| ZeroBOX

xKtzvdEoDAjLmvN.exe "C:\Users\test22\AppData\Local\Temp\xKtzvdEoDAjLmvN.exe"
1460
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\xKtzvdEoDAjLmvN.exe"
  2436
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\uXVGwksuXiVBy.exe"
  2496
- schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmpF69F.tmp"
  2556
- xKtzvdEoDAjLmvN.exe "C:\Users\test22\AppData\Local\Temp\xKtzvdEoDAjLmvN.exe"
  2692
  - remcos.exe "C:\ProgramData\Remcos\remcos.exe"
    2820
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Remcos\remcos.exe"
      2992
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\uXVGwksuXiVBy.exe"
      3040
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXVGwksuXiVBy" /XML "C:\Users\test22\AppData\Local\Temp\tmp34C2.tmp"
      2104
    - remcos.exe "C:\ProgramData\Remcos\remcos.exe"
      2032
      - svchost.exe svchost.exe
        2724
        
        iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
        2660
        
        iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2660 CREDAT:145409
        2800
        
        iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2660 CREDAT:79875
        2980
      - svchost.exe svchost.exe
        2132
      - svchost.exe svchost.exe
        2404

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents