| ZeroBOX

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\mq.ps1
2552
- cmd.exe "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe
  2704
  - taskkill.exe taskkill /f /im dsm.exe
    2760
- cmd.exe "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe
  2868
  - taskkill.exe taskkill /f /im dom.exe
    2912
- cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\*
  2976
- cmd.exe "C:\Windows\system32\cmd.exe" /c taskkill /f /im WindowsUpdate.exe
  3020
  - taskkill.exe taskkill /f /im WindowsUpdate.exe
    3064
- cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe
  2084
- cmd.exe "C:\Windows\system32\cmd.exe" /c attrib -s -h -r %tmp%\config.json
  1264
  - attrib.exe attrib -s -h -r C:\Users\test22\AppData\Local\Temp\config.json
    148
- cmd.exe "C:\Windows\system32\cmd.exe" /c attrib -s -h -r C:\Windows\temp\config.json
  2208
  - attrib.exe attrib -s -h -r C:\Windows\temp\config.json
    2272
- cmd.exe "C:\Windows\system32\cmd.exe" /c rd /s /q %tmp%\config.json
  2464
- cmd.exe "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Windows\temp\config.json
  2548
- cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +R +S +H %tmp%\config.json
  2080
  - attrib.exe attrib +R +S +H C:\Users\test22\AppData\Local\Temp\config.json
    2124
- cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +R +S +H C:\Windows\temp\config.json
  196
  - attrib.exe attrib +R +S +H C:\Windows\temp\config.json
    2424
- cmd.exe "C:\Windows\system32\cmd.exe" /c taskkill /f /im shella.exe
  2524
  - taskkill.exe taskkill /f /im shella.exe
    2716

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents