| ZeroBOX

microa.exe "C:\Users\test22\AppData\Local\Temp\microa.exe"
4564
- microa.exe C:\Users\test22\AppData\Local\Temp\microa.exe
  2228
  - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
    4408
    - cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\Remcos\remcos.exe"
      4848
      - remcos.exe C:\Users\test22\AppData\Roaming\Remcos\remcos.exe
        6696
        
        remcos.exe C:\Users\test22\AppData\Local\Temp\remcos.exe
        4764
        
        wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
        6440
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\Remcos\remcos.exe"
        8700
        
        remcos.exe C:\Users\test22\AppData\Roaming\Remcos\remcos.exe
        4804
        
        remcos.exe C:\Users\test22\AppData\Local\Temp\remcos.exe
        884
        
        wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
        6684
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\Remcos\remcos.exe"
        6124
        
        remcos.exe C:\Users\test22\AppData\Roaming\Remcos\remcos.exe
        6188
        
        remcos.exe C:\Users\test22\AppData\Local\Temp\remcos.exe
        6368
        
        wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
        1308
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\Remcos\remcos.exe"
        4264
        
        remcos.exe C:\Users\test22\AppData\Roaming\Remcos\remcos.exe
        8776

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents