| ZeroBOX

photo_410.exe "C:\Users\test22\AppData\Local\Temp\photo_410.exe"
2556
- wa363839.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\wa363839.exe
  2608
  - tn822860.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\tn822860.exe
    2688
    - Mu503333.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\Mu503333.exe
      2732
      - 125298223.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\125298223.exe
        2776
      - 260604685.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\260604685.exe
        2936
    - 389830422.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\389830422.exe
      2980
      - oneetx.exe "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        604
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
        148
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "test22:N"&&CACLS "..\cb7ae701b3" /P "test22:R" /E&&Exit
        2256
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2460
        
        cacls.exe CACLS "oneetx.exe" /P "test22:N"
        2504
        
        cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
        2584
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2656
        
        cacls.exe CACLS "..\cb7ae701b3" /P "test22:N"
        2684
        
        cacls.exe CACLS "..\cb7ae701b3" /P "test22:R" /E
        2872
        
        foto0174.exe "C:\Users\test22\AppData\Local\Temp\1000007051\foto0174.exe"
        536
        
        un044733.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\un044733.exe
        2916
        
        03413863.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\03413863.exe
        2772
        
        rk873095.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\rk873095.exe
        2236
        
        si887271.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\si887271.exe
        2508
        
        foto34.exe "C:\Users\test22\AppData\Local\Temp\1000008051\foto34.exe"
        940
        
        st567195.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\st567195.exe
        744
        
        80954164.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\80954164.exe
        2124
        
        kp833867.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\kp833867.exe
        2664
        
        lr828472.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\lr828472.exe
        1064
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2116
  - 476586955.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\476586955.exe
    1728
- 594526377.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\594526377.exe
  776
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents