| ZeroBOX

Na.exe "C:\Users\test22\AppData\Local\Temp\Na.exe"
2544
- cmd.exe cmd /c sc config "UxSms" start= demand
  2596
  - sc.exe sc config "UxSms" start= demand
    2656
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2756
  - net.exe net stop "Desktop Window Manager Session Manager"
    2816
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2860
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2916
  - net.exe net start "Desktop Window Manager Session Manager"
    2976
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      3020
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"
  1964
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2492
  - net.exe net stop "Desktop Window Manager Session Manager"
    2572
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2684
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2704
  - net.exe net start "Desktop Window Manager Session Manager"
    2796
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      1408
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"
  3032
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2964
  - net.exe net stop "Desktop Window Manager Session Manager"
    2104
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2404
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2484
  - net.exe net start "Desktop Window Manager Session Manager"
    2640
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      776

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents