| ZeroBOX

fotod45.exe "C:\Users\test22\AppData\Local\Temp\fotod45.exe"
2640
- y3022941.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\y3022941.exe
  2744
  - k3948274.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\k3948274.exe
    2788
  - l4090866.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\l4090866.exe
    2980
- n9579444.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\n9579444.exe
  2200
  - danke.exe "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe"
    2456
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
      2596
    - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "test22:N"&&CACLS "danke.exe" /P "test22:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "test22:N"&&CACLS "..\3ec1f323b5" /P "test22:R" /E&&Exit
      2672
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2816
      - cacls.exe CACLS "danke.exe" /P "test22:N"
        2392
      - cacls.exe CACLS "danke.exe" /P "test22:R" /E
        2952
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        776
      - cacls.exe CACLS "..\3ec1f323b5" /P "test22:N"
        1656
      - cacls.exe CACLS "..\3ec1f323b5" /P "test22:R" /E
        2972
    - foto175.exe "C:\Users\test22\AppData\Local\Temp\1000010051\foto175.exe"
      1976
      - x6385145.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x6385145.exe
        1616
        
        f4388758.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\f4388758.exe
        1484
    - fotod45.exe "C:\Users\test22\AppData\Local\Temp\1000011051\fotod45.exe"
      2236
      - y3346153.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\y3346153.exe
        2440
        
        k9205098.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\k9205098.exe
        2684
        
        l4326779.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\l4326779.exe
        452
      - n4210104.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\n4210104.exe
        2936
    - du.exe "C:\Users\test22\AppData\Local\Temp\1000012051\du.exe"
      2736
    - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      2996
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents