remcos | 6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc

Analysis

max time kernel
150s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
03/11/2020, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe
Size 519KB
Sample201103-rpcq9dk83j
SHA256 6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc
MD5 a529633ffa991638887d99c4cbfa9eb4
SHA1 e119a6cbb6ff426ca35ef597a5906231dbd34b64
SHA512 bd73e3df113262f10693fe321873b6d6af6ad9f4401d739cec1dde855e47b8858b362c251b191bb3c542cdb307f35c0afdc80a47cecb604c4ccc5545e7965956
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

moorenike.sytes.net:1024

Signatures

Modifies WinLogon for persistence 2 TTPs 83 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 3 IoCs

pid	Process
964	tnt.exe
900	tnt.exe
1616	remcos.exe

Loads dropped DLL 1 IoCs

pid	Process
1200	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	tnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	tnt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 964 set thread context of 900	964	tnt.exe	39

Suspicious behavior: EnumeratesProcesses 83 IoCs

pid	Process
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe
964	tnt.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe
Token: SeDebugPrivilege	964	tnt.exe
Token: SeDebugPrivilege	1616	remcos.exe

Suspicious use of WriteProcessMemory 699 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1580	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	29
PID 1644 wrote to memory of 1580	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	29
PID 1644 wrote to memory of 1580	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	29
PID 1644 wrote to memory of 1580	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	29
PID 1644 wrote to memory of 1952	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	32
PID 1644 wrote to memory of 1952	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	32
PID 1644 wrote to memory of 1952	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	32
PID 1644 wrote to memory of 1952	1644	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	32
PID 1952 wrote to memory of 964	1952	cmd.exe	34
PID 1952 wrote to memory of 964	1952	cmd.exe	34
PID 1952 wrote to memory of 964	1952	cmd.exe	34
PID 1952 wrote to memory of 964	1952	cmd.exe	34
PID 964 wrote to memory of 1508	964	tnt.exe	35
PID 964 wrote to memory of 1508	964	tnt.exe	35
PID 964 wrote to memory of 1508	964	tnt.exe	35
PID 964 wrote to memory of 1508	964	tnt.exe	35
PID 1508 wrote to memory of 1464	1508	cmd.exe	37
PID 1508 wrote to memory of 1464	1508	cmd.exe	37
PID 1508 wrote to memory of 1464	1508	cmd.exe	37
PID 1508 wrote to memory of 1464	1508	cmd.exe	37
PID 964 wrote to memory of 344	964	tnt.exe	38
PID 964 wrote to memory of 344	964	tnt.exe	38
PID 964 wrote to memory of 344	964	tnt.exe	38
PID 964 wrote to memory of 344	964	tnt.exe	38
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 344 wrote to memory of 388	344	cmd.exe	41
PID 344 wrote to memory of 388	344	cmd.exe	41
PID 344 wrote to memory of 388	344	cmd.exe	41
PID 344 wrote to memory of 388	344	cmd.exe	41
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 900	964	tnt.exe	39
PID 964 wrote to memory of 1592	964	tnt.exe	42
PID 964 wrote to memory of 1592	964	tnt.exe	42
PID 964 wrote to memory of 1592	964	tnt.exe	42
PID 964 wrote to memory of 1592	964	tnt.exe	42
PID 1592 wrote to memory of 1144	1592	cmd.exe	44
PID 1592 wrote to memory of 1144	1592	cmd.exe	44
PID 1592 wrote to memory of 1144	1592	cmd.exe	44
PID 1592 wrote to memory of 1144	1592	cmd.exe	44
PID 964 wrote to memory of 1472	964	tnt.exe	45
PID 964 wrote to memory of 1472	964	tnt.exe	45
PID 964 wrote to memory of 1472	964	tnt.exe	45
PID 964 wrote to memory of 1472	964	tnt.exe	45
PID 1472 wrote to memory of 1964	1472	cmd.exe	47
PID 1472 wrote to memory of 1964	1472	cmd.exe	47
PID 1472 wrote to memory of 1964	1472	cmd.exe	47
PID 1472 wrote to memory of 1964	1472	cmd.exe	47
PID 900 wrote to memory of 1672	900	tnt.exe	48
PID 900 wrote to memory of 1672	900	tnt.exe	48
PID 900 wrote to memory of 1672	900	tnt.exe	48
PID 900 wrote to memory of 1672	900	tnt.exe	48
PID 964 wrote to memory of 1324	964	tnt.exe	49
PID 964 wrote to memory of 1324	964	tnt.exe	49
PID 964 wrote to memory of 1324	964	tnt.exe	49
PID 964 wrote to memory of 1324	964	tnt.exe	49
PID 1324 wrote to memory of 1612	1324	cmd.exe	51
PID 1324 wrote to memory of 1612	1324	cmd.exe	51
PID 1324 wrote to memory of 1612	1324	cmd.exe	51
PID 1324 wrote to memory of 1612	1324	cmd.exe	51
PID 964 wrote to memory of 272	964	tnt.exe	52
PID 964 wrote to memory of 272	964	tnt.exe	52
PID 964 wrote to memory of 272	964	tnt.exe	52
PID 964 wrote to memory of 272	964	tnt.exe	52
PID 272 wrote to memory of 1120	272	cmd.exe	54
PID 272 wrote to memory of 1120	272	cmd.exe	54
PID 272 wrote to memory of 1120	272	cmd.exe	54
PID 272 wrote to memory of 1120	272	cmd.exe	54
PID 1672 wrote to memory of 1200	1672	WScript.exe	55
PID 1672 wrote to memory of 1200	1672	WScript.exe	55
PID 1672 wrote to memory of 1200	1672	WScript.exe	55
PID 1672 wrote to memory of 1200	1672	WScript.exe	55
PID 1200 wrote to memory of 1616	1200	cmd.exe	57
PID 1200 wrote to memory of 1616	1200	cmd.exe	57
PID 1200 wrote to memory of 1616	1200	cmd.exe	57
PID 1200 wrote to memory of 1616	1200	cmd.exe	57
PID 964 wrote to memory of 928	964	tnt.exe	58
PID 964 wrote to memory of 928	964	tnt.exe	58
PID 964 wrote to memory of 928	964	tnt.exe	58
PID 964 wrote to memory of 928	964	tnt.exe	58
PID 928 wrote to memory of 868	928	cmd.exe	60
PID 928 wrote to memory of 868	928	cmd.exe	60
PID 928 wrote to memory of 868	928	cmd.exe	60
PID 928 wrote to memory of 868	928	cmd.exe	60
PID 964 wrote to memory of 1728	964	tnt.exe	61
PID 964 wrote to memory of 1728	964	tnt.exe	61
PID 964 wrote to memory of 1728	964	tnt.exe	61
PID 964 wrote to memory of 1728	964	tnt.exe	61
PID 1728 wrote to memory of 916	1728	cmd.exe	63
PID 1728 wrote to memory of 916	1728	cmd.exe	63
PID 1728 wrote to memory of 916	1728	cmd.exe	63
PID 1728 wrote to memory of 916	1728	cmd.exe	63
PID 964 wrote to memory of 1436	964	tnt.exe	64
PID 964 wrote to memory of 1436	964	tnt.exe	64
PID 964 wrote to memory of 1436	964	tnt.exe	64
PID 964 wrote to memory of 1436	964	tnt.exe	64
PID 1436 wrote to memory of 1188	1436	cmd.exe	66
PID 1436 wrote to memory of 1188	1436	cmd.exe	66
PID 1436 wrote to memory of 1188	1436	cmd.exe	66
PID 1436 wrote to memory of 1188	1436	cmd.exe	66
PID 964 wrote to memory of 656	964	tnt.exe	67
PID 964 wrote to memory of 656	964	tnt.exe	67
PID 964 wrote to memory of 656	964	tnt.exe	67
PID 964 wrote to memory of 656	964	tnt.exe	67
PID 656 wrote to memory of 1144	656	cmd.exe	69
PID 656 wrote to memory of 1144	656	cmd.exe	69
PID 656 wrote to memory of 1144	656	cmd.exe	69
PID 656 wrote to memory of 1144	656	cmd.exe	69
PID 964 wrote to memory of 1696	964	tnt.exe	70
PID 964 wrote to memory of 1696	964	tnt.exe	70
PID 964 wrote to memory of 1696	964	tnt.exe	70
PID 964 wrote to memory of 1696	964	tnt.exe	70
PID 1696 wrote to memory of 1976	1696	cmd.exe	72
PID 1696 wrote to memory of 1976	1696	cmd.exe	72
PID 1696 wrote to memory of 1976	1696	cmd.exe	72
PID 1696 wrote to memory of 1976	1696	cmd.exe	72
PID 964 wrote to memory of 1984	964	tnt.exe	73
PID 964 wrote to memory of 1984	964	tnt.exe	73
PID 964 wrote to memory of 1984	964	tnt.exe	73
PID 964 wrote to memory of 1984	964	tnt.exe	73
PID 1984 wrote to memory of 972	1984	cmd.exe	75
PID 1984 wrote to memory of 972	1984	cmd.exe	75
PID 1984 wrote to memory of 972	1984	cmd.exe	75
PID 1984 wrote to memory of 972	1984	cmd.exe	75
PID 964 wrote to memory of 396	964	tnt.exe	76
PID 964 wrote to memory of 396	964	tnt.exe	76
PID 964 wrote to memory of 396	964	tnt.exe	76
PID 964 wrote to memory of 396	964	tnt.exe	76
PID 396 wrote to memory of 1080	396	cmd.exe	78
PID 396 wrote to memory of 1080	396	cmd.exe	78
PID 396 wrote to memory of 1080	396	cmd.exe	78
PID 396 wrote to memory of 1080	396	cmd.exe	78
PID 964 wrote to memory of 1120	964	tnt.exe	79
PID 964 wrote to memory of 1120	964	tnt.exe	79
PID 964 wrote to memory of 1120	964	tnt.exe	79
PID 964 wrote to memory of 1120	964	tnt.exe	79
PID 1120 wrote to memory of 1400	1120	cmd.exe	81
PID 1120 wrote to memory of 1400	1120	cmd.exe	81
PID 1120 wrote to memory of 1400	1120	cmd.exe	81
PID 1120 wrote to memory of 1400	1120	cmd.exe	81
PID 964 wrote to memory of 956	964	tnt.exe	82
PID 964 wrote to memory of 956	964	tnt.exe	82
PID 964 wrote to memory of 956	964	tnt.exe	82
PID 964 wrote to memory of 956	964	tnt.exe	82
PID 956 wrote to memory of 1644	956	cmd.exe	84
PID 956 wrote to memory of 1644	956	cmd.exe	84
PID 956 wrote to memory of 1644	956	cmd.exe	84
PID 956 wrote to memory of 1644	956	cmd.exe	84
PID 964 wrote to memory of 1340	964	tnt.exe	85
PID 964 wrote to memory of 1340	964	tnt.exe	85
PID 964 wrote to memory of 1340	964	tnt.exe	85
PID 964 wrote to memory of 1340	964	tnt.exe	85
PID 1340 wrote to memory of 1828	1340	cmd.exe	87
PID 1340 wrote to memory of 1828	1340	cmd.exe	87
PID 1340 wrote to memory of 1828	1340	cmd.exe	87
PID 1340 wrote to memory of 1828	1340	cmd.exe	87
PID 964 wrote to memory of 1880	964	tnt.exe	88
PID 964 wrote to memory of 1880	964	tnt.exe	88
PID 964 wrote to memory of 1880	964	tnt.exe	88
PID 964 wrote to memory of 1880	964	tnt.exe	88
PID 1880 wrote to memory of 744	1880	cmd.exe	90
PID 1880 wrote to memory of 744	1880	cmd.exe	90
PID 1880 wrote to memory of 744	1880	cmd.exe	90
PID 1880 wrote to memory of 744	1880	cmd.exe	90
PID 964 wrote to memory of 1944	964	tnt.exe	91
PID 964 wrote to memory of 1944	964	tnt.exe	91
PID 964 wrote to memory of 1944	964	tnt.exe	91
PID 964 wrote to memory of 1944	964	tnt.exe	91
PID 1944 wrote to memory of 924	1944	cmd.exe	93
PID 1944 wrote to memory of 924	1944	cmd.exe	93
PID 1944 wrote to memory of 924	1944	cmd.exe	93
PID 1944 wrote to memory of 924	1944	cmd.exe	93
PID 964 wrote to memory of 1600	964	tnt.exe	94
PID 964 wrote to memory of 1600	964	tnt.exe	94
PID 964 wrote to memory of 1600	964	tnt.exe	94
PID 964 wrote to memory of 1600	964	tnt.exe	94
PID 1600 wrote to memory of 1980	1600	cmd.exe	96
PID 1600 wrote to memory of 1980	1600	cmd.exe	96
PID 1600 wrote to memory of 1980	1600	cmd.exe	96
PID 1600 wrote to memory of 1980	1600	cmd.exe	96
PID 964 wrote to memory of 1976	964	tnt.exe	97
PID 964 wrote to memory of 1976	964	tnt.exe	97
PID 964 wrote to memory of 1976	964	tnt.exe	97
PID 964 wrote to memory of 1976	964	tnt.exe	97
PID 1976 wrote to memory of 1548	1976	cmd.exe	99
PID 1976 wrote to memory of 1548	1976	cmd.exe	99
PID 1976 wrote to memory of 1548	1976	cmd.exe	99
PID 1976 wrote to memory of 1548	1976	cmd.exe	99
PID 964 wrote to memory of 1532	964	tnt.exe	100
PID 964 wrote to memory of 1532	964	tnt.exe	100
PID 964 wrote to memory of 1532	964	tnt.exe	100
PID 964 wrote to memory of 1532	964	tnt.exe	100
PID 1532 wrote to memory of 1612	1532	cmd.exe	102
PID 1532 wrote to memory of 1612	1532	cmd.exe	102
PID 1532 wrote to memory of 1612	1532	cmd.exe	102
PID 1532 wrote to memory of 1612	1532	cmd.exe	102
PID 964 wrote to memory of 1080	964	tnt.exe	103
PID 964 wrote to memory of 1080	964	tnt.exe	103
PID 964 wrote to memory of 1080	964	tnt.exe	103
PID 964 wrote to memory of 1080	964	tnt.exe	103
PID 1080 wrote to memory of 948	1080	cmd.exe	105
PID 1080 wrote to memory of 948	1080	cmd.exe	105
PID 1080 wrote to memory of 948	1080	cmd.exe	105
PID 1080 wrote to memory of 948	1080	cmd.exe	105
PID 964 wrote to memory of 1412	964	tnt.exe	106
PID 964 wrote to memory of 1412	964	tnt.exe	106
PID 964 wrote to memory of 1412	964	tnt.exe	106
PID 964 wrote to memory of 1412	964	tnt.exe	106
PID 1412 wrote to memory of 1644	1412	cmd.exe	108
PID 1412 wrote to memory of 1644	1412	cmd.exe	108
PID 1412 wrote to memory of 1644	1412	cmd.exe	108
PID 1412 wrote to memory of 1644	1412	cmd.exe	108
PID 964 wrote to memory of 872	964	tnt.exe	109
PID 964 wrote to memory of 872	964	tnt.exe	109
PID 964 wrote to memory of 872	964	tnt.exe	109
PID 964 wrote to memory of 872	964	tnt.exe	109
PID 872 wrote to memory of 1928	872	cmd.exe	111
PID 872 wrote to memory of 1928	872	cmd.exe	111
PID 872 wrote to memory of 1928	872	cmd.exe	111
PID 872 wrote to memory of 1928	872	cmd.exe	111
PID 964 wrote to memory of 364	964	tnt.exe	112
PID 964 wrote to memory of 364	964	tnt.exe	112
PID 964 wrote to memory of 364	964	tnt.exe	112
PID 964 wrote to memory of 364	964	tnt.exe	112
PID 364 wrote to memory of 844	364	cmd.exe	114
PID 364 wrote to memory of 844	364	cmd.exe	114
PID 364 wrote to memory of 844	364	cmd.exe	114
PID 364 wrote to memory of 844	364	cmd.exe	114
PID 964 wrote to memory of 596	964	tnt.exe	115
PID 964 wrote to memory of 596	964	tnt.exe	115
PID 964 wrote to memory of 596	964	tnt.exe	115
PID 964 wrote to memory of 596	964	tnt.exe	115
PID 596 wrote to memory of 820	596	cmd.exe	117
PID 596 wrote to memory of 820	596	cmd.exe	117
PID 596 wrote to memory of 820	596	cmd.exe	117
PID 596 wrote to memory of 820	596	cmd.exe	117
PID 964 wrote to memory of 1596	964	tnt.exe	118
PID 964 wrote to memory of 1596	964	tnt.exe	118
PID 964 wrote to memory of 1596	964	tnt.exe	118
PID 964 wrote to memory of 1596	964	tnt.exe	118
PID 1596 wrote to memory of 332	1596	cmd.exe	120
PID 1596 wrote to memory of 332	1596	cmd.exe	120
PID 1596 wrote to memory of 332	1596	cmd.exe	120
PID 1596 wrote to memory of 332	1596	cmd.exe	120
PID 964 wrote to memory of 676	964	tnt.exe	121
PID 964 wrote to memory of 676	964	tnt.exe	121
PID 964 wrote to memory of 676	964	tnt.exe	121
PID 964 wrote to memory of 676	964	tnt.exe	121
PID 676 wrote to memory of 1960	676	cmd.exe	123
PID 676 wrote to memory of 1960	676	cmd.exe	123
PID 676 wrote to memory of 1960	676	cmd.exe	123
PID 676 wrote to memory of 1960	676	cmd.exe	123
PID 964 wrote to memory of 268	964	tnt.exe	124
PID 964 wrote to memory of 268	964	tnt.exe	124
PID 964 wrote to memory of 268	964	tnt.exe	124
PID 964 wrote to memory of 268	964	tnt.exe	124
PID 268 wrote to memory of 1096	268	cmd.exe	126
PID 268 wrote to memory of 1096	268	cmd.exe	126
PID 268 wrote to memory of 1096	268	cmd.exe	126
PID 268 wrote to memory of 1096	268	cmd.exe	126
PID 964 wrote to memory of 944	964	tnt.exe	127
PID 964 wrote to memory of 944	964	tnt.exe	127
PID 964 wrote to memory of 944	964	tnt.exe	127
PID 964 wrote to memory of 944	964	tnt.exe	127
PID 944 wrote to memory of 1808	944	cmd.exe	129
PID 944 wrote to memory of 1808	944	cmd.exe	129
PID 944 wrote to memory of 1808	944	cmd.exe	129
PID 944 wrote to memory of 1808	944	cmd.exe	129
PID 964 wrote to memory of 1928	964	tnt.exe	130
PID 964 wrote to memory of 1928	964	tnt.exe	130
PID 964 wrote to memory of 1928	964	tnt.exe	130
PID 964 wrote to memory of 1928	964	tnt.exe	130
PID 1928 wrote to memory of 1188	1928	cmd.exe	132
PID 1928 wrote to memory of 1188	1928	cmd.exe	132
PID 1928 wrote to memory of 1188	1928	cmd.exe	132
PID 1928 wrote to memory of 1188	1928	cmd.exe	132
PID 964 wrote to memory of 1392	964	tnt.exe	133
PID 964 wrote to memory of 1392	964	tnt.exe	133
PID 964 wrote to memory of 1392	964	tnt.exe	133
PID 964 wrote to memory of 1392	964	tnt.exe	133
PID 1392 wrote to memory of 820	1392	cmd.exe	135
PID 1392 wrote to memory of 820	1392	cmd.exe	135
PID 1392 wrote to memory of 820	1392	cmd.exe	135
PID 1392 wrote to memory of 820	1392	cmd.exe	135
PID 964 wrote to memory of 864	964	tnt.exe	136
PID 964 wrote to memory of 864	964	tnt.exe	136
PID 964 wrote to memory of 864	964	tnt.exe	136
PID 964 wrote to memory of 864	964	tnt.exe	136
PID 864 wrote to memory of 1572	864	cmd.exe	138
PID 864 wrote to memory of 1572	864	cmd.exe	138
PID 864 wrote to memory of 1572	864	cmd.exe	138
PID 864 wrote to memory of 1572	864	cmd.exe	138
PID 964 wrote to memory of 1688	964	tnt.exe	139
PID 964 wrote to memory of 1688	964	tnt.exe	139
PID 964 wrote to memory of 1688	964	tnt.exe	139
PID 964 wrote to memory of 1688	964	tnt.exe	139
PID 1688 wrote to memory of 1256	1688	cmd.exe	141
PID 1688 wrote to memory of 1256	1688	cmd.exe	141
PID 1688 wrote to memory of 1256	1688	cmd.exe	141
PID 1688 wrote to memory of 1256	1688	cmd.exe	141
PID 964 wrote to memory of 1584	964	tnt.exe	142
PID 964 wrote to memory of 1584	964	tnt.exe	142
PID 964 wrote to memory of 1584	964	tnt.exe	142
PID 964 wrote to memory of 1584	964	tnt.exe	142
PID 1584 wrote to memory of 1664	1584	cmd.exe	144
PID 1584 wrote to memory of 1664	1584	cmd.exe	144
PID 1584 wrote to memory of 1664	1584	cmd.exe	144
PID 1584 wrote to memory of 1664	1584	cmd.exe	144
PID 964 wrote to memory of 368	964	tnt.exe	145
PID 964 wrote to memory of 368	964	tnt.exe	145
PID 964 wrote to memory of 368	964	tnt.exe	145
PID 964 wrote to memory of 368	964	tnt.exe	145
PID 368 wrote to memory of 1188	368	cmd.exe	147
PID 368 wrote to memory of 1188	368	cmd.exe	147
PID 368 wrote to memory of 1188	368	cmd.exe	147
PID 368 wrote to memory of 1188	368	cmd.exe	147
PID 964 wrote to memory of 1828	964	tnt.exe	148
PID 964 wrote to memory of 1828	964	tnt.exe	148
PID 964 wrote to memory of 1828	964	tnt.exe	148
PID 964 wrote to memory of 1828	964	tnt.exe	148
PID 1828 wrote to memory of 1172	1828	cmd.exe	150
PID 1828 wrote to memory of 1172	1828	cmd.exe	150
PID 1828 wrote to memory of 1172	1828	cmd.exe	150
PID 1828 wrote to memory of 1172	1828	cmd.exe	150
PID 964 wrote to memory of 1548	964	tnt.exe	151
PID 964 wrote to memory of 1548	964	tnt.exe	151
PID 964 wrote to memory of 1548	964	tnt.exe	151
PID 964 wrote to memory of 1548	964	tnt.exe	151
PID 1548 wrote to memory of 556	1548	cmd.exe	153
PID 1548 wrote to memory of 556	1548	cmd.exe	153
PID 1548 wrote to memory of 556	1548	cmd.exe	153
PID 1548 wrote to memory of 556	1548	cmd.exe	153
PID 964 wrote to memory of 1400	964	tnt.exe	154
PID 964 wrote to memory of 1400	964	tnt.exe	154
PID 964 wrote to memory of 1400	964	tnt.exe	154
PID 964 wrote to memory of 1400	964	tnt.exe	154
PID 1400 wrote to memory of 1624	1400	cmd.exe	156
PID 1400 wrote to memory of 1624	1400	cmd.exe	156
PID 1400 wrote to memory of 1624	1400	cmd.exe	156
PID 1400 wrote to memory of 1624	1400	cmd.exe	156
PID 964 wrote to memory of 1644	964	tnt.exe	157
PID 964 wrote to memory of 1644	964	tnt.exe	157
PID 964 wrote to memory of 1644	964	tnt.exe	157
PID 964 wrote to memory of 1644	964	tnt.exe	157
PID 1644 wrote to memory of 316	1644	cmd.exe	159
PID 1644 wrote to memory of 316	1644	cmd.exe	159
PID 1644 wrote to memory of 316	1644	cmd.exe	159
PID 1644 wrote to memory of 316	1644	cmd.exe	159
PID 964 wrote to memory of 1640	964	tnt.exe	160
PID 964 wrote to memory of 1640	964	tnt.exe	160
PID 964 wrote to memory of 1640	964	tnt.exe	160
PID 964 wrote to memory of 1640	964	tnt.exe	160
PID 1640 wrote to memory of 1172	1640	cmd.exe	162
PID 1640 wrote to memory of 1172	1640	cmd.exe	162
PID 1640 wrote to memory of 1172	1640	cmd.exe	162
PID 1640 wrote to memory of 1172	1640	cmd.exe	162
PID 964 wrote to memory of 924	964	tnt.exe	163
PID 964 wrote to memory of 924	964	tnt.exe	163
PID 964 wrote to memory of 924	964	tnt.exe	163
PID 964 wrote to memory of 924	964	tnt.exe	163
PID 924 wrote to memory of 1228	924	cmd.exe	165
PID 924 wrote to memory of 1228	924	cmd.exe	165
PID 924 wrote to memory of 1228	924	cmd.exe	165
PID 924 wrote to memory of 1228	924	cmd.exe	165
PID 964 wrote to memory of 1496	964	tnt.exe	166
PID 964 wrote to memory of 1496	964	tnt.exe	166
PID 964 wrote to memory of 1496	964	tnt.exe	166
PID 964 wrote to memory of 1496	964	tnt.exe	166
PID 1496 wrote to memory of 2008	1496	cmd.exe	168
PID 1496 wrote to memory of 2008	1496	cmd.exe	168
PID 1496 wrote to memory of 2008	1496	cmd.exe	168
PID 1496 wrote to memory of 2008	1496	cmd.exe	168
PID 964 wrote to memory of 1628	964	tnt.exe	169
PID 964 wrote to memory of 1628	964	tnt.exe	169
PID 964 wrote to memory of 1628	964	tnt.exe	169
PID 964 wrote to memory of 1628	964	tnt.exe	169
PID 1628 wrote to memory of 1144	1628	cmd.exe	171
PID 1628 wrote to memory of 1144	1628	cmd.exe	171
PID 1628 wrote to memory of 1144	1628	cmd.exe	171
PID 1628 wrote to memory of 1144	1628	cmd.exe	171
PID 964 wrote to memory of 844	964	tnt.exe	172
PID 964 wrote to memory of 844	964	tnt.exe	172
PID 964 wrote to memory of 844	964	tnt.exe	172
PID 964 wrote to memory of 844	964	tnt.exe	172
PID 844 wrote to memory of 1228	844	cmd.exe	174
PID 844 wrote to memory of 1228	844	cmd.exe	174
PID 844 wrote to memory of 1228	844	cmd.exe	174
PID 844 wrote to memory of 1228	844	cmd.exe	174
PID 964 wrote to memory of 1612	964	tnt.exe	175
PID 964 wrote to memory of 1612	964	tnt.exe	175
PID 964 wrote to memory of 1612	964	tnt.exe	175
PID 964 wrote to memory of 1612	964	tnt.exe	175
PID 1612 wrote to memory of 572	1612	cmd.exe	177
PID 1612 wrote to memory of 572	1612	cmd.exe	177
PID 1612 wrote to memory of 572	1612	cmd.exe	177
PID 1612 wrote to memory of 572	1612	cmd.exe	177
PID 964 wrote to memory of 812	964	tnt.exe	178
PID 964 wrote to memory of 812	964	tnt.exe	178
PID 964 wrote to memory of 812	964	tnt.exe	178
PID 964 wrote to memory of 812	964	tnt.exe	178
PID 812 wrote to memory of 1096	812	cmd.exe	180
PID 812 wrote to memory of 1096	812	cmd.exe	180
PID 812 wrote to memory of 1096	812	cmd.exe	180
PID 812 wrote to memory of 1096	812	cmd.exe	180
PID 964 wrote to memory of 2020	964	tnt.exe	181
PID 964 wrote to memory of 2020	964	tnt.exe	181
PID 964 wrote to memory of 2020	964	tnt.exe	181
PID 964 wrote to memory of 2020	964	tnt.exe	181
PID 2020 wrote to memory of 884	2020	cmd.exe	183
PID 2020 wrote to memory of 884	2020	cmd.exe	183
PID 2020 wrote to memory of 884	2020	cmd.exe	183
PID 2020 wrote to memory of 884	2020	cmd.exe	183
PID 964 wrote to memory of 1960	964	tnt.exe	184
PID 964 wrote to memory of 1960	964	tnt.exe	184
PID 964 wrote to memory of 1960	964	tnt.exe	184
PID 964 wrote to memory of 1960	964	tnt.exe	184
PID 1960 wrote to memory of 304	1960	cmd.exe	186
PID 1960 wrote to memory of 304	1960	cmd.exe	186
PID 1960 wrote to memory of 304	1960	cmd.exe	186
PID 1960 wrote to memory of 304	1960	cmd.exe	186
PID 964 wrote to memory of 1572	964	tnt.exe	187
PID 964 wrote to memory of 1572	964	tnt.exe	187
PID 964 wrote to memory of 1572	964	tnt.exe	187
PID 964 wrote to memory of 1572	964	tnt.exe	187
PID 1572 wrote to memory of 2012	1572	cmd.exe	189
PID 1572 wrote to memory of 2012	1572	cmd.exe	189
PID 1572 wrote to memory of 2012	1572	cmd.exe	189
PID 1572 wrote to memory of 2012	1572	cmd.exe	189
PID 964 wrote to memory of 868	964	tnt.exe	190
PID 964 wrote to memory of 868	964	tnt.exe	190
PID 964 wrote to memory of 868	964	tnt.exe	190
PID 964 wrote to memory of 868	964	tnt.exe	190
PID 868 wrote to memory of 2012	868	cmd.exe	192
PID 868 wrote to memory of 2012	868	cmd.exe	192
PID 868 wrote to memory of 2012	868	cmd.exe	192
PID 868 wrote to memory of 2012	868	cmd.exe	192
PID 964 wrote to memory of 884	964	tnt.exe	193
PID 964 wrote to memory of 884	964	tnt.exe	193
PID 964 wrote to memory of 884	964	tnt.exe	193
PID 964 wrote to memory of 884	964	tnt.exe	193
PID 884 wrote to memory of 792	884	cmd.exe	195
PID 884 wrote to memory of 792	884	cmd.exe	195
PID 884 wrote to memory of 792	884	cmd.exe	195
PID 884 wrote to memory of 792	884	cmd.exe	195
PID 964 wrote to memory of 1884	964	tnt.exe	196
PID 964 wrote to memory of 1884	964	tnt.exe	196
PID 964 wrote to memory of 1884	964	tnt.exe	196
PID 964 wrote to memory of 1884	964	tnt.exe	196
PID 1884 wrote to memory of 1208	1884	cmd.exe	198
PID 1884 wrote to memory of 1208	1884	cmd.exe	198
PID 1884 wrote to memory of 1208	1884	cmd.exe	198
PID 1884 wrote to memory of 1208	1884	cmd.exe	198
PID 964 wrote to memory of 1256	964	tnt.exe	199
PID 964 wrote to memory of 1256	964	tnt.exe	199
PID 964 wrote to memory of 1256	964	tnt.exe	199
PID 964 wrote to memory of 1256	964	tnt.exe	199
PID 1256 wrote to memory of 1964	1256	cmd.exe	201
PID 1256 wrote to memory of 1964	1256	cmd.exe	201
PID 1256 wrote to memory of 1964	1256	cmd.exe	201
PID 1256 wrote to memory of 1964	1256	cmd.exe	201
PID 964 wrote to memory of 792	964	tnt.exe	202
PID 964 wrote to memory of 792	964	tnt.exe	202
PID 964 wrote to memory of 792	964	tnt.exe	202
PID 964 wrote to memory of 792	964	tnt.exe	202
PID 792 wrote to memory of 796	792	cmd.exe	204
PID 792 wrote to memory of 796	792	cmd.exe	204
PID 792 wrote to memory of 796	792	cmd.exe	204
PID 792 wrote to memory of 796	792	cmd.exe	204
PID 964 wrote to memory of 1144	964	tnt.exe	205
PID 964 wrote to memory of 1144	964	tnt.exe	205
PID 964 wrote to memory of 1144	964	tnt.exe	205
PID 964 wrote to memory of 1144	964	tnt.exe	205
PID 1144 wrote to memory of 1948	1144	cmd.exe	207
PID 1144 wrote to memory of 1948	1144	cmd.exe	207
PID 1144 wrote to memory of 1948	1144	cmd.exe	207
PID 1144 wrote to memory of 1948	1144	cmd.exe	207
PID 964 wrote to memory of 332	964	tnt.exe	208
PID 964 wrote to memory of 332	964	tnt.exe	208
PID 964 wrote to memory of 332	964	tnt.exe	208
PID 964 wrote to memory of 332	964	tnt.exe	208
PID 332 wrote to memory of 796	332	cmd.exe	210
PID 332 wrote to memory of 796	332	cmd.exe	210
PID 332 wrote to memory of 796	332	cmd.exe	210
PID 332 wrote to memory of 796	332	cmd.exe	210
PID 964 wrote to memory of 776	964	tnt.exe	211
PID 964 wrote to memory of 776	964	tnt.exe	211
PID 964 wrote to memory of 776	964	tnt.exe	211
PID 964 wrote to memory of 776	964	tnt.exe	211
PID 776 wrote to memory of 1948	776	cmd.exe	213
PID 776 wrote to memory of 1948	776	cmd.exe	213
PID 776 wrote to memory of 1948	776	cmd.exe	213
PID 776 wrote to memory of 1948	776	cmd.exe	213
PID 964 wrote to memory of 1760	964	tnt.exe	214
PID 964 wrote to memory of 1760	964	tnt.exe	214
PID 964 wrote to memory of 1760	964	tnt.exe	214
PID 964 wrote to memory of 1760	964	tnt.exe	214
PID 1760 wrote to memory of 744	1760	cmd.exe	216
PID 1760 wrote to memory of 744	1760	cmd.exe	216
PID 1760 wrote to memory of 744	1760	cmd.exe	216
PID 1760 wrote to memory of 744	1760	cmd.exe	216
PID 964 wrote to memory of 1560	964	tnt.exe	217
PID 964 wrote to memory of 1560	964	tnt.exe	217
PID 964 wrote to memory of 1560	964	tnt.exe	217
PID 964 wrote to memory of 1560	964	tnt.exe	217
PID 1560 wrote to memory of 1616	1560	cmd.exe	219
PID 1560 wrote to memory of 1616	1560	cmd.exe	219
PID 1560 wrote to memory of 1616	1560	cmd.exe	219
PID 1560 wrote to memory of 1616	1560	cmd.exe	219
PID 964 wrote to memory of 744	964	tnt.exe	220
PID 964 wrote to memory of 744	964	tnt.exe	220
PID 964 wrote to memory of 744	964	tnt.exe	220
PID 964 wrote to memory of 744	964	tnt.exe	220
PID 744 wrote to memory of 1484	744	cmd.exe	222
PID 744 wrote to memory of 1484	744	cmd.exe	222
PID 744 wrote to memory of 1484	744	cmd.exe	222
PID 744 wrote to memory of 1484	744	cmd.exe	222
PID 964 wrote to memory of 1028	964	tnt.exe	223
PID 964 wrote to memory of 1028	964	tnt.exe	223
PID 964 wrote to memory of 1028	964	tnt.exe	223
PID 964 wrote to memory of 1028	964	tnt.exe	223
PID 1028 wrote to memory of 1096	1028	cmd.exe	225
PID 1028 wrote to memory of 1096	1028	cmd.exe	225
PID 1028 wrote to memory of 1096	1028	cmd.exe	225
PID 1028 wrote to memory of 1096	1028	cmd.exe	225
PID 964 wrote to memory of 316	964	tnt.exe	226
PID 964 wrote to memory of 316	964	tnt.exe	226
PID 964 wrote to memory of 316	964	tnt.exe	226
PID 964 wrote to memory of 316	964	tnt.exe	226
PID 316 wrote to memory of 1616	316	cmd.exe	228
PID 316 wrote to memory of 1616	316	cmd.exe	228
PID 316 wrote to memory of 1616	316	cmd.exe	228
PID 316 wrote to memory of 1616	316	cmd.exe	228
PID 964 wrote to memory of 1948	964	tnt.exe	229
PID 964 wrote to memory of 1948	964	tnt.exe	229
PID 964 wrote to memory of 1948	964	tnt.exe	229
PID 964 wrote to memory of 1948	964	tnt.exe	229
PID 1948 wrote to memory of 1484	1948	cmd.exe	231
PID 1948 wrote to memory of 1484	1948	cmd.exe	231
PID 1948 wrote to memory of 1484	1948	cmd.exe	231
PID 1948 wrote to memory of 1484	1948	cmd.exe	231
PID 964 wrote to memory of 436	964	tnt.exe	232
PID 964 wrote to memory of 436	964	tnt.exe	232
PID 964 wrote to memory of 436	964	tnt.exe	232
PID 964 wrote to memory of 436	964	tnt.exe	232
PID 436 wrote to memory of 1484	436	cmd.exe	234
PID 436 wrote to memory of 1484	436	cmd.exe	234
PID 436 wrote to memory of 1484	436	cmd.exe	234
PID 436 wrote to memory of 1484	436	cmd.exe	234
PID 964 wrote to memory of 2060	964	tnt.exe	235
PID 964 wrote to memory of 2060	964	tnt.exe	235
PID 964 wrote to memory of 2060	964	tnt.exe	235
PID 964 wrote to memory of 2060	964	tnt.exe	235
PID 2060 wrote to memory of 2088	2060	cmd.exe	237
PID 2060 wrote to memory of 2088	2060	cmd.exe	237
PID 2060 wrote to memory of 2088	2060	cmd.exe	237
PID 2060 wrote to memory of 2088	2060	cmd.exe	237
PID 964 wrote to memory of 2104	964	tnt.exe	238
PID 964 wrote to memory of 2104	964	tnt.exe	238
PID 964 wrote to memory of 2104	964	tnt.exe	238
PID 964 wrote to memory of 2104	964	tnt.exe	238
PID 2104 wrote to memory of 2132	2104	cmd.exe	240
PID 2104 wrote to memory of 2132	2104	cmd.exe	240
PID 2104 wrote to memory of 2132	2104	cmd.exe	240
PID 2104 wrote to memory of 2132	2104	cmd.exe	240
PID 964 wrote to memory of 2148	964	tnt.exe	241
PID 964 wrote to memory of 2148	964	tnt.exe	241
PID 964 wrote to memory of 2148	964	tnt.exe	241
PID 964 wrote to memory of 2148	964	tnt.exe	241
PID 2148 wrote to memory of 2176	2148	cmd.exe	243
PID 2148 wrote to memory of 2176	2148	cmd.exe	243
PID 2148 wrote to memory of 2176	2148	cmd.exe	243
PID 2148 wrote to memory of 2176	2148	cmd.exe	243
PID 964 wrote to memory of 2192	964	tnt.exe	244
PID 964 wrote to memory of 2192	964	tnt.exe	244
PID 964 wrote to memory of 2192	964	tnt.exe	244
PID 964 wrote to memory of 2192	964	tnt.exe	244
PID 2192 wrote to memory of 2220	2192	cmd.exe	246
PID 2192 wrote to memory of 2220	2192	cmd.exe	246
PID 2192 wrote to memory of 2220	2192	cmd.exe	246
PID 2192 wrote to memory of 2220	2192	cmd.exe	246
PID 964 wrote to memory of 2236	964	tnt.exe	247
PID 964 wrote to memory of 2236	964	tnt.exe	247
PID 964 wrote to memory of 2236	964	tnt.exe	247
PID 964 wrote to memory of 2236	964	tnt.exe	247
PID 2236 wrote to memory of 2264	2236	cmd.exe	249
PID 2236 wrote to memory of 2264	2236	cmd.exe	249
PID 2236 wrote to memory of 2264	2236	cmd.exe	249
PID 2236 wrote to memory of 2264	2236	cmd.exe	249
PID 964 wrote to memory of 2280	964	tnt.exe	250
PID 964 wrote to memory of 2280	964	tnt.exe	250
PID 964 wrote to memory of 2280	964	tnt.exe	250
PID 964 wrote to memory of 2280	964	tnt.exe	250
PID 2280 wrote to memory of 2308	2280	cmd.exe	252
PID 2280 wrote to memory of 2308	2280	cmd.exe	252
PID 2280 wrote to memory of 2308	2280	cmd.exe	252
PID 2280 wrote to memory of 2308	2280	cmd.exe	252
PID 964 wrote to memory of 2324	964	tnt.exe	253
PID 964 wrote to memory of 2324	964	tnt.exe	253
PID 964 wrote to memory of 2324	964	tnt.exe	253
PID 964 wrote to memory of 2324	964	tnt.exe	253
PID 2324 wrote to memory of 2352	2324	cmd.exe	255
PID 2324 wrote to memory of 2352	2324	cmd.exe	255
PID 2324 wrote to memory of 2352	2324	cmd.exe	255
PID 2324 wrote to memory of 2352	2324	cmd.exe	255
PID 964 wrote to memory of 2368	964	tnt.exe	256
PID 964 wrote to memory of 2368	964	tnt.exe	256
PID 964 wrote to memory of 2368	964	tnt.exe	256
PID 964 wrote to memory of 2368	964	tnt.exe	256
PID 2368 wrote to memory of 2396	2368	cmd.exe	258
PID 2368 wrote to memory of 2396	2368	cmd.exe	258
PID 2368 wrote to memory of 2396	2368	cmd.exe	258
PID 2368 wrote to memory of 2396	2368	cmd.exe	258
PID 964 wrote to memory of 2412	964	tnt.exe	259
PID 964 wrote to memory of 2412	964	tnt.exe	259
PID 964 wrote to memory of 2412	964	tnt.exe	259
PID 964 wrote to memory of 2412	964	tnt.exe	259
PID 2412 wrote to memory of 2440	2412	cmd.exe	261
PID 2412 wrote to memory of 2440	2412	cmd.exe	261
PID 2412 wrote to memory of 2440	2412	cmd.exe	261
PID 2412 wrote to memory of 2440	2412	cmd.exe	261
PID 964 wrote to memory of 2456	964	tnt.exe	262
PID 964 wrote to memory of 2456	964	tnt.exe	262
PID 964 wrote to memory of 2456	964	tnt.exe	262
PID 964 wrote to memory of 2456	964	tnt.exe	262
PID 2456 wrote to memory of 2484	2456	cmd.exe	264
PID 2456 wrote to memory of 2484	2456	cmd.exe	264
PID 2456 wrote to memory of 2484	2456	cmd.exe	264
PID 2456 wrote to memory of 2484	2456	cmd.exe	264
PID 964 wrote to memory of 2500	964	tnt.exe	265
PID 964 wrote to memory of 2500	964	tnt.exe	265
PID 964 wrote to memory of 2500	964	tnt.exe	265
PID 964 wrote to memory of 2500	964	tnt.exe	265
PID 2500 wrote to memory of 2528	2500	cmd.exe	267
PID 2500 wrote to memory of 2528	2500	cmd.exe	267
PID 2500 wrote to memory of 2528	2500	cmd.exe	267
PID 2500 wrote to memory of 2528	2500	cmd.exe	267
PID 964 wrote to memory of 2544	964	tnt.exe	268
PID 964 wrote to memory of 2544	964	tnt.exe	268
PID 964 wrote to memory of 2544	964	tnt.exe	268
PID 964 wrote to memory of 2544	964	tnt.exe	268
PID 2544 wrote to memory of 2572	2544	cmd.exe	270
PID 2544 wrote to memory of 2572	2544	cmd.exe	270
PID 2544 wrote to memory of 2572	2544	cmd.exe	270
PID 2544 wrote to memory of 2572	2544	cmd.exe	270
PID 964 wrote to memory of 2588	964	tnt.exe	271
PID 964 wrote to memory of 2588	964	tnt.exe	271
PID 964 wrote to memory of 2588	964	tnt.exe	271
PID 964 wrote to memory of 2588	964	tnt.exe	271
PID 2588 wrote to memory of 2616	2588	cmd.exe	273
PID 2588 wrote to memory of 2616	2588	cmd.exe	273
PID 2588 wrote to memory of 2616	2588	cmd.exe	273
PID 2588 wrote to memory of 2616	2588	cmd.exe	273
PID 964 wrote to memory of 2632	964	tnt.exe	274
PID 964 wrote to memory of 2632	964	tnt.exe	274
PID 964 wrote to memory of 2632	964	tnt.exe	274
PID 964 wrote to memory of 2632	964	tnt.exe	274
PID 2632 wrote to memory of 2660	2632	cmd.exe	276
PID 2632 wrote to memory of 2660	2632	cmd.exe	276
PID 2632 wrote to memory of 2660	2632	cmd.exe	276
PID 2632 wrote to memory of 2660	2632	cmd.exe	276
PID 964 wrote to memory of 2676	964	tnt.exe	277
PID 964 wrote to memory of 2676	964	tnt.exe	277
PID 964 wrote to memory of 2676	964	tnt.exe	277
PID 964 wrote to memory of 2676	964	tnt.exe	277
PID 2676 wrote to memory of 2704	2676	cmd.exe	279
PID 2676 wrote to memory of 2704	2676	cmd.exe	279
PID 2676 wrote to memory of 2704	2676	cmd.exe	279
PID 2676 wrote to memory of 2704	2676	cmd.exe	279
PID 964 wrote to memory of 2720	964	tnt.exe	280
PID 964 wrote to memory of 2720	964	tnt.exe	280
PID 964 wrote to memory of 2720	964	tnt.exe	280
PID 964 wrote to memory of 2720	964	tnt.exe	280
PID 2720 wrote to memory of 2748	2720	cmd.exe	282
PID 2720 wrote to memory of 2748	2720	cmd.exe	282
PID 2720 wrote to memory of 2748	2720	cmd.exe	282
PID 2720 wrote to memory of 2748	2720	cmd.exe	282
PID 964 wrote to memory of 2764	964	tnt.exe	283
PID 964 wrote to memory of 2764	964	tnt.exe	283
PID 964 wrote to memory of 2764	964	tnt.exe	283
PID 964 wrote to memory of 2764	964	tnt.exe	283
PID 2764 wrote to memory of 2792	2764	cmd.exe	285
PID 2764 wrote to memory of 2792	2764	cmd.exe	285
PID 2764 wrote to memory of 2792	2764	cmd.exe	285
PID 2764 wrote to memory of 2792	2764	cmd.exe	285
PID 964 wrote to memory of 2808	964	tnt.exe	286
PID 964 wrote to memory of 2808	964	tnt.exe	286
PID 964 wrote to memory of 2808	964	tnt.exe	286
PID 964 wrote to memory of 2808	964	tnt.exe	286
PID 2808 wrote to memory of 2836	2808	cmd.exe	288
PID 2808 wrote to memory of 2836	2808	cmd.exe	288
PID 2808 wrote to memory of 2836	2808	cmd.exe	288
PID 2808 wrote to memory of 2836	2808	cmd.exe	288

C:\Users\Admin\AppData\Local\Temp\6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe
"C:\Users\Admin\AppData\Local\Temp\6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe" "C:\Users\Admin\Desktop\tnt.exe"
  2⤵
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\tnt.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Users\Admin\Desktop\tnt.exe
    "C:\Users\Admin\Desktop\tnt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1508
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1464
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:344
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:388
  - - C:\Users\Admin\Desktop\tnt.exe
      "C:\Users\Admin\Desktop\tnt.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:900
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        5⤵
        
        PID:1672
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        Loads dropped DLL
        
        PID:1200
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1324
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:272
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1120
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:928
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1728
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:916
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1436
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1188
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:656
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1696
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1976
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1984
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:972
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:396
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1120
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:956
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1340
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1828
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1880
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:744
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1600
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1976
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1548
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1532
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1080
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1412
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:872
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:364
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:844
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:596
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:820
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:332
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:676
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:268
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1928
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1188
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1392
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:820
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:864
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1572
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1688
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1256
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1584
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:368
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1188
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1828
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1548
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1400
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1644
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1640
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:924
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1228
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1496
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1628
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:844
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1228
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:572
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:812
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2020
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:884
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1960
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:304
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1572
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:868
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:884
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1884
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1208
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:792
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1144
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:332
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:776
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1760
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:744
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1560
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:744
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:316
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1948
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:436
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2060
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2104
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2132
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2148
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2192
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2220
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2236
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2264
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2280
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2308
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2324
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2352
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2368
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2412
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2440
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2456
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2484
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2500
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2528
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2544
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2588
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2676
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2720
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2764
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2808
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/900-25-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/964-17-0x00000000006C0000-0x00000000006CA000-memory.dmp

Download

memory/964-10-0x0000000073850000-0x0000000073F3E000-memory.dmp

Download

memory/964-11-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/1616-41-0x0000000000360000-0x0000000000361000-memory.dmp

Download

memory/1616-40-0x0000000073850000-0x0000000073F3E000-memory.dmp

Download

memory/1644-4-0x00000000003C0000-0x00000000003DF000-memory.dmp

Download

memory/1644-3-0x0000000000390000-0x00000000003A7000-memory.dmp

Download

memory/1644-1-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/1644-0-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Download

memory/1672-35-0x0000000002720000-0x0000000002724000-memory.dmp

Download