| ZeroBOX

actives.exe "C:\Users\test22\AppData\Local\Temp\actives.exe"
2540
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\zbe2024101632843703.bat" "
  2608
  - schtasks.exe Schtasks.Exe /delete /tn "Maintenance" /f
    2692
  - schtasks.exe Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\test22\AppData\Local\Temp\zx2024101632843703.xml"
    2808
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\zb2024101632843703.bat" "
  2736
  - chcp.com chcp 1251
    2852
  - actives.exe "C:\Users\test22\AppData\Local\Temp\actives.exe"
    2904
    - Minha Conta.exe "C:\Users\test22\AppData\Roaming\Minha Conta.exe" C:\Users\test22\AppData\Local\Temp\actives.exe
      3044
      - wmiintegrator.exe "C:\Users\test22\AppData\Roaming\Windows Objects\wmiintegrator.exe" unk
        1152
        
        wmihostwin.exe "C:\Users\test22\AppData\Roaming\Windows Objects\wmihostwin.exe" unk2
        2168
        
        wmimic.exe "C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe" unk3
        2628
        
        wmisecure.exe "C:\Users\test22\AppData\Roaming\Windows Objects\wmisecure.exe" execute
        2768
        
        wmisecure64.exe "C:\Users\test22\AppData\Roaming\Windows Objects\wmisecure64.exe" autorun
        2824
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        3020
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2072
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2196
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2648
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        204
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1852
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2284
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1332
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2788
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        544
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1080
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2856
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2176
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1264
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1252
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1040
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2684
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        3036
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        2604
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1928
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1736
        
        reg.exe "C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\test22\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f
        1576
  - timeout.exe timeout /t 3 /nobreak
    2988

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents