| ZeroBOX

bet365.exe "C:\Users\test22\AppData\Local\Temp\bet365.exe"
1280
- cmd.exe cmd /k cmd < Irs & exit
  2188
  - cmd.exe cmd
    2300
    - findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      2500
    - tasklist.exe tasklist
      2460
    - tasklist.exe tasklist
      2608
    - findstr.exe findstr /I "wrsa.exe"
      2644
    - cmd.exe cmd /c mkdir 12922
      2732
    - cmd.exe cmd /c copy /b Plants + Ai + Entertaining + Mozilla + Artistic 12922\Publication.pif
      2808
    - cmd.exe cmd /c copy /b Bradley + Observation + Tribune + Tribes + Latinas + Troubleshooting + Shoppingcom + Peak + Canadian + Peterson + Institute + Carrying + Map + Persian + Snow 12922\a
      2852
    - Publication.pif 12922\Publication.pif 12922\a
      2904
    - PING.EXE ping -n 5 localhost
      2940
Publication.pif C:\Users\test22\AppData\Local\Temp\59843\12922\Publication.pif
2088

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis