| ZeroBOX

scania54646.exe "C:\Users\test22\AppData\Local\Temp\scania54646.exe"
840
- scania54646.exe "C:\Users\test22\AppData\Local\Temp\scania54646.exe"
  2504
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\GLqLto.exe"
    2096
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GLqLto" /XML "C:\Users\test22\AppData\Local\Temp\tmpC8B5.tmp"
    2324
- chrome.exe "C:\Users\test22\AppData\Local\Temp\chrome.exe"
  2596
  - chrome.exe "C:\Users\test22\AppData\Local\Temp\chrome.exe"
    2956
  - cmd.exe "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost"
    2812
  - cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
    2852
    - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
      2460
  - cmd.exe "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\chrome.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
    1656
- cmd.exe "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\chrome"
  2640
- cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
  2712
  - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\chrome\chrome.exe'" /f
    2768
- cmd.exe "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\scania54646.exe" "C:\Users\test22\AppData\Roaming\chrome\chrome.exe"
  2816

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents