| ZeroBOX

foto4060.exe "C:\Users\test22\AppData\Local\Temp\foto4060.exe"
2644
- x2971289.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\x2971289.exe
  2704
  - x6794585.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\x6794585.exe
    2772
    - g0899698.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\g0899698.exe
      2828
      - pdates.exe "C:\Users\test22\AppData\Local\Temp\925e7e99c5\pdates.exe"
        2940
        
        schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\test22\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        3060
        
        cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "test22:N"&&CACLS "pdates.exe" /P "test22:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "test22:N"&&CACLS "..\925e7e99c5" /P "test22:R" /E&&Exit
        2072
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2136
        
        cacls.exe CACLS "pdates.exe" /P "test22:N"
        2176
        
        cacls.exe CACLS "pdates.exe" /P "test22:R" /E
        2248
        
        cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2392
        
        cacls.exe CACLS "..\925e7e99c5" /P "test22:N"
        2448
        
        cacls.exe CACLS "..\925e7e99c5" /P "test22:R" /E
        2412
        
        foto4060.exe "C:\Users\test22\AppData\Local\Temp\1000026051\foto4060.exe"
        2824
        
        x5136279.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\x5136279.exe
        2904
        
        x7609095.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\x7609095.exe
        2980
        
        g5266081.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\g5266081.exe
        3004
        
        h2681591.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\h2681591.exe
        800
        
        i9373524.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\i9373524.exe
        320
        
        j0297540.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\j0297540.exe
        536
        
        fotod360.exe "C:\Users\test22\AppData\Local\Temp\1000027051\fotod360.exe"
        2220
        
        y7975502.exe C:\Users\test22\AppData\Local\Temp\IXP006.TMP\y7975502.exe
        2212
        
        y6623953.exe C:\Users\test22\AppData\Local\Temp\IXP007.TMP\y6623953.exe
        2436
        
        k4635838.exe C:\Users\test22\AppData\Local\Temp\IXP008.TMP\k4635838.exe
        2608
        
        l5383585.exe C:\Users\test22\AppData\Local\Temp\IXP008.TMP\l5383585.exe
        1504
        
        m8427536.exe C:\Users\test22\AppData\Local\Temp\IXP007.TMP\m8427536.exe
        1780
        
        du.exe "C:\Users\test22\AppData\Local\Temp\1000028051\du.exe"
        2736
        
        faman.exe "C:\Users\test22\AppData\Local\Temp\1000029051\faman.exe"
        416
        
        control.exe "C:\Windows\System32\control.exe" .\C_0WEQJe.Bs
        1796
        
        rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\C_0WEQJe.Bs
        2304
        
        rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\C_0WEQJe.Bs
        2844
        
        rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\C_0WEQJe.Bs
        2888
        
        rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        2708
    - h4365085.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\h4365085.exe
      2988
  - i4006850.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\i4006850.exe
    2956
- j1860769.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\j1860769.exe
  2812
  - uZBK32pSeMu1Wcf.exe "C:\Users\test22\AppData\Local\Temp\uZBK32pSeMu1Wcf.exe"
    1952
  - cmd.exe /c schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\uZBK32pSeMu1Wcf.exe" /tn "\WindowsAppPool\uZBK32pSeMu1Wcf"
    2696
    - schtasks.exe schtasks /create /F /sc minute /mo 15 /tr "C:\Users\test22\AppData\Local\Temp\uZBK32pSeMu1Wcf.exe" /tn "\WindowsAppPool\uZBK32pSeMu1Wcf"
      1332
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents