| ZeroBOX

SS.exe "C:\Users\test22\AppData\Local\Temp\SS.exe"
2556
- cmd.exe cmd /c sc config "UxSms" start= demand
  2632
  - sc.exe sc config "UxSms" start= demand
    2692
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2768
  - net.exe net stop "Desktop Window Manager Session Manager"
    2828
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2872
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2932
  - net.exe net start "Desktop Window Manager Session Manager"
    2992
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      3036
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"
  2076
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2552
  - net.exe net stop "Desktop Window Manager Session Manager"
    2644
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2696
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2364
  - net.exe net start "Desktop Window Manager Session Manager"
    2840
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      1144
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"
  3068
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2996
  - net.exe net stop "Desktop Window Manager Session Manager"
    2224
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      284
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2576
  - net.exe net start "Desktop Window Manager Session Manager"
    2688
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      776

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents