| ZeroBOX

photo_112.exe "C:\Users\test22\AppData\Local\Temp\photo_112.exe"
316
- kina8539.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\kina8539.exe
  2132
  - kina3470.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\kina3470.exe
    2176
    - kina7146.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\kina7146.exe
      2252
      - kina7675.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\kina7675.exe
        2312
        
        az024066.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\az024066.exe
        2356
        
        bu308972.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\bu308972.exe
        2800
      - cor0898.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\cor0898.exe
        2848
    - dbZ77s50.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\dbZ77s50.exe
      2892
  - en867709.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\en867709.exe
    2936
- ge565254.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ge565254.exe
  2248
  - oneetx.exe "C:\Users\test22\AppData\Local\Temp\595f021478\oneetx.exe"
    2104
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\595f021478\oneetx.exe" /F
      2720
    - foto0154.exe "C:\Users\test22\AppData\Local\Temp\1000004051\foto0154.exe"
      2852
      - un980364.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\un980364.exe
        2216
        
        un862395.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\un862395.exe
        2788
        
        pr739684.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\pr739684.exe
        2452
        
        qu242309.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\qu242309.exe
        2072
        
        rk146336.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\rk146336.exe
        2272
      - si289156.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\si289156.exe
        2096
    - fotocr17.exe "C:\Users\test22\AppData\Local\Temp\1000005051\fotocr17.exe"
      2228
      - ziYp2030.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ziYp2030.exe
        2040
        
        ziuM0553.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\ziuM0553.exe
        2304
        
        it009576.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\it009576.exe
        2396
        
        jr585388.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\jr585388.exe
        2160
        
        kp479679.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\kp479679.exe
        1688
      - lr389987.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\lr389987.exe
        1900
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      2136
explorer.exe C:\Windows\Explorer.EXE
1236

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents