Analysis
- max time kernel
300s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
24092026_0036_23092026_KDBCRYPTED_STUB.ps1
Resource
win10v2004-20260911-en
13 signatures
300 seconds
Behavioral task
behavioral2
Sample
24092026_0036_23092026_KDBCRYPTED_STUB.ps1
Resource
win11ltsc2024-20260911-en
13 signatures
300 seconds
General
- Target 24092026_0036_23092026_KDBCRYPTED_STUB.ps1
- Size 2.1MB
- Sample260924-ax7jasxtfs
- SHA256 fe96ac64fddef020e19358dc7713c7b021d417ddb745a484f91f0ed84bc7e7e8
- MD5 af2a5c1c6e590510bb6e8c97ad509e75
- SHA1 e783e51997943719349dd3fe7b1db8b36d2970b0
- SHA512 cdaed5ec3ccc76d254282206ea69e36c6329f5d9c13295e2c355630a212ef206ba0698422991e5980aec5deaa9d1e49304eed801a33293e4eb83ab50e42ce825
- SSDEEP 24576:RXiYTS5h0AV249Q9v2DVJK4KJwNhT2LhsD6rfWtOELjZy4p7NYyWg0k5hd:k
- TLSH T193A5A8B6FE6B9FABA6CD0407DF7EBC74016BAA09298D5CFD9460150020E4749BB10F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Formbook payload 8 IoCs
resource yara_rule behavioral2/memory/5944-22-0x0000000000E10000-0x0000000000E56000-memory.dmp family_formbook behavioral2/memory/5944-34-0x0000000000E10000-0x0000000000E56000-memory.dmp family_formbook behavioral2/memory/5944-35-0x0000000000E10000-0x0000000000E56000-memory.dmp family_formbook behavioral2/memory/5944-41-0x0000000000E10000-0x0000000000E56000-memory.dmp family_formbook behavioral2/memory/2884-43-0x0000000000A60000-0x0000000000AA3000-memory.dmp family_formbook behavioral2/memory/248-48-0x0000000000ED0000-0x0000000000F16000-memory.dmp family_formbook behavioral2/memory/2884-49-0x0000000000A60000-0x0000000000AA3000-memory.dmp family_formbook behavioral2/memory/5464-54-0x0000000000C50000-0x0000000000C96000-memory.dmp family_formbook - Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 8 5640 PowerShell.exe 9 5640 PowerShell.exe 10 5640 PowerShell.exe 11 5640 PowerShell.exe 12 5640 PowerShell.exe 14 5640 PowerShell.exe 15 5640 PowerShell.exe 16 5640 PowerShell.exe 17 5640 PowerShell.exe 18 5640 PowerShell.exe 19 5640 PowerShell.exe 20 5640 PowerShell.exe 21 5640 PowerShell.exe 22 5640 PowerShell.exe 23 5640 PowerShell.exe 24 5640 PowerShell.exe 25 5640 PowerShell.exe 26 5640 PowerShell.exe 27 5640 PowerShell.exe 28 5640 PowerShell.exe 29 5640 PowerShell.exe 30 5640 PowerShell.exe 31 5640 PowerShell.exe 32 5640 PowerShell.exe 33 5640 PowerShell.exe 34 5640 PowerShell.exe 35 5640 PowerShell.exe 36 5640 PowerShell.exe 37 5640 PowerShell.exe 38 5640 PowerShell.exe 39 5640 PowerShell.exe 40 5640 PowerShell.exe 41 5640 PowerShell.exe 42 5640 PowerShell.exe 43 5640 PowerShell.exe 44 5640 PowerShell.exe 45 5640 PowerShell.exe 46 5640 PowerShell.exe 47 5640 PowerShell.exe 48 5640 PowerShell.exe 49 5640 PowerShell.exe 50 5640 PowerShell.exe 51 5640 PowerShell.exe 52 5640 PowerShell.exe 53 5640 PowerShell.exe 54 5640 PowerShell.exe 55 5640 PowerShell.exe 56 5640 PowerShell.exe 57 5640 PowerShell.exe 58 5640 PowerShell.exe 59 5640 PowerShell.exe 60 5640 PowerShell.exe 61 5640 PowerShell.exe 62 5640 PowerShell.exe 63 5640 PowerShell.exe 64 5640 PowerShell.exe 65 5640 PowerShell.exe 66 5640 PowerShell.exe 67 5640 PowerShell.exe 68 5640 PowerShell.exe 69 5640 PowerShell.exe 70 5640 PowerShell.exe 71 5640 PowerShell.exe 72 5640 PowerShell.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key enumerated \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmdkey.exe - Suspicious use of SetThreadContext 59 IoCs
description pid Process procid_target PID 5640 set thread context of 5944 5640 PowerShell.exe 96 PID 5944 set thread context of 5640 5944 aspnet_compiler.exe 88 PID 5944 set thread context of 2884 5944 aspnet_compiler.exe 97 PID 5640 set thread context of 248 5640 PowerShell.exe 99 PID 2884 set thread context of 5640 2884 cmdkey.exe 88 PID 5640 set thread context of 5464 5640 PowerShell.exe 101 PID 5640 set thread context of 2728 5640 PowerShell.exe 102 PID 5640 set thread context of 4268 5640 PowerShell.exe 104 PID 2884 set thread context of 2272 2884 cmdkey.exe 103 PID 5640 set thread context of 4648 5640 PowerShell.exe 105 PID 5640 set thread context of 5800 5640 PowerShell.exe 106 PID 5640 set thread context of 3492 5640 PowerShell.exe 107 PID 5640 set thread context of 6016 5640 PowerShell.exe 108 PID 5640 set thread context of 4796 5640 PowerShell.exe 109 PID 5640 set thread context of 3404 5640 PowerShell.exe 110 PID 5640 set thread context of 5204 5640 PowerShell.exe 111 PID 5640 set thread context of 2724 5640 PowerShell.exe 115 PID 5640 set thread context of 5500 5640 PowerShell.exe 118 PID 5640 set thread context of 3820 5640 PowerShell.exe 119 PID 5640 set thread context of 704 5640 PowerShell.exe 120 PID 5640 set thread context of 2912 5640 PowerShell.exe 124 PID 5640 set thread context of 2712 5640 PowerShell.exe 125 PID 5640 set thread context of 1232 5640 PowerShell.exe 126 PID 5640 set thread context of 1996 5640 PowerShell.exe 127 PID 5640 set thread context of 4500 5640 PowerShell.exe 128 PID 5640 set thread context of 5188 5640 PowerShell.exe 129 PID 5640 set thread context of 4744 5640 PowerShell.exe 130 PID 5640 set thread context of 1892 5640 PowerShell.exe 131 PID 5640 set thread context of 2492 5640 PowerShell.exe 132 PID 5640 set thread context of 4660 5640 PowerShell.exe 133 PID 5640 set thread context of 1772 5640 PowerShell.exe 134 PID 5640 set thread context of 4888 5640 PowerShell.exe 135 PID 5640 set thread context of 3200 5640 PowerShell.exe 138 PID 5640 set thread context of 2000 5640 PowerShell.exe 140 PID 5640 set thread context of 2540 5640 PowerShell.exe 141 PID 5640 set thread context of 3416 5640 PowerShell.exe 143 PID 5640 set thread context of 4148 5640 PowerShell.exe 148 PID 5640 set thread context of 3612 5640 PowerShell.exe 149 PID 5640 set thread context of 2468 5640 PowerShell.exe 150 PID 5640 set thread context of 3944 5640 PowerShell.exe 151 PID 5640 set thread context of 5016 5640 PowerShell.exe 152 PID 5640 set thread context of 5240 5640 PowerShell.exe 154 PID 5640 set thread context of 5536 5640 PowerShell.exe 155 PID 5640 set thread context of 1916 5640 PowerShell.exe 156 PID 5640 set thread context of 4592 5640 PowerShell.exe 158 PID 5640 set thread context of 3576 5640 PowerShell.exe 159 PID 5640 set thread context of 4800 5640 PowerShell.exe 160 PID 5640 set thread context of 2436 5640 PowerShell.exe 161 PID 5640 set thread context of 3168 5640 PowerShell.exe 163 PID 5640 set thread context of 3004 5640 PowerShell.exe 164 PID 5640 set thread context of 4360 5640 PowerShell.exe 165 PID 5640 set thread context of 4512 5640 PowerShell.exe 166 PID 5640 set thread context of 1784 5640 PowerShell.exe 167 PID 5640 set thread context of 1988 5640 PowerShell.exe 168 PID 5640 set thread context of 992 5640 PowerShell.exe 169 PID 5640 set thread context of 1212 5640 PowerShell.exe 170 PID 5640 set thread context of 3000 5640 PowerShell.exe 172 PID 5640 set thread context of 4884 5640 PowerShell.exe 173 PID 5640 set thread context of 2680 5640 PowerShell.exe 174 -
pid Process 5640 PowerShell.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmdkey.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2714045687-1127350534-2056456672-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmdkey.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5944 aspnet_compiler.exe 5944 aspnet_compiler.exe 5944 aspnet_compiler.exe 5944 aspnet_compiler.exe 5640 PowerShell.exe 2884 cmdkey.exe 2884 cmdkey.exe 2884 cmdkey.exe 2884 cmdkey.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 248 aspnet_compiler.exe 5640 PowerShell.exe 5464 aspnet_compiler.exe 5640 PowerShell.exe 2728 aspnet_compiler.exe 5640 PowerShell.exe 4268 aspnet_compiler.exe 5640 PowerShell.exe 4648 aspnet_compiler.exe 5640 PowerShell.exe 5800 aspnet_compiler.exe 5640 PowerShell.exe 3492 aspnet_compiler.exe 5640 PowerShell.exe 6016 aspnet_compiler.exe 5640 PowerShell.exe 4796 aspnet_compiler.exe 5640 PowerShell.exe 3404 aspnet_compiler.exe 5640 PowerShell.exe 5204 aspnet_compiler.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 2724 aspnet_compiler.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5640 PowerShell.exe 5500 aspnet_compiler.exe 5640 PowerShell.exe 3820 aspnet_compiler.exe 5640 PowerShell.exe - Suspicious behavior: MapViewOfSection 1 TTPs 7 IoCs
pid Process 5944 aspnet_compiler.exe 5640 PowerShell.exe 5640 PowerShell.exe 2884 cmdkey.exe 2884 cmdkey.exe 2884 cmdkey.exe 2884 cmdkey.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5640 PowerShell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5640 wrote to memory of 2620 5640 PowerShell.exe 91 PID 5640 wrote to memory of 5948 5640 PowerShell.exe 92 PID 5640 wrote to memory of 3952 5640 PowerShell.exe 93 PID 5640 wrote to memory of 1716 5640 PowerShell.exe 94 PID 5640 wrote to memory of 4968 5640 PowerShell.exe 95 PID 5640 wrote to memory of 5944 5640 PowerShell.exe 96 PID 5640 wrote to memory of 5944 5640 PowerShell.exe 96 PID 5640 wrote to memory of 5944 5640 PowerShell.exe 96 PID 5640 wrote to memory of 2884 5640 PowerShell.exe 97 PID 5640 wrote to memory of 256 5640 PowerShell.exe 98 PID 5640 wrote to memory of 248 5640 PowerShell.exe 99 PID 5640 wrote to memory of 248 5640 PowerShell.exe 99 PID 5640 wrote to memory of 248 5640 PowerShell.exe 99 PID 5640 wrote to memory of 5464 5640 PowerShell.exe 101 PID 5640 wrote to memory of 5464 5640 PowerShell.exe 101 PID 5640 wrote to memory of 5464 5640 PowerShell.exe 101 PID 5640 wrote to memory of 2728 5640 PowerShell.exe 102 PID 5640 wrote to memory of 2728 5640 PowerShell.exe 102 PID 5640 wrote to memory of 2728 5640 PowerShell.exe 102 PID 2884 wrote to memory of 2272 2884 cmdkey.exe 103 PID 5640 wrote to memory of 4268 5640 PowerShell.exe 104 PID 5640 wrote to memory of 4268 5640 PowerShell.exe 104 PID 5640 wrote to memory of 4268 5640 PowerShell.exe 104 PID 5640 wrote to memory of 4648 5640 PowerShell.exe 105 PID 5640 wrote to memory of 4648 5640 PowerShell.exe 105 PID 5640 wrote to memory of 4648 5640 PowerShell.exe 105 PID 5640 wrote to memory of 5800 5640 PowerShell.exe 106 PID 5640 wrote to memory of 5800 5640 PowerShell.exe 106 PID 5640 wrote to memory of 5800 5640 PowerShell.exe 106 PID 5640 wrote to memory of 3492 5640 PowerShell.exe 107 PID 5640 wrote to memory of 3492 5640 PowerShell.exe 107 PID 5640 wrote to memory of 3492 5640 PowerShell.exe 107 PID 5640 wrote to memory of 6016 5640 PowerShell.exe 108 PID 5640 wrote to memory of 6016 5640 PowerShell.exe 108 PID 5640 wrote to memory of 6016 5640 PowerShell.exe 108 PID 5640 wrote to memory of 4796 5640 PowerShell.exe 109 PID 5640 wrote to memory of 4796 5640 PowerShell.exe 109 PID 5640 wrote to memory of 4796 5640 PowerShell.exe 109 PID 5640 wrote to memory of 3404 5640 PowerShell.exe 110 PID 5640 wrote to memory of 3404 5640 PowerShell.exe 110 PID 5640 wrote to memory of 3404 5640 PowerShell.exe 110 PID 5640 wrote to memory of 5204 5640 PowerShell.exe 111 PID 5640 wrote to memory of 5204 5640 PowerShell.exe 111 PID 5640 wrote to memory of 5204 5640 PowerShell.exe 111 PID 5640 wrote to memory of 800 5640 PowerShell.exe 112 PID 5640 wrote to memory of 5504 5640 PowerShell.exe 113 PID 5640 wrote to memory of 5860 5640 PowerShell.exe 114 PID 5640 wrote to memory of 2724 5640 PowerShell.exe 115 PID 5640 wrote to memory of 2724 5640 PowerShell.exe 115 PID 5640 wrote to memory of 2724 5640 PowerShell.exe 115 PID 5640 wrote to memory of 2928 5640 PowerShell.exe 116 PID 5640 wrote to memory of 5636 5640 PowerShell.exe 117 PID 5640 wrote to memory of 5500 5640 PowerShell.exe 118 PID 5640 wrote to memory of 5500 5640 PowerShell.exe 118 PID 5640 wrote to memory of 5500 5640 PowerShell.exe 118 PID 5640 wrote to memory of 3820 5640 PowerShell.exe 119 PID 5640 wrote to memory of 3820 5640 PowerShell.exe 119 PID 5640 wrote to memory of 3820 5640 PowerShell.exe 119 PID 5640 wrote to memory of 704 5640 PowerShell.exe 120 PID 5640 wrote to memory of 704 5640 PowerShell.exe 120 PID 5640 wrote to memory of 704 5640 PowerShell.exe 120 PID 5640 wrote to memory of 2288 5640 PowerShell.exe 121 PID 5640 wrote to memory of 3892 5640 PowerShell.exe 122 PID 5640 wrote to memory of 5824 5640 PowerShell.exe 123 - outlook_office_path 1 IoCs
description ioc Process Key enumerated \REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook cmdkey.exe
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\24092026_0036_23092026_KDBCRYPTED_STUB.ps11⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2620
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3952
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1716
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4968
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5944
-
-
C:\Windows\SysWOW64\cmdkey.exe"C:\Windows\SysWOW64\cmdkey.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:2884 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2272
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:256
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:248
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5464
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6016
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5204
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5504
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2928
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3820
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:704
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2288
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3892
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2712
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1996
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5188
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1892
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5324
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3200
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4916
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2000
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2768
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3416
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:6116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4388
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4148
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3612
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3944
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5016
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:5536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1916
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4840
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3168
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3004
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4360
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4512
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1988
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:992
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:1212
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:3000
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:4884
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵PID:2680
-