remcos | 6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc

Analysis

max time kernel
150s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
03/11/2020, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe
Size 519KB
Sample201103-rpcq9dk83j
SHA256 6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc
MD5 a529633ffa991638887d99c4cbfa9eb4
SHA1 e119a6cbb6ff426ca35ef597a5906231dbd34b64
SHA512 bd73e3df113262f10693fe321873b6d6af6ad9f4401d739cec1dde855e47b8858b362c251b191bb3c542cdb307f35c0afdc80a47cecb604c4ccc5545e7965956
MD5 SHA1 SHA512

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

moorenike.sytes.net:1024

Signatures

Modifies WinLogon for persistence 2 TTPs 89 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\Desktop\\tnt.exe,"	reg.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 3 IoCs

pid	Process
2064	tnt.exe
2204	tnt.exe
3908	remcos.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\	tnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	tnt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2204	2064	tnt.exe	87

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	tnt.exe

Suspicious behavior: EnumeratesProcesses 102 IoCs

pid	Process
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe
2064	tnt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	tnt.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe
Token: SeDebugPrivilege	2064	tnt.exe
Token: SeDebugPrivilege	3908	remcos.exe

Suspicious use of WriteProcessMemory 562 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2244	3372	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	78
PID 3372 wrote to memory of 2244	3372	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	78
PID 3372 wrote to memory of 2244	3372	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	78
PID 3372 wrote to memory of 1332	3372	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	81
PID 3372 wrote to memory of 1332	3372	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	81
PID 3372 wrote to memory of 1332	3372	6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe	81
PID 1332 wrote to memory of 2064	1332	cmd.exe	83
PID 1332 wrote to memory of 2064	1332	cmd.exe	83
PID 1332 wrote to memory of 2064	1332	cmd.exe	83
PID 2064 wrote to memory of 2740	2064	tnt.exe	84
PID 2064 wrote to memory of 2740	2064	tnt.exe	84
PID 2064 wrote to memory of 2740	2064	tnt.exe	84
PID 2740 wrote to memory of 2432	2740	cmd.exe	86
PID 2740 wrote to memory of 2432	2740	cmd.exe	86
PID 2740 wrote to memory of 2432	2740	cmd.exe	86
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 3256	2064	tnt.exe	88
PID 2064 wrote to memory of 3256	2064	tnt.exe	88
PID 2064 wrote to memory of 3256	2064	tnt.exe	88
PID 3256 wrote to memory of 2684	3256	cmd.exe	90
PID 3256 wrote to memory of 2684	3256	cmd.exe	90
PID 3256 wrote to memory of 2684	3256	cmd.exe	90
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 2204	2064	tnt.exe	87
PID 2064 wrote to memory of 1192	2064	tnt.exe	91
PID 2064 wrote to memory of 1192	2064	tnt.exe	91
PID 2064 wrote to memory of 1192	2064	tnt.exe	91
PID 1192 wrote to memory of 1928	1192	cmd.exe	93
PID 1192 wrote to memory of 1928	1192	cmd.exe	93
PID 1192 wrote to memory of 1928	1192	cmd.exe	93
PID 2064 wrote to memory of 1712	2064	tnt.exe	94
PID 2064 wrote to memory of 1712	2064	tnt.exe	94
PID 2064 wrote to memory of 1712	2064	tnt.exe	94
PID 1712 wrote to memory of 2272	1712	cmd.exe	96
PID 1712 wrote to memory of 2272	1712	cmd.exe	96
PID 1712 wrote to memory of 2272	1712	cmd.exe	96
PID 2204 wrote to memory of 3420	2204	tnt.exe	97
PID 2204 wrote to memory of 3420	2204	tnt.exe	97
PID 2204 wrote to memory of 3420	2204	tnt.exe	97
PID 2064 wrote to memory of 68	2064	tnt.exe	98
PID 2064 wrote to memory of 68	2064	tnt.exe	98
PID 2064 wrote to memory of 68	2064	tnt.exe	98
PID 68 wrote to memory of 3084	68	cmd.exe	100
PID 68 wrote to memory of 3084	68	cmd.exe	100
PID 68 wrote to memory of 3084	68	cmd.exe	100
PID 2064 wrote to memory of 1488	2064	tnt.exe	101
PID 2064 wrote to memory of 1488	2064	tnt.exe	101
PID 2064 wrote to memory of 1488	2064	tnt.exe	101
PID 1488 wrote to memory of 4032	1488	cmd.exe	103
PID 1488 wrote to memory of 4032	1488	cmd.exe	103
PID 1488 wrote to memory of 4032	1488	cmd.exe	103
PID 2064 wrote to memory of 504	2064	tnt.exe	104
PID 2064 wrote to memory of 504	2064	tnt.exe	104
PID 2064 wrote to memory of 504	2064	tnt.exe	104
PID 504 wrote to memory of 2640	504	cmd.exe	106
PID 504 wrote to memory of 2640	504	cmd.exe	106
PID 504 wrote to memory of 2640	504	cmd.exe	106
PID 3420 wrote to memory of 3876	3420	WScript.exe	107
PID 3420 wrote to memory of 3876	3420	WScript.exe	107
PID 3420 wrote to memory of 3876	3420	WScript.exe	107
PID 3876 wrote to memory of 3908	3876	cmd.exe	109
PID 3876 wrote to memory of 3908	3876	cmd.exe	109
PID 3876 wrote to memory of 3908	3876	cmd.exe	109
PID 2064 wrote to memory of 3844	2064	tnt.exe	110
PID 2064 wrote to memory of 3844	2064	tnt.exe	110
PID 2064 wrote to memory of 3844	2064	tnt.exe	110
PID 3844 wrote to memory of 3552	3844	cmd.exe	112
PID 3844 wrote to memory of 3552	3844	cmd.exe	112
PID 3844 wrote to memory of 3552	3844	cmd.exe	112
PID 2064 wrote to memory of 188	2064	tnt.exe	113
PID 2064 wrote to memory of 188	2064	tnt.exe	113
PID 2064 wrote to memory of 188	2064	tnt.exe	113
PID 188 wrote to memory of 3252	188	cmd.exe	115
PID 188 wrote to memory of 3252	188	cmd.exe	115
PID 188 wrote to memory of 3252	188	cmd.exe	115
PID 2064 wrote to memory of 3972	2064	tnt.exe	116
PID 2064 wrote to memory of 3972	2064	tnt.exe	116
PID 2064 wrote to memory of 3972	2064	tnt.exe	116
PID 3972 wrote to memory of 2276	3972	cmd.exe	118
PID 3972 wrote to memory of 2276	3972	cmd.exe	118
PID 3972 wrote to memory of 2276	3972	cmd.exe	118
PID 2064 wrote to memory of 2260	2064	tnt.exe	119
PID 2064 wrote to memory of 2260	2064	tnt.exe	119
PID 2064 wrote to memory of 2260	2064	tnt.exe	119
PID 2260 wrote to memory of 3536	2260	cmd.exe	121
PID 2260 wrote to memory of 3536	2260	cmd.exe	121
PID 2260 wrote to memory of 3536	2260	cmd.exe	121
PID 2064 wrote to memory of 3104	2064	tnt.exe	122
PID 2064 wrote to memory of 3104	2064	tnt.exe	122
PID 2064 wrote to memory of 3104	2064	tnt.exe	122
PID 3104 wrote to memory of 1632	3104	cmd.exe	124
PID 3104 wrote to memory of 1632	3104	cmd.exe	124
PID 3104 wrote to memory of 1632	3104	cmd.exe	124
PID 2064 wrote to memory of 4028	2064	tnt.exe	125
PID 2064 wrote to memory of 4028	2064	tnt.exe	125
PID 2064 wrote to memory of 4028	2064	tnt.exe	125
PID 4028 wrote to memory of 2044	4028	cmd.exe	127
PID 4028 wrote to memory of 2044	4028	cmd.exe	127
PID 4028 wrote to memory of 2044	4028	cmd.exe	127
PID 2064 wrote to memory of 2940	2064	tnt.exe	128
PID 2064 wrote to memory of 2940	2064	tnt.exe	128
PID 2064 wrote to memory of 2940	2064	tnt.exe	128
PID 2940 wrote to memory of 2408	2940	cmd.exe	130
PID 2940 wrote to memory of 2408	2940	cmd.exe	130
PID 2940 wrote to memory of 2408	2940	cmd.exe	130
PID 2064 wrote to memory of 660	2064	tnt.exe	131
PID 2064 wrote to memory of 660	2064	tnt.exe	131
PID 2064 wrote to memory of 660	2064	tnt.exe	131
PID 660 wrote to memory of 3264	660	cmd.exe	133
PID 660 wrote to memory of 3264	660	cmd.exe	133
PID 660 wrote to memory of 3264	660	cmd.exe	133
PID 2064 wrote to memory of 2228	2064	tnt.exe	134
PID 2064 wrote to memory of 2228	2064	tnt.exe	134
PID 2064 wrote to memory of 2228	2064	tnt.exe	134
PID 2228 wrote to memory of 2296	2228	cmd.exe	136
PID 2228 wrote to memory of 2296	2228	cmd.exe	136
PID 2228 wrote to memory of 2296	2228	cmd.exe	136
PID 2064 wrote to memory of 756	2064	tnt.exe	137
PID 2064 wrote to memory of 756	2064	tnt.exe	137
PID 2064 wrote to memory of 756	2064	tnt.exe	137
PID 756 wrote to memory of 2324	756	cmd.exe	139
PID 756 wrote to memory of 2324	756	cmd.exe	139
PID 756 wrote to memory of 2324	756	cmd.exe	139
PID 2064 wrote to memory of 2348	2064	tnt.exe	140
PID 2064 wrote to memory of 2348	2064	tnt.exe	140
PID 2064 wrote to memory of 2348	2064	tnt.exe	140
PID 2348 wrote to memory of 3404	2348	cmd.exe	142
PID 2348 wrote to memory of 3404	2348	cmd.exe	142
PID 2348 wrote to memory of 3404	2348	cmd.exe	142
PID 2064 wrote to memory of 1356	2064	tnt.exe	143
PID 2064 wrote to memory of 1356	2064	tnt.exe	143
PID 2064 wrote to memory of 1356	2064	tnt.exe	143
PID 1356 wrote to memory of 2756	1356	cmd.exe	145
PID 1356 wrote to memory of 2756	1356	cmd.exe	145
PID 1356 wrote to memory of 2756	1356	cmd.exe	145
PID 2064 wrote to memory of 2200	2064	tnt.exe	146
PID 2064 wrote to memory of 2200	2064	tnt.exe	146
PID 2064 wrote to memory of 2200	2064	tnt.exe	146
PID 2200 wrote to memory of 2580	2200	cmd.exe	148
PID 2200 wrote to memory of 2580	2200	cmd.exe	148
PID 2200 wrote to memory of 2580	2200	cmd.exe	148
PID 2064 wrote to memory of 520	2064	tnt.exe	149
PID 2064 wrote to memory of 520	2064	tnt.exe	149
PID 2064 wrote to memory of 520	2064	tnt.exe	149
PID 520 wrote to memory of 3204	520	cmd.exe	151
PID 520 wrote to memory of 3204	520	cmd.exe	151
PID 520 wrote to memory of 3204	520	cmd.exe	151
PID 2064 wrote to memory of 2420	2064	tnt.exe	152
PID 2064 wrote to memory of 2420	2064	tnt.exe	152
PID 2064 wrote to memory of 2420	2064	tnt.exe	152
PID 2420 wrote to memory of 2456	2420	cmd.exe	154
PID 2420 wrote to memory of 2456	2420	cmd.exe	154
PID 2420 wrote to memory of 2456	2420	cmd.exe	154
PID 2064 wrote to memory of 200	2064	tnt.exe	155
PID 2064 wrote to memory of 200	2064	tnt.exe	155
PID 2064 wrote to memory of 200	2064	tnt.exe	155
PID 200 wrote to memory of 760	200	cmd.exe	157
PID 200 wrote to memory of 760	200	cmd.exe	157
PID 200 wrote to memory of 760	200	cmd.exe	157
PID 2064 wrote to memory of 3680	2064	tnt.exe	158
PID 2064 wrote to memory of 3680	2064	tnt.exe	158
PID 2064 wrote to memory of 3680	2064	tnt.exe	158
PID 3680 wrote to memory of 3840	3680	cmd.exe	160
PID 3680 wrote to memory of 3840	3680	cmd.exe	160
PID 3680 wrote to memory of 3840	3680	cmd.exe	160
PID 2064 wrote to memory of 2800	2064	tnt.exe	161
PID 2064 wrote to memory of 2800	2064	tnt.exe	161
PID 2064 wrote to memory of 2800	2064	tnt.exe	161
PID 2800 wrote to memory of 852	2800	cmd.exe	163
PID 2800 wrote to memory of 852	2800	cmd.exe	163
PID 2800 wrote to memory of 852	2800	cmd.exe	163
PID 2064 wrote to memory of 3232	2064	tnt.exe	164
PID 2064 wrote to memory of 3232	2064	tnt.exe	164
PID 2064 wrote to memory of 3232	2064	tnt.exe	164
PID 3232 wrote to memory of 2424	3232	cmd.exe	166
PID 3232 wrote to memory of 2424	3232	cmd.exe	166
PID 3232 wrote to memory of 2424	3232	cmd.exe	166
PID 2064 wrote to memory of 4060	2064	tnt.exe	167
PID 2064 wrote to memory of 4060	2064	tnt.exe	167
PID 2064 wrote to memory of 4060	2064	tnt.exe	167
PID 4060 wrote to memory of 3500	4060	cmd.exe	169
PID 4060 wrote to memory of 3500	4060	cmd.exe	169
PID 4060 wrote to memory of 3500	4060	cmd.exe	169
PID 2064 wrote to memory of 2180	2064	tnt.exe	170
PID 2064 wrote to memory of 2180	2064	tnt.exe	170
PID 2064 wrote to memory of 2180	2064	tnt.exe	170
PID 2180 wrote to memory of 3996	2180	cmd.exe	172
PID 2180 wrote to memory of 3996	2180	cmd.exe	172
PID 2180 wrote to memory of 3996	2180	cmd.exe	172
PID 2064 wrote to memory of 940	2064	tnt.exe	173
PID 2064 wrote to memory of 940	2064	tnt.exe	173
PID 2064 wrote to memory of 940	2064	tnt.exe	173
PID 940 wrote to memory of 1452	940	cmd.exe	175
PID 940 wrote to memory of 1452	940	cmd.exe	175
PID 940 wrote to memory of 1452	940	cmd.exe	175
PID 2064 wrote to memory of 2748	2064	tnt.exe	176
PID 2064 wrote to memory of 2748	2064	tnt.exe	176
PID 2064 wrote to memory of 2748	2064	tnt.exe	176
PID 2748 wrote to memory of 4088	2748	cmd.exe	178
PID 2748 wrote to memory of 4088	2748	cmd.exe	178
PID 2748 wrote to memory of 4088	2748	cmd.exe	178
PID 2064 wrote to memory of 2068	2064	tnt.exe	179
PID 2064 wrote to memory of 2068	2064	tnt.exe	179
PID 2064 wrote to memory of 2068	2064	tnt.exe	179
PID 2068 wrote to memory of 2736	2068	cmd.exe	181
PID 2068 wrote to memory of 2736	2068	cmd.exe	181
PID 2068 wrote to memory of 2736	2068	cmd.exe	181
PID 2064 wrote to memory of 3880	2064	tnt.exe	182
PID 2064 wrote to memory of 3880	2064	tnt.exe	182
PID 2064 wrote to memory of 3880	2064	tnt.exe	182
PID 3880 wrote to memory of 2232	3880	cmd.exe	184
PID 3880 wrote to memory of 2232	3880	cmd.exe	184
PID 3880 wrote to memory of 2232	3880	cmd.exe	184
PID 2064 wrote to memory of 4056	2064	tnt.exe	185
PID 2064 wrote to memory of 4056	2064	tnt.exe	185
PID 2064 wrote to memory of 4056	2064	tnt.exe	185
PID 4056 wrote to memory of 3164	4056	cmd.exe	187
PID 4056 wrote to memory of 3164	4056	cmd.exe	187
PID 4056 wrote to memory of 3164	4056	cmd.exe	187
PID 2064 wrote to memory of 2156	2064	tnt.exe	188
PID 2064 wrote to memory of 2156	2064	tnt.exe	188
PID 2064 wrote to memory of 2156	2064	tnt.exe	188
PID 2156 wrote to memory of 1300	2156	cmd.exe	190
PID 2156 wrote to memory of 1300	2156	cmd.exe	190
PID 2156 wrote to memory of 1300	2156	cmd.exe	190
PID 2064 wrote to memory of 1872	2064	tnt.exe	191
PID 2064 wrote to memory of 1872	2064	tnt.exe	191
PID 2064 wrote to memory of 1872	2064	tnt.exe	191
PID 1872 wrote to memory of 1956	1872	cmd.exe	193
PID 1872 wrote to memory of 1956	1872	cmd.exe	193
PID 1872 wrote to memory of 1956	1872	cmd.exe	193
PID 2064 wrote to memory of 3268	2064	tnt.exe	194
PID 2064 wrote to memory of 3268	2064	tnt.exe	194
PID 2064 wrote to memory of 3268	2064	tnt.exe	194
PID 3268 wrote to memory of 2212	3268	cmd.exe	196
PID 3268 wrote to memory of 2212	3268	cmd.exe	196
PID 3268 wrote to memory of 2212	3268	cmd.exe	196
PID 2064 wrote to memory of 588	2064	tnt.exe	197
PID 2064 wrote to memory of 588	2064	tnt.exe	197
PID 2064 wrote to memory of 588	2064	tnt.exe	197
PID 588 wrote to memory of 3660	588	cmd.exe	199
PID 588 wrote to memory of 3660	588	cmd.exe	199
PID 588 wrote to memory of 3660	588	cmd.exe	199
PID 2064 wrote to memory of 1612	2064	tnt.exe	200
PID 2064 wrote to memory of 1612	2064	tnt.exe	200
PID 2064 wrote to memory of 1612	2064	tnt.exe	200
PID 1612 wrote to memory of 3304	1612	cmd.exe	202
PID 1612 wrote to memory of 3304	1612	cmd.exe	202
PID 1612 wrote to memory of 3304	1612	cmd.exe	202
PID 2064 wrote to memory of 3396	2064	tnt.exe	203
PID 2064 wrote to memory of 3396	2064	tnt.exe	203
PID 2064 wrote to memory of 3396	2064	tnt.exe	203
PID 3396 wrote to memory of 184	3396	cmd.exe	205
PID 3396 wrote to memory of 184	3396	cmd.exe	205
PID 3396 wrote to memory of 184	3396	cmd.exe	205
PID 2064 wrote to memory of 2960	2064	tnt.exe	206
PID 2064 wrote to memory of 2960	2064	tnt.exe	206
PID 2064 wrote to memory of 2960	2064	tnt.exe	206
PID 2960 wrote to memory of 4080	2960	cmd.exe	208
PID 2960 wrote to memory of 4080	2960	cmd.exe	208
PID 2960 wrote to memory of 4080	2960	cmd.exe	208
PID 2064 wrote to memory of 2688	2064	tnt.exe	209
PID 2064 wrote to memory of 2688	2064	tnt.exe	209
PID 2064 wrote to memory of 2688	2064	tnt.exe	209
PID 2688 wrote to memory of 1524	2688	cmd.exe	211
PID 2688 wrote to memory of 1524	2688	cmd.exe	211
PID 2688 wrote to memory of 1524	2688	cmd.exe	211
PID 2064 wrote to memory of 4076	2064	tnt.exe	212
PID 2064 wrote to memory of 4076	2064	tnt.exe	212
PID 2064 wrote to memory of 4076	2064	tnt.exe	212
PID 4076 wrote to memory of 2776	4076	cmd.exe	214
PID 4076 wrote to memory of 2776	4076	cmd.exe	214
PID 4076 wrote to memory of 2776	4076	cmd.exe	214
PID 2064 wrote to memory of 420	2064	tnt.exe	215
PID 2064 wrote to memory of 420	2064	tnt.exe	215
PID 2064 wrote to memory of 420	2064	tnt.exe	215
PID 420 wrote to memory of 2664	420	cmd.exe	217
PID 420 wrote to memory of 2664	420	cmd.exe	217
PID 420 wrote to memory of 2664	420	cmd.exe	217
PID 2064 wrote to memory of 2796	2064	tnt.exe	218
PID 2064 wrote to memory of 2796	2064	tnt.exe	218
PID 2064 wrote to memory of 2796	2064	tnt.exe	218
PID 2796 wrote to memory of 3676	2796	cmd.exe	220
PID 2796 wrote to memory of 3676	2796	cmd.exe	220
PID 2796 wrote to memory of 3676	2796	cmd.exe	220
PID 2064 wrote to memory of 3532	2064	tnt.exe	221
PID 2064 wrote to memory of 3532	2064	tnt.exe	221
PID 2064 wrote to memory of 3532	2064	tnt.exe	221
PID 3532 wrote to memory of 2320	3532	cmd.exe	223
PID 3532 wrote to memory of 2320	3532	cmd.exe	223
PID 3532 wrote to memory of 2320	3532	cmd.exe	223
PID 2064 wrote to memory of 3236	2064	tnt.exe	224
PID 2064 wrote to memory of 3236	2064	tnt.exe	224
PID 2064 wrote to memory of 3236	2064	tnt.exe	224
PID 3236 wrote to memory of 3852	3236	cmd.exe	226
PID 3236 wrote to memory of 3852	3236	cmd.exe	226
PID 3236 wrote to memory of 3852	3236	cmd.exe	226
PID 2064 wrote to memory of 2256	2064	tnt.exe	227
PID 2064 wrote to memory of 2256	2064	tnt.exe	227
PID 2064 wrote to memory of 2256	2064	tnt.exe	227
PID 2256 wrote to memory of 1432	2256	cmd.exe	229
PID 2256 wrote to memory of 1432	2256	cmd.exe	229
PID 2256 wrote to memory of 1432	2256	cmd.exe	229
PID 2064 wrote to memory of 4044	2064	tnt.exe	230
PID 2064 wrote to memory of 4044	2064	tnt.exe	230
PID 2064 wrote to memory of 4044	2064	tnt.exe	230
PID 4044 wrote to memory of 976	4044	cmd.exe	232
PID 4044 wrote to memory of 976	4044	cmd.exe	232
PID 4044 wrote to memory of 976	4044	cmd.exe	232
PID 2064 wrote to memory of 1000	2064	tnt.exe	233
PID 2064 wrote to memory of 1000	2064	tnt.exe	233
PID 2064 wrote to memory of 1000	2064	tnt.exe	233
PID 1000 wrote to memory of 2328	1000	cmd.exe	235
PID 1000 wrote to memory of 2328	1000	cmd.exe	235
PID 1000 wrote to memory of 2328	1000	cmd.exe	235
PID 2064 wrote to memory of 3888	2064	tnt.exe	236
PID 2064 wrote to memory of 3888	2064	tnt.exe	236
PID 2064 wrote to memory of 3888	2064	tnt.exe	236
PID 3888 wrote to memory of 3140	3888	cmd.exe	238
PID 3888 wrote to memory of 3140	3888	cmd.exe	238
PID 3888 wrote to memory of 3140	3888	cmd.exe	238
PID 2064 wrote to memory of 4120	2064	tnt.exe	239
PID 2064 wrote to memory of 4120	2064	tnt.exe	239
PID 2064 wrote to memory of 4120	2064	tnt.exe	239
PID 4120 wrote to memory of 4164	4120	cmd.exe	241
PID 4120 wrote to memory of 4164	4120	cmd.exe	241
PID 4120 wrote to memory of 4164	4120	cmd.exe	241
PID 2064 wrote to memory of 4188	2064	tnt.exe	242
PID 2064 wrote to memory of 4188	2064	tnt.exe	242
PID 2064 wrote to memory of 4188	2064	tnt.exe	242
PID 4188 wrote to memory of 4232	4188	cmd.exe	244
PID 4188 wrote to memory of 4232	4188	cmd.exe	244
PID 4188 wrote to memory of 4232	4188	cmd.exe	244
PID 2064 wrote to memory of 4256	2064	tnt.exe	245
PID 2064 wrote to memory of 4256	2064	tnt.exe	245
PID 2064 wrote to memory of 4256	2064	tnt.exe	245
PID 4256 wrote to memory of 4300	4256	cmd.exe	247
PID 4256 wrote to memory of 4300	4256	cmd.exe	247
PID 4256 wrote to memory of 4300	4256	cmd.exe	247
PID 2064 wrote to memory of 4324	2064	tnt.exe	248
PID 2064 wrote to memory of 4324	2064	tnt.exe	248
PID 2064 wrote to memory of 4324	2064	tnt.exe	248
PID 4324 wrote to memory of 4368	4324	cmd.exe	250
PID 4324 wrote to memory of 4368	4324	cmd.exe	250
PID 4324 wrote to memory of 4368	4324	cmd.exe	250
PID 2064 wrote to memory of 4392	2064	tnt.exe	251
PID 2064 wrote to memory of 4392	2064	tnt.exe	251
PID 2064 wrote to memory of 4392	2064	tnt.exe	251
PID 4392 wrote to memory of 4436	4392	cmd.exe	253
PID 4392 wrote to memory of 4436	4392	cmd.exe	253
PID 4392 wrote to memory of 4436	4392	cmd.exe	253
PID 2064 wrote to memory of 4460	2064	tnt.exe	254
PID 2064 wrote to memory of 4460	2064	tnt.exe	254
PID 2064 wrote to memory of 4460	2064	tnt.exe	254
PID 4460 wrote to memory of 4504	4460	cmd.exe	256
PID 4460 wrote to memory of 4504	4460	cmd.exe	256
PID 4460 wrote to memory of 4504	4460	cmd.exe	256
PID 2064 wrote to memory of 4536	2064	tnt.exe	257
PID 2064 wrote to memory of 4536	2064	tnt.exe	257
PID 2064 wrote to memory of 4536	2064	tnt.exe	257
PID 4536 wrote to memory of 4580	4536	cmd.exe	259
PID 4536 wrote to memory of 4580	4536	cmd.exe	259
PID 4536 wrote to memory of 4580	4536	cmd.exe	259
PID 2064 wrote to memory of 4612	2064	tnt.exe	260
PID 2064 wrote to memory of 4612	2064	tnt.exe	260
PID 2064 wrote to memory of 4612	2064	tnt.exe	260
PID 4612 wrote to memory of 4656	4612	cmd.exe	262
PID 4612 wrote to memory of 4656	4612	cmd.exe	262
PID 4612 wrote to memory of 4656	4612	cmd.exe	262
PID 2064 wrote to memory of 4680	2064	tnt.exe	263
PID 2064 wrote to memory of 4680	2064	tnt.exe	263
PID 2064 wrote to memory of 4680	2064	tnt.exe	263
PID 4680 wrote to memory of 4724	4680	cmd.exe	265
PID 4680 wrote to memory of 4724	4680	cmd.exe	265
PID 4680 wrote to memory of 4724	4680	cmd.exe	265
PID 2064 wrote to memory of 4748	2064	tnt.exe	266
PID 2064 wrote to memory of 4748	2064	tnt.exe	266
PID 2064 wrote to memory of 4748	2064	tnt.exe	266
PID 4748 wrote to memory of 4792	4748	cmd.exe	268
PID 4748 wrote to memory of 4792	4748	cmd.exe	268
PID 4748 wrote to memory of 4792	4748	cmd.exe	268
PID 2064 wrote to memory of 4816	2064	tnt.exe	269
PID 2064 wrote to memory of 4816	2064	tnt.exe	269
PID 2064 wrote to memory of 4816	2064	tnt.exe	269
PID 4816 wrote to memory of 4860	4816	cmd.exe	271
PID 4816 wrote to memory of 4860	4816	cmd.exe	271
PID 4816 wrote to memory of 4860	4816	cmd.exe	271
PID 2064 wrote to memory of 4884	2064	tnt.exe	272
PID 2064 wrote to memory of 4884	2064	tnt.exe	272
PID 2064 wrote to memory of 4884	2064	tnt.exe	272
PID 4884 wrote to memory of 4928	4884	cmd.exe	274
PID 4884 wrote to memory of 4928	4884	cmd.exe	274
PID 4884 wrote to memory of 4928	4884	cmd.exe	274
PID 2064 wrote to memory of 4952	2064	tnt.exe	275
PID 2064 wrote to memory of 4952	2064	tnt.exe	275
PID 2064 wrote to memory of 4952	2064	tnt.exe	275
PID 4952 wrote to memory of 4996	4952	cmd.exe	277
PID 4952 wrote to memory of 4996	4952	cmd.exe	277
PID 4952 wrote to memory of 4996	4952	cmd.exe	277
PID 2064 wrote to memory of 5020	2064	tnt.exe	278
PID 2064 wrote to memory of 5020	2064	tnt.exe	278
PID 2064 wrote to memory of 5020	2064	tnt.exe	278
PID 5020 wrote to memory of 5064	5020	cmd.exe	280
PID 5020 wrote to memory of 5064	5020	cmd.exe	280
PID 5020 wrote to memory of 5064	5020	cmd.exe	280
PID 2064 wrote to memory of 5088	2064	tnt.exe	281
PID 2064 wrote to memory of 5088	2064	tnt.exe	281
PID 2064 wrote to memory of 5088	2064	tnt.exe	281
PID 5088 wrote to memory of 4108	5088	cmd.exe	283
PID 5088 wrote to memory of 4108	5088	cmd.exe	283
PID 5088 wrote to memory of 4108	5088	cmd.exe	283
PID 2064 wrote to memory of 2308	2064	tnt.exe	284
PID 2064 wrote to memory of 2308	2064	tnt.exe	284
PID 2064 wrote to memory of 2308	2064	tnt.exe	284
PID 2308 wrote to memory of 4160	2308	cmd.exe	286
PID 2308 wrote to memory of 4160	2308	cmd.exe	286
PID 2308 wrote to memory of 4160	2308	cmd.exe	286
PID 2064 wrote to memory of 4132	2064	tnt.exe	287
PID 2064 wrote to memory of 4132	2064	tnt.exe	287
PID 2064 wrote to memory of 4132	2064	tnt.exe	287
PID 4132 wrote to memory of 4212	4132	cmd.exe	289
PID 4132 wrote to memory of 4212	4132	cmd.exe	289
PID 4132 wrote to memory of 4212	4132	cmd.exe	289
PID 2064 wrote to memory of 4308	2064	tnt.exe	290
PID 2064 wrote to memory of 4308	2064	tnt.exe	290
PID 2064 wrote to memory of 4308	2064	tnt.exe	290
PID 4308 wrote to memory of 4268	4308	cmd.exe	292
PID 4308 wrote to memory of 4268	4308	cmd.exe	292
PID 4308 wrote to memory of 4268	4308	cmd.exe	292
PID 2064 wrote to memory of 4380	2064	tnt.exe	293
PID 2064 wrote to memory of 4380	2064	tnt.exe	293
PID 2064 wrote to memory of 4380	2064	tnt.exe	293
PID 4380 wrote to memory of 4444	4380	cmd.exe	295
PID 4380 wrote to memory of 4444	4380	cmd.exe	295
PID 4380 wrote to memory of 4444	4380	cmd.exe	295
PID 2064 wrote to memory of 4424	2064	tnt.exe	296
PID 2064 wrote to memory of 4424	2064	tnt.exe	296
PID 2064 wrote to memory of 4424	2064	tnt.exe	296
PID 4424 wrote to memory of 4516	4424	cmd.exe	298
PID 4424 wrote to memory of 4516	4424	cmd.exe	298
PID 4424 wrote to memory of 4516	4424	cmd.exe	298
PID 2064 wrote to memory of 4496	2064	tnt.exe	299
PID 2064 wrote to memory of 4496	2064	tnt.exe	299
PID 2064 wrote to memory of 4496	2064	tnt.exe	299
PID 4496 wrote to memory of 4564	4496	cmd.exe	301
PID 4496 wrote to memory of 4564	4496	cmd.exe	301
PID 4496 wrote to memory of 4564	4496	cmd.exe	301
PID 2064 wrote to memory of 4548	2064	tnt.exe	302
PID 2064 wrote to memory of 4548	2064	tnt.exe	302
PID 2064 wrote to memory of 4548	2064	tnt.exe	302
PID 4548 wrote to memory of 4600	4548	cmd.exe	304
PID 4548 wrote to memory of 4600	4548	cmd.exe	304
PID 4548 wrote to memory of 4600	4548	cmd.exe	304
PID 2064 wrote to memory of 2992	2064	tnt.exe	305
PID 2064 wrote to memory of 2992	2064	tnt.exe	305
PID 2064 wrote to memory of 2992	2064	tnt.exe	305
PID 2992 wrote to memory of 4616	2992	cmd.exe	307
PID 2992 wrote to memory of 4616	2992	cmd.exe	307
PID 2992 wrote to memory of 4616	2992	cmd.exe	307
PID 2064 wrote to memory of 4696	2064	tnt.exe	308
PID 2064 wrote to memory of 4696	2064	tnt.exe	308
PID 2064 wrote to memory of 4696	2064	tnt.exe	308
PID 4696 wrote to memory of 4700	4696	cmd.exe	310
PID 4696 wrote to memory of 4700	4696	cmd.exe	310
PID 4696 wrote to memory of 4700	4696	cmd.exe	310
PID 2064 wrote to memory of 4808	2064	tnt.exe	311
PID 2064 wrote to memory of 4808	2064	tnt.exe	311
PID 2064 wrote to memory of 4808	2064	tnt.exe	311
PID 4808 wrote to memory of 4832	4808	cmd.exe	313
PID 4808 wrote to memory of 4832	4808	cmd.exe	313
PID 4808 wrote to memory of 4832	4808	cmd.exe	313
PID 2064 wrote to memory of 4844	2064	tnt.exe	314
PID 2064 wrote to memory of 4844	2064	tnt.exe	314
PID 2064 wrote to memory of 4844	2064	tnt.exe	314
PID 4844 wrote to memory of 4944	4844	cmd.exe	316
PID 4844 wrote to memory of 4944	4844	cmd.exe	316
PID 4844 wrote to memory of 4944	4844	cmd.exe	316
PID 2064 wrote to memory of 4908	2064	tnt.exe	317
PID 2064 wrote to memory of 4908	2064	tnt.exe	317
PID 2064 wrote to memory of 4908	2064	tnt.exe	317
PID 4908 wrote to memory of 4992	4908	cmd.exe	319
PID 4908 wrote to memory of 4992	4908	cmd.exe	319
PID 4908 wrote to memory of 4992	4908	cmd.exe	319
PID 2064 wrote to memory of 4964	2064	tnt.exe	320
PID 2064 wrote to memory of 4964	2064	tnt.exe	320
PID 2064 wrote to memory of 4964	2064	tnt.exe	320
PID 4964 wrote to memory of 5044	4964	cmd.exe	322
PID 4964 wrote to memory of 5044	4964	cmd.exe	322
PID 4964 wrote to memory of 5044	4964	cmd.exe	322
PID 2064 wrote to memory of 2576	2064	tnt.exe	323
PID 2064 wrote to memory of 2576	2064	tnt.exe	323
PID 2064 wrote to memory of 2576	2064	tnt.exe	323
PID 2576 wrote to memory of 5100	2576	cmd.exe	325
PID 2576 wrote to memory of 5100	2576	cmd.exe	325
PID 2576 wrote to memory of 5100	2576	cmd.exe	325
PID 2064 wrote to memory of 4144	2064	tnt.exe	326
PID 2064 wrote to memory of 4144	2064	tnt.exe	326
PID 2064 wrote to memory of 4144	2064	tnt.exe	326
PID 4144 wrote to memory of 4208	4144	cmd.exe	328
PID 4144 wrote to memory of 4208	4144	cmd.exe	328
PID 4144 wrote to memory of 4208	4144	cmd.exe	328
PID 2064 wrote to memory of 4228	2064	tnt.exe	329
PID 2064 wrote to memory of 4228	2064	tnt.exe	329
PID 2064 wrote to memory of 4228	2064	tnt.exe	329
PID 4228 wrote to memory of 4376	4228	cmd.exe	331
PID 4228 wrote to memory of 4376	4228	cmd.exe	331
PID 4228 wrote to memory of 4376	4228	cmd.exe	331
PID 2064 wrote to memory of 4292	2064	tnt.exe	332
PID 2064 wrote to memory of 4292	2064	tnt.exe	332
PID 2064 wrote to memory of 4292	2064	tnt.exe	332
PID 4292 wrote to memory of 4336	4292	cmd.exe	334
PID 4292 wrote to memory of 4336	4292	cmd.exe	334
PID 4292 wrote to memory of 4336	4292	cmd.exe	334
PID 2064 wrote to memory of 4412	2064	tnt.exe	335
PID 2064 wrote to memory of 4412	2064	tnt.exe	335
PID 2064 wrote to memory of 4412	2064	tnt.exe	335
PID 4412 wrote to memory of 4508	4412	cmd.exe	337
PID 4412 wrote to memory of 4508	4412	cmd.exe	337
PID 4412 wrote to memory of 4508	4412	cmd.exe	337
PID 2064 wrote to memory of 4576	2064	tnt.exe	338
PID 2064 wrote to memory of 4576	2064	tnt.exe	338
PID 2064 wrote to memory of 4576	2064	tnt.exe	338
PID 4576 wrote to memory of 2032	4576	cmd.exe	340
PID 4576 wrote to memory of 2032	4576	cmd.exe	340
PID 4576 wrote to memory of 2032	4576	cmd.exe	340
PID 2064 wrote to memory of 1832	2064	tnt.exe	341
PID 2064 wrote to memory of 1832	2064	tnt.exe	341
PID 2064 wrote to memory of 1832	2064	tnt.exe	341
PID 1832 wrote to memory of 2880	1832	cmd.exe	343
PID 1832 wrote to memory of 2880	1832	cmd.exe	343
PID 1832 wrote to memory of 2880	1832	cmd.exe	343
PID 2064 wrote to memory of 3932	2064	tnt.exe	344
PID 2064 wrote to memory of 3932	2064	tnt.exe	344
PID 2064 wrote to memory of 3932	2064	tnt.exe	344
PID 3932 wrote to memory of 4620	3932	cmd.exe	346
PID 3932 wrote to memory of 4620	3932	cmd.exe	346
PID 3932 wrote to memory of 4620	3932	cmd.exe	346
PID 2064 wrote to memory of 4668	2064	tnt.exe	347
PID 2064 wrote to memory of 4668	2064	tnt.exe	347
PID 2064 wrote to memory of 4668	2064	tnt.exe	347
PID 4668 wrote to memory of 4692	4668	cmd.exe	349
PID 4668 wrote to memory of 4692	4668	cmd.exe	349
PID 4668 wrote to memory of 4692	4668	cmd.exe	349
PID 2064 wrote to memory of 4732	2064	tnt.exe	350
PID 2064 wrote to memory of 4732	2064	tnt.exe	350
PID 2064 wrote to memory of 4732	2064	tnt.exe	350
PID 4732 wrote to memory of 4804	4732	cmd.exe	352
PID 4732 wrote to memory of 4804	4732	cmd.exe	352
PID 4732 wrote to memory of 4804	4732	cmd.exe	352
PID 2064 wrote to memory of 4752	2064	tnt.exe	353
PID 2064 wrote to memory of 4752	2064	tnt.exe	353
PID 2064 wrote to memory of 4752	2064	tnt.exe	353
PID 4752 wrote to memory of 4848	4752	cmd.exe	355
PID 4752 wrote to memory of 4848	4752	cmd.exe	355
PID 4752 wrote to memory of 4848	4752	cmd.exe	355

C:\Users\Admin\AppData\Local\Temp\6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe
"C:\Users\Admin\AppData\Local\Temp\6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\6c50d72da5ab733ffcc197ef2f403e4b490673164ea72012440fcbfa72ac31fc.exe" "C:\Users\Admin\Desktop\tnt.exe"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\tnt.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Users\Admin\Desktop\tnt.exe
    "C:\Users\Admin\Desktop\tnt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2432
  - - C:\Users\Admin\Desktop\tnt.exe
      "C:\Users\Admin\Desktop\tnt.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        5⤵
        
        PID:3420
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
        6⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2684
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2272
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:68
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:3084
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:504
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2640
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3844
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3552
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:188
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:3252
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2276
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2260
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:3536
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3104
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1632
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2940
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2408
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:660
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3264
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2228
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2296
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:756
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2324
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2348
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1356
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2756
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2200
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2580
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:520
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:3204
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2420
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2456
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:200
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:760
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3680
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:3840
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2800
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3232
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4060
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:3500
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2180
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:940
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2748
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2068
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3880
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2232
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4056
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2156
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1300
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1872
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3268
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2212
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:588
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:3304
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3396
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:184
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2960
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2688
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4076
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:420
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2796
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3676
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3532
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2320
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3236
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1432
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4044
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:976
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1000
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3888
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3140
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4120
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4188
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4232
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4300
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4324
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4392
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4436
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4460
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4504
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4536
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4580
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4612
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4656
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4680
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4748
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4816
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4884
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4952
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:5020
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:5064
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:5088
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4160
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4132
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4380
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4424
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4516
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4496
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4564
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4548
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2992
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4696
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4700
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4808
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4844
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4944
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4908
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4992
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4964
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:5044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:2576
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:5100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4144
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4208
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4228
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4376
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4292
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4336
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4412
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4508
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4576
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:2032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:1832
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:3932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        
        PID:4620
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4668
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4692
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4732
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4804
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
      4⤵
      PID:4752
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Desktop\tnt.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-24-0x0000000008750000-0x0000000008751000-memory.dmp

Download

memory/2064-23-0x00000000085C0000-0x00000000085CA000-memory.dmp

Download

memory/2064-13-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/2204-31-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2204-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3372-7-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

Download

memory/3372-1-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/3372-0-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/3372-6-0x0000000008300000-0x0000000008301000-memory.dmp

Download

memory/3372-3-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download

memory/3372-4-0x0000000005510000-0x0000000005527000-memory.dmp

Download

memory/3372-5-0x00000000057B0000-0x00000000057CF000-memory.dmp

Download

memory/3908-47-0x0000000073940000-0x000000007402E000-memory.dmp

Download