| ZeroBOX

fotod25.exe "C:\Users\test22\AppData\Local\Temp\fotod25.exe"
1188
- y4937624.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y4937624.exe
  2164
  - y1672558.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\y1672558.exe
    2232
    - y1326850.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y1326850.exe
      2292
      - j3040911.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\j3040911.exe
        2336
        
        AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2404
      - k0118956.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\k0118956.exe
        2556
    - l4980171.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\l4980171.exe
      2932
  - m8178462.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\m8178462.exe
    2196
    - lamod.exe "C:\Users\test22\AppData\Local\Temp\a9e2a16078\lamod.exe"
      2384
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\test22\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
        2676
      - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "test22:N"&&CACLS "lamod.exe" /P "test22:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "test22:N"&&CACLS "..\a9e2a16078" /P "test22:R" /E&&Exit
        1676
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2624
        
        cacls.exe CACLS "lamod.exe" /P "test22:N"
        2620
        
        cacls.exe CACLS "lamod.exe" /P "test22:R" /E
        2976
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2264
        
        cacls.exe CACLS "..\a9e2a16078" /P "test22:N"
        2432
        
        cacls.exe CACLS "..\a9e2a16078" /P "test22:R" /E
        2340
      - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2936
- n4366049.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\n4366049.exe
  2444
  - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    2732
explorer.exe C:\Windows\Explorer.EXE
1236

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents