| ZeroBOX

WW.exe "C:\Users\test22\AppData\Local\Temp\WW.exe"
2368
- iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
  2480
  - iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2480 CREDAT:145409
    2552
  - iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2480 CREDAT:145410
    2764
  - iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2480 CREDAT:210945
    2800
- F0geI.exe "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
  2988
- kukurzka9000.exe "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
  2124
- namdoitntn.exe "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
  2240
- real.exe "C:\Program Files (x86)\Company\NewProduct\real.exe"
  2408
- safert44.exe "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
  2500
- tag.exe "C:\Program Files (x86)\Company\NewProduct\tag.exe"
  2652
- jshainx.exe "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
  2924
  - MinecraftForge.exe "C:\Users\test22\AppData\Local\Temp\MinecraftForge.exe"
    3860
    - cmd.exe "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
      3988
      - chcp.com chcp 1251
        4044
      - powershell.exe powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
        4088
      - powershell.exe powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
        2468
      - powershell.exe powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
        3272
    - dllhost.exe "C:\ProgramData\Dllhost\dllhost.exe"
      1172
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3600
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3684
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        2632
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3404
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3620
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        292
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3316
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        1504
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3332
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3832
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        244
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3088
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3856
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3108
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3792
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3340
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1481" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        1512
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1481" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3568
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk579" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        2312
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk579" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        2828
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk406" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3992
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk406" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3756
      - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7066" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        3544
        
        schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7066" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        1060
      - cmd.exe "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        2064
        
        chcp.com chcp 1251
        2656
        
        winlogson.exe C:\ProgramData\Dllhost\winlogson.exe -c config.json
        2120
- ffnameedit.exe "C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"
  2568
- rawxdev.exe "C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"
  2596
- WW1.exe "C:\Program Files (x86)\Company\NewProduct\WW1.exe"
  3096
explorer.exe C:\Windows\Explorer.EXE
1236

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents