| ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

| ZeroBOX

payload.exe "C:\Users\test22\AppData\Local\Temp\payload.exe"
2560
- abgrcnq.exe C:\Users\test22\AppData\Roaming\Z0BAZwxx\abgrcnq.exe
  2676
  - cmd.exe /a /c netsh advfirewall firewall add rule name="Z0BAZwxx" dir=in action=allow program="C:\Users\test22\AppData\Roaming\Z0BAZwxx\abgrcnq.exe"
    2884
    - netsh.exe netsh advfirewall firewall add rule name="Z0BAZwxx" dir=in action=allow program="C:\Users\test22\AppData\Roaming\Z0BAZwxx\abgrcnq.exe"
      2944
  - abgrcnq.exe "C:\Users\test22\AppData\Roaming\Z0BAZwxx\abgrcnq.exe"
    3008
- cmd.exe /a /c ping 127.0.0.1 -n 3&del "C:\Users\test22\AppData\Local\Temp\payload.exe"
  2760
  - PING.EXE ping 127.0.0.1 -n 3
    2824

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf