| ZeroBOX

photo170.exe "C:\Users\test22\AppData\Local\Temp\photo170.exe"
2584
- v5161549.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\v5161549.exe
  2636
  - v5218568.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\v5218568.exe
    2716
    - a2860925.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\a2860925.exe
      2764
    - b6900950.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\b6900950.exe
      2944
      - danke.exe "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe"
        3052
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
        2068
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "test22:N"&&CACLS "danke.exe" /P "test22:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "test22:N"&&CACLS "..\3ec1f323b5" /P "test22:R" /E&&Exit
        2248
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2380
        
        cacls.exe CACLS "danke.exe" /P "test22:N"
        2484
        
        cacls.exe CACLS "danke.exe" /P "test22:R" /E
        2564
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2664
        
        cacls.exe CACLS "..\3ec1f323b5" /P "test22:N"
        2732
        
        cacls.exe CACLS "..\3ec1f323b5" /P "test22:R" /E
        2848
        
        foto135.exe "C:\Users\test22\AppData\Local\Temp\1000038051\foto135.exe"
        1456
        
        x6412530.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\x6412530.exe
        1792
        
        g8876974.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\g8876974.exe
        2920
        
        h0247653.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\h0247653.exe
        2284
        
        j9687903.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\j9687903.exe
        536
        
        fotod25.exe "C:\Users\test22\AppData\Local\Temp\1000039051\fotod25.exe"
        812
        
        y8069687.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\y8069687.exe
        2076
        
        k3151030.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\k3151030.exe
        2112
        
        l8349481.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\l8349481.exe
        1376
        
        n3861378.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\n3861378.exe
        1976
        
        an.exe "C:\Users\test22\AppData\Local\Temp\1000040051\an.exe"
        2376
        
        outsidevariety.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\outsidevariety.exe
        192
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2372
  - c3584474.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\c3584474.exe
    1152
- d4057680.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\d4057680.exe
  2120
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents