| ZeroBOX

photo912.exe "C:\Users\test22\AppData\Local\Temp\photo912.exe"
660
- v6329954.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\v6329954.exe
  1488
  - v2133053.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\v2133053.exe
    2104
    - v2696155.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\v2696155.exe
      2164
      - a9421387.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\a9421387.exe
        2216
      - b9632235.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\b9632235.exe
        2712
    - c4167888.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\c4167888.exe
      2884
  - d4904288.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\d4904288.exe
    3040
    - lamod.exe "C:\Users\test22\AppData\Local\Temp\a9e2a16078\lamod.exe"
      2156
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN lamod.exe /TR "C:\Users\test22\AppData\Local\Temp\a9e2a16078\lamod.exe" /F
        2612
      - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "lamod.exe" /P "test22:N"&&CACLS "lamod.exe" /P "test22:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "test22:N"&&CACLS "..\a9e2a16078" /P "test22:R" /E&&Exit
        2352
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        1800
        
        cacls.exe CACLS "lamod.exe" /P "test22:N"
        1072
        
        cacls.exe CACLS "lamod.exe" /P "test22:R" /E
        2328
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2900
        
        cacls.exe CACLS "..\a9e2a16078" /P "test22:N"
        2992
        
        cacls.exe CACLS "..\a9e2a16078" /P "test22:R" /E
        2944
      - foto164.exe "C:\Users\test22\AppData\Local\Temp\1000007051\foto164.exe"
        2184
        
        x6558453.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\x6558453.exe
        1440
        
        x9212526.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\x9212526.exe
        2428
        
        f6979804.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\f6979804.exe
        2220
        
        g0104781.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\g0104781.exe
        2152
        
        h8741057.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\h8741057.exe
        1804
        
        i2742322.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\i2742322.exe
        2880
      - fotod75.exe "C:\Users\test22\AppData\Local\Temp\1000008051\fotod75.exe"
        2780
        
        y9697386.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\y9697386.exe
        2976
        
        y8949096.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\y8949096.exe
        2940
        
        y5450570.exe C:\Users\test22\AppData\Local\Temp\IXP006.TMP\y5450570.exe
        1676
        
        j5374024.exe C:\Users\test22\AppData\Local\Temp\IXP007.TMP\j5374024.exe
        2856
        
        k5556685.exe C:\Users\test22\AppData\Local\Temp\IXP007.TMP\k5556685.exe
        2304
        
        l0309674.exe C:\Users\test22\AppData\Local\Temp\IXP006.TMP\l0309674.exe
        2708
      - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        3004
- e7254436.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\e7254436.exe
  2228
explorer.exe C:\Windows\Explorer.EXE
1236

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents