Modifies WinLogon for persistence

UAC bypass

Windows security bypass

Renames multiple (58) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Event Triggered Execution: Image File Execution Options Injection