nanocore | ccb238545e350b6c90285c5eff16df04dd0da678b587613c3f4e4f9bc4799d01

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
30/11/2020, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request.exe
Size 601KB
Sample201130-2b2vze9g6e
SHA256 ccb238545e350b6c90285c5eff16df04dd0da678b587613c3f4e4f9bc4799d01
MD5 b346b95b211c8da43f5a8d3ed6f600fd
SHA1 f01c8b11a3964913d827d612557410766029db08
SHA512 51c44695de898a7e67c1decf8c01ba377aa86204da9b4714ae3f243b69002d31b5f9eea17b031300b1edc19e90f7efc57e6879270c706ddc5e5d095288704b56
MD5 SHA1 SHA512

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

new8855.duckdns.org:9922
127.0.0.1:9922

Mutex

fc670a7b-7f62-40e8-8df4-51bc9e02d755

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-08-12T17:25:45.457238936Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9922
default_group
Odumeje
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
fc670a7b-7f62-40e8-8df4-51bc9e02d755
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
new8855.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Modifies WinLogon for persistence 2 TTPs 80 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
888	window.exe

Loads dropped DLL 1 IoCs

pid	Process
756	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Manager = "C:\\Program Files (x86)\\NTFS Manager\\ntfsmgr.exe"	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 888 set thread context of 456	888	window.exe	39

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe	InstallUtil.exe
File created	C:\Program Files (x86)\NTFS Manager\ntfsmgr.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
888	window.exe
888	window.exe
456	InstallUtil.exe
456	InstallUtil.exe
456	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
456	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	Request.exe
Token: SeDebugPrivilege	888	window.exe
Token: SeDebugPrivilege	456	InstallUtil.exe

Suspicious use of WriteProcessMemory 664 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1348	736	Request.exe	29
PID 736 wrote to memory of 1348	736	Request.exe	29
PID 736 wrote to memory of 1348	736	Request.exe	29
PID 736 wrote to memory of 1348	736	Request.exe	29
PID 736 wrote to memory of 756	736	Request.exe	31
PID 736 wrote to memory of 756	736	Request.exe	31
PID 736 wrote to memory of 756	736	Request.exe	31
PID 736 wrote to memory of 756	736	Request.exe	31
PID 756 wrote to memory of 888	756	cmd.exe	33
PID 756 wrote to memory of 888	756	cmd.exe	33
PID 756 wrote to memory of 888	756	cmd.exe	33
PID 756 wrote to memory of 888	756	cmd.exe	33
PID 888 wrote to memory of 1128	888	window.exe	34
PID 888 wrote to memory of 1128	888	window.exe	34
PID 888 wrote to memory of 1128	888	window.exe	34
PID 888 wrote to memory of 1128	888	window.exe	34
PID 1128 wrote to memory of 688	1128	cmd.exe	36
PID 1128 wrote to memory of 688	1128	cmd.exe	36
PID 1128 wrote to memory of 688	1128	cmd.exe	36
PID 1128 wrote to memory of 688	1128	cmd.exe	36
PID 888 wrote to memory of 1544	888	window.exe	37
PID 888 wrote to memory of 1544	888	window.exe	37
PID 888 wrote to memory of 1544	888	window.exe	37
PID 888 wrote to memory of 1544	888	window.exe	37
PID 1544 wrote to memory of 1684	1544	cmd.exe	40
PID 1544 wrote to memory of 1684	1544	cmd.exe	40
PID 1544 wrote to memory of 1684	1544	cmd.exe	40
PID 1544 wrote to memory of 1684	1544	cmd.exe	40
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 456	888	window.exe	39
PID 888 wrote to memory of 1396	888	window.exe	41
PID 888 wrote to memory of 1396	888	window.exe	41
PID 888 wrote to memory of 1396	888	window.exe	41
PID 888 wrote to memory of 1396	888	window.exe	41
PID 1396 wrote to memory of 1596	1396	cmd.exe	43
PID 1396 wrote to memory of 1596	1396	cmd.exe	43
PID 1396 wrote to memory of 1596	1396	cmd.exe	43
PID 1396 wrote to memory of 1596	1396	cmd.exe	43
PID 888 wrote to memory of 1332	888	window.exe	44
PID 888 wrote to memory of 1332	888	window.exe	44
PID 888 wrote to memory of 1332	888	window.exe	44
PID 888 wrote to memory of 1332	888	window.exe	44
PID 1332 wrote to memory of 900	1332	cmd.exe	46
PID 1332 wrote to memory of 900	1332	cmd.exe	46
PID 1332 wrote to memory of 900	1332	cmd.exe	46
PID 1332 wrote to memory of 900	1332	cmd.exe	46
PID 888 wrote to memory of 1316	888	window.exe	47
PID 888 wrote to memory of 1316	888	window.exe	47
PID 888 wrote to memory of 1316	888	window.exe	47
PID 888 wrote to memory of 1316	888	window.exe	47
PID 1316 wrote to memory of 2040	1316	cmd.exe	49
PID 1316 wrote to memory of 2040	1316	cmd.exe	49
PID 1316 wrote to memory of 2040	1316	cmd.exe	49
PID 1316 wrote to memory of 2040	1316	cmd.exe	49
PID 888 wrote to memory of 1552	888	window.exe	50
PID 888 wrote to memory of 1552	888	window.exe	50
PID 888 wrote to memory of 1552	888	window.exe	50
PID 888 wrote to memory of 1552	888	window.exe	50
PID 1552 wrote to memory of 1792	1552	cmd.exe	52
PID 1552 wrote to memory of 1792	1552	cmd.exe	52
PID 1552 wrote to memory of 1792	1552	cmd.exe	52
PID 1552 wrote to memory of 1792	1552	cmd.exe	52
PID 888 wrote to memory of 824	888	window.exe	53
PID 888 wrote to memory of 824	888	window.exe	53
PID 888 wrote to memory of 824	888	window.exe	53
PID 888 wrote to memory of 824	888	window.exe	53
PID 824 wrote to memory of 852	824	cmd.exe	55
PID 824 wrote to memory of 852	824	cmd.exe	55
PID 824 wrote to memory of 852	824	cmd.exe	55
PID 824 wrote to memory of 852	824	cmd.exe	55
PID 888 wrote to memory of 436	888	window.exe	56
PID 888 wrote to memory of 436	888	window.exe	56
PID 888 wrote to memory of 436	888	window.exe	56
PID 888 wrote to memory of 436	888	window.exe	56
PID 436 wrote to memory of 1640	436	cmd.exe	58
PID 436 wrote to memory of 1640	436	cmd.exe	58
PID 436 wrote to memory of 1640	436	cmd.exe	58
PID 436 wrote to memory of 1640	436	cmd.exe	58
PID 888 wrote to memory of 1852	888	window.exe	59
PID 888 wrote to memory of 1852	888	window.exe	59
PID 888 wrote to memory of 1852	888	window.exe	59
PID 888 wrote to memory of 1852	888	window.exe	59
PID 1852 wrote to memory of 2036	1852	cmd.exe	61
PID 1852 wrote to memory of 2036	1852	cmd.exe	61
PID 1852 wrote to memory of 2036	1852	cmd.exe	61
PID 1852 wrote to memory of 2036	1852	cmd.exe	61
PID 888 wrote to memory of 1164	888	window.exe	62
PID 888 wrote to memory of 1164	888	window.exe	62
PID 888 wrote to memory of 1164	888	window.exe	62
PID 888 wrote to memory of 1164	888	window.exe	62
PID 1164 wrote to memory of 840	1164	cmd.exe	64
PID 1164 wrote to memory of 840	1164	cmd.exe	64
PID 1164 wrote to memory of 840	1164	cmd.exe	64
PID 1164 wrote to memory of 840	1164	cmd.exe	64
PID 888 wrote to memory of 1084	888	window.exe	65
PID 888 wrote to memory of 1084	888	window.exe	65
PID 888 wrote to memory of 1084	888	window.exe	65
PID 888 wrote to memory of 1084	888	window.exe	65
PID 1084 wrote to memory of 860	1084	cmd.exe	67
PID 1084 wrote to memory of 860	1084	cmd.exe	67
PID 1084 wrote to memory of 860	1084	cmd.exe	67
PID 1084 wrote to memory of 860	1084	cmd.exe	67
PID 888 wrote to memory of 1680	888	window.exe	68
PID 888 wrote to memory of 1680	888	window.exe	68
PID 888 wrote to memory of 1680	888	window.exe	68
PID 888 wrote to memory of 1680	888	window.exe	68
PID 1680 wrote to memory of 1000	1680	cmd.exe	70
PID 1680 wrote to memory of 1000	1680	cmd.exe	70
PID 1680 wrote to memory of 1000	1680	cmd.exe	70
PID 1680 wrote to memory of 1000	1680	cmd.exe	70
PID 888 wrote to memory of 1796	888	window.exe	71
PID 888 wrote to memory of 1796	888	window.exe	71
PID 888 wrote to memory of 1796	888	window.exe	71
PID 888 wrote to memory of 1796	888	window.exe	71
PID 1796 wrote to memory of 1468	1796	cmd.exe	73
PID 1796 wrote to memory of 1468	1796	cmd.exe	73
PID 1796 wrote to memory of 1468	1796	cmd.exe	73
PID 1796 wrote to memory of 1468	1796	cmd.exe	73
PID 888 wrote to memory of 892	888	window.exe	74
PID 888 wrote to memory of 892	888	window.exe	74
PID 888 wrote to memory of 892	888	window.exe	74
PID 888 wrote to memory of 892	888	window.exe	74
PID 892 wrote to memory of 1868	892	cmd.exe	76
PID 892 wrote to memory of 1868	892	cmd.exe	76
PID 892 wrote to memory of 1868	892	cmd.exe	76
PID 892 wrote to memory of 1868	892	cmd.exe	76
PID 888 wrote to memory of 1352	888	window.exe	77
PID 888 wrote to memory of 1352	888	window.exe	77
PID 888 wrote to memory of 1352	888	window.exe	77
PID 888 wrote to memory of 1352	888	window.exe	77
PID 1352 wrote to memory of 1196	1352	cmd.exe	79
PID 1352 wrote to memory of 1196	1352	cmd.exe	79
PID 1352 wrote to memory of 1196	1352	cmd.exe	79
PID 1352 wrote to memory of 1196	1352	cmd.exe	79
PID 888 wrote to memory of 684	888	window.exe	80
PID 888 wrote to memory of 684	888	window.exe	80
PID 888 wrote to memory of 684	888	window.exe	80
PID 888 wrote to memory of 684	888	window.exe	80
PID 684 wrote to memory of 1928	684	cmd.exe	82
PID 684 wrote to memory of 1928	684	cmd.exe	82
PID 684 wrote to memory of 1928	684	cmd.exe	82
PID 684 wrote to memory of 1928	684	cmd.exe	82
PID 888 wrote to memory of 1444	888	window.exe	83
PID 888 wrote to memory of 1444	888	window.exe	83
PID 888 wrote to memory of 1444	888	window.exe	83
PID 888 wrote to memory of 1444	888	window.exe	83
PID 1444 wrote to memory of 736	1444	cmd.exe	85
PID 1444 wrote to memory of 736	1444	cmd.exe	85
PID 1444 wrote to memory of 736	1444	cmd.exe	85
PID 1444 wrote to memory of 736	1444	cmd.exe	85
PID 888 wrote to memory of 1036	888	window.exe	86
PID 888 wrote to memory of 1036	888	window.exe	86
PID 888 wrote to memory of 1036	888	window.exe	86
PID 888 wrote to memory of 1036	888	window.exe	86
PID 1036 wrote to memory of 1660	1036	cmd.exe	88
PID 1036 wrote to memory of 1660	1036	cmd.exe	88
PID 1036 wrote to memory of 1660	1036	cmd.exe	88
PID 1036 wrote to memory of 1660	1036	cmd.exe	88
PID 888 wrote to memory of 2036	888	window.exe	89
PID 888 wrote to memory of 2036	888	window.exe	89
PID 888 wrote to memory of 2036	888	window.exe	89
PID 888 wrote to memory of 2036	888	window.exe	89
PID 2036 wrote to memory of 1980	2036	cmd.exe	91
PID 2036 wrote to memory of 1980	2036	cmd.exe	91
PID 2036 wrote to memory of 1980	2036	cmd.exe	91
PID 2036 wrote to memory of 1980	2036	cmd.exe	91
PID 888 wrote to memory of 2004	888	window.exe	92
PID 888 wrote to memory of 2004	888	window.exe	92
PID 888 wrote to memory of 2004	888	window.exe	92
PID 888 wrote to memory of 2004	888	window.exe	92
PID 2004 wrote to memory of 860	2004	cmd.exe	94
PID 2004 wrote to memory of 860	2004	cmd.exe	94
PID 2004 wrote to memory of 860	2004	cmd.exe	94
PID 2004 wrote to memory of 860	2004	cmd.exe	94
PID 888 wrote to memory of 688	888	window.exe	95
PID 888 wrote to memory of 688	888	window.exe	95
PID 888 wrote to memory of 688	888	window.exe	95
PID 888 wrote to memory of 688	888	window.exe	95
PID 688 wrote to memory of 292	688	cmd.exe	97
PID 688 wrote to memory of 292	688	cmd.exe	97
PID 688 wrote to memory of 292	688	cmd.exe	97
PID 688 wrote to memory of 292	688	cmd.exe	97
PID 888 wrote to memory of 1708	888	window.exe	98
PID 888 wrote to memory of 1708	888	window.exe	98
PID 888 wrote to memory of 1708	888	window.exe	98
PID 888 wrote to memory of 1708	888	window.exe	98
PID 1708 wrote to memory of 1580	1708	cmd.exe	100
PID 1708 wrote to memory of 1580	1708	cmd.exe	100
PID 1708 wrote to memory of 1580	1708	cmd.exe	100
PID 1708 wrote to memory of 1580	1708	cmd.exe	100
PID 888 wrote to memory of 944	888	window.exe	101
PID 888 wrote to memory of 944	888	window.exe	101
PID 888 wrote to memory of 944	888	window.exe	101
PID 888 wrote to memory of 944	888	window.exe	101
PID 944 wrote to memory of 2040	944	cmd.exe	103
PID 944 wrote to memory of 2040	944	cmd.exe	103
PID 944 wrote to memory of 2040	944	cmd.exe	103
PID 944 wrote to memory of 2040	944	cmd.exe	103
PID 888 wrote to memory of 928	888	window.exe	104
PID 888 wrote to memory of 928	888	window.exe	104
PID 888 wrote to memory of 928	888	window.exe	104
PID 888 wrote to memory of 928	888	window.exe	104
PID 928 wrote to memory of 652	928	cmd.exe	106
PID 928 wrote to memory of 652	928	cmd.exe	106
PID 928 wrote to memory of 652	928	cmd.exe	106
PID 928 wrote to memory of 652	928	cmd.exe	106
PID 888 wrote to memory of 1792	888	window.exe	107
PID 888 wrote to memory of 1792	888	window.exe	107
PID 888 wrote to memory of 1792	888	window.exe	107
PID 888 wrote to memory of 1792	888	window.exe	107
PID 1792 wrote to memory of 644	1792	cmd.exe	109
PID 1792 wrote to memory of 644	1792	cmd.exe	109
PID 1792 wrote to memory of 644	1792	cmd.exe	109
PID 1792 wrote to memory of 644	1792	cmd.exe	109
PID 888 wrote to memory of 1640	888	window.exe	110
PID 888 wrote to memory of 1640	888	window.exe	110
PID 888 wrote to memory of 1640	888	window.exe	110
PID 888 wrote to memory of 1640	888	window.exe	110
PID 1640 wrote to memory of 1048	1640	cmd.exe	112
PID 1640 wrote to memory of 1048	1640	cmd.exe	112
PID 1640 wrote to memory of 1048	1640	cmd.exe	112
PID 1640 wrote to memory of 1048	1640	cmd.exe	112
PID 888 wrote to memory of 840	888	window.exe	113
PID 888 wrote to memory of 840	888	window.exe	113
PID 888 wrote to memory of 840	888	window.exe	113
PID 888 wrote to memory of 840	888	window.exe	113
PID 840 wrote to memory of 1336	840	cmd.exe	115
PID 840 wrote to memory of 1336	840	cmd.exe	115
PID 840 wrote to memory of 1336	840	cmd.exe	115
PID 840 wrote to memory of 1336	840	cmd.exe	115
PID 888 wrote to memory of 860	888	window.exe	116
PID 888 wrote to memory of 860	888	window.exe	116
PID 888 wrote to memory of 860	888	window.exe	116
PID 888 wrote to memory of 860	888	window.exe	116
PID 860 wrote to memory of 1684	860	cmd.exe	118
PID 860 wrote to memory of 1684	860	cmd.exe	118
PID 860 wrote to memory of 1684	860	cmd.exe	118
PID 860 wrote to memory of 1684	860	cmd.exe	118
PID 888 wrote to memory of 1620	888	window.exe	119
PID 888 wrote to memory of 1620	888	window.exe	119
PID 888 wrote to memory of 1620	888	window.exe	119
PID 888 wrote to memory of 1620	888	window.exe	119
PID 1620 wrote to memory of 1580	1620	cmd.exe	121
PID 1620 wrote to memory of 1580	1620	cmd.exe	121
PID 1620 wrote to memory of 1580	1620	cmd.exe	121
PID 1620 wrote to memory of 1580	1620	cmd.exe	121
PID 888 wrote to memory of 1468	888	window.exe	122
PID 888 wrote to memory of 1468	888	window.exe	122
PID 888 wrote to memory of 1468	888	window.exe	122
PID 888 wrote to memory of 1468	888	window.exe	122
PID 1468 wrote to memory of 1868	1468	cmd.exe	124
PID 1468 wrote to memory of 1868	1468	cmd.exe	124
PID 1468 wrote to memory of 1868	1468	cmd.exe	124
PID 1468 wrote to memory of 1868	1468	cmd.exe	124
PID 888 wrote to memory of 1260	888	window.exe	125
PID 888 wrote to memory of 1260	888	window.exe	125
PID 888 wrote to memory of 1260	888	window.exe	125
PID 888 wrote to memory of 1260	888	window.exe	125
PID 1260 wrote to memory of 788	1260	cmd.exe	127
PID 1260 wrote to memory of 788	1260	cmd.exe	127
PID 1260 wrote to memory of 788	1260	cmd.exe	127
PID 1260 wrote to memory of 788	1260	cmd.exe	127
PID 888 wrote to memory of 644	888	window.exe	128
PID 888 wrote to memory of 644	888	window.exe	128
PID 888 wrote to memory of 644	888	window.exe	128
PID 888 wrote to memory of 644	888	window.exe	128
PID 644 wrote to memory of 1820	644	cmd.exe	130
PID 644 wrote to memory of 1820	644	cmd.exe	130
PID 644 wrote to memory of 1820	644	cmd.exe	130
PID 644 wrote to memory of 1820	644	cmd.exe	130
PID 888 wrote to memory of 1484	888	window.exe	131
PID 888 wrote to memory of 1484	888	window.exe	131
PID 888 wrote to memory of 1484	888	window.exe	131
PID 888 wrote to memory of 1484	888	window.exe	131
PID 1484 wrote to memory of 1336	1484	cmd.exe	133
PID 1484 wrote to memory of 1336	1484	cmd.exe	133
PID 1484 wrote to memory of 1336	1484	cmd.exe	133
PID 1484 wrote to memory of 1336	1484	cmd.exe	133
PID 888 wrote to memory of 2012	888	window.exe	134
PID 888 wrote to memory of 2012	888	window.exe	134
PID 888 wrote to memory of 2012	888	window.exe	134
PID 888 wrote to memory of 2012	888	window.exe	134
PID 2012 wrote to memory of 1128	2012	cmd.exe	136
PID 2012 wrote to memory of 1128	2012	cmd.exe	136
PID 2012 wrote to memory of 1128	2012	cmd.exe	136
PID 2012 wrote to memory of 1128	2012	cmd.exe	136
PID 888 wrote to memory of 1296	888	window.exe	137
PID 888 wrote to memory of 1296	888	window.exe	137
PID 888 wrote to memory of 1296	888	window.exe	137
PID 888 wrote to memory of 1296	888	window.exe	137
PID 1296 wrote to memory of 1996	1296	cmd.exe	139
PID 1296 wrote to memory of 1996	1296	cmd.exe	139
PID 1296 wrote to memory of 1996	1296	cmd.exe	139
PID 1296 wrote to memory of 1996	1296	cmd.exe	139
PID 888 wrote to memory of 316	888	window.exe	140
PID 888 wrote to memory of 316	888	window.exe	140
PID 888 wrote to memory of 316	888	window.exe	140
PID 888 wrote to memory of 316	888	window.exe	140
PID 316 wrote to memory of 652	316	cmd.exe	142
PID 316 wrote to memory of 652	316	cmd.exe	142
PID 316 wrote to memory of 652	316	cmd.exe	142
PID 316 wrote to memory of 652	316	cmd.exe	142
PID 888 wrote to memory of 788	888	window.exe	143
PID 888 wrote to memory of 788	888	window.exe	143
PID 888 wrote to memory of 788	888	window.exe	143
PID 888 wrote to memory of 788	888	window.exe	143
PID 788 wrote to memory of 1048	788	cmd.exe	145
PID 788 wrote to memory of 1048	788	cmd.exe	145
PID 788 wrote to memory of 1048	788	cmd.exe	145
PID 788 wrote to memory of 1048	788	cmd.exe	145
PID 888 wrote to memory of 1524	888	window.exe	146
PID 888 wrote to memory of 1524	888	window.exe	146
PID 888 wrote to memory of 1524	888	window.exe	146
PID 888 wrote to memory of 1524	888	window.exe	146
PID 1524 wrote to memory of 1336	1524	cmd.exe	148
PID 1524 wrote to memory of 1336	1524	cmd.exe	148
PID 1524 wrote to memory of 1336	1524	cmd.exe	148
PID 1524 wrote to memory of 1336	1524	cmd.exe	148
PID 888 wrote to memory of 1980	888	window.exe	149
PID 888 wrote to memory of 1980	888	window.exe	149
PID 888 wrote to memory of 1980	888	window.exe	149
PID 888 wrote to memory of 1980	888	window.exe	149
PID 1980 wrote to memory of 1532	1980	cmd.exe	151
PID 1980 wrote to memory of 1532	1980	cmd.exe	151
PID 1980 wrote to memory of 1532	1980	cmd.exe	151
PID 1980 wrote to memory of 1532	1980	cmd.exe	151
PID 888 wrote to memory of 1600	888	window.exe	152
PID 888 wrote to memory of 1600	888	window.exe	152
PID 888 wrote to memory of 1600	888	window.exe	152
PID 888 wrote to memory of 1600	888	window.exe	152
PID 1600 wrote to memory of 932	1600	cmd.exe	154
PID 1600 wrote to memory of 932	1600	cmd.exe	154
PID 1600 wrote to memory of 932	1600	cmd.exe	154
PID 1600 wrote to memory of 932	1600	cmd.exe	154
PID 888 wrote to memory of 1268	888	window.exe	155
PID 888 wrote to memory of 1268	888	window.exe	155
PID 888 wrote to memory of 1268	888	window.exe	155
PID 888 wrote to memory of 1268	888	window.exe	155
PID 1268 wrote to memory of 1248	1268	cmd.exe	157
PID 1268 wrote to memory of 1248	1268	cmd.exe	157
PID 1268 wrote to memory of 1248	1268	cmd.exe	157
PID 1268 wrote to memory of 1248	1268	cmd.exe	157
PID 888 wrote to memory of 1972	888	window.exe	158
PID 888 wrote to memory of 1972	888	window.exe	158
PID 888 wrote to memory of 1972	888	window.exe	158
PID 888 wrote to memory of 1972	888	window.exe	158
PID 1972 wrote to memory of 512	1972	cmd.exe	160
PID 1972 wrote to memory of 512	1972	cmd.exe	160
PID 1972 wrote to memory of 512	1972	cmd.exe	160
PID 1972 wrote to memory of 512	1972	cmd.exe	160
PID 888 wrote to memory of 464	888	window.exe	161
PID 888 wrote to memory of 464	888	window.exe	161
PID 888 wrote to memory of 464	888	window.exe	161
PID 888 wrote to memory of 464	888	window.exe	161
PID 464 wrote to memory of 1636	464	cmd.exe	163
PID 464 wrote to memory of 1636	464	cmd.exe	163
PID 464 wrote to memory of 1636	464	cmd.exe	163
PID 464 wrote to memory of 1636	464	cmd.exe	163
PID 888 wrote to memory of 1976	888	window.exe	164
PID 888 wrote to memory of 1976	888	window.exe	164
PID 888 wrote to memory of 1976	888	window.exe	164
PID 888 wrote to memory of 1976	888	window.exe	164
PID 1976 wrote to memory of 1028	1976	cmd.exe	166
PID 1976 wrote to memory of 1028	1976	cmd.exe	166
PID 1976 wrote to memory of 1028	1976	cmd.exe	166
PID 1976 wrote to memory of 1028	1976	cmd.exe	166
PID 888 wrote to memory of 1644	888	window.exe	167
PID 888 wrote to memory of 1644	888	window.exe	167
PID 888 wrote to memory of 1644	888	window.exe	167
PID 888 wrote to memory of 1644	888	window.exe	167
PID 1644 wrote to memory of 1808	1644	cmd.exe	169
PID 1644 wrote to memory of 1808	1644	cmd.exe	169
PID 1644 wrote to memory of 1808	1644	cmd.exe	169
PID 1644 wrote to memory of 1808	1644	cmd.exe	169
PID 888 wrote to memory of 512	888	window.exe	170
PID 888 wrote to memory of 512	888	window.exe	170
PID 888 wrote to memory of 512	888	window.exe	170
PID 888 wrote to memory of 512	888	window.exe	170
PID 512 wrote to memory of 1604	512	cmd.exe	172
PID 512 wrote to memory of 1604	512	cmd.exe	172
PID 512 wrote to memory of 1604	512	cmd.exe	172
PID 512 wrote to memory of 1604	512	cmd.exe	172
PID 888 wrote to memory of 1564	888	window.exe	173
PID 888 wrote to memory of 1564	888	window.exe	173
PID 888 wrote to memory of 1564	888	window.exe	173
PID 888 wrote to memory of 1564	888	window.exe	173
PID 1564 wrote to memory of 1028	1564	cmd.exe	175
PID 1564 wrote to memory of 1028	1564	cmd.exe	175
PID 1564 wrote to memory of 1028	1564	cmd.exe	175
PID 1564 wrote to memory of 1028	1564	cmd.exe	175
PID 888 wrote to memory of 1580	888	window.exe	176
PID 888 wrote to memory of 1580	888	window.exe	176
PID 888 wrote to memory of 1580	888	window.exe	176
PID 888 wrote to memory of 1580	888	window.exe	176
PID 1580 wrote to memory of 900	1580	cmd.exe	178
PID 1580 wrote to memory of 900	1580	cmd.exe	178
PID 1580 wrote to memory of 900	1580	cmd.exe	178
PID 1580 wrote to memory of 900	1580	cmd.exe	178
PID 888 wrote to memory of 1128	888	window.exe	179
PID 888 wrote to memory of 1128	888	window.exe	179
PID 888 wrote to memory of 1128	888	window.exe	179
PID 888 wrote to memory of 1128	888	window.exe	179
PID 1128 wrote to memory of 932	1128	cmd.exe	181
PID 1128 wrote to memory of 932	1128	cmd.exe	181
PID 1128 wrote to memory of 932	1128	cmd.exe	181
PID 1128 wrote to memory of 932	1128	cmd.exe	181
PID 888 wrote to memory of 2044	888	window.exe	182
PID 888 wrote to memory of 2044	888	window.exe	182
PID 888 wrote to memory of 2044	888	window.exe	182
PID 888 wrote to memory of 2044	888	window.exe	182
PID 2044 wrote to memory of 1928	2044	cmd.exe	184
PID 2044 wrote to memory of 1928	2044	cmd.exe	184
PID 2044 wrote to memory of 1928	2044	cmd.exe	184
PID 2044 wrote to memory of 1928	2044	cmd.exe	184
PID 888 wrote to memory of 1808	888	window.exe	185
PID 888 wrote to memory of 1808	888	window.exe	185
PID 888 wrote to memory of 1808	888	window.exe	185
PID 888 wrote to memory of 1808	888	window.exe	185
PID 1808 wrote to memory of 1604	1808	cmd.exe	187
PID 1808 wrote to memory of 1604	1808	cmd.exe	187
PID 1808 wrote to memory of 1604	1808	cmd.exe	187
PID 1808 wrote to memory of 1604	1808	cmd.exe	187
PID 888 wrote to memory of 2028	888	window.exe	188
PID 888 wrote to memory of 2028	888	window.exe	188
PID 888 wrote to memory of 2028	888	window.exe	188
PID 888 wrote to memory of 2028	888	window.exe	188
PID 2028 wrote to memory of 1532	2028	cmd.exe	190
PID 2028 wrote to memory of 1532	2028	cmd.exe	190
PID 2028 wrote to memory of 1532	2028	cmd.exe	190
PID 2028 wrote to memory of 1532	2028	cmd.exe	190
PID 888 wrote to memory of 1476	888	window.exe	191
PID 888 wrote to memory of 1476	888	window.exe	191
PID 888 wrote to memory of 1476	888	window.exe	191
PID 888 wrote to memory of 1476	888	window.exe	191
PID 1476 wrote to memory of 1824	1476	cmd.exe	193
PID 1476 wrote to memory of 1824	1476	cmd.exe	193
PID 1476 wrote to memory of 1824	1476	cmd.exe	193
PID 1476 wrote to memory of 1824	1476	cmd.exe	193
PID 888 wrote to memory of 736	888	window.exe	194
PID 888 wrote to memory of 736	888	window.exe	194
PID 888 wrote to memory of 736	888	window.exe	194
PID 888 wrote to memory of 736	888	window.exe	194
PID 736 wrote to memory of 932	736	cmd.exe	196
PID 736 wrote to memory of 932	736	cmd.exe	196
PID 736 wrote to memory of 932	736	cmd.exe	196
PID 736 wrote to memory of 932	736	cmd.exe	196
PID 888 wrote to memory of 1700	888	window.exe	197
PID 888 wrote to memory of 1700	888	window.exe	197
PID 888 wrote to memory of 1700	888	window.exe	197
PID 888 wrote to memory of 1700	888	window.exe	197
PID 1700 wrote to memory of 932	1700	cmd.exe	199
PID 1700 wrote to memory of 932	1700	cmd.exe	199
PID 1700 wrote to memory of 932	1700	cmd.exe	199
PID 1700 wrote to memory of 932	1700	cmd.exe	199
PID 888 wrote to memory of 328	888	window.exe	200
PID 888 wrote to memory of 328	888	window.exe	200
PID 888 wrote to memory of 328	888	window.exe	200
PID 888 wrote to memory of 328	888	window.exe	200
PID 328 wrote to memory of 1996	328	cmd.exe	202
PID 328 wrote to memory of 1996	328	cmd.exe	202
PID 328 wrote to memory of 1996	328	cmd.exe	202
PID 328 wrote to memory of 1996	328	cmd.exe	202
PID 888 wrote to memory of 1900	888	window.exe	203
PID 888 wrote to memory of 1900	888	window.exe	203
PID 888 wrote to memory of 1900	888	window.exe	203
PID 888 wrote to memory of 1900	888	window.exe	203
PID 1900 wrote to memory of 1604	1900	cmd.exe	205
PID 1900 wrote to memory of 1604	1900	cmd.exe	205
PID 1900 wrote to memory of 1604	1900	cmd.exe	205
PID 1900 wrote to memory of 1604	1900	cmd.exe	205
PID 888 wrote to memory of 652	888	window.exe	206
PID 888 wrote to memory of 652	888	window.exe	206
PID 888 wrote to memory of 652	888	window.exe	206
PID 888 wrote to memory of 652	888	window.exe	206
PID 652 wrote to memory of 1148	652	cmd.exe	208
PID 652 wrote to memory of 1148	652	cmd.exe	208
PID 652 wrote to memory of 1148	652	cmd.exe	208
PID 652 wrote to memory of 1148	652	cmd.exe	208
PID 888 wrote to memory of 932	888	window.exe	209
PID 888 wrote to memory of 932	888	window.exe	209
PID 888 wrote to memory of 932	888	window.exe	209
PID 888 wrote to memory of 932	888	window.exe	209
PID 932 wrote to memory of 1996	932	cmd.exe	211
PID 932 wrote to memory of 1996	932	cmd.exe	211
PID 932 wrote to memory of 1996	932	cmd.exe	211
PID 932 wrote to memory of 1996	932	cmd.exe	211
PID 888 wrote to memory of 2064	888	window.exe	212
PID 888 wrote to memory of 2064	888	window.exe	212
PID 888 wrote to memory of 2064	888	window.exe	212
PID 888 wrote to memory of 2064	888	window.exe	212
PID 2064 wrote to memory of 2092	2064	cmd.exe	214
PID 2064 wrote to memory of 2092	2064	cmd.exe	214
PID 2064 wrote to memory of 2092	2064	cmd.exe	214
PID 2064 wrote to memory of 2092	2064	cmd.exe	214
PID 888 wrote to memory of 2108	888	window.exe	215
PID 888 wrote to memory of 2108	888	window.exe	215
PID 888 wrote to memory of 2108	888	window.exe	215
PID 888 wrote to memory of 2108	888	window.exe	215
PID 2108 wrote to memory of 2136	2108	cmd.exe	217
PID 2108 wrote to memory of 2136	2108	cmd.exe	217
PID 2108 wrote to memory of 2136	2108	cmd.exe	217
PID 2108 wrote to memory of 2136	2108	cmd.exe	217
PID 888 wrote to memory of 2152	888	window.exe	218
PID 888 wrote to memory of 2152	888	window.exe	218
PID 888 wrote to memory of 2152	888	window.exe	218
PID 888 wrote to memory of 2152	888	window.exe	218
PID 2152 wrote to memory of 2180	2152	cmd.exe	220
PID 2152 wrote to memory of 2180	2152	cmd.exe	220
PID 2152 wrote to memory of 2180	2152	cmd.exe	220
PID 2152 wrote to memory of 2180	2152	cmd.exe	220
PID 888 wrote to memory of 2196	888	window.exe	221
PID 888 wrote to memory of 2196	888	window.exe	221
PID 888 wrote to memory of 2196	888	window.exe	221
PID 888 wrote to memory of 2196	888	window.exe	221
PID 2196 wrote to memory of 2224	2196	cmd.exe	223
PID 2196 wrote to memory of 2224	2196	cmd.exe	223
PID 2196 wrote to memory of 2224	2196	cmd.exe	223
PID 2196 wrote to memory of 2224	2196	cmd.exe	223
PID 888 wrote to memory of 2240	888	window.exe	224
PID 888 wrote to memory of 2240	888	window.exe	224
PID 888 wrote to memory of 2240	888	window.exe	224
PID 888 wrote to memory of 2240	888	window.exe	224
PID 2240 wrote to memory of 2268	2240	cmd.exe	226
PID 2240 wrote to memory of 2268	2240	cmd.exe	226
PID 2240 wrote to memory of 2268	2240	cmd.exe	226
PID 2240 wrote to memory of 2268	2240	cmd.exe	226
PID 888 wrote to memory of 2284	888	window.exe	227
PID 888 wrote to memory of 2284	888	window.exe	227
PID 888 wrote to memory of 2284	888	window.exe	227
PID 888 wrote to memory of 2284	888	window.exe	227
PID 2284 wrote to memory of 2312	2284	cmd.exe	229
PID 2284 wrote to memory of 2312	2284	cmd.exe	229
PID 2284 wrote to memory of 2312	2284	cmd.exe	229
PID 2284 wrote to memory of 2312	2284	cmd.exe	229
PID 888 wrote to memory of 2328	888	window.exe	230
PID 888 wrote to memory of 2328	888	window.exe	230
PID 888 wrote to memory of 2328	888	window.exe	230
PID 888 wrote to memory of 2328	888	window.exe	230
PID 2328 wrote to memory of 2356	2328	cmd.exe	232
PID 2328 wrote to memory of 2356	2328	cmd.exe	232
PID 2328 wrote to memory of 2356	2328	cmd.exe	232
PID 2328 wrote to memory of 2356	2328	cmd.exe	232
PID 888 wrote to memory of 2372	888	window.exe	233
PID 888 wrote to memory of 2372	888	window.exe	233
PID 888 wrote to memory of 2372	888	window.exe	233
PID 888 wrote to memory of 2372	888	window.exe	233
PID 2372 wrote to memory of 2400	2372	cmd.exe	235
PID 2372 wrote to memory of 2400	2372	cmd.exe	235
PID 2372 wrote to memory of 2400	2372	cmd.exe	235
PID 2372 wrote to memory of 2400	2372	cmd.exe	235
PID 888 wrote to memory of 2416	888	window.exe	236
PID 888 wrote to memory of 2416	888	window.exe	236
PID 888 wrote to memory of 2416	888	window.exe	236
PID 888 wrote to memory of 2416	888	window.exe	236
PID 2416 wrote to memory of 2444	2416	cmd.exe	238
PID 2416 wrote to memory of 2444	2416	cmd.exe	238
PID 2416 wrote to memory of 2444	2416	cmd.exe	238
PID 2416 wrote to memory of 2444	2416	cmd.exe	238
PID 888 wrote to memory of 2460	888	window.exe	239
PID 888 wrote to memory of 2460	888	window.exe	239
PID 888 wrote to memory of 2460	888	window.exe	239
PID 888 wrote to memory of 2460	888	window.exe	239
PID 2460 wrote to memory of 2488	2460	cmd.exe	241
PID 2460 wrote to memory of 2488	2460	cmd.exe	241
PID 2460 wrote to memory of 2488	2460	cmd.exe	241
PID 2460 wrote to memory of 2488	2460	cmd.exe	241
PID 888 wrote to memory of 2504	888	window.exe	242
PID 888 wrote to memory of 2504	888	window.exe	242
PID 888 wrote to memory of 2504	888	window.exe	242
PID 888 wrote to memory of 2504	888	window.exe	242
PID 2504 wrote to memory of 2532	2504	cmd.exe	244
PID 2504 wrote to memory of 2532	2504	cmd.exe	244
PID 2504 wrote to memory of 2532	2504	cmd.exe	244
PID 2504 wrote to memory of 2532	2504	cmd.exe	244
PID 888 wrote to memory of 2548	888	window.exe	245
PID 888 wrote to memory of 2548	888	window.exe	245
PID 888 wrote to memory of 2548	888	window.exe	245
PID 888 wrote to memory of 2548	888	window.exe	245
PID 2548 wrote to memory of 2576	2548	cmd.exe	247
PID 2548 wrote to memory of 2576	2548	cmd.exe	247
PID 2548 wrote to memory of 2576	2548	cmd.exe	247
PID 2548 wrote to memory of 2576	2548	cmd.exe	247
PID 888 wrote to memory of 2592	888	window.exe	248
PID 888 wrote to memory of 2592	888	window.exe	248
PID 888 wrote to memory of 2592	888	window.exe	248
PID 888 wrote to memory of 2592	888	window.exe	248
PID 2592 wrote to memory of 2620	2592	cmd.exe	250
PID 2592 wrote to memory of 2620	2592	cmd.exe	250
PID 2592 wrote to memory of 2620	2592	cmd.exe	250
PID 2592 wrote to memory of 2620	2592	cmd.exe	250
PID 888 wrote to memory of 2636	888	window.exe	251
PID 888 wrote to memory of 2636	888	window.exe	251
PID 888 wrote to memory of 2636	888	window.exe	251
PID 888 wrote to memory of 2636	888	window.exe	251
PID 2636 wrote to memory of 2664	2636	cmd.exe	253
PID 2636 wrote to memory of 2664	2636	cmd.exe	253
PID 2636 wrote to memory of 2664	2636	cmd.exe	253
PID 2636 wrote to memory of 2664	2636	cmd.exe	253
PID 888 wrote to memory of 2680	888	window.exe	254
PID 888 wrote to memory of 2680	888	window.exe	254
PID 888 wrote to memory of 2680	888	window.exe	254
PID 888 wrote to memory of 2680	888	window.exe	254
PID 2680 wrote to memory of 2708	2680	cmd.exe	256
PID 2680 wrote to memory of 2708	2680	cmd.exe	256
PID 2680 wrote to memory of 2708	2680	cmd.exe	256
PID 2680 wrote to memory of 2708	2680	cmd.exe	256
PID 888 wrote to memory of 2724	888	window.exe	257
PID 888 wrote to memory of 2724	888	window.exe	257
PID 888 wrote to memory of 2724	888	window.exe	257
PID 888 wrote to memory of 2724	888	window.exe	257
PID 2724 wrote to memory of 2752	2724	cmd.exe	259
PID 2724 wrote to memory of 2752	2724	cmd.exe	259
PID 2724 wrote to memory of 2752	2724	cmd.exe	259
PID 2724 wrote to memory of 2752	2724	cmd.exe	259
PID 888 wrote to memory of 2768	888	window.exe	260
PID 888 wrote to memory of 2768	888	window.exe	260
PID 888 wrote to memory of 2768	888	window.exe	260
PID 888 wrote to memory of 2768	888	window.exe	260
PID 2768 wrote to memory of 2796	2768	cmd.exe	262
PID 2768 wrote to memory of 2796	2768	cmd.exe	262
PID 2768 wrote to memory of 2796	2768	cmd.exe	262
PID 2768 wrote to memory of 2796	2768	cmd.exe	262
PID 888 wrote to memory of 2812	888	window.exe	263
PID 888 wrote to memory of 2812	888	window.exe	263
PID 888 wrote to memory of 2812	888	window.exe	263
PID 888 wrote to memory of 2812	888	window.exe	263
PID 2812 wrote to memory of 2840	2812	cmd.exe	265
PID 2812 wrote to memory of 2840	2812	cmd.exe	265
PID 2812 wrote to memory of 2840	2812	cmd.exe	265
PID 2812 wrote to memory of 2840	2812	cmd.exe	265
PID 888 wrote to memory of 2860	888	window.exe	266
PID 888 wrote to memory of 2860	888	window.exe	266
PID 888 wrote to memory of 2860	888	window.exe	266
PID 888 wrote to memory of 2860	888	window.exe	266
PID 2860 wrote to memory of 2888	2860	cmd.exe	268
PID 2860 wrote to memory of 2888	2860	cmd.exe	268
PID 2860 wrote to memory of 2888	2860	cmd.exe	268
PID 2860 wrote to memory of 2888	2860	cmd.exe	268
PID 888 wrote to memory of 2904	888	window.exe	269
PID 888 wrote to memory of 2904	888	window.exe	269
PID 888 wrote to memory of 2904	888	window.exe	269
PID 888 wrote to memory of 2904	888	window.exe	269
PID 2904 wrote to memory of 2932	2904	cmd.exe	271
PID 2904 wrote to memory of 2932	2904	cmd.exe	271
PID 2904 wrote to memory of 2932	2904	cmd.exe	271
PID 2904 wrote to memory of 2932	2904	cmd.exe	271
PID 888 wrote to memory of 2948	888	window.exe	272
PID 888 wrote to memory of 2948	888	window.exe	272
PID 888 wrote to memory of 2948	888	window.exe	272
PID 888 wrote to memory of 2948	888	window.exe	272
PID 2948 wrote to memory of 2976	2948	cmd.exe	274
PID 2948 wrote to memory of 2976	2948	cmd.exe	274
PID 2948 wrote to memory of 2976	2948	cmd.exe	274
PID 2948 wrote to memory of 2976	2948	cmd.exe	274

C:\Users\Admin\AppData\Local\Temp\Request.exe
"C:\Users\Admin\AppData\Local\Temp\Request.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Request.exe" "C:\Users\Admin\AppData\Roaming\window.exe"
  2⤵
  PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\window.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Users\Admin\AppData\Roaming\window.exe
    "C:\Users\Admin\AppData\Roaming\window.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1684
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:456
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1552
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:824
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:436
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1852
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1164
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:840
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1084
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1680
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1000
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1796
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1468
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1352
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1196
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:684
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1444
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1036
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1660
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2036
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:688
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:292
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1708
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:928
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:652
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1792
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1640
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:840
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:860
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1620
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1468
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1260
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:788
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:644
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1484
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2012
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1296
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:316
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:652
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:788
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1524
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1980
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1532
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1600
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1268
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:512
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:464
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1976
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1644
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1564
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1580
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1128
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2044
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1808
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1532
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1476
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1824
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:736
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1700
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:328
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1900
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:652
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2064
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2092
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2108
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2152
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2180
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2196
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2224
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2240
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2284
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2312
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2328
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2372
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2416
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2460
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2504
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2532
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2548
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2576
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2620
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2636
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2680
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2708
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2724
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2752
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2768
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2812
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2840
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2860
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2888
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2904
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2948
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-37-0x0000000000580000-0x0000000000599000-memory.dmp

Download

memory/456-38-0x0000000000530000-0x0000000000533000-memory.dmp

Download

memory/456-36-0x0000000000520000-0x0000000000525000-memory.dmp

Download

memory/456-30-0x0000000074310000-0x00000000749FE000-memory.dmp

Download

memory/456-29-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/456-27-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/456-25-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/736-2-0x0000000074390000-0x0000000074A7E000-memory.dmp

Download

memory/736-5-0x00000000003C0000-0x00000000003D7000-memory.dmp

Download

memory/736-3-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/736-6-0x00000000004F0000-0x000000000050F000-memory.dmp

Download

memory/888-20-0x0000000000260000-0x000000000026A000-memory.dmp

Download

memory/888-13-0x0000000074310000-0x00000000749FE000-memory.dmp

Download

memory/888-14-0x0000000000060000-0x0000000000061000-memory.dmp

Download