| ZeroBOX

Practical3.exe "C:\Users\test22\AppData\Local\Temp\Practical3.exe"
1868
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM zoolz.exe /F
  2800
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM agntsvc.exe /F
  668
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM dbeng50.exe /F
  888
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM dbsnmp.exe /F
  1240
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM encsvc.exe /F
  2212
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM excel.exe /F
  1348
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM firefoxconfig.exe /F
  2744
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM infopath.exe /F
  1120
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM isqlplussvc.exe /F
  1108
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM msaccess.exe /F
  1596
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM msftesql.exe /F
  2720
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM mspub.exe /F
  1892
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM mydesktopqos.exe /F
  2064
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM mydesktopservice.exe /F
  108
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM mysqld.exe /F
  2648
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM mysqld-nt.exe /F
  1884
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM mysqld-opt.exe /F
  3020
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM ocautoupds.exe /F
  2252
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM ocomm.exe /F
  2412
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM ocssd.exe /F
  2888
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM onenote.exe /F
  1828
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM oracle.exe /F
  2092
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM outlook.exe /F
  2120
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM powerpnt.exe /F
  2388
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM sqbcoreservice.exe /F
  2852
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM sqlagent.exe /F
  2772
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM sqlbrowser.exe /F
  1116
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM sqlservr.exe /F
  1744
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM sqlwriter.exe /F
  2408
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM steam.exe /F
  1760
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM synctime.exe /F
  2080
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM tbirdconfig.exe /F
  2128
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM thebat.exe /F
  2540
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM thebat64.exe /F
  2776
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM thunderbird.exe /F
  2608
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM visio.exe /F
  2340
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM winword.exe /F
  2192
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM wordpad.exe /F
  2432
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM xfssvccon.exe /F
  916
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM tmlisten.exe /F
  2696
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM PccNTMon.exe /F
  2988
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM CNTAoSMgr.exe /F
  3092
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM Ntrtscan.exe /F
  3200
- taskkill.exe "C:\Windows\System32\taskkill.exe" /IM mbamtray.exe /F
  3284
- net.exe "C:\Windows\System32\net.exe" stop "Acronis VSS Provider" /y
  3368
  - net1.exe C:\Windows\system32\net1 stop "Acronis VSS Provider" /y
    3432
- net.exe "C:\Windows\System32\net.exe" stop "Enterprise Client Service" /y
  3476
  - net1.exe C:\Windows\system32\net1 stop "Enterprise Client Service" /y
    3540
- net.exe "C:\Windows\System32\net.exe" stop "Sophos Agent" /y
  3592
  - net1.exe C:\Windows\system32\net1 stop "Sophos Agent" /y
    3656
- net.exe "C:\Windows\System32\net.exe" stop "Sophos AutoUpdate Service" /y
  3700
  - net1.exe C:\Windows\system32\net1 stop "Sophos AutoUpdate Service" /y
    3764
- net.exe "C:\Windows\System32\net.exe" stop "Sophos Clean Service" /y
  3844
  - net1.exe C:\Windows\system32\net1 stop "Sophos Clean Service" /y
    3908
- net.exe "C:\Windows\System32\net.exe" stop "Sophos Device Control Service" /y
  3960
  - net1.exe C:\Windows\system32\net1 stop "Sophos Device Control Service" /y
    4024
- net.exe "C:\Windows\System32\net.exe" stop "Sophos File Scanner Service" /y
  4068
  - net1.exe C:\Windows\system32\net1 stop "Sophos File Scanner Service" /y
    652
- net.exe "C:\Windows\System32\net.exe" stop "Sophos Health Service" /y
  3180
  - net1.exe C:\Windows\system32\net1 stop "Sophos Health Service" /y
    3228
- net.exe "C:\Windows\System32\net.exe" stop "Sophos MCS Agent" /y
  3244
  - net1.exe C:\Windows\system32\net1 stop "Sophos MCS Agent" /y
    3352
- net.exe "C:\Windows\System32\net.exe" stop "Sophos MCS Client" /y
  3444
  - net1.exe C:\Windows\system32\net1 stop "Sophos MCS Client" /y
    2616
- net.exe "C:\Windows\System32\net.exe" stop "Sophos Message Router" /y
  3560
  - net1.exe C:\Windows\system32\net1 stop "Sophos Message Router" /y
    3604
- net.exe "C:\Windows\System32\net.exe" stop "Sophos Safestore Service" /y
  3720
  - net1.exe C:\Windows\system32\net1 stop "Sophos Safestore Service" /y
    3760
- net.exe "C:\Windows\System32\net.exe" stop "Sophos System Protection Service" /y
  2592
  - net1.exe C:\Windows\system32\net1 stop "Sophos System Protection Service" /y
    3864
- net.exe "C:\Windows\System32\net.exe" stop "Sophos Web Control Service" /y
  3912
  - net1.exe C:\Windows\system32\net1 stop "Sophos Web Control Service" /y
    1344
- net.exe "C:\Windows\System32\net.exe" stop "SQLsafe Backup Service" /y
  3976
  - net1.exe C:\Windows\system32\net1 stop "SQLsafe Backup Service" /y
    3964
- net.exe "C:\Windows\System32\net.exe" stop "SQLsafe Filter Service" /y
  3088
  - net1.exe C:\Windows\system32\net1 stop "SQLsafe Filter Service" /y
    3080
- net.exe "C:\Windows\System32\net.exe" stop "Symantec System Recovery" /y
  3272
  - net1.exe C:\Windows\system32\net1 stop "Symantec System Recovery" /y
    3360
- net.exe "C:\Windows\System32\net.exe" stop "Veeam Backup Catalog Data Service" /y
  3344
  - net1.exe C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service" /y
    2828
- net.exe "C:\Windows\System32\net.exe" stop AcronisAgent /y
  2600
  - net1.exe C:\Windows\system32\net1 stop AcronisAgent /y
    3552
- net.exe "C:\Windows\System32\net.exe" stop AcrSch2Svc /y
  3776
  - net1.exe C:\Windows\system32\net1 stop AcrSch2Svc /y
    3716
- net.exe "C:\Windows\System32\net.exe" stop Antivirus /y
  3804
  - net1.exe C:\Windows\system32\net1 stop Antivirus /y
    2036
- net.exe "C:\Windows\System32\net.exe" stop ARSM /y
  2700
  - net1.exe C:\Windows\system32\net1 stop ARSM /y
    604
- net.exe "C:\Windows\System32\net.exe" stop BackupExecAgentAccelerator /y
  3104
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    3184
- net.exe "C:\Windows\System32\net.exe" stop BackupExecAgentBrowser /y
  3400
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3460
- net.exe "C:\Windows\System32\net.exe" stop BackupExecDeviceMediaService /y
  2536
  - net1.exe C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
    3740
- net.exe "C:\Windows\System32\net.exe" stop BackupExecJobEngine /y
  3812
  - net1.exe C:\Windows\system32\net1 stop BackupExecJobEngine /y
    3920
- net.exe "C:\Windows\System32\net.exe" stop BackupExecManagementService /y
  2512
  - net1.exe C:\Windows\system32\net1 stop BackupExecManagementService /y
    3084
- net.exe "C:\Windows\System32\net.exe" stop BackupExecRPCService /y
  2752
  - net1.exe C:\Windows\system32\net1 stop BackupExecRPCService /y
    2756
- net.exe "C:\Windows\System32\net.exe" stop BackupExecVSSProvider /y
  1520
  - net1.exe C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    2920
- net.exe "C:\Windows\System32\net.exe" stop bedbg /y
  3728
  - net1.exe C:\Windows\system32\net1 stop bedbg /y
    3624
- net.exe "C:\Windows\System32\net.exe" stop DCAgent /y
  3928
  - net1.exe C:\Windows\system32\net1 stop DCAgent /y
    1208
- net.exe "C:\Windows\System32\net.exe" stop EPSecurityService /y
  2088
  - net1.exe C:\Windows\system32\net1 stop EPSecurityService /y
    3504
- net.exe "C:\Windows\System32\net.exe" stop EPUpdateService /y
  3076
  - net1.exe C:\Windows\system32\net1 stop EPUpdateService /y
    3784
- net.exe "C:\Windows\System32\net.exe" stop EraserSvc11710 /y
  1064
  - net1.exe C:\Windows\system32\net1 stop EraserSvc11710 /y
    3904
- net.exe "C:\Windows\System32\net.exe" stop EsgShKernel /y
  1272
  - net1.exe C:\Windows\system32\net1 stop EsgShKernel /y
    3520
- net.exe "C:\Windows\System32\net.exe" stop FA_Scheduler /y
  3528
  - net1.exe C:\Windows\system32\net1 stop FA_Scheduler /y
    196
- net.exe "C:\Windows\System32\net.exe" stop IISAdmin /y
  3536
  - net1.exe C:\Windows\system32\net1 stop IISAdmin /y
    3820
- net.exe "C:\Windows\System32\net.exe" stop IMAP4Svc /y
  996
  - net1.exe C:\Windows\system32\net1 stop IMAP4Svc /y
    2604
- net.exe "C:\Windows\System32\net.exe" stop macmnsvc /y
  4052
  - net1.exe C:\Windows\system32\net1 stop macmnsvc /y
    232
- net.exe "C:\Windows\System32\net.exe" stop masvc /y
  3480
  - net1.exe C:\Windows\system32\net1 stop masvc /y
    3188
- net.exe "C:\Windows\System32\net.exe" stop MBAMService /y
  1720
  - net1.exe C:\Windows\system32\net1 stop MBAMService /y
    4056
- net.exe "C:\Windows\System32\net.exe" stop MBEndpointAgent /y
  4136
  - net1.exe C:\Windows\system32\net1 stop MBEndpointAgent /y
    4200
- net.exe "C:\Windows\System32\net.exe" stop McAfeeEngineService /y
  4244
  - net1.exe C:\Windows\system32\net1 stop McAfeeEngineService /y
    4308
- net.exe "C:\Windows\System32\net.exe" stop McAfeeFramework /y
  4352
  - net1.exe C:\Windows\system32\net1 stop McAfeeFramework /y
    4416
- net.exe "C:\Windows\System32\net.exe" stop McAfeeFrameworkMcAfeeFramework /y
  4460
  - net1.exe C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
    4524
- net.exe "C:\Windows\System32\net.exe" stop McShield /y
  4592
  - net1.exe C:\Windows\system32\net1 stop McShield /y
    4656
- net.exe "C:\Windows\System32\net.exe" stop McTaskManager /y
  4700
  - net1.exe C:\Windows\system32\net1 stop McTaskManager /y
    4764
- net.exe "C:\Windows\System32\net.exe" stop mfemms /y
  4808
  - net1.exe C:\Windows\system32\net1 stop mfemms /y
    4872
- net.exe "C:\Windows\System32\net.exe" stop mfevtp /y
  4916
  - net1.exe C:\Windows\system32\net1 stop mfevtp /y
    4980
- net.exe "C:\Windows\System32\net.exe" stop MMS /y
  5028
  - net1.exe C:\Windows\system32\net1 stop MMS /y
    5092
- net.exe "C:\Windows\System32\net.exe" stop mozyprobackup /y
  4124
  - net1.exe C:\Windows\system32\net1 stop mozyprobackup /y
    4216
- net.exe "C:\Windows\System32\net.exe" stop MsDtsServer /y
  4172
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer /y
    4292
- net.exe "C:\Windows\System32\net.exe" stop MsDtsServer100 /y
  4420
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer100 /y
    4552
- net.exe "C:\Windows\System32\net.exe" stop MsDtsServer110 /y
  4572
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer110 /y
    4696
- net.exe "C:\Windows\System32\net.exe" stop MSExchangeES /y
  4732
  - net1.exe C:\Windows\system32\net1 stop MSExchangeES /y
    4828
- net.exe "C:\Windows\System32\net.exe" stop MSExchangeIS /y
  4904
  - net1.exe C:\Windows\system32\net1 stop MSExchangeIS /y
    4996
- net.exe "C:\Windows\System32\net.exe" stop MSExchangeMGMT /y
  4976
  - net1.exe C:\Windows\system32\net1 stop MSExchangeMGMT /y
    5064

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents