nanocore | ccb238545e350b6c90285c5eff16df04dd0da678b587613c3f4e4f9bc4799d01

Analysis

max time kernel
150s
max time network
141s
platform
windows10_x64
resource
win10v20201028
submitted
30/11/2020, 14:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request.exe
Size 601KB
Sample201130-2b2vze9g6e
SHA256 ccb238545e350b6c90285c5eff16df04dd0da678b587613c3f4e4f9bc4799d01
MD5 b346b95b211c8da43f5a8d3ed6f600fd
SHA1 f01c8b11a3964913d827d612557410766029db08
SHA512 51c44695de898a7e67c1decf8c01ba377aa86204da9b4714ae3f243b69002d31b5f9eea17b031300b1edc19e90f7efc57e6879270c706ddc5e5d095288704b56
MD5 SHA1 SHA512

Score

10^/10

nanocore keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

new8855.duckdns.org:9922
127.0.0.1:9922

Mutex

fc670a7b-7f62-40e8-8df4-51bc9e02d755

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2020-08-12T17:25:45.457238936Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9922
default_group
Odumeje
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
fc670a7b-7f62-40e8-8df4-51bc9e02d755
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
new8855.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Modifies WinLogon for persistence 2 TTPs 96 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\window.exe,"	reg.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 1 IoCs

pid	Process
1316	window.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Service = "C:\\Program Files (x86)\\WAN Service\\wansv.exe"	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 1784	1316	window.exe	87

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WAN Service\wansv.exe	InstallUtil.exe
File opened for modification	C:\Program Files (x86)\WAN Service\wansv.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1316	window.exe
1316	window.exe
1784	InstallUtil.exe
1784	InstallUtil.exe
1784	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1784	InstallUtil.exe
1316	window.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	Request.exe
Token: SeDebugPrivilege	1316	window.exe
Token: SeDebugPrivilege	1784	InstallUtil.exe

Suspicious use of WriteProcessMemory 593 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 204	4020	Request.exe	77
PID 4020 wrote to memory of 204	4020	Request.exe	77
PID 4020 wrote to memory of 204	4020	Request.exe	77
PID 4020 wrote to memory of 3124	4020	Request.exe	79
PID 4020 wrote to memory of 3124	4020	Request.exe	79
PID 4020 wrote to memory of 3124	4020	Request.exe	79
PID 3124 wrote to memory of 1316	3124	cmd.exe	81
PID 3124 wrote to memory of 1316	3124	cmd.exe	81
PID 3124 wrote to memory of 1316	3124	cmd.exe	81
PID 1316 wrote to memory of 2972	1316	window.exe	82
PID 1316 wrote to memory of 2972	1316	window.exe	82
PID 1316 wrote to memory of 2972	1316	window.exe	82
PID 2972 wrote to memory of 1016	2972	cmd.exe	84
PID 2972 wrote to memory of 1016	2972	cmd.exe	84
PID 2972 wrote to memory of 1016	2972	cmd.exe	84
PID 1316 wrote to memory of 1288	1316	window.exe	85
PID 1316 wrote to memory of 1288	1316	window.exe	85
PID 1316 wrote to memory of 1288	1316	window.exe	85
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1288 wrote to memory of 2240	1288	cmd.exe	88
PID 1288 wrote to memory of 2240	1288	cmd.exe	88
PID 1288 wrote to memory of 2240	1288	cmd.exe	88
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1316 wrote to memory of 1784	1316	window.exe	87
PID 1316 wrote to memory of 2652	1316	window.exe	89
PID 1316 wrote to memory of 2652	1316	window.exe	89
PID 1316 wrote to memory of 2652	1316	window.exe	89
PID 2652 wrote to memory of 3860	2652	cmd.exe	91
PID 2652 wrote to memory of 3860	2652	cmd.exe	91
PID 2652 wrote to memory of 3860	2652	cmd.exe	91
PID 1316 wrote to memory of 2220	1316	window.exe	92
PID 1316 wrote to memory of 2220	1316	window.exe	92
PID 1316 wrote to memory of 2220	1316	window.exe	92
PID 2220 wrote to memory of 1940	2220	cmd.exe	94
PID 2220 wrote to memory of 1940	2220	cmd.exe	94
PID 2220 wrote to memory of 1940	2220	cmd.exe	94
PID 1316 wrote to memory of 1816	1316	window.exe	95
PID 1316 wrote to memory of 1816	1316	window.exe	95
PID 1316 wrote to memory of 1816	1316	window.exe	95
PID 1816 wrote to memory of 2152	1816	cmd.exe	97
PID 1816 wrote to memory of 2152	1816	cmd.exe	97
PID 1816 wrote to memory of 2152	1816	cmd.exe	97
PID 1316 wrote to memory of 1956	1316	window.exe	98
PID 1316 wrote to memory of 1956	1316	window.exe	98
PID 1316 wrote to memory of 1956	1316	window.exe	98
PID 1956 wrote to memory of 1672	1956	cmd.exe	100
PID 1956 wrote to memory of 1672	1956	cmd.exe	100
PID 1956 wrote to memory of 1672	1956	cmd.exe	100
PID 1316 wrote to memory of 2404	1316	window.exe	101
PID 1316 wrote to memory of 2404	1316	window.exe	101
PID 1316 wrote to memory of 2404	1316	window.exe	101
PID 2404 wrote to memory of 812	2404	cmd.exe	103
PID 2404 wrote to memory of 812	2404	cmd.exe	103
PID 2404 wrote to memory of 812	2404	cmd.exe	103
PID 1316 wrote to memory of 2408	1316	window.exe	104
PID 1316 wrote to memory of 2408	1316	window.exe	104
PID 1316 wrote to memory of 2408	1316	window.exe	104
PID 2408 wrote to memory of 3304	2408	cmd.exe	106
PID 2408 wrote to memory of 3304	2408	cmd.exe	106
PID 2408 wrote to memory of 3304	2408	cmd.exe	106
PID 1316 wrote to memory of 1128	1316	window.exe	107
PID 1316 wrote to memory of 1128	1316	window.exe	107
PID 1316 wrote to memory of 1128	1316	window.exe	107
PID 1128 wrote to memory of 3008	1128	cmd.exe	109
PID 1128 wrote to memory of 3008	1128	cmd.exe	109
PID 1128 wrote to memory of 3008	1128	cmd.exe	109
PID 1316 wrote to memory of 3016	1316	window.exe	110
PID 1316 wrote to memory of 3016	1316	window.exe	110
PID 1316 wrote to memory of 3016	1316	window.exe	110
PID 3016 wrote to memory of 3524	3016	cmd.exe	112
PID 3016 wrote to memory of 3524	3016	cmd.exe	112
PID 3016 wrote to memory of 3524	3016	cmd.exe	112
PID 1316 wrote to memory of 2028	1316	window.exe	113
PID 1316 wrote to memory of 2028	1316	window.exe	113
PID 1316 wrote to memory of 2028	1316	window.exe	113
PID 2028 wrote to memory of 2176	2028	cmd.exe	115
PID 2028 wrote to memory of 2176	2028	cmd.exe	115
PID 2028 wrote to memory of 2176	2028	cmd.exe	115
PID 1316 wrote to memory of 4084	1316	window.exe	116
PID 1316 wrote to memory of 4084	1316	window.exe	116
PID 1316 wrote to memory of 4084	1316	window.exe	116
PID 4084 wrote to memory of 3068	4084	cmd.exe	118
PID 4084 wrote to memory of 3068	4084	cmd.exe	118
PID 4084 wrote to memory of 3068	4084	cmd.exe	118
PID 1316 wrote to memory of 3972	1316	window.exe	119
PID 1316 wrote to memory of 3972	1316	window.exe	119
PID 1316 wrote to memory of 3972	1316	window.exe	119
PID 3972 wrote to memory of 4088	3972	cmd.exe	121
PID 3972 wrote to memory of 4088	3972	cmd.exe	121
PID 3972 wrote to memory of 4088	3972	cmd.exe	121
PID 1316 wrote to memory of 2692	1316	window.exe	122
PID 1316 wrote to memory of 2692	1316	window.exe	122
PID 1316 wrote to memory of 2692	1316	window.exe	122
PID 2692 wrote to memory of 2488	2692	cmd.exe	124
PID 2692 wrote to memory of 2488	2692	cmd.exe	124
PID 2692 wrote to memory of 2488	2692	cmd.exe	124
PID 1316 wrote to memory of 1384	1316	window.exe	125
PID 1316 wrote to memory of 1384	1316	window.exe	125
PID 1316 wrote to memory of 1384	1316	window.exe	125
PID 1384 wrote to memory of 1856	1384	cmd.exe	127
PID 1384 wrote to memory of 1856	1384	cmd.exe	127
PID 1384 wrote to memory of 1856	1384	cmd.exe	127
PID 1316 wrote to memory of 1240	1316	window.exe	128
PID 1316 wrote to memory of 1240	1316	window.exe	128
PID 1316 wrote to memory of 1240	1316	window.exe	128
PID 1240 wrote to memory of 512	1240	cmd.exe	130
PID 1240 wrote to memory of 512	1240	cmd.exe	130
PID 1240 wrote to memory of 512	1240	cmd.exe	130
PID 1316 wrote to memory of 3164	1316	window.exe	131
PID 1316 wrote to memory of 3164	1316	window.exe	131
PID 1316 wrote to memory of 3164	1316	window.exe	131
PID 3164 wrote to memory of 1516	3164	cmd.exe	133
PID 3164 wrote to memory of 1516	3164	cmd.exe	133
PID 3164 wrote to memory of 1516	3164	cmd.exe	133
PID 1316 wrote to memory of 3460	1316	window.exe	134
PID 1316 wrote to memory of 3460	1316	window.exe	134
PID 1316 wrote to memory of 3460	1316	window.exe	134
PID 3460 wrote to memory of 3932	3460	cmd.exe	136
PID 3460 wrote to memory of 3932	3460	cmd.exe	136
PID 3460 wrote to memory of 3932	3460	cmd.exe	136
PID 1316 wrote to memory of 2936	1316	window.exe	137
PID 1316 wrote to memory of 2936	1316	window.exe	137
PID 1316 wrote to memory of 2936	1316	window.exe	137
PID 2936 wrote to memory of 1276	2936	cmd.exe	139
PID 2936 wrote to memory of 1276	2936	cmd.exe	139
PID 2936 wrote to memory of 1276	2936	cmd.exe	139
PID 1316 wrote to memory of 1832	1316	window.exe	140
PID 1316 wrote to memory of 1832	1316	window.exe	140
PID 1316 wrote to memory of 1832	1316	window.exe	140
PID 1832 wrote to memory of 3708	1832	cmd.exe	142
PID 1832 wrote to memory of 3708	1832	cmd.exe	142
PID 1832 wrote to memory of 3708	1832	cmd.exe	142
PID 1316 wrote to memory of 3976	1316	window.exe	143
PID 1316 wrote to memory of 3976	1316	window.exe	143
PID 1316 wrote to memory of 3976	1316	window.exe	143
PID 3976 wrote to memory of 2492	3976	cmd.exe	145
PID 3976 wrote to memory of 2492	3976	cmd.exe	145
PID 3976 wrote to memory of 2492	3976	cmd.exe	145
PID 1316 wrote to memory of 3448	1316	window.exe	146
PID 1316 wrote to memory of 3448	1316	window.exe	146
PID 1316 wrote to memory of 3448	1316	window.exe	146
PID 3448 wrote to memory of 756	3448	cmd.exe	148
PID 3448 wrote to memory of 756	3448	cmd.exe	148
PID 3448 wrote to memory of 756	3448	cmd.exe	148
PID 1316 wrote to memory of 192	1316	window.exe	149
PID 1316 wrote to memory of 192	1316	window.exe	149
PID 1316 wrote to memory of 192	1316	window.exe	149
PID 192 wrote to memory of 392	192	cmd.exe	151
PID 192 wrote to memory of 392	192	cmd.exe	151
PID 192 wrote to memory of 392	192	cmd.exe	151
PID 1316 wrote to memory of 3572	1316	window.exe	152
PID 1316 wrote to memory of 3572	1316	window.exe	152
PID 1316 wrote to memory of 3572	1316	window.exe	152
PID 3572 wrote to memory of 2844	3572	cmd.exe	154
PID 3572 wrote to memory of 2844	3572	cmd.exe	154
PID 3572 wrote to memory of 2844	3572	cmd.exe	154
PID 1316 wrote to memory of 3920	1316	window.exe	155
PID 1316 wrote to memory of 3920	1316	window.exe	155
PID 1316 wrote to memory of 3920	1316	window.exe	155
PID 3920 wrote to memory of 2400	3920	cmd.exe	157
PID 3920 wrote to memory of 2400	3920	cmd.exe	157
PID 3920 wrote to memory of 2400	3920	cmd.exe	157
PID 1316 wrote to memory of 868	1316	window.exe	158
PID 1316 wrote to memory of 868	1316	window.exe	158
PID 1316 wrote to memory of 868	1316	window.exe	158
PID 868 wrote to memory of 1852	868	cmd.exe	160
PID 868 wrote to memory of 1852	868	cmd.exe	160
PID 868 wrote to memory of 1852	868	cmd.exe	160
PID 1316 wrote to memory of 1776	1316	window.exe	161
PID 1316 wrote to memory of 1776	1316	window.exe	161
PID 1316 wrote to memory of 1776	1316	window.exe	161
PID 1776 wrote to memory of 3180	1776	cmd.exe	163
PID 1776 wrote to memory of 3180	1776	cmd.exe	163
PID 1776 wrote to memory of 3180	1776	cmd.exe	163
PID 1316 wrote to memory of 1580	1316	window.exe	164
PID 1316 wrote to memory of 1580	1316	window.exe	164
PID 1316 wrote to memory of 1580	1316	window.exe	164
PID 1580 wrote to memory of 2592	1580	cmd.exe	166
PID 1580 wrote to memory of 2592	1580	cmd.exe	166
PID 1580 wrote to memory of 2592	1580	cmd.exe	166
PID 1316 wrote to memory of 416	1316	window.exe	167
PID 1316 wrote to memory of 416	1316	window.exe	167
PID 1316 wrote to memory of 416	1316	window.exe	167
PID 416 wrote to memory of 3752	416	cmd.exe	169
PID 416 wrote to memory of 3752	416	cmd.exe	169
PID 416 wrote to memory of 3752	416	cmd.exe	169
PID 1316 wrote to memory of 648	1316	window.exe	170
PID 1316 wrote to memory of 648	1316	window.exe	170
PID 1316 wrote to memory of 648	1316	window.exe	170
PID 648 wrote to memory of 1880	648	cmd.exe	172
PID 648 wrote to memory of 1880	648	cmd.exe	172
PID 648 wrote to memory of 1880	648	cmd.exe	172
PID 1316 wrote to memory of 3980	1316	window.exe	173
PID 1316 wrote to memory of 3980	1316	window.exe	173
PID 1316 wrote to memory of 3980	1316	window.exe	173
PID 3980 wrote to memory of 1664	3980	cmd.exe	175
PID 3980 wrote to memory of 1664	3980	cmd.exe	175
PID 3980 wrote to memory of 1664	3980	cmd.exe	175
PID 1316 wrote to memory of 3856	1316	window.exe	176
PID 1316 wrote to memory of 3856	1316	window.exe	176
PID 1316 wrote to memory of 3856	1316	window.exe	176
PID 3856 wrote to memory of 2184	3856	cmd.exe	178
PID 3856 wrote to memory of 2184	3856	cmd.exe	178
PID 3856 wrote to memory of 2184	3856	cmd.exe	178
PID 1316 wrote to memory of 4048	1316	window.exe	179
PID 1316 wrote to memory of 4048	1316	window.exe	179
PID 1316 wrote to memory of 4048	1316	window.exe	179
PID 4048 wrote to memory of 1192	4048	cmd.exe	181
PID 4048 wrote to memory of 1192	4048	cmd.exe	181
PID 4048 wrote to memory of 1192	4048	cmd.exe	181
PID 1316 wrote to memory of 4044	1316	window.exe	182
PID 1316 wrote to memory of 4044	1316	window.exe	182
PID 1316 wrote to memory of 4044	1316	window.exe	182
PID 4044 wrote to memory of 2244	4044	cmd.exe	184
PID 4044 wrote to memory of 2244	4044	cmd.exe	184
PID 4044 wrote to memory of 2244	4044	cmd.exe	184
PID 1316 wrote to memory of 3936	1316	window.exe	185
PID 1316 wrote to memory of 3936	1316	window.exe	185
PID 1316 wrote to memory of 3936	1316	window.exe	185
PID 3936 wrote to memory of 2232	3936	cmd.exe	187
PID 3936 wrote to memory of 2232	3936	cmd.exe	187
PID 3936 wrote to memory of 2232	3936	cmd.exe	187
PID 1316 wrote to memory of 1576	1316	window.exe	188
PID 1316 wrote to memory of 1576	1316	window.exe	188
PID 1316 wrote to memory of 1576	1316	window.exe	188
PID 1576 wrote to memory of 2688	1576	cmd.exe	190
PID 1576 wrote to memory of 2688	1576	cmd.exe	190
PID 1576 wrote to memory of 2688	1576	cmd.exe	190
PID 1316 wrote to memory of 4068	1316	window.exe	191
PID 1316 wrote to memory of 4068	1316	window.exe	191
PID 1316 wrote to memory of 4068	1316	window.exe	191
PID 4068 wrote to memory of 2020	4068	cmd.exe	193
PID 4068 wrote to memory of 2020	4068	cmd.exe	193
PID 4068 wrote to memory of 2020	4068	cmd.exe	193
PID 1316 wrote to memory of 4012	1316	window.exe	194
PID 1316 wrote to memory of 4012	1316	window.exe	194
PID 1316 wrote to memory of 4012	1316	window.exe	194
PID 4012 wrote to memory of 3996	4012	cmd.exe	196
PID 4012 wrote to memory of 3996	4012	cmd.exe	196
PID 4012 wrote to memory of 3996	4012	cmd.exe	196
PID 1316 wrote to memory of 2932	1316	window.exe	197
PID 1316 wrote to memory of 2932	1316	window.exe	197
PID 1316 wrote to memory of 2932	1316	window.exe	197
PID 2932 wrote to memory of 2180	2932	cmd.exe	199
PID 2932 wrote to memory of 2180	2932	cmd.exe	199
PID 2932 wrote to memory of 2180	2932	cmd.exe	199
PID 1316 wrote to memory of 3508	1316	window.exe	200
PID 1316 wrote to memory of 3508	1316	window.exe	200
PID 1316 wrote to memory of 3508	1316	window.exe	200
PID 3508 wrote to memory of 1404	3508	cmd.exe	202
PID 3508 wrote to memory of 1404	3508	cmd.exe	202
PID 3508 wrote to memory of 1404	3508	cmd.exe	202
PID 1316 wrote to memory of 2772	1316	window.exe	203
PID 1316 wrote to memory of 2772	1316	window.exe	203
PID 1316 wrote to memory of 2772	1316	window.exe	203
PID 2772 wrote to memory of 3264	2772	cmd.exe	205
PID 2772 wrote to memory of 3264	2772	cmd.exe	205
PID 2772 wrote to memory of 3264	2772	cmd.exe	205
PID 1316 wrote to memory of 2964	1316	window.exe	206
PID 1316 wrote to memory of 2964	1316	window.exe	206
PID 1316 wrote to memory of 2964	1316	window.exe	206
PID 2964 wrote to memory of 1424	2964	cmd.exe	208
PID 2964 wrote to memory of 1424	2964	cmd.exe	208
PID 2964 wrote to memory of 1424	2964	cmd.exe	208
PID 1316 wrote to memory of 2564	1316	window.exe	209
PID 1316 wrote to memory of 2564	1316	window.exe	209
PID 1316 wrote to memory of 2564	1316	window.exe	209
PID 2564 wrote to memory of 1760	2564	cmd.exe	211
PID 2564 wrote to memory of 1760	2564	cmd.exe	211
PID 2564 wrote to memory of 1760	2564	cmd.exe	211
PID 1316 wrote to memory of 1448	1316	window.exe	212
PID 1316 wrote to memory of 1448	1316	window.exe	212
PID 1316 wrote to memory of 1448	1316	window.exe	212
PID 1448 wrote to memory of 2712	1448	cmd.exe	214
PID 1448 wrote to memory of 2712	1448	cmd.exe	214
PID 1448 wrote to memory of 2712	1448	cmd.exe	214
PID 1316 wrote to memory of 2944	1316	window.exe	215
PID 1316 wrote to memory of 2944	1316	window.exe	215
PID 1316 wrote to memory of 2944	1316	window.exe	215
PID 2944 wrote to memory of 3140	2944	cmd.exe	217
PID 2944 wrote to memory of 3140	2944	cmd.exe	217
PID 2944 wrote to memory of 3140	2944	cmd.exe	217
PID 1316 wrote to memory of 2156	1316	window.exe	218
PID 1316 wrote to memory of 2156	1316	window.exe	218
PID 1316 wrote to memory of 2156	1316	window.exe	218
PID 2156 wrote to memory of 2960	2156	cmd.exe	220
PID 2156 wrote to memory of 2960	2156	cmd.exe	220
PID 2156 wrote to memory of 2960	2156	cmd.exe	220
PID 1316 wrote to memory of 3144	1316	window.exe	221
PID 1316 wrote to memory of 3144	1316	window.exe	221
PID 1316 wrote to memory of 3144	1316	window.exe	221
PID 3144 wrote to memory of 1272	3144	cmd.exe	223
PID 3144 wrote to memory of 1272	3144	cmd.exe	223
PID 3144 wrote to memory of 1272	3144	cmd.exe	223
PID 1316 wrote to memory of 984	1316	window.exe	224
PID 1316 wrote to memory of 984	1316	window.exe	224
PID 1316 wrote to memory of 984	1316	window.exe	224
PID 984 wrote to memory of 3472	984	cmd.exe	226
PID 984 wrote to memory of 3472	984	cmd.exe	226
PID 984 wrote to memory of 3472	984	cmd.exe	226
PID 1316 wrote to memory of 2412	1316	window.exe	227
PID 1316 wrote to memory of 2412	1316	window.exe	227
PID 1316 wrote to memory of 2412	1316	window.exe	227
PID 2412 wrote to memory of 3476	2412	cmd.exe	229
PID 2412 wrote to memory of 3476	2412	cmd.exe	229
PID 2412 wrote to memory of 3476	2412	cmd.exe	229
PID 1316 wrote to memory of 688	1316	window.exe	230
PID 1316 wrote to memory of 688	1316	window.exe	230
PID 1316 wrote to memory of 688	1316	window.exe	230
PID 688 wrote to memory of 2816	688	cmd.exe	232
PID 688 wrote to memory of 2816	688	cmd.exe	232
PID 688 wrote to memory of 2816	688	cmd.exe	232
PID 1316 wrote to memory of 1528	1316	window.exe	233
PID 1316 wrote to memory of 1528	1316	window.exe	233
PID 1316 wrote to memory of 1528	1316	window.exe	233
PID 1528 wrote to memory of 2128	1528	cmd.exe	235
PID 1528 wrote to memory of 2128	1528	cmd.exe	235
PID 1528 wrote to memory of 2128	1528	cmd.exe	235
PID 1316 wrote to memory of 424	1316	window.exe	236
PID 1316 wrote to memory of 424	1316	window.exe	236
PID 1316 wrote to memory of 424	1316	window.exe	236
PID 424 wrote to memory of 4060	424	cmd.exe	238
PID 424 wrote to memory of 4060	424	cmd.exe	238
PID 424 wrote to memory of 4060	424	cmd.exe	238
PID 1316 wrote to memory of 2908	1316	window.exe	239
PID 1316 wrote to memory of 2908	1316	window.exe	239
PID 1316 wrote to memory of 2908	1316	window.exe	239
PID 2908 wrote to memory of 2868	2908	cmd.exe	241
PID 2908 wrote to memory of 2868	2908	cmd.exe	241
PID 2908 wrote to memory of 2868	2908	cmd.exe	241
PID 1316 wrote to memory of 3724	1316	window.exe	242
PID 1316 wrote to memory of 3724	1316	window.exe	242
PID 1316 wrote to memory of 3724	1316	window.exe	242
PID 3724 wrote to memory of 2508	3724	cmd.exe	244
PID 3724 wrote to memory of 2508	3724	cmd.exe	244
PID 3724 wrote to memory of 2508	3724	cmd.exe	244
PID 1316 wrote to memory of 4112	1316	window.exe	245
PID 1316 wrote to memory of 4112	1316	window.exe	245
PID 1316 wrote to memory of 4112	1316	window.exe	245
PID 4112 wrote to memory of 4156	4112	cmd.exe	247
PID 4112 wrote to memory of 4156	4112	cmd.exe	247
PID 4112 wrote to memory of 4156	4112	cmd.exe	247
PID 1316 wrote to memory of 4180	1316	window.exe	248
PID 1316 wrote to memory of 4180	1316	window.exe	248
PID 1316 wrote to memory of 4180	1316	window.exe	248
PID 4180 wrote to memory of 4224	4180	cmd.exe	250
PID 4180 wrote to memory of 4224	4180	cmd.exe	250
PID 4180 wrote to memory of 4224	4180	cmd.exe	250
PID 1316 wrote to memory of 4248	1316	window.exe	251
PID 1316 wrote to memory of 4248	1316	window.exe	251
PID 1316 wrote to memory of 4248	1316	window.exe	251
PID 4248 wrote to memory of 4292	4248	cmd.exe	253
PID 4248 wrote to memory of 4292	4248	cmd.exe	253
PID 4248 wrote to memory of 4292	4248	cmd.exe	253
PID 1316 wrote to memory of 4316	1316	window.exe	254
PID 1316 wrote to memory of 4316	1316	window.exe	254
PID 1316 wrote to memory of 4316	1316	window.exe	254
PID 4316 wrote to memory of 4360	4316	cmd.exe	256
PID 4316 wrote to memory of 4360	4316	cmd.exe	256
PID 4316 wrote to memory of 4360	4316	cmd.exe	256
PID 1316 wrote to memory of 4388	1316	window.exe	257
PID 1316 wrote to memory of 4388	1316	window.exe	257
PID 1316 wrote to memory of 4388	1316	window.exe	257
PID 4388 wrote to memory of 4432	4388	cmd.exe	259
PID 4388 wrote to memory of 4432	4388	cmd.exe	259
PID 4388 wrote to memory of 4432	4388	cmd.exe	259
PID 1316 wrote to memory of 4456	1316	window.exe	260
PID 1316 wrote to memory of 4456	1316	window.exe	260
PID 1316 wrote to memory of 4456	1316	window.exe	260
PID 4456 wrote to memory of 4500	4456	cmd.exe	262
PID 4456 wrote to memory of 4500	4456	cmd.exe	262
PID 4456 wrote to memory of 4500	4456	cmd.exe	262
PID 1316 wrote to memory of 4524	1316	window.exe	263
PID 1316 wrote to memory of 4524	1316	window.exe	263
PID 1316 wrote to memory of 4524	1316	window.exe	263
PID 4524 wrote to memory of 4568	4524	cmd.exe	265
PID 4524 wrote to memory of 4568	4524	cmd.exe	265
PID 4524 wrote to memory of 4568	4524	cmd.exe	265
PID 1316 wrote to memory of 4592	1316	window.exe	266
PID 1316 wrote to memory of 4592	1316	window.exe	266
PID 1316 wrote to memory of 4592	1316	window.exe	266
PID 4592 wrote to memory of 4636	4592	cmd.exe	268
PID 4592 wrote to memory of 4636	4592	cmd.exe	268
PID 4592 wrote to memory of 4636	4592	cmd.exe	268
PID 1316 wrote to memory of 4660	1316	window.exe	269
PID 1316 wrote to memory of 4660	1316	window.exe	269
PID 1316 wrote to memory of 4660	1316	window.exe	269
PID 4660 wrote to memory of 4704	4660	cmd.exe	271
PID 4660 wrote to memory of 4704	4660	cmd.exe	271
PID 4660 wrote to memory of 4704	4660	cmd.exe	271
PID 1316 wrote to memory of 4728	1316	window.exe	272
PID 1316 wrote to memory of 4728	1316	window.exe	272
PID 1316 wrote to memory of 4728	1316	window.exe	272
PID 4728 wrote to memory of 4772	4728	cmd.exe	274
PID 4728 wrote to memory of 4772	4728	cmd.exe	274
PID 4728 wrote to memory of 4772	4728	cmd.exe	274
PID 1316 wrote to memory of 4796	1316	window.exe	275
PID 1316 wrote to memory of 4796	1316	window.exe	275
PID 1316 wrote to memory of 4796	1316	window.exe	275
PID 4796 wrote to memory of 4840	4796	cmd.exe	277
PID 4796 wrote to memory of 4840	4796	cmd.exe	277
PID 4796 wrote to memory of 4840	4796	cmd.exe	277
PID 1316 wrote to memory of 4864	1316	window.exe	278
PID 1316 wrote to memory of 4864	1316	window.exe	278
PID 1316 wrote to memory of 4864	1316	window.exe	278
PID 4864 wrote to memory of 4908	4864	cmd.exe	280
PID 4864 wrote to memory of 4908	4864	cmd.exe	280
PID 4864 wrote to memory of 4908	4864	cmd.exe	280
PID 1316 wrote to memory of 4932	1316	window.exe	281
PID 1316 wrote to memory of 4932	1316	window.exe	281
PID 1316 wrote to memory of 4932	1316	window.exe	281
PID 4932 wrote to memory of 4976	4932	cmd.exe	283
PID 4932 wrote to memory of 4976	4932	cmd.exe	283
PID 4932 wrote to memory of 4976	4932	cmd.exe	283
PID 1316 wrote to memory of 5000	1316	window.exe	284
PID 1316 wrote to memory of 5000	1316	window.exe	284
PID 1316 wrote to memory of 5000	1316	window.exe	284
PID 5000 wrote to memory of 5044	5000	cmd.exe	286
PID 5000 wrote to memory of 5044	5000	cmd.exe	286
PID 5000 wrote to memory of 5044	5000	cmd.exe	286
PID 1316 wrote to memory of 5068	1316	window.exe	287
PID 1316 wrote to memory of 5068	1316	window.exe	287
PID 1316 wrote to memory of 5068	1316	window.exe	287
PID 5068 wrote to memory of 5112	5068	cmd.exe	289
PID 5068 wrote to memory of 5112	5068	cmd.exe	289
PID 5068 wrote to memory of 5112	5068	cmd.exe	289
PID 1316 wrote to memory of 4028	1316	window.exe	290
PID 1316 wrote to memory of 4028	1316	window.exe	290
PID 1316 wrote to memory of 4028	1316	window.exe	290
PID 4028 wrote to memory of 4168	4028	cmd.exe	292
PID 4028 wrote to memory of 4168	4028	cmd.exe	292
PID 4028 wrote to memory of 4168	4028	cmd.exe	292
PID 1316 wrote to memory of 4136	1316	window.exe	293
PID 1316 wrote to memory of 4136	1316	window.exe	293
PID 1316 wrote to memory of 4136	1316	window.exe	293
PID 4136 wrote to memory of 4236	4136	cmd.exe	295
PID 4136 wrote to memory of 4236	4136	cmd.exe	295
PID 4136 wrote to memory of 4236	4136	cmd.exe	295
PID 1316 wrote to memory of 4216	1316	window.exe	296
PID 1316 wrote to memory of 4216	1316	window.exe	296
PID 1316 wrote to memory of 4216	1316	window.exe	296
PID 4216 wrote to memory of 4280	4216	cmd.exe	298
PID 4216 wrote to memory of 4280	4216	cmd.exe	298
PID 4216 wrote to memory of 4280	4216	cmd.exe	298
PID 1316 wrote to memory of 4324	1316	window.exe	299
PID 1316 wrote to memory of 4324	1316	window.exe	299
PID 1316 wrote to memory of 4324	1316	window.exe	299
PID 4324 wrote to memory of 4352	4324	cmd.exe	301
PID 4324 wrote to memory of 4352	4324	cmd.exe	301
PID 4324 wrote to memory of 4352	4324	cmd.exe	301
PID 1316 wrote to memory of 4448	1316	window.exe	302
PID 1316 wrote to memory of 4448	1316	window.exe	302
PID 1316 wrote to memory of 4448	1316	window.exe	302
PID 4448 wrote to memory of 4464	4448	cmd.exe	304
PID 4448 wrote to memory of 4464	4448	cmd.exe	304
PID 4448 wrote to memory of 4464	4448	cmd.exe	304
PID 1316 wrote to memory of 4484	1316	window.exe	305
PID 1316 wrote to memory of 4484	1316	window.exe	305
PID 1316 wrote to memory of 4484	1316	window.exe	305
PID 4484 wrote to memory of 4584	4484	cmd.exe	307
PID 4484 wrote to memory of 4584	4484	cmd.exe	307
PID 4484 wrote to memory of 4584	4484	cmd.exe	307
PID 1316 wrote to memory of 4528	1316	window.exe	308
PID 1316 wrote to memory of 4528	1316	window.exe	308
PID 1316 wrote to memory of 4528	1316	window.exe	308
PID 4528 wrote to memory of 4620	4528	cmd.exe	310
PID 4528 wrote to memory of 4620	4528	cmd.exe	310
PID 4528 wrote to memory of 4620	4528	cmd.exe	310
PID 1316 wrote to memory of 4612	1316	window.exe	311
PID 1316 wrote to memory of 4612	1316	window.exe	311
PID 1316 wrote to memory of 4612	1316	window.exe	311
PID 4612 wrote to memory of 4664	4612	cmd.exe	313
PID 4612 wrote to memory of 4664	4612	cmd.exe	313
PID 4612 wrote to memory of 4664	4612	cmd.exe	313
PID 1316 wrote to memory of 4744	1316	window.exe	314
PID 1316 wrote to memory of 4744	1316	window.exe	314
PID 1316 wrote to memory of 4744	1316	window.exe	314
PID 4744 wrote to memory of 4748	4744	cmd.exe	316
PID 4744 wrote to memory of 4748	4744	cmd.exe	316
PID 4744 wrote to memory of 4748	4744	cmd.exe	316
PID 1316 wrote to memory of 4852	1316	window.exe	317
PID 1316 wrote to memory of 4852	1316	window.exe	317
PID 1316 wrote to memory of 4852	1316	window.exe	317
PID 4852 wrote to memory of 4880	4852	cmd.exe	319
PID 4852 wrote to memory of 4880	4852	cmd.exe	319
PID 4852 wrote to memory of 4880	4852	cmd.exe	319
PID 1316 wrote to memory of 4896	1316	window.exe	320
PID 1316 wrote to memory of 4896	1316	window.exe	320
PID 1316 wrote to memory of 4896	1316	window.exe	320
PID 4896 wrote to memory of 4980	4896	cmd.exe	322
PID 4896 wrote to memory of 4980	4896	cmd.exe	322
PID 4896 wrote to memory of 4980	4896	cmd.exe	322
PID 1316 wrote to memory of 4968	1316	window.exe	323
PID 1316 wrote to memory of 4968	1316	window.exe	323
PID 1316 wrote to memory of 4968	1316	window.exe	323
PID 4968 wrote to memory of 5032	4968	cmd.exe	325
PID 4968 wrote to memory of 5032	4968	cmd.exe	325
PID 4968 wrote to memory of 5032	4968	cmd.exe	325
PID 1316 wrote to memory of 5076	1316	window.exe	326
PID 1316 wrote to memory of 5076	1316	window.exe	326
PID 1316 wrote to memory of 5076	1316	window.exe	326
PID 5076 wrote to memory of 5104	5076	cmd.exe	328
PID 5076 wrote to memory of 5104	5076	cmd.exe	328
PID 5076 wrote to memory of 5104	5076	cmd.exe	328
PID 1316 wrote to memory of 4144	1316	window.exe	329
PID 1316 wrote to memory of 4144	1316	window.exe	329
PID 1316 wrote to memory of 4144	1316	window.exe	329
PID 4144 wrote to memory of 4132	4144	cmd.exe	331
PID 4144 wrote to memory of 4132	4144	cmd.exe	331
PID 4144 wrote to memory of 4132	4144	cmd.exe	331
PID 1316 wrote to memory of 4196	1316	window.exe	332
PID 1316 wrote to memory of 4196	1316	window.exe	332
PID 1316 wrote to memory of 4196	1316	window.exe	332
PID 4196 wrote to memory of 4268	4196	cmd.exe	334
PID 4196 wrote to memory of 4268	4196	cmd.exe	334
PID 4196 wrote to memory of 4268	4196	cmd.exe	334
PID 1316 wrote to memory of 4296	1316	window.exe	335
PID 1316 wrote to memory of 4296	1316	window.exe	335
PID 1316 wrote to memory of 4296	1316	window.exe	335
PID 4296 wrote to memory of 4340	4296	cmd.exe	337
PID 4296 wrote to memory of 4340	4296	cmd.exe	337
PID 4296 wrote to memory of 4340	4296	cmd.exe	337
PID 1316 wrote to memory of 4364	1316	window.exe	338
PID 1316 wrote to memory of 4364	1316	window.exe	338
PID 1316 wrote to memory of 4364	1316	window.exe	338
PID 4364 wrote to memory of 4392	4364	cmd.exe	340
PID 4364 wrote to memory of 4392	4364	cmd.exe	340
PID 4364 wrote to memory of 4392	4364	cmd.exe	340
PID 1316 wrote to memory of 4572	1316	window.exe	341
PID 1316 wrote to memory of 4572	1316	window.exe	341
PID 1316 wrote to memory of 4572	1316	window.exe	341
PID 4572 wrote to memory of 4460	4572	cmd.exe	343
PID 4572 wrote to memory of 4460	4572	cmd.exe	343
PID 4572 wrote to memory of 4460	4572	cmd.exe	343
PID 1316 wrote to memory of 4632	1316	window.exe	344
PID 1316 wrote to memory of 4632	1316	window.exe	344
PID 1316 wrote to memory of 4632	1316	window.exe	344
PID 4632 wrote to memory of 4696	4632	cmd.exe	346
PID 4632 wrote to memory of 4696	4632	cmd.exe	346
PID 4632 wrote to memory of 4696	4632	cmd.exe	346
PID 1316 wrote to memory of 4688	1316	window.exe	347
PID 1316 wrote to memory of 4688	1316	window.exe	347
PID 1316 wrote to memory of 4688	1316	window.exe	347
PID 4688 wrote to memory of 4812	4688	cmd.exe	349
PID 4688 wrote to memory of 4812	4688	cmd.exe	349
PID 4688 wrote to memory of 4812	4688	cmd.exe	349
PID 1316 wrote to memory of 4752	1316	window.exe	350
PID 1316 wrote to memory of 4752	1316	window.exe	350
PID 1316 wrote to memory of 4752	1316	window.exe	350
PID 4752 wrote to memory of 4844	4752	cmd.exe	352
PID 4752 wrote to memory of 4844	4752	cmd.exe	352
PID 4752 wrote to memory of 4844	4752	cmd.exe	352
PID 1316 wrote to memory of 1508	1316	window.exe	353
PID 1316 wrote to memory of 1508	1316	window.exe	353
PID 1316 wrote to memory of 1508	1316	window.exe	353
PID 1508 wrote to memory of 920	1508	cmd.exe	355
PID 1508 wrote to memory of 920	1508	cmd.exe	355
PID 1508 wrote to memory of 920	1508	cmd.exe	355
PID 1316 wrote to memory of 3356	1316	window.exe	356
PID 1316 wrote to memory of 3356	1316	window.exe	356
PID 1316 wrote to memory of 3356	1316	window.exe	356
PID 3356 wrote to memory of 4868	3356	cmd.exe	358
PID 3356 wrote to memory of 4868	3356	cmd.exe	358
PID 3356 wrote to memory of 4868	3356	cmd.exe	358
PID 1316 wrote to memory of 4944	1316	window.exe	359
PID 1316 wrote to memory of 4944	1316	window.exe	359
PID 1316 wrote to memory of 4944	1316	window.exe	359
PID 4944 wrote to memory of 5028	4944	cmd.exe	361
PID 4944 wrote to memory of 5028	4944	cmd.exe	361
PID 4944 wrote to memory of 5028	4944	cmd.exe	361
PID 1316 wrote to memory of 3588	1316	window.exe	362
PID 1316 wrote to memory of 3588	1316	window.exe	362
PID 1316 wrote to memory of 3588	1316	window.exe	362
PID 3588 wrote to memory of 4160	3588	cmd.exe	364
PID 3588 wrote to memory of 4160	3588	cmd.exe	364
PID 3588 wrote to memory of 4160	3588	cmd.exe	364
PID 1316 wrote to memory of 2708	1316	window.exe	365
PID 1316 wrote to memory of 2708	1316	window.exe	365
PID 1316 wrote to memory of 2708	1316	window.exe	365
PID 2708 wrote to memory of 4288	2708	cmd.exe	367
PID 2708 wrote to memory of 4288	2708	cmd.exe	367
PID 2708 wrote to memory of 4288	2708	cmd.exe	367
PID 1316 wrote to memory of 4240	1316	window.exe	368
PID 1316 wrote to memory of 4240	1316	window.exe	368
PID 1316 wrote to memory of 4240	1316	window.exe	368
PID 4240 wrote to memory of 4404	4240	cmd.exe	370
PID 4240 wrote to memory of 4404	4240	cmd.exe	370
PID 4240 wrote to memory of 4404	4240	cmd.exe	370

C:\Users\Admin\AppData\Local\Temp\Request.exe
"C:\Users\Admin\AppData\Local\Temp\Request.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\Request.exe" "C:\Users\Admin\AppData\Roaming\window.exe"
  2⤵
  PID:204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\window.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Users\Admin\AppData\Roaming\window.exe
    "C:\Users\Admin\AppData\Roaming\window.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1288
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2240
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3860
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2220
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2152
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:812
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3304
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1128
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3016
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2176
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4084
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3068
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2692
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1384
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1856
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1240
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:512
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3164
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1516
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3460
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2936
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1276
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1832
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3708
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3976
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2492
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3448
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:192
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:392
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3572
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2844
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3920
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:868
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1776
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3180
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1580
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:416
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3752
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:648
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3980
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3856
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4048
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1192
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4044
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2244
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3936
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2232
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1576
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4068
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4012
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2180
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3508
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2772
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3264
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2964
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1424
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2564
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1760
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1448
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2712
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3140
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2156
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3144
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1272
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:984
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3472
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2412
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:3476
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:688
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2816
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1528
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:424
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2908
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3724
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2508
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4112
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4180
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4224
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4248
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4292
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4316
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4360
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4388
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4432
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4456
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4500
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4568
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4660
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4728
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4772
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4796
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4840
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4864
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4908
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4976
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:5000
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:5044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:5068
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4168
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4136
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4236
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4280
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4324
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4352
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4448
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4464
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4484
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4584
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4528
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4620
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4612
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4744
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4852
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4896
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4968
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:5032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:5076
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:5104
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4144
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4132
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4196
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4296
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4340
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4364
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4392
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4572
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4460
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4632
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4696
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4688
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4812
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4752
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4844
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:1508
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3356
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4944
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:5028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:3588
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4160
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:2708
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        
        PID:4288
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
      4⤵
      PID:4240
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\window.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:4404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-27-0x0000000004740000-0x0000000004741000-memory.dmp

Download

memory/1316-25-0x0000000004700000-0x000000000470A000-memory.dmp

Download

memory/1316-15-0x0000000073CA0000-0x000000007438E000-memory.dmp

Download

memory/1784-46-0x0000000005CE0000-0x0000000005CE3000-memory.dmp

Download

memory/1784-33-0x0000000073CA0000-0x000000007438E000-memory.dmp

Download

memory/1784-44-0x0000000005AE0000-0x0000000005AF9000-memory.dmp

Download

memory/1784-41-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/1784-43-0x0000000005AD0000-0x0000000005AD5000-memory.dmp

Download

memory/1784-31-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4020-8-0x0000000008070000-0x0000000008071000-memory.dmp

Download

memory/4020-6-0x00000000014B0000-0x00000000014C7000-memory.dmp

Download

memory/4020-7-0x00000000014D0000-0x00000000014EF000-memory.dmp

Download

memory/4020-2-0x0000000073CA0000-0x000000007438E000-memory.dmp

Download

memory/4020-9-0x0000000007C60000-0x0000000007C61000-memory.dmp

Download

memory/4020-3-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/4020-5-0x00000000053D0000-0x00000000053D1000-memory.dmp

Download