| ZeroBOX

ya.exe "C:\Users\test22\AppData\Local\Temp\ya.exe"
7960
- dllhost.exe "C:\Windows\System32\dllhost.exe"
  5916
- cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Poi.vsd
  4384
  - cmd.exe C:\Windows\System32\cmd.exe
    8704
    - findstr.exe findstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd
      8168
    - Agli.exe.com Agli.exe.com D
      4884
      - Agli.exe.com C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com D
        9024
        
        Agli.exe.com C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com D
        6596
        
        Agli.exe.com C:\Users\test22\AppData\Roaming\mbxeFARwrUfNuQPTuPG\Agli.exe.com
        5352
        
        cmd.exe cmd.exe /C ver > "C:\Users\test22\AppData\Local\Temp\chrD6EC.tmp"
        8888
        
        cmd.exe cmd.exe /C wmic process get Name > "C:\Users\test22\AppData\Local\Temp\chrD799.tmp"
        7096
        
        WMIC.exe wmic process get Name
        5932
        
        cmd.exe cmd /c makecab /V3 "C:\Users\test22\AppData\Local\Temp\5e65aaa67ea5c920748e191e17645c6a932f8796" "C:\Users\test22\AppData\Local\Temp\chrD96F.tmp"
        4468
        
        makecab.exe makecab /V3 "C:\Users\test22\AppData\Local\Temp\5e65aaa67ea5c920748e191e17645c6a932f8796" "C:\Users\test22\AppData\Local\Temp\chrD96F.tmp"
        1388
    - PING.EXE ping 127.0.0.1 -n 30
      5272

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents