Overview

overview

10

Static

static

10

JaffaCakes...bd.exe

windows7-x64

10

JaffaCakes...bd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2025, 20:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_97121a1adc292b9662fdd2589a7a63bd.exe

  • Size

    112KB

  • MD5

    97121a1adc292b9662fdd2589a7a63bd

  • SHA1

    7186a3e386b24a2fd9f563bb78545e98c5511f27

  • SHA256

    8297c737844e45c510c376df0bec692508f10fd54e252ad53e1d072a77e872cd

  • SHA512

    42a66e44e836ccf8a0535289c009cfe32f638268b653f7122211a9c6b3635f36af06f30a67cadf911c2237cc0afc61aeb18dcc3afffc51641e17ab18989d84b4

  • SSDEEP

    1536:awmM3Ygts6GTHPquFz86tJzUx9qOKr8rF0srLbVI/6ZSYt9ofa+16qeU:awmpTiadtp/r4XrfVS84p7e

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 64 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97121a1adc292b9662fdd2589a7a63bd.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97121a1adc292b9662fdd2589a7a63bd.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4588
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97121a1adc292b9662fdd2589a7a63bd.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97121a1adc292b9662fdd2589a7a63bd.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3344
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97121a1adc292b9662fdd2589a7a63bd.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97121a1adc292b9662fdd2589a7a63bd.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:2096
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • Modifies registry key
        PID:1316
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\hoez.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\hoez.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\hoez.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\hoez.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • Modifies registry key
        PID:3768
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1536
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4484
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1768
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1388
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4652
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1484
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3528
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2864
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2008
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2288
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4160
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4196
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:680
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:524
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Users\Admin\AppData\Roaming\hoez.exe
      C:\Users\Admin\AppData\Roaming\hoez.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4736
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
    1⤵
      PID:1416
      • C:\Users\Admin\AppData\Roaming\hoez.exe
        C:\Users\Admin\AppData\Roaming\hoez.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4788
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
      1⤵
        PID:4868
        • C:\Users\Admin\AppData\Roaming\hoez.exe
          C:\Users\Admin\AppData\Roaming\hoez.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
        1⤵
          PID:1616
          • C:\Users\Admin\AppData\Roaming\hoez.exe
            C:\Users\Admin\AppData\Roaming\hoez.exe
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2448
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
          1⤵
            PID:4144
            • C:\Users\Admin\AppData\Roaming\hoez.exe
              C:\Users\Admin\AppData\Roaming\hoez.exe
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2628
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
            1⤵
              PID:2864
              • C:\Users\Admin\AppData\Roaming\hoez.exe
                C:\Users\Admin\AppData\Roaming\hoez.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1304
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
              1⤵
                PID:3732
                • C:\Users\Admin\AppData\Roaming\hoez.exe
                  C:\Users\Admin\AppData\Roaming\hoez.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4540
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                1⤵
                  PID:440
                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                    C:\Users\Admin\AppData\Roaming\hoez.exe
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4784
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                  1⤵
                    PID:3820
                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                      C:\Users\Admin\AppData\Roaming\hoez.exe
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2244
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                    1⤵
                      PID:3660
                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                        C:\Users\Admin\AppData\Roaming\hoez.exe
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2304
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                      1⤵
                        PID:3700
                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                          C:\Users\Admin\AppData\Roaming\hoez.exe
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:2448
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                        1⤵
                          PID:3156
                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                            C:\Users\Admin\AppData\Roaming\hoez.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2864
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                          1⤵
                            PID:4540
                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                              C:\Users\Admin\AppData\Roaming\hoez.exe
                              2⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:2176
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                            1⤵
                              PID:4776
                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                2⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:1748
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                              1⤵
                                PID:1300
                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:816
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                1⤵
                                  PID:3820
                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                    C:\Users\Admin\AppData\Roaming\hoez.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2296
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                  1⤵
                                    PID:680
                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2616
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                    1⤵
                                      PID:3696
                                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                                        C:\Users\Admin\AppData\Roaming\hoez.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1960
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                      1⤵
                                        PID:1392
                                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                                          C:\Users\Admin\AppData\Roaming\hoez.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4052
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                        1⤵
                                          PID:2372
                                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                                            C:\Users\Admin\AppData\Roaming\hoez.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:3824
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                          1⤵
                                            PID:944
                                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                                              C:\Users\Admin\AppData\Roaming\hoez.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:5016
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                            1⤵
                                              PID:1484
                                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:4808
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                              1⤵
                                                PID:4984
                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3500
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                1⤵
                                                  PID:1648
                                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                    C:\Users\Admin\AppData\Roaming\hoez.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:3328
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                  1⤵
                                                    PID:3908
                                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1540
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                    1⤵
                                                      PID:32
                                                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                        C:\Users\Admin\AppData\Roaming\hoez.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2000
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                      1⤵
                                                        PID:3040
                                                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                          C:\Users\Admin\AppData\Roaming\hoez.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2440
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                        1⤵
                                                          PID:444
                                                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                            C:\Users\Admin\AppData\Roaming\hoez.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:1468
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                          1⤵
                                                            PID:3432
                                                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                              C:\Users\Admin\AppData\Roaming\hoez.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4504
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                            1⤵
                                                              PID:2364
                                                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1688
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                              1⤵
                                                                PID:4312
                                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2684
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                1⤵
                                                                  PID:3700
                                                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                    C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4836
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                  1⤵
                                                                    PID:5068
                                                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:4296
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                    1⤵
                                                                      PID:2268
                                                                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                        C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:964
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                      1⤵
                                                                        PID:1880
                                                                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                          C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:3224
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                        1⤵
                                                                          PID:2516
                                                                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                            C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1816
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                          1⤵
                                                                            PID:2308
                                                                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                              C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4400
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                            1⤵
                                                                              PID:2668
                                                                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4448
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                              1⤵
                                                                                PID:3328
                                                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:3400
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                1⤵
                                                                                  PID:4040
                                                                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                    C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3040
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                  1⤵
                                                                                    PID:2440
                                                                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2472
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                    1⤵
                                                                                      PID:524
                                                                                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                        C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2296
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                      1⤵
                                                                                        PID:1932
                                                                                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                          C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3152
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                        1⤵
                                                                                          PID:3824
                                                                                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                            C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2276
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                          1⤵
                                                                                            PID:1244
                                                                                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                              C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2448
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                            1⤵
                                                                                              PID:2700
                                                                                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:3536
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                              1⤵
                                                                                                PID:2384
                                                                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5096
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                1⤵
                                                                                                  PID:3724
                                                                                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4752
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                  1⤵
                                                                                                    PID:352
                                                                                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2484
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                    1⤵
                                                                                                      PID:1296
                                                                                                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:8
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                      1⤵
                                                                                                        PID:4252
                                                                                                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2680
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                        1⤵
                                                                                                          PID:2176
                                                                                                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2924
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                          1⤵
                                                                                                            PID:4584
                                                                                                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:440
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                            1⤵
                                                                                                              PID:3768
                                                                                                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                2⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3252
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                              1⤵
                                                                                                                PID:1560
                                                                                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4376
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                1⤵
                                                                                                                  PID:4516
                                                                                                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                    2⤵
                                                                                                                      PID:3564
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                    1⤵
                                                                                                                      PID:2440
                                                                                                                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                        2⤵
                                                                                                                          PID:4344
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                        1⤵
                                                                                                                          PID:1768
                                                                                                                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                            2⤵
                                                                                                                              PID:5016
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                            1⤵
                                                                                                                              PID:2296
                                                                                                                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                2⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4928
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                              1⤵
                                                                                                                                PID:2448
                                                                                                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:660
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:2464
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4764
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:4788
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                        2⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2268
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:944
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:500
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:3460
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:1072
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:4984
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3172
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:2536
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3264
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3908
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3332
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4580
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2960
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3020
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                            2⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3040
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4076
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1460
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:328
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:696
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:528
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2548
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:4428
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:444

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\hoez.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    112KB

                                                                                                                                                                    MD5

                                                                                                                                                                    97121a1adc292b9662fdd2589a7a63bd

                                                                                                                                                                    SHA1

                                                                                                                                                                    7186a3e386b24a2fd9f563bb78545e98c5511f27

                                                                                                                                                                    SHA256

                                                                                                                                                                    8297c737844e45c510c376df0bec692508f10fd54e252ad53e1d072a77e872cd

                                                                                                                                                                    SHA512

                                                                                                                                                                    42a66e44e836ccf8a0535289c009cfe32f638268b653f7122211a9c6b3635f36af06f30a67cadf911c2237cc0afc61aeb18dcc3afffc51641e17ab18989d84b4

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • memory/8-396-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/440-405-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/444-506-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/500-457-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/524-95-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/660-445-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/680-82-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/696-498-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/816-181-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/964-298-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1072-465-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1304-133-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1388-29-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1460-497-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1468-264-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1484-43-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1484-35-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1536-19-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1540-242-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1688-275-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1748-182-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1768-31-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1816-309-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1960-207-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2000-252-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2008-56-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2176-168-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2244-144-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2268-456-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2276-360-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2288-70-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2296-347-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2296-194-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2304-151-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2304-156-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2440-253-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2448-118-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2448-359-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2448-157-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2472-334-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2484-383-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2548-508-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2616-192-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2628-119-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2680-394-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2684-276-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2864-170-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2864-58-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2924-406-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2960-486-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3040-335-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3040-488-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3152-345-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3172-467-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3224-296-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3264-475-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3328-243-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3332-477-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3400-321-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3500-232-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3528-45-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3536-372-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3564-424-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3824-218-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-0-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-46-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-323-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-195-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-254-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-121-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-287-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-32-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-158-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-83-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3916-220-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4052-205-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4160-68-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4196-80-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4296-286-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4344-426-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4376-415-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4400-310-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4448-322-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4484-14-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4504-266-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4540-132-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4736-94-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4752-384-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4764-446-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4784-145-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4788-105-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4808-231-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4836-285-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4928-436-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4964-107-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/5016-219-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/5016-435-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/5096-370-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    368KB

                                                                                                                                                                    Download