| ZeroBOX

Y2Q0MzM1.exe "C:\Users\test22\AppData\Local\Temp\Y2Q0MzM1.exe"
2556
- x3618941.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x3618941.exe
  2616
  - x4612096.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\x4612096.exe
    2684
    - f5747904.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\f5747904.exe
      2728
    - g3084756.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\g3084756.exe
      2980
  - h4990012.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\h4990012.exe
    2084
    - h4990012.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\h4990012.exe
      2136
      - oneetx.exe "C:\Users\test22\AppData\Local\Temp\c3912af058\oneetx.exe"
        2588
        
        oneetx.exe C:\Users\test22\AppData\Local\Temp\c3912af058\oneetx.exe
        2388
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\c3912af058\oneetx.exe" /F
        1536
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\c3912af058" /P "test22:N"&&CACLS "..\c3912af058" /P "test22:R" /E&&Exit
        2968
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2308
        
        cacls.exe CACLS "oneetx.exe" /P "test22:N"
        3060
        
        cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
        1948
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        1364
        
        cacls.exe CACLS "..\c3912af058" /P "test22:N"
        2072
        
        cacls.exe CACLS "..\c3912af058" /P "test22:R" /E
        2104
        
        fotocr05.exe "C:\Users\test22\AppData\Local\Temp\1000032051\fotocr05.exe"
        2836
        
        y2456585.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y2456585.exe
        1512
        
        y4802370.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y4802370.exe
        2584
        
        k9126803.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\k9126803.exe
        2844
        
        l5468402.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\l5468402.exe
        1108
        
        m6117018.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\m6117018.exe
        176
        
        metado.exe "C:\Users\test22\AppData\Local\Temp\a9e2a16078\metado.exe"
        2372
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2088
- i7478602.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\i7478602.exe
  2216
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents