| ZeroBOX

photo_112.exe "C:\Users\test22\AppData\Local\Temp\photo_112.exe"
2560
- ki883322.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ki883322.exe
  2612
  - ki530062.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\ki530062.exe
    2684
    - ki717776.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\ki717776.exe
      2740
      - ki425492.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\ki425492.exe
        2784
        
        az898093.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\az898093.exe
        2828
        
        bu994032.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\bu994032.exe
        3020
      - cor4469.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\cor4469.exe
        3064
    - dvA69s46.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\dvA69s46.exe
      1964
      - oneetx.exe "C:\Users\test22\AppData\Local\Temp\595f021478\oneetx.exe"
        196
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\595f021478\oneetx.exe" /F
        2428
        
        foto0154.exe "C:\Users\test22\AppData\Local\Temp\1000001051\foto0154.exe"
        2644
        
        un391298.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\un391298.exe
        2668
        
        un767980.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\un767980.exe
        2728
        
        pr259072.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\pr259072.exe
        2856
        
        qu134949.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\qu134949.exe
        2968
        
        rk372809.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\rk372809.exe
        1304
        
        si046543.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\si046543.exe
        2104
        
        fotocr17.exe "C:\Users\test22\AppData\Local\Temp\1000002051\fotocr17.exe"
        1656
        
        ziyk0479.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\ziyk0479.exe
        1780
        
        ziEQ0567.exe C:\Users\test22\AppData\Local\Temp\IXP006.TMP\ziEQ0567.exe
        2320
        
        it878033.exe C:\Users\test22\AppData\Local\Temp\IXP007.TMP\it878033.exe
        3004
        
        jr293151.exe C:\Users\test22\AppData\Local\Temp\IXP007.TMP\jr293151.exe
        2448
        
        kp610283.exe C:\Users\test22\AppData\Local\Temp\IXP006.TMP\kp610283.exe
        1668
        
        lr320687.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\lr320687.exe
        2832
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        1632
  - ft460785.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\ft460785.exe
    2236
- ge919894.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ge919894.exe
  1576
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents