| ZeroBOX

service.exe "C:\Users\test22\AppData\Local\Temp\service.exe"
840
- service.exe 1 C:\Users\test22\AppData\Local\Temp\255132002555.ps1 C:\Users\test22\AppData\Local\Temp\435534154234324.txt
  1280
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\test22\AppData\Local\Temp\15002164.ps1" | Out-File -encoding UTF8 "C:\Users\test22\AppData\Local\Temp\42412566645505.txt"
  2780
explorer.exe C:\Windows\Explorer.EXE
1236
- powershell.exe powershell.exe Set-ExecutionPolicy RemoteSigned -Scope Process -Force -Confirm:$false;$PSDefaultParameterValues = @{'Out-File:Encoding' = 'utf8'}; " C:\Users\test22\AppData\Local\Temp\255132002555.ps1" | Out-File -encoding UTF8 "C:\Users\test22\AppData\Local\Temp\435534154234324.txt"
  2212

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis