formbook | 21f54a9d180619b9656ad19add4bb8065d05793e8248e8a7eec97da545e579a9

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crypted.ps1
Size 2.1MB
Sample260819-xbhpda1arc
SHA256 21f54a9d180619b9656ad19add4bb8065d05793e8248e8a7eec97da545e579a9
MD5 0f3894cf979a46d77336baa6003aec15
SHA1 d89e379083c935e7f41d5e815376d4dba64d52be
SHA512 030c5c2b3107b725cc8a7fbc7684c26caf17ca7346294a09bc6ecd13415b828158f0f9d32627456b20e397d6d34c60b2a900503da481d039d84c8670679b7cfa
SSDEEP 24576:Z6DF/FDxS8LuQmnF/08q0p/KJ9cHuaekj/J8w13pLNZsz7/cAknG7RBTunK7tWAy:L
TLSH
T130A5883DD380B96E9B3DC7E2887A29EC1761F567A05B205CC722EA9710E6166FFC0D11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/1256-25-0x0000000000E20000-0x0000000000E66000-memory.dmp	family_formbook
behavioral2/memory/1256-28-0x0000000000E20000-0x0000000000E66000-memory.dmp	family_formbook
behavioral2/memory/1256-34-0x0000000000E20000-0x0000000000E66000-memory.dmp	family_formbook
behavioral2/memory/3256-37-0x0000000000400000-0x0000000000443000-memory.dmp	family_formbook
behavioral2/memory/1056-40-0x0000000001620000-0x0000000001666000-memory.dmp	family_formbook
behavioral2/memory/1056-42-0x0000000001620000-0x0000000001666000-memory.dmp	family_formbook
behavioral2/memory/3256-43-0x0000000000400000-0x0000000000443000-memory.dmp	family_formbook

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5368	PowerShell.exe
8	5368	PowerShell.exe
9	5368	PowerShell.exe
10	5368	PowerShell.exe
11	5368	PowerShell.exe
12	5368	PowerShell.exe
13	5368	PowerShell.exe
14	5368	PowerShell.exe
15	5368	PowerShell.exe
16	5368	PowerShell.exe
16	5368	PowerShell.exe
18	5368	PowerShell.exe
19	5368	PowerShell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	xcopy.exe

Suspicious use of SetThreadContext 29 IoCs

description	pid	Process	procid_target
PID 5368 set thread context of 1256	5368	PowerShell.exe	95
PID 1256 set thread context of 5368	1256	aspnet_compiler.exe	88
PID 1256 set thread context of 3256	1256	aspnet_compiler.exe	96
PID 5368 set thread context of 1056	5368	PowerShell.exe	97
PID 3256 set thread context of 5368	3256	xcopy.exe	88
PID 5368 set thread context of 4900	5368	PowerShell.exe	100
PID 5368 set thread context of 3884	5368	PowerShell.exe	102
PID 5368 set thread context of 4424	5368	PowerShell.exe	103
PID 5368 set thread context of 5136	5368	PowerShell.exe	105
PID 3256 set thread context of 2828	3256	xcopy.exe	104
PID 5368 set thread context of 4744	5368	PowerShell.exe	106
PID 5368 set thread context of 4496	5368	PowerShell.exe	107
PID 5368 set thread context of 2748	5368	PowerShell.exe	108
PID 5368 set thread context of 3456	5368	PowerShell.exe	110
PID 5368 set thread context of 4804	5368	PowerShell.exe	111
PID 5368 set thread context of 3720	5368	PowerShell.exe	112
PID 5368 set thread context of 1948	5368	PowerShell.exe	113
PID 5368 set thread context of 6084	5368	PowerShell.exe	114
PID 5368 set thread context of 4292	5368	PowerShell.exe	115
PID 5368 set thread context of 4128	5368	PowerShell.exe	118
PID 5368 set thread context of 2044	5368	PowerShell.exe	119
PID 5368 set thread context of 1000	5368	PowerShell.exe	120
PID 5368 set thread context of 2344	5368	PowerShell.exe	121
PID 5368 set thread context of 4784	5368	PowerShell.exe	122
PID 5368 set thread context of 2728	5368	PowerShell.exe	123
PID 5368 set thread context of 3852	5368	PowerShell.exe	127
PID 5368 set thread context of 6008	5368	PowerShell.exe	128
PID 5368 set thread context of 4620	5368	PowerShell.exe	129
PID 5368 set thread context of 4624	5368	PowerShell.exe	132

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5368	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-552508041-2681165170-3229858294-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	xcopy.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
1256	aspnet_compiler.exe
1256	aspnet_compiler.exe
1256	aspnet_compiler.exe
1256	aspnet_compiler.exe
5368	PowerShell.exe
3256	xcopy.exe
3256	xcopy.exe
3256	xcopy.exe
3256	xcopy.exe
5368	PowerShell.exe
1056	aspnet_compiler.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
4900	aspnet_compiler.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
3884	aspnet_compiler.exe
5368	PowerShell.exe
4424	aspnet_compiler.exe
5368	PowerShell.exe
5136	aspnet_compiler.exe
5368	PowerShell.exe
4744	aspnet_compiler.exe
5368	PowerShell.exe
4496	aspnet_compiler.exe
5368	PowerShell.exe
2748	aspnet_compiler.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
3456	aspnet_compiler.exe
5368	PowerShell.exe
4804	aspnet_compiler.exe
5368	PowerShell.exe
3720	aspnet_compiler.exe
5368	PowerShell.exe
1948	aspnet_compiler.exe
5368	PowerShell.exe
6084	aspnet_compiler.exe
5368	PowerShell.exe
4292	aspnet_compiler.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
5368	PowerShell.exe
4128	aspnet_compiler.exe
5368	PowerShell.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1256	aspnet_compiler.exe
5368	PowerShell.exe
5368	PowerShell.exe
3256	xcopy.exe
3256	xcopy.exe
3256	xcopy.exe
3256	xcopy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5368	PowerShell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 3388	5368	PowerShell.exe	90
PID 5368 wrote to memory of 6024	5368	PowerShell.exe	91
PID 5368 wrote to memory of 860	5368	PowerShell.exe	92
PID 5368 wrote to memory of 3080	5368	PowerShell.exe	93
PID 5368 wrote to memory of 5956	5368	PowerShell.exe	94
PID 5368 wrote to memory of 1256	5368	PowerShell.exe	95
PID 5368 wrote to memory of 1256	5368	PowerShell.exe	95
PID 5368 wrote to memory of 1256	5368	PowerShell.exe	95
PID 5368 wrote to memory of 3256	5368	PowerShell.exe	96
PID 5368 wrote to memory of 1056	5368	PowerShell.exe	97
PID 5368 wrote to memory of 1056	5368	PowerShell.exe	97
PID 5368 wrote to memory of 1056	5368	PowerShell.exe	97
PID 5368 wrote to memory of 3448	5368	PowerShell.exe	99
PID 5368 wrote to memory of 4900	5368	PowerShell.exe	100
PID 5368 wrote to memory of 4900	5368	PowerShell.exe	100
PID 5368 wrote to memory of 4900	5368	PowerShell.exe	100
PID 5368 wrote to memory of 5684	5368	PowerShell.exe	101
PID 5368 wrote to memory of 3884	5368	PowerShell.exe	102
PID 5368 wrote to memory of 3884	5368	PowerShell.exe	102
PID 5368 wrote to memory of 3884	5368	PowerShell.exe	102
PID 5368 wrote to memory of 4424	5368	PowerShell.exe	103
PID 5368 wrote to memory of 4424	5368	PowerShell.exe	103
PID 5368 wrote to memory of 4424	5368	PowerShell.exe	103
PID 3256 wrote to memory of 2828	3256	xcopy.exe	104
PID 5368 wrote to memory of 5136	5368	PowerShell.exe	105
PID 5368 wrote to memory of 5136	5368	PowerShell.exe	105
PID 5368 wrote to memory of 5136	5368	PowerShell.exe	105
PID 5368 wrote to memory of 4744	5368	PowerShell.exe	106
PID 5368 wrote to memory of 4744	5368	PowerShell.exe	106
PID 5368 wrote to memory of 4744	5368	PowerShell.exe	106
PID 5368 wrote to memory of 4496	5368	PowerShell.exe	107
PID 5368 wrote to memory of 4496	5368	PowerShell.exe	107
PID 5368 wrote to memory of 4496	5368	PowerShell.exe	107
PID 5368 wrote to memory of 2748	5368	PowerShell.exe	108
PID 5368 wrote to memory of 2748	5368	PowerShell.exe	108
PID 5368 wrote to memory of 2748	5368	PowerShell.exe	108
PID 5368 wrote to memory of 3132	5368	PowerShell.exe	109
PID 5368 wrote to memory of 3456	5368	PowerShell.exe	110
PID 5368 wrote to memory of 3456	5368	PowerShell.exe	110
PID 5368 wrote to memory of 3456	5368	PowerShell.exe	110
PID 5368 wrote to memory of 4804	5368	PowerShell.exe	111
PID 5368 wrote to memory of 4804	5368	PowerShell.exe	111
PID 5368 wrote to memory of 4804	5368	PowerShell.exe	111
PID 5368 wrote to memory of 3720	5368	PowerShell.exe	112
PID 5368 wrote to memory of 3720	5368	PowerShell.exe	112
PID 5368 wrote to memory of 3720	5368	PowerShell.exe	112
PID 5368 wrote to memory of 1948	5368	PowerShell.exe	113
PID 5368 wrote to memory of 1948	5368	PowerShell.exe	113
PID 5368 wrote to memory of 1948	5368	PowerShell.exe	113
PID 5368 wrote to memory of 6084	5368	PowerShell.exe	114
PID 5368 wrote to memory of 6084	5368	PowerShell.exe	114
PID 5368 wrote to memory of 6084	5368	PowerShell.exe	114
PID 5368 wrote to memory of 4292	5368	PowerShell.exe	115
PID 5368 wrote to memory of 4292	5368	PowerShell.exe	115
PID 5368 wrote to memory of 4292	5368	PowerShell.exe	115
PID 5368 wrote to memory of 2280	5368	PowerShell.exe	116
PID 5368 wrote to memory of 2336	5368	PowerShell.exe	117
PID 5368 wrote to memory of 4128	5368	PowerShell.exe	118
PID 5368 wrote to memory of 4128	5368	PowerShell.exe	118
PID 5368 wrote to memory of 4128	5368	PowerShell.exe	118
PID 5368 wrote to memory of 2044	5368	PowerShell.exe	119
PID 5368 wrote to memory of 2044	5368	PowerShell.exe	119
PID 5368 wrote to memory of 2044	5368	PowerShell.exe	119
PID 5368 wrote to memory of 1000	5368	PowerShell.exe	120

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	xcopy.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\crypted.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:6024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1256
- C:\Windows\SysWOW64\xcopy.exe
  "C:\Windows\SysWOW64\xcopy.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:3256
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:6008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:5080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-41-0x0000000001BA0000-0x0000000001F14000-memory.dmp

Download

memory/1056-40-0x0000000001620000-0x0000000001666000-memory.dmp

Download

memory/1056-42-0x0000000001620000-0x0000000001666000-memory.dmp

Download

memory/1256-35-0x0000000001640000-0x0000000001663000-memory.dmp

Download

memory/1256-34-0x0000000000E20000-0x0000000000E66000-memory.dmp

Download

memory/1256-23-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1256-32-0x0000000000E20000-0x0000000000E66000-memory.dmp

Download

memory/1256-30-0x0000000001640000-0x0000000001663000-memory.dmp

Download

memory/1256-29-0x0000000000E20000-0x0000000000E66000-memory.dmp

Download

memory/1256-28-0x0000000000E20000-0x0000000000E66000-memory.dmp

Download

memory/1256-27-0x0000000001200000-0x0000000001574000-memory.dmp

Download

memory/1256-25-0x0000000000E20000-0x0000000000E66000-memory.dmp

Download

memory/2828-62-0x00000293B48B0000-0x00000293B497C000-memory.dmp

Download

memory/3256-43-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3256-31-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3256-52-0x0000000000BE0000-0x0000000000C82000-memory.dmp

Download

memory/3256-44-0x0000000000BE0000-0x0000000000C82000-memory.dmp

Download

memory/3256-37-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3256-36-0x0000000000D70000-0x00000000010E4000-memory.dmp

Download

memory/3256-33-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4900-49-0x0000000001890000-0x0000000001C04000-memory.dmp

Download

memory/4900-48-0x0000000001220000-0x0000000001266000-memory.dmp

Download

memory/5368-7-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-5-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-26-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-12-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-11-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-10-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-14-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-9-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-24-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-8-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-16-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-15-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-22-0x0000014494830000-0x0000014494844000-memory.dmp

Download

memory/5368-38-0x0000014494870000-0x0000014494884000-memory.dmp

Download

memory/5368-6-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-13-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-4-0x0000014494840000-0x0000014494862000-memory.dmp

Download

memory/5368-0-0x00007FFCECF1F000-0x00007FFCECF20000-memory.dmp

Download

memory/5368-21-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-45-0x00000144ACBF0000-0x00000144ACC99000-memory.dmp

Download

memory/5368-46-0x00000144ACBF0000-0x00000144ACC99000-memory.dmp

Download

memory/5368-19-0x00000144946F0000-0x0000014494704000-memory.dmp

Download

memory/5368-18-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-50-0x0000014494890000-0x00000144948A4000-memory.dmp

Download

memory/5368-17-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-53-0x00000144ACBF0000-0x00000144ACC99000-memory.dmp

Download

memory/5368-3-0x00007FFCECD90000-0x00007FFCED734000-memory.dmp

Download

memory/5368-65-0x00000144ACCE0000-0x00000144ACCF4000-memory.dmp

Download

memory/5368-73-0x0000014502960000-0x0000014502974000-memory.dmp

Download

memory/5368-78-0x00000144ACD80000-0x00000144ACD94000-memory.dmp

Download