| ZeroBOX

joiner.exe "C:\Users\test22\AppData\Local\Temp\joiner.exe"
2544
- server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
  2688
  - netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    2784
  - netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
    2916
  - netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    2952
  - svchost.exe "C:\Users\test22\AppData\Roaming\Microsoft\svchost.exe"
    3048
    - server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
      1264
      - netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        2236
      - netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
        2500
      - netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        2528
      - svchost.exe "C:\Users\test22\AppData\Roaming\Microsoft\svchost.exe"
        2700
        
        server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
        2876
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3028
        
        netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
        3036
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        3012
        
        svchost.exe "C:\Users\test22\AppData\Roaming\Microsoft\svchost.exe"
        2124
        
        server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
        2408
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        2684
        
        netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
        2816
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        2372
        
        svchost.exe "C:\Users\test22\AppData\Roaming\Microsoft\svchost.exe"
        2368
        
        server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
        2076
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        1952
        
        netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
        3044
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        884
        
        svchost.exe "C:\Users\test22\AppData\Roaming\Microsoft\svchost.exe"
        1336
        
        server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
        2460
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        2888
        
        netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
        2280
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        2660
        
        svchost.exe "C:\Users\test22\AppData\Roaming\Microsoft\svchost.exe"
        1608
        
        server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
        2516
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        284
        
        netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
        2620
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        1080
        
        svchost.exe "C:\Users\test22\AppData\Roaming\Microsoft\svchost.exe"
        2744
        
        server.exe "C:\Users\test22\AppData\Local\Temp\server.exe"
        2164
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        1576
        
        netsh.exe netsh firewall delete allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe"
        2732
        
        netsh.exe netsh firewall add allowedprogram "C:\Users\test22\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        2860

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents