664
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe65⤵PID:5684
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe66⤵PID:5700
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe67⤵PID:5716
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe68⤵
- Drops file in System32 directory
PID:5732 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe69⤵
- Enumerates connected drives
PID:5760 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe70⤵PID:5784
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe71⤵PID:5804
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe72⤵
- Drops file in System32 directory
PID:5828 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe73⤵PID:5856
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe74⤵PID:5884
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe75⤵PID:5904
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe76⤵PID:5924
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe77⤵PID:5940
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe78⤵PID:5960
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe79⤵PID:5988
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe80⤵
- Enumerates connected drives
PID:6012 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe81⤵PID:6036
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe82⤵PID:6052
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe83⤵
- Enumerates connected drives
PID:6072 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe84⤵PID:6092
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe85⤵
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe86⤵
- Drops file in System32 directory
PID:6132 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe87⤵PID:5184
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe88⤵PID:5280
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe89⤵PID:5344
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe90⤵PID:5440
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe91⤵
- Drops file in System32 directory
PID:5792 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe92⤵PID:5840
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe93⤵
- Drops file in System32 directory
PID:5892 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe94⤵PID:5984
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe95⤵
- Enumerates connected drives
PID:6064 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe96⤵PID:5308
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe97⤵PID:5748
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe98⤵PID:6020
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe99⤵PID:6160
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe100⤵PID:6176
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe101⤵PID:6192
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe102⤵PID:6208
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe103⤵
- Enumerates connected drives
PID:6224 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe104⤵PID:6240
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe105⤵PID:6256
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe106⤵PID:6272
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe107⤵PID:6288
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe108⤵
- Enumerates connected drives
PID:6304 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe109⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:6320 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe110⤵PID:6336
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe111⤵PID:6352
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe112⤵PID:6368
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe113⤵
- Enumerates connected drives
PID:6384 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe114⤵
- Drops file in System32 directory
PID:6400 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe115⤵
- Enumerates connected drives
PID:6416 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe116⤵PID:6432
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe117⤵
- Drops file in System32 directory
PID:6456 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe118⤵PID:6476
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe119⤵
- Enumerates connected drives
PID:6492 -
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe120⤵PID:6512
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe121⤵PID:6536
-
C:\Windows\SysWOW64\HpGgEAy\bCDVtTL.exeC:\Windows\system32\HpGgEAy\bCDVtTL.exe122⤵PID:6552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-