Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25540759683bad52cc6f1e5276c79904.exe
Resource
win7-20231129-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
25540759683bad52cc6f1e5276c79904.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
25540759683bad52cc6f1e5276c79904.exe
-
Size
9KB
-
MD5
25540759683bad52cc6f1e5276c79904
-
SHA1
d16f761c4cfd4ea5f2fdccfd9d4813450b34a40f
-
SHA256
f76b653dd6916f6e6d0fc689c6036e1a0bf2ab1314d70afdaf4bb8d99cf02d56
-
SHA512
43c0ae82d4842eb028fb14c35b21731a7774b2b0626c041d8cce2647b25c749361125b731d4e5f226489255d1d78fafccf84577723f0ff9c8b94790ab678fb40
-
SSDEEP
192:YJM4hLNupBfLBKgcTkeRIeY1QWPIhcVtcsLnW8Pj8cUj6ge0YxmoZaU:YJ5BupFLBKgc1RINPICVtJBPj8BZehxD
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 10112 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2996 RAV008C.exe 2952 RAV008C.exe 2360 RAV008C.exe 2532 RAV008C.exe 2588 RAV008C.exe 2652 RAV008C.exe 2840 RAV008C.exe 2720 RAV008C.exe 2680 RAV008C.exe 2724 RAV008C.exe 2776 RAV008C.exe 2576 RAV008C.exe 2484 RAV008C.exe 2448 RAV008C.exe 2512 RAV008C.exe 2764 RAV008C.exe 3048 RAV008C.exe 2916 RAV008C.exe 1488 RAV008C.exe 1704 RAV008C.exe 2384 RAV008C.exe 1600 RAV008C.exe 2192 RAV008C.exe 2196 RAV008C.exe 404 RAV008C.exe 1320 RAV008C.exe 2376 RAV008C.exe 2036 RAV008C.exe 2032 RAV008C.exe 1044 RAV008C.exe 2040 RAV008C.exe 2012 RAV008C.exe 1228 RAV008C.exe 2424 RAV008C.exe 2708 RAV008C.exe 1208 RAV008C.exe 1360 RAV008C.exe 2476 RAV008C.exe 2804 RAV008C.exe 2800 RAV008C.exe 2536 RAV008C.exe 1980 RAV008C.exe 3000 RAV008C.exe 2768 RAV008C.exe 2784 RAV008C.exe 2100 RAV008C.exe 540 RAV008C.exe 488 RAV008C.exe 544 RAV008C.exe 772 RAV008C.exe 1560 RAV008C.exe 1408 RAV008C.exe 2688 RAV008C.exe 1396 RAV008C.exe 652 RAV008C.exe 1140 RAV008C.exe 1084 RAV008C.exe 1780 RAV008C.exe 692 RAV008C.exe 3044 RAV008C.exe 1976 RAV008C.exe 2172 RAV008C.exe 1284 RAV008C.exe 840 RAV008C.exe -
Loads dropped DLL 64 IoCs
pid Process 2932 25540759683bad52cc6f1e5276c79904.exe 2932 25540759683bad52cc6f1e5276c79904.exe 2996 RAV008C.exe 2996 RAV008C.exe 2952 RAV008C.exe 2952 RAV008C.exe 2360 RAV008C.exe 2360 RAV008C.exe 2532 RAV008C.exe 2532 RAV008C.exe 2588 RAV008C.exe 2588 RAV008C.exe 2652 RAV008C.exe 2652 RAV008C.exe 2840 RAV008C.exe 2840 RAV008C.exe 2720 RAV008C.exe 2720 RAV008C.exe 2680 RAV008C.exe 2680 RAV008C.exe 2724 RAV008C.exe 2724 RAV008C.exe 2776 RAV008C.exe 2776 RAV008C.exe 2576 RAV008C.exe 2576 RAV008C.exe 2484 RAV008C.exe 2484 RAV008C.exe 2448 RAV008C.exe 2448 RAV008C.exe 2512 RAV008C.exe 2512 RAV008C.exe 2764 RAV008C.exe 2764 RAV008C.exe 3048 RAV008C.exe 3048 RAV008C.exe 2916 RAV008C.exe 2916 RAV008C.exe 1488 RAV008C.exe 1488 RAV008C.exe 1704 RAV008C.exe 1704 RAV008C.exe 2384 RAV008C.exe 2384 RAV008C.exe 1600 RAV008C.exe 1600 RAV008C.exe 2192 RAV008C.exe 2192 RAV008C.exe 2196 RAV008C.exe 2196 RAV008C.exe 404 RAV008C.exe 404 RAV008C.exe 1320 RAV008C.exe 1320 RAV008C.exe 2376 RAV008C.exe 2376 RAV008C.exe 2036 RAV008C.exe 2036 RAV008C.exe 2032 RAV008C.exe 2032 RAV008C.exe 1044 RAV008C.exe 1044 RAV008C.exe 2040 RAV008C.exe 2040 RAV008C.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" 25540759683bad52cc6f1e5276c79904.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RAV008C = "C:\\Windows\\system32\\RAV008C.exe" RAV008C.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe File created C:\Windows\SysWOW64\RAV008C.exe RAV008C.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 25540759683bad52cc6f1e5276c79904.exe 2996 RAV008C.exe 2952 RAV008C.exe 2360 RAV008C.exe 2532 RAV008C.exe 2588 RAV008C.exe 2652 RAV008C.exe 2840 RAV008C.exe 2720 RAV008C.exe 2680 RAV008C.exe 2724 RAV008C.exe 2776 RAV008C.exe 2576 RAV008C.exe 2484 RAV008C.exe 2448 RAV008C.exe 2512 RAV008C.exe 2764 RAV008C.exe 3048 RAV008C.exe 2916 RAV008C.exe 1488 RAV008C.exe 1704 RAV008C.exe 2384 RAV008C.exe 1600 RAV008C.exe 2192 RAV008C.exe 2196 RAV008C.exe 404 RAV008C.exe 1320 RAV008C.exe 2376 RAV008C.exe 2036 RAV008C.exe 2032 RAV008C.exe 1044 RAV008C.exe 2040 RAV008C.exe 2012 RAV008C.exe 1228 RAV008C.exe 2424 RAV008C.exe 2708 RAV008C.exe 1208 RAV008C.exe 1360 RAV008C.exe 2476 RAV008C.exe 2804 RAV008C.exe 2800 RAV008C.exe 2536 RAV008C.exe 1980 RAV008C.exe 3000 RAV008C.exe 2768 RAV008C.exe 2784 RAV008C.exe 2100 RAV008C.exe 540 RAV008C.exe 488 RAV008C.exe 544 RAV008C.exe 772 RAV008C.exe 1560 RAV008C.exe 1408 RAV008C.exe 2688 RAV008C.exe 1396 RAV008C.exe 652 RAV008C.exe 1140 RAV008C.exe 1084 RAV008C.exe 1780 RAV008C.exe 692 RAV008C.exe 3044 RAV008C.exe 1976 RAV008C.exe 2172 RAV008C.exe 1284 RAV008C.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2996 2932 25540759683bad52cc6f1e5276c79904.exe 67 PID 2932 wrote to memory of 2996 2932 25540759683bad52cc6f1e5276c79904.exe 67 PID 2932 wrote to memory of 2996 2932 25540759683bad52cc6f1e5276c79904.exe 67 PID 2932 wrote to memory of 2996 2932 25540759683bad52cc6f1e5276c79904.exe 67 PID 2996 wrote to memory of 2952 2996 RAV008C.exe 66 PID 2996 wrote to memory of 2952 2996 RAV008C.exe 66 PID 2996 wrote to memory of 2952 2996 RAV008C.exe 66 PID 2996 wrote to memory of 2952 2996 RAV008C.exe 66 PID 2952 wrote to memory of 2360 2952 RAV008C.exe 65 PID 2952 wrote to memory of 2360 2952 RAV008C.exe 65 PID 2952 wrote to memory of 2360 2952 RAV008C.exe 65 PID 2952 wrote to memory of 2360 2952 RAV008C.exe 65 PID 2360 wrote to memory of 2532 2360 RAV008C.exe 64 PID 2360 wrote to memory of 2532 2360 RAV008C.exe 64 PID 2360 wrote to memory of 2532 2360 RAV008C.exe 64 PID 2360 wrote to memory of 2532 2360 RAV008C.exe 64 PID 2532 wrote to memory of 2588 2532 RAV008C.exe 63 PID 2532 wrote to memory of 2588 2532 RAV008C.exe 63 PID 2532 wrote to memory of 2588 2532 RAV008C.exe 63 PID 2532 wrote to memory of 2588 2532 RAV008C.exe 63 PID 2588 wrote to memory of 2652 2588 RAV008C.exe 62 PID 2588 wrote to memory of 2652 2588 RAV008C.exe 62 PID 2588 wrote to memory of 2652 2588 RAV008C.exe 62 PID 2588 wrote to memory of 2652 2588 RAV008C.exe 62 PID 2652 wrote to memory of 2840 2652 RAV008C.exe 61 PID 2652 wrote to memory of 2840 2652 RAV008C.exe 61 PID 2652 wrote to memory of 2840 2652 RAV008C.exe 61 PID 2652 wrote to memory of 2840 2652 RAV008C.exe 61 PID 2840 wrote to memory of 2720 2840 RAV008C.exe 60 PID 2840 wrote to memory of 2720 2840 RAV008C.exe 60 PID 2840 wrote to memory of 2720 2840 RAV008C.exe 60 PID 2840 wrote to memory of 2720 2840 RAV008C.exe 60 PID 2720 wrote to memory of 2680 2720 RAV008C.exe 59 PID 2720 wrote to memory of 2680 2720 RAV008C.exe 59 PID 2720 wrote to memory of 2680 2720 RAV008C.exe 59 PID 2720 wrote to memory of 2680 2720 RAV008C.exe 59 PID 2680 wrote to memory of 2724 2680 RAV008C.exe 58 PID 2680 wrote to memory of 2724 2680 RAV008C.exe 58 PID 2680 wrote to memory of 2724 2680 RAV008C.exe 58 PID 2680 wrote to memory of 2724 2680 RAV008C.exe 58 PID 2724 wrote to memory of 2776 2724 RAV008C.exe 57 PID 2724 wrote to memory of 2776 2724 RAV008C.exe 57 PID 2724 wrote to memory of 2776 2724 RAV008C.exe 57 PID 2724 wrote to memory of 2776 2724 RAV008C.exe 57 PID 2776 wrote to memory of 2576 2776 RAV008C.exe 56 PID 2776 wrote to memory of 2576 2776 RAV008C.exe 56 PID 2776 wrote to memory of 2576 2776 RAV008C.exe 56 PID 2776 wrote to memory of 2576 2776 RAV008C.exe 56 PID 2576 wrote to memory of 2484 2576 RAV008C.exe 55 PID 2576 wrote to memory of 2484 2576 RAV008C.exe 55 PID 2576 wrote to memory of 2484 2576 RAV008C.exe 55 PID 2576 wrote to memory of 2484 2576 RAV008C.exe 55 PID 2484 wrote to memory of 2448 2484 RAV008C.exe 54 PID 2484 wrote to memory of 2448 2484 RAV008C.exe 54 PID 2484 wrote to memory of 2448 2484 RAV008C.exe 54 PID 2484 wrote to memory of 2448 2484 RAV008C.exe 54 PID 2448 wrote to memory of 2512 2448 RAV008C.exe 53 PID 2448 wrote to memory of 2512 2448 RAV008C.exe 53 PID 2448 wrote to memory of 2512 2448 RAV008C.exe 53 PID 2448 wrote to memory of 2512 2448 RAV008C.exe 53 PID 2512 wrote to memory of 2764 2512 RAV008C.exe 52 PID 2512 wrote to memory of 2764 2512 RAV008C.exe 52 PID 2512 wrote to memory of 2764 2512 RAV008C.exe 52 PID 2512 wrote to memory of 2764 2512 RAV008C.exe 52
Processes
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1704 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10328
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10856
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:9432
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10192
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2192 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10872
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10320
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2376 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10700
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10380
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2040 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10552
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10964
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1360 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10788
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2536 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10932
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11048
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10940
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:488 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11040
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1408 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"4⤵PID:2932
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:10732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10760
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2236
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11004
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11276
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2388
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10924
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10972
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10908
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10680
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10536
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10652
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10428
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10888
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10372
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10880
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10176
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10128
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10160
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10144
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10168
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10184
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10060
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10104
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10024
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10120
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10068
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10096
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10076
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10152
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10044
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10136
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10032
-
-
C:\Users\Admin\AppData\Local\Temp\25540759683bad52cc6f1e5276c79904.exe"C:\Users\Admin\AppData\Local\Temp\25540759683bad52cc6f1e5276c79904.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\25540759683bad52cc6f1e5276c79904.exe"2⤵
- Deletes itself
PID:10112
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:652 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10740
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:692 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11020
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1284 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Executes dropped EXE
PID:840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11012
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2276
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11292
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11220
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:976
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:1532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:2572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11228
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2820
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:1764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11360
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11252
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2112
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:2240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:1488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10644
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1032
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:788
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:572
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵PID:1056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"5⤵PID:1732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"4⤵PID:11084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2168
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11352
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11392
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11156
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11236
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2452
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11320
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2720
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11400
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11284
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11244
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1136
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2588
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11304
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10748
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11408
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10980
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:1596 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:1620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11344
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:888
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:1672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11328
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2064
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:1628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10364
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1520
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:1516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11492
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11960
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:2516 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:2732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12240
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12032
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2592
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:2728
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11476
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2460
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
PID:2612 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:2436
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵PID:2456
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe5⤵PID:1468
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe6⤵PID:2896
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe7⤵PID:1740
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe8⤵
- Drops file in System32 directory
PID:2920 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe9⤵PID:628
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe10⤵PID:276
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe11⤵PID:2164
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe12⤵PID:1612
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe13⤵PID:3080
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe14⤵PID:3092
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe15⤵
- Drops file in System32 directory
PID:3104 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe16⤵PID:3116
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe17⤵PID:3128
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe18⤵PID:3140
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe19⤵PID:3152
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe20⤵PID:3164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"21⤵PID:10036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"20⤵PID:11600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"19⤵PID:10048
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"18⤵PID:12264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"17⤵PID:12084
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"16⤵PID:11824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"15⤵PID:10032
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"14⤵PID:11524
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"13⤵PID:10440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"12⤵PID:12232
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"11⤵PID:12052
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"10⤵PID:12076
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"9⤵PID:12068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"8⤵PID:11816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"7⤵PID:12100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"6⤵PID:11808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"5⤵PID:12060
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"4⤵PID:12256
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12092
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12224
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11452
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11508
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11444
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12248
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11944
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11500
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2596
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11484
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11872
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12024
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2680
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11336
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2360
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:2308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2484
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3212
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11532
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11568
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3260
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3272
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11516
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3320
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11704
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3380
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11640
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10028
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3428
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10388
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3488
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:2376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11696
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3536
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11736
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3572
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11744
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12304
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3632
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11632
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3680
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3692
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12408
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12456
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3740
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12392
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3776
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:3788
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:3800
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵PID:3812
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe5⤵
- Adds Run key to start application
PID:3824 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe6⤵PID:3836
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe7⤵PID:3848
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe8⤵PID:3860
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe9⤵
- Adds Run key to start application
PID:3872 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe10⤵PID:3884
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe11⤵PID:3896
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe12⤵
- Drops file in System32 directory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"13⤵PID:12416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"12⤵PID:12512
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"10⤵PID:12008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"9⤵PID:11780
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"8⤵PID:12432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"7⤵PID:11796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"6⤵PID:12472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"5⤵PID:12384
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"4⤵PID:12464
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12400
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12488
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12336
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11728
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12360
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3704
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12440
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12352
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12448
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3620
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12376
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11752
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12312
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11712
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11204
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11720
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12296
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11608
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:1228
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11688
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11764
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11664
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2528
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11616
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11556
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11656
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3284
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11548
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11648
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11540
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11592
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11832
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11680
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3956
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11952
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3992
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
PID:4004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12560
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4040
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12528
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:4088 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12544
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4140
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4152
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12504
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4176
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12792
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4224
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12768
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4272
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12744
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4320
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4332
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4368
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11976
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4416
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4428
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4476
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4488
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4524
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:2380
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4572
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12752
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4608
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4620
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:4632
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵PID:4644
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe5⤵PID:4656
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe6⤵PID:4668
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe7⤵PID:4680
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe8⤵PID:4692
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe9⤵PID:4704
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"6⤵PID:12320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"5⤵PID:12496
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"4⤵PID:1460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12520
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11880
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4596
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12328
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12204
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:4512
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:4500
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:10468
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:4452
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:2772
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4404
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11968
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12736
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4344
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12600
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4296
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12760
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4248
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12784
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4200
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4164
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12776
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4128
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12592
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11888
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12536
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11936
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12552
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12424
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12568
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11992
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:3920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12584
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4728
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4740
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11904
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4764
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12880
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4800
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12840
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4824
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12888
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4872
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4884
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12156
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4908
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12864
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12164
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:4932 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:11896
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12116
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:4968 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:4980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12196
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5016
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12188
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11984
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5052
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Drops file in System32 directory
PID:5064
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12172
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:5088 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12180
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5112
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5128
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:5140
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12108
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5152
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12124
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5176
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5188
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12140
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5200
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12132
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5236
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5248
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5272
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5284
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:5296
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵PID:5308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"5⤵PID:12872
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"3⤵PID:12832
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:5320 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5336
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:5348
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵PID:5360
-
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5372
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5384
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:5396
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵PID:5408
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe5⤵PID:5420
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe6⤵PID:5432
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe7⤵PID:5444
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe8⤵PID:5456
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe9⤵PID:5468
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe10⤵PID:5480
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe11⤵PID:5492
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe12⤵PID:5504
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe13⤵PID:5516
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe14⤵PID:5528
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe15⤵PID:5544
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe16⤵
- Adds Run key to start application
PID:5556 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe17⤵PID:5568
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe18⤵PID:5580
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe19⤵PID:5592
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe20⤵PID:5604
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe21⤵PID:5616
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe22⤵
- Adds Run key to start application
PID:5628 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe23⤵PID:5640
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe24⤵PID:5652
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe25⤵PID:5664
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe26⤵
- Drops file in System32 directory
PID:5676 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe27⤵PID:5688
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe28⤵PID:5700
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe29⤵PID:5712
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe30⤵PID:5724
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe31⤵
- Adds Run key to start application
PID:5736 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe32⤵PID:5748
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe33⤵PID:5760
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe34⤵PID:5772
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe35⤵PID:5784
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe36⤵PID:5796
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe37⤵PID:5808
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe38⤵PID:5820
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe39⤵PID:5832
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe40⤵PID:5844
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe41⤵PID:5860
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe42⤵PID:5872
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe43⤵
- Drops file in System32 directory
PID:5884 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe44⤵
- Adds Run key to start application
PID:5896 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe45⤵PID:5908
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe46⤵
- Adds Run key to start application
PID:5920 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe47⤵PID:5932
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe48⤵
- Drops file in System32 directory
PID:5944 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe49⤵PID:5956
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe50⤵
- Adds Run key to start application
PID:5968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:5260
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5224
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12216
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12952
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:11912
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5004
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12856
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12148
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12896
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:4860
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12848
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4788
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\SysWOW64\RAV008C.exe"2⤵PID:12904
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:4716
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5980
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:5992
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6004
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
PID:6016
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6028
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Drops file in System32 directory
PID:6040
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6052
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
PID:6064
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Adds Run key to start application
PID:6088 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6100
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6112
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6124
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:6136
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:1856
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:2928
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6160
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6172
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6184
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6196
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:6208
-
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6148
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:5328
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6076
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6220
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6232
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6244
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6256
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6268
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6280
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵
- Drops file in System32 directory
PID:6292 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6304
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6328
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6340
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6368
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6380
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6404
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6416
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6428
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵
- Drops file in System32 directory
PID:6440
-
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe1⤵PID:6452
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe2⤵PID:6464
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe3⤵PID:6476
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe4⤵
- Adds Run key to start application
PID:6488 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe5⤵
- Drops file in System32 directory
PID:6500 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe6⤵PID:6512
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe7⤵
- Adds Run key to start application
PID:6524 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe8⤵PID:6536
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe9⤵PID:6548
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe10⤵PID:6560
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe11⤵PID:6572
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe12⤵
- Drops file in System32 directory
PID:6584 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe13⤵PID:6596
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe14⤵PID:6608
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe15⤵PID:6620
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe16⤵
- Adds Run key to start application
PID:6632 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe17⤵PID:6644
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe18⤵PID:6656
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe19⤵PID:6668
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe20⤵PID:6680
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe21⤵PID:6692
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe22⤵PID:6704
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe23⤵
- Drops file in System32 directory
PID:6720 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe24⤵PID:6732
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe25⤵PID:6744
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe26⤵PID:6756
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe27⤵
- Adds Run key to start application
PID:6768 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe28⤵PID:6780
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe29⤵PID:6792
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe30⤵PID:6804
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe31⤵PID:6816
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe32⤵PID:6828
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe33⤵
- Adds Run key to start application
PID:6840 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe34⤵PID:6852
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe35⤵PID:6864
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe36⤵PID:6876
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe37⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6888 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe38⤵PID:6904
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe39⤵PID:6916
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe40⤵
- Adds Run key to start application
PID:6928 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe41⤵PID:6940
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe42⤵PID:6952
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe43⤵PID:6968
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe44⤵PID:6980
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe45⤵PID:6992
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe46⤵PID:7004
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe47⤵PID:7016
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe48⤵PID:7028
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe49⤵PID:7040
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe50⤵PID:7052
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe51⤵PID:7064
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe52⤵
- Adds Run key to start application
PID:7076 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe53⤵PID:7088
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe54⤵PID:7100
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe55⤵PID:7112
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe56⤵PID:7124
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe57⤵PID:7136
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe58⤵PID:7148
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe59⤵PID:7160
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe60⤵
- Adds Run key to start application
PID:6348 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe61⤵PID:2880
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe62⤵PID:7176
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe63⤵PID:7192
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe64⤵PID:7204
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe65⤵PID:7216
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe66⤵PID:7228
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe67⤵
- Drops file in System32 directory
PID:7240 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe68⤵PID:7252
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe69⤵PID:7264
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe70⤵PID:7276
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe71⤵PID:7288
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe72⤵PID:7300
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe73⤵
- Drops file in System32 directory
PID:7312 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe74⤵PID:7324
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe75⤵PID:7336
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe76⤵PID:7348
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe77⤵PID:7360
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe78⤵
- Drops file in System32 directory
PID:7372 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe79⤵PID:7384
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe80⤵PID:7396
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe81⤵
- Adds Run key to start application
PID:7408 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe82⤵PID:7420
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe83⤵PID:7432
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe84⤵PID:7444
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe85⤵
- Drops file in System32 directory
PID:7456 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe86⤵PID:7468
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe87⤵PID:7480
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe88⤵PID:7492
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe89⤵PID:7504
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe90⤵PID:7516
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe91⤵PID:7528
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe92⤵
- Adds Run key to start application
PID:7544 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe93⤵
- Adds Run key to start application
PID:7556 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe94⤵PID:7568
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe95⤵PID:7580
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe96⤵PID:7592
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe97⤵PID:7604
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe98⤵PID:7616
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe99⤵PID:7628
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe100⤵PID:7640
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe101⤵
- Drops file in System32 directory
PID:7652 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe102⤵PID:7664
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe103⤵PID:7676
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe104⤵
- Adds Run key to start application
PID:7688 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe105⤵PID:7700
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe106⤵PID:7712
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe107⤵PID:7724
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe108⤵PID:7740
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe109⤵
- Adds Run key to start application
PID:7752 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe110⤵PID:7764
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe111⤵PID:7776
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe112⤵PID:7788
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe113⤵
- Adds Run key to start application
PID:7800 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe114⤵
- Adds Run key to start application
PID:7812 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe115⤵PID:7824
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe116⤵PID:7836
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe117⤵PID:7848
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe118⤵PID:7860
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe119⤵
- Adds Run key to start application
PID:7872 -
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe120⤵PID:7884
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe121⤵PID:7896
-
C:\Windows\SysWOW64\RAV008C.exeC:\Windows\system32\RAV008C.exe122⤵PID:7916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-