| ZeroBOX

Na.exe "C:\Users\test22\AppData\Local\Temp\Na.exe"
2548
- cmd.exe cmd /c sc config "UxSms" start= demand
  2624
  - sc.exe sc config "UxSms" start= demand
    2684
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2764
  - net.exe net stop "Desktop Window Manager Session Manager"
    2824
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2868
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2932
  - net.exe net start "Desktop Window Manager Session Manager"
    2992
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      3036
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"
  2076
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2496
  - net.exe net stop "Desktop Window Manager Session Manager"
    2644
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2740
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2604
  - net.exe net start "Desktop Window Manager Session Manager"
    2840
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      2128
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"
  3056
- cmd.exe cmd /c net stop "Desktop Window Manager Session Manager"
  2980
  - net.exe net stop "Desktop Window Manager Session Manager"
    2064
    - net1.exe C:\Windows\system32\net1 stop "Desktop Window Manager Session Manager"
      2508
- cmd.exe cmd /c net start "Desktop Window Manager Session Manager"
  2536
  - net.exe net start "Desktop Window Manager Session Manager"
    2628
    - net1.exe C:\Windows\system32\net1 start "Desktop Window Manager Session Manager"
      1304

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents