| ZeroBOX

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\pdf.ps1
2544
- tmpF8C7.exe "C:\Users\test22\AppData\Local\Temp\tmpF8C7.exe"
  2704
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\tmpF8C7.exe"
    2904
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\gFnEPEuEhX.exe"
    2960
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gFnEPEuEhX" /XML "C:\Users\test22\AppData\Local\Temp\tmp581D.tmp"
    3000
  - tmpF8C7.exe "C:\Users\test22\AppData\Local\Temp\tmpF8C7.exe"
    800
    - process.exe "C:\ProgramData\Tencent\process.exe"
      148
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gFnEPEuEhX" /XML "C:\Users\test22\AppData\Local\Temp\tmpB0BD.tmp"
        2784
      - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Roaming\gFnEPEuEhX.exe"
        2612
      - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Tencent\process.exe"
        2716
      - process.exe "C:\ProgramData\Tencent\process.exe"
        1796
        
        recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\test22\AppData\Local\Temp\vyfeuhxwjibvrjt"
        2760
        
        recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\test22\AppData\Local\Temp\fasonaiqxqtibpizyt"
        2084
        
        recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\test22\AppData\Local\Temp\quyhostrlzlneeedpehqj"
        3008
        
        recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\test22\AppData\Local\Temp\ndzrljywndhla"
        2664
        
        recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\test22\AppData\Local\Temp\xgeklcjyjlzycrsr"
        828
        
        recover.exe C:\Windows\SysWOW64\recover.exe /stext "C:\Users\test22\AppData\Local\Temp\hajumutsxtrdnxgvappx"
        2696

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents