| ZeroBOX

file.exe "C:\Users\test22\AppData\Local\Temp\file.exe"
1460
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\run.vbs"
  2084
  - update.exe "C:\Users\test22\AppData\Local\Temp\RarSFX0\update.exe"
    2176
    - cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
      2340
  - setup.exe "C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe"
    2244
    - setup.exe "C:\Users\test22\AppData\Local\Temp\RarSFX0\setup.exe"
      2348
explorer.exe C:\Windows\Explorer.EXE
1236
ctfmon.exe "C:\Windows\SysWOW64\ctfmon.exe"
2836
- firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
  1156
explorer.exe explorer.exe
2956

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis