| ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

| ZeroBOX

PI_nr_784_(REV).exe "C:\Users\test22\AppData\Local\Temp\PI_nr_784_(REV).exe"
2192
- cmd.exe cmd /c ""C:\Users\test22\Rzkqpszzt.bat" "
  2476
  - cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\RzkqpszzO.bat
    1628
    - net.exe net session
      2628
      - net1.exe C:\Windows\system32\net1 session
        2632
    - whoami.exe whoami /groups
      2880
    - findstr.exe findstr /i "\<S-1-5-32-544\>"
      2860
    - cmd.exe C:\Windows\system32\cmd.exe /c ver
      2828
    - cmd.exe C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
      2148
      - reg.exe REG QUERY "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin
        2228
    - powershell.exe powershell -c Start-Process "C:\Users\test22\Cdex.bat" -Verb runas
      1548
      - cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\test22\Cdex.bat"
        296
        
        powershell.exe powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        2544

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf