| ZeroBOX

photo_727.exe "C:\Users\test22\AppData\Local\Temp\photo_727.exe"
2544
- v1557743.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\v1557743.exe
  2596
  - a4172395.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\a4172395.exe
    2672
  - b7807161.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\b7807161.exe
    2844
- d2627477.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\d2627477.exe
  1216
  - oneetx.exe "C:\Users\test22\AppData\Local\Temp\c3912af058\oneetx.exe"
    1356
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\c3912af058\oneetx.exe" /F
      2220
    - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\c3912af058" /P "test22:N"&&CACLS "..\c3912af058" /P "test22:R" /E&&Exit
      2264
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2508
      - cacls.exe CACLS "oneetx.exe" /P "test22:N"
        2556
      - cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
        2688
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2640
      - cacls.exe CACLS "..\c3912af058" /P "test22:N"
        2784
      - cacls.exe CACLS "..\c3912af058" /P "test22:R" /E
        204
    - foto0183.exe "C:\Users\test22\AppData\Local\Temp\1000001051\foto0183.exe"
      1576
      - x5425468.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x5425468.exe
        1892
        
        g0249443.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\g0249443.exe
        2932
        
        h5276126.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\h5276126.exe
        916
      - i0550857.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\i0550857.exe
        544
    - fotocr54.exe "C:\Users\test22\AppData\Local\Temp\1000002051\fotocr54.exe"
      3008
      - y5920556.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y5920556.exe
        3028
        
        k8811583.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\k8811583.exe
        1632
        
        l2340798.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\l2340798.exe
        2624
      - m1100438.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\m1100438.exe
        2312
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      2148
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents