| ZeroBOX

scandk464646464.exe "C:\Users\test22\AppData\Local\Temp\scandk464646464.exe"
1532
- Powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Local\Temp\scandk464646464.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anydesk.exe.exe'
  2164
- scandk464646464.exe "C:\Users\test22\AppData\Local\Temp\scandk464646464.exe"
  2500
  - Tswbdzzhdxro.exe "C:\Users\test22\AppData\Local\Temp\Tswbdzzhdxro.exe"
    2828
    - Powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Local\Temp\Tswbdzzhdxro.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe.exe'
      2964
    - Tswbdzzhdxro.exe "C:\Users\test22\AppData\Local\Temp\Tswbdzzhdxro.exe"
      1000
  - Qputuwjvixr.exe "C:\Users\test22\AppData\Local\Temp\Qputuwjvixr.exe"
    2868
    - Qputuwjvixr.exe "C:\Users\test22\AppData\Local\Temp\Qputuwjvixr.exe"
      1960
    - cmd.exe "cmd.exe" /C mkdir "C:\Users\test22\AppData\Roaming\svchost"
      1676
    - cmd.exe "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
      2692
      - schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\test22\AppData\Roaming\svchost\svchost.exe'" /f
        2856
    - cmd.exe "cmd.exe" /C copy "C:\Users\test22\AppData\Local\Temp\Qputuwjvixr.exe" "C:\Users\test22\AppData\Roaming\svchost\svchost.exe"
      2816

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents