c318ad5f935df51e6db4e83610c25c473e5c5e0ccc2bdd914d54522cc6f0dd2d

Analysis

max time kernel
32s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Seven.exe
Size

139KB
MD5

6503f847c3281ff85b304fc674b62580
SHA1

947536e0741c085f37557b7328b067ef97cb1a61
SHA256

afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512

abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP

3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Seven.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
evasion

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Seven.exeSevenCopy.exeSevenCopy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	Seven.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	SevenCopy.exe

Deletes itself 1 IoCs

Processes:

SevenCopy.exe

pid process

3704 SevenCopy.exe
Executes dropped EXE 2 IoCs

Processes:

SevenCopy.exeSevenCopy.exe

pid process

3704 SevenCopy.exe
10260 SevenCopy.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe

pid	process
3704	SevenCopy.exe

pid	process
3704	SevenCopy.exe
10260	SevenCopy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Seven.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

Processes:

SevenCopy.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Music\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SevenCopy.exe

Drops file in System32 directory 9 IoCs

Processes:

cmd.execmd.exeattrib.execmd.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Windows\System32\SevenCopy.exe	cmd.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	cmd.exe
File created	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	attrib.exe
File created	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	attrib.exe
File opened for modification	C:\Windows\System32\Seven.dll	attrib.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

896 powershell.exe
896 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 896 powershell.exe

pid	process
896	powershell.exe
896	powershell.exe

description	pid	process
Token: SeDebugPrivilege	896	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Seven.execmd.execmd.execmd.exeSevenCopy.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2972 wrote to memory of 896	2972	Seven.exe	powershell.exe
PID 2972 wrote to memory of 896	2972	Seven.exe	powershell.exe
PID 2972 wrote to memory of 1256	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 1256	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 1884	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 1884	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 5040	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 5040	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 2688	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 2688	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 2964	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 2964	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 2700	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 2700	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 4740	2972	Seven.exe	cmd.exe
PID 2972 wrote to memory of 4740	2972	Seven.exe	cmd.exe
PID 4740 wrote to memory of 2052	4740	cmd.exe	attrib.exe
PID 4740 wrote to memory of 2052	4740	cmd.exe	attrib.exe
PID 5040 wrote to memory of 4892	5040	cmd.exe	attrib.exe
PID 5040 wrote to memory of 4892	5040	cmd.exe	attrib.exe
PID 2700 wrote to memory of 5104	2700	cmd.exe	attrib.exe
PID 2700 wrote to memory of 5104	2700	cmd.exe	attrib.exe
PID 2972 wrote to memory of 3704	2972	Seven.exe	SevenCopy.exe
PID 2972 wrote to memory of 3704	2972	Seven.exe	SevenCopy.exe
PID 3704 wrote to memory of 4520	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 4520	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3344	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3344	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3396	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3396	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 1160	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 1160	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 4936	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 4936	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2016	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2016	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 5036	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 5036	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2012	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2012	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2796	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2796	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 4168	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 4168	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2172	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2172	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3900	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3900	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3024	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 3024	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2944	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2944	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2516	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 2516	3704	SevenCopy.exe	cmd.exe
PID 4520 wrote to memory of 2844	4520	cmd.exe	choice.exe
PID 4520 wrote to memory of 2844	4520	cmd.exe	choice.exe
PID 3704 wrote to memory of 1120	3704	SevenCopy.exe	cmd.exe
PID 3704 wrote to memory of 1120	3704	SevenCopy.exe	cmd.exe
PID 3344 wrote to memory of 2900	3344	cmd.exe	choice.exe
PID 3344 wrote to memory of 2900	3344	cmd.exe	choice.exe
PID 4936 wrote to memory of 2220	4936	cmd.exe	choice.exe
PID 4936 wrote to memory of 2220	4936	cmd.exe	choice.exe
PID 3024 wrote to memory of 4460	3024	cmd.exe	choice.exe
PID 3024 wrote to memory of 4460	3024	cmd.exe	choice.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

5104 attrib.exe
4892 attrib.exe
2052 attrib.exe

pid	process
5104	attrib.exe
4892	attrib.exe
2052	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
2⤵
PID:1256

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe
2⤵
- Drops file in System32 directory
PID:1884

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\SevenCopy.exe
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:4892

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
2⤵
- Drops file in System32 directory
PID:2688

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Drops file in System32 directory
PID:2964

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.dll
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:5104

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.runtimeconfig.json
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:2052

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
3⤵
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2900

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
3⤵
PID:3396

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
3⤵
PID:1160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
3⤵
PID:2016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
3⤵
PID:5036

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3680

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
3⤵
PID:2012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:2796

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4944

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:4168

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7084

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:2172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5316

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:3900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4460

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:2944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:2516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:1120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\InvokePush.png"
3⤵
PID:1112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
3⤵
PID:2464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14216

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ResolveClear.csv"
3⤵
PID:4384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\StartCopy.txt"
3⤵
PID:2216

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
3⤵
PID:4456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14224

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CloseSelect.docx"
3⤵
PID:3148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14756

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\DisableRepair.csv"
3⤵
PID:4316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
3⤵
PID:4364

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15016

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\GetSearch.xlsx"
3⤵
PID:3092

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\NewUnlock.xlsx"
3⤵
PID:2772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14004

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
3⤵
PID:4472

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\OutConfirm.docx"
3⤵
PID:1660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
3⤵
PID:5104

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14800

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
3⤵
PID:5000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnblockDisconnect.xls"
3⤵
PID:608

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14208

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ProtectRedo.xml"
3⤵
PID:3992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ResumeUnprotect.lnk"
3⤵
PID:2112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UnregisterConvert.docx"
3⤵
PID:1256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14776

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\WritePing.docx"
3⤵
PID:5100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\WriteRequest.pptx"
3⤵
PID:860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15272

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
3⤵
PID:220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14860

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
3⤵
PID:3028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RemoveMeasure.html"
3⤵
PID:4284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\DismountRedo.jpg"
3⤵
PID:1900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
3⤵
PID:628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RemoveUninstall.bmp"
3⤵
PID:5008

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14784

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RevokeSync.png"
3⤵
PID:4720

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15108

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SendInitialize.jpg"
3⤵
PID:4500

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14876

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\StartRemove.png"
3⤵
PID:3172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14792

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BackupCopy.odt"
3⤵
PID:376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ExitStart.pptx"
3⤵
PID:5132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15008

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\LimitOpen.png"
3⤵
PID:5152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResetUpdate.docx"
3⤵
PID:5164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14840

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnblockGrant.asp"
3⤵
PID:5188

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5328

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WatchRepair.csv"
3⤵
PID:5208

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1300

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510859.txt"
3⤵
PID:5220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
3⤵
PID:5236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14924

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2573.txt"
3⤵
PID:5256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2588

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2594.txt"
3⤵
PID:5452

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2573.txt"
3⤵
PID:5480

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2594.txt"
3⤵
PID:5504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
3⤵
PID:5516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4576

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
3⤵
PID:5528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070937929.html"
3⤵
PID:5540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4992

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
3⤵
PID:5556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
3⤵
PID:5572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
3⤵
PID:5588

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
3⤵
PID:5600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
3⤵
PID:5612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
3⤵
PID:5632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
3⤵
PID:5652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
3⤵
PID:5676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
3⤵
PID:5692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
3⤵
PID:5720

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15388

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
3⤵
PID:5740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
3⤵
PID:5756

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5272

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
3⤵
PID:5784

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
3⤵
PID:5800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
3⤵
PID:5820

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2984

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
3⤵
PID:5840

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15756

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
3⤵
PID:5856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15140

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
3⤵
PID:5872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
3⤵
PID:5896

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
3⤵
PID:5912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:796

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
3⤵
PID:5940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
3⤵
PID:5960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15296

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
3⤵
PID:5980

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4216

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
3⤵
PID:5992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3020

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
3⤵
PID:6004

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16032

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
3⤵
PID:6016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15172

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
3⤵
PID:6032

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
3⤵
PID:6052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
3⤵
PID:6076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
3⤵
PID:6100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
3⤵
PID:6112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
3⤵
PID:6124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12704

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
3⤵
PID:6136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2800

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
3⤵
PID:3372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15520

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
3⤵
PID:3804

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1908

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
3⤵
PID:2160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15836

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
3⤵
PID:5128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
3⤵
PID:5184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1876

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
3⤵
PID:5232

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
3⤵
PID:5644

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
3⤵
PID:6148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16056

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
3⤵
PID:6164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
3⤵
PID:6176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
3⤵
PID:6200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
3⤵
PID:6228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15724

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
3⤵
PID:6248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
3⤵
PID:6268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
3⤵
PID:6284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
3⤵
PID:6316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
3⤵
PID:6336

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
3⤵
PID:6360

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15056

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
3⤵
PID:6372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
3⤵
PID:6388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
3⤵
PID:6420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2084

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
3⤵
PID:6440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14968

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
3⤵
PID:6468

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
3⤵
PID:6484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
3⤵
PID:6500

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
3⤵
PID:6512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1680

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
3⤵
PID:6532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15716

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
3⤵
PID:6544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
3⤵
PID:6560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
3⤵
PID:6572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16004

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
3⤵
PID:6592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15884

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
3⤵
PID:6604

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3344

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
3⤵
PID:6616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
3⤵
PID:6636

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
3⤵
PID:6660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
3⤵
PID:6676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15660

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
3⤵
PID:6692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16360

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
3⤵
PID:6712

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2448

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
3⤵
PID:6732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8648

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
3⤵
PID:6744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11308

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
3⤵
PID:6756

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
3⤵
PID:6768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14248

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
3⤵
PID:6780

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14240

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
3⤵
PID:6800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
3⤵
PID:6820

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
3⤵
PID:6832

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11248

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
3⤵
PID:6852

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
3⤵
PID:6864

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
3⤵
PID:6876

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
3⤵
PID:6892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
3⤵
PID:6916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14960

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
3⤵
PID:6940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15164

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
3⤵
PID:6960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15788

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
3⤵
PID:6976

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
3⤵
PID:6988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
3⤵
PID:7000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9720

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
3⤵
PID:7012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
3⤵
PID:7028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14464

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
3⤵
PID:7044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
3⤵
PID:7064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836920720375.txt"
3⤵
PID:7076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14456

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837673235315.txt"
3⤵
PID:7088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16112

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838035795288.txt"
3⤵
PID:7100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838223107009.txt"
3⤵
PID:7112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838301576473.txt"
3⤵
PID:7124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15148

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838338840824.txt"
3⤵
PID:7136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838521861617.txt"
3⤵
PID:7148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838595500613.txt"
3⤵
PID:7164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838635878820.txt"
3⤵
PID:5464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840260629574.txt"
3⤵
PID:5536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840892874528.txt"
3⤵
PID:840

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8908

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844391404585.txt"
3⤵
PID:7180

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844691426618.txt"
3⤵
PID:7200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844995168251.txt"
3⤵
PID:7220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845411700161.txt"
3⤵
PID:7244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2664

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845809349073.txt"
3⤵
PID:7792

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846010706410.txt"
3⤵
PID:7804

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847286016159.txt"
3⤵
PID:7816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847585307268.txt"
3⤵
PID:7836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15860

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847885345947.txt"
3⤵
PID:7848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15796

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848185514733.txt"
3⤵
PID:7860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848943443912.txt"
3⤵
PID:7872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579864486974019.txt"
3⤵
PID:7884

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
3⤵
PID:7896

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
3⤵
PID:7908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:7920

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\a9whdnbl.default-release\pkcs11.txt"
3⤵
PID:7932

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6WJSJ70T\known_providers_download_v1[1].xml"
3⤵
PID:7944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHECI205\update100[1].xml"
3⤵
PID:7956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16104

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
3⤵
PID:7984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16864

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
3⤵
PID:7996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16436

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
3⤵
PID:8008

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
3⤵
PID:8028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
3⤵
PID:8056

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16800

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
3⤵
PID:8068

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
3⤵
PID:8096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
3⤵
PID:8124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15184

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4faffe29-6c64-4865-b2b6-53e28d7b5b9e}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4faffe29-6c64-4865-b2b6-53e28d7b5b9e}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4faffe29-6c64-4865-b2b6-53e28d7b5b9e}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15812

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{50955674-1487-4cd6-bef1-60084ee7c8a3}\0.0.filtertrie.intermediate.txt"
3⤵
PID:5716

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{50955674-1487-4cd6-bef1-60084ee7c8a3}\0.1.filtertrie.intermediate.txt"
3⤵
PID:5816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16784

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{50955674-1487-4cd6-bef1-60084ee7c8a3}\0.2.filtertrie.intermediate.txt"
3⤵
PID:5924

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15684

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{64307d17-ad17-4a20-816f-fbadedd1058d}\0.0.filtertrie.intermediate.txt"
3⤵
PID:5972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{64307d17-ad17-4a20-816f-fbadedd1058d}\0.1.filtertrie.intermediate.txt"
3⤵
PID:6064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15828

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{64307d17-ad17-4a20-816f-fbadedd1058d}\0.2.filtertrie.intermediate.txt"
3⤵
PID:4612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\appsconversions.txt"
3⤵
PID:6508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\appsglobals.txt"
3⤵
PID:6048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\appssynonyms.txt"
3⤵
PID:6120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\settingsconversions.txt"
3⤵
PID:6328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\settingsglobals.txt"
3⤵
PID:6540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\settingssynonyms.txt"
3⤵
PID:6632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b0d77648-6980-423f-9d4d-7c0fe74ff606}\0.0.filtertrie.intermediate.txt"
3⤵
PID:6888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b0d77648-6980-423f-9d4d-7c0fe74ff606}\0.1.filtertrie.intermediate.txt"
3⤵
PID:7176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b0d77648-6980-423f-9d4d-7c0fe74ff606}\0.2.filtertrie.intermediate.txt"
3⤵
PID:6764

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.0.filtertrie.intermediate.txt"
3⤵
PID:7040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15432

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.1.filtertrie.intermediate.txt"
3⤵
PID:7108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.2.filtertrie.intermediate.txt"
3⤵
PID:7328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
3⤵
PID:6588

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15400

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
3⤵
PID:8196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15288

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
3⤵
PID:8220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
3⤵
PID:8236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
3⤵
PID:8256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
3⤵
PID:8268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
3⤵
PID:8280

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
3⤵
PID:8292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15552

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
3⤵
PID:8304

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
3⤵
PID:8316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
3⤵
PID:8332

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15528

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
3⤵
PID:8344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
3⤵
PID:8360

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
3⤵
PID:8372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15568

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
3⤵
PID:8400

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
3⤵
PID:8424

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
3⤵
PID:8440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
3⤵
PID:8460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2P3G45R4\microsoft.windows[1].xml"
3⤵
PID:8488

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16048

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LR6RU4I1\www.bing[1].xml"
3⤵
PID:8516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
3⤵
PID:8532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16984

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
3⤵
PID:8548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
3⤵
PID:8568

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
3⤵
PID:8588

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
3⤵
PID:8616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
3⤵
PID:8636

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
3⤵
PID:8652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
3⤵
PID:8672

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
3⤵
PID:8700

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
3⤵
PID:8712

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16388

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
3⤵
PID:8728

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
3⤵
PID:8744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
3⤵
PID:8760

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15480

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
3⤵
PID:8780

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16040

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
3⤵
PID:8792

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
3⤵
PID:8804

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16224

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
3⤵
PID:8816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16824

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
3⤵
PID:8832

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
3⤵
PID:8848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
3⤵
PID:8860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
3⤵
PID:8872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
3⤵
PID:8888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16792

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
3⤵
PID:8900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
3⤵
PID:8912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16976

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
3⤵
PID:8924

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16428

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
3⤵
PID:8940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
3⤵
PID:8956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
3⤵
PID:8968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16608

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
3⤵
PID:8984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
3⤵
PID:9000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3296

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
3⤵
PID:9012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
3⤵
PID:9024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1720

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
3⤵
PID:9040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15464

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
3⤵
PID:9052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
3⤵
PID:9064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
3⤵
PID:9076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16756

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
3⤵
PID:9092

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
3⤵
PID:9112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16840

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
3⤵
PID:9124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:640

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
3⤵
PID:9136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
3⤵
PID:9148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16600

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
3⤵
PID:9172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
3⤵
PID:9184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
3⤵
PID:9200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16260

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
3⤵
PID:6912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
3⤵
PID:9220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
3⤵
PID:9236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
3⤵
PID:9252

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
3⤵
PID:9268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
3⤵
PID:9284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15576

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:10260

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
4⤵
PID:17372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
4⤵
PID:17396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
4⤵
PID:16216

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
4⤵
PID:17412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
4⤵
PID:17428

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
4⤵
PID:17660

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
4⤵
PID:17676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19076

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BackupCopy.odt"
4⤵
PID:17696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ExitStart.pptx"
4⤵
PID:18068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\LimitOpen.png"
4⤵
PID:18084

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResetUpdate.docx"
4⤵
PID:18108

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnblockGrant.asp"
4⤵
PID:18124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WatchRepair.csv"
4⤵
PID:18144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510859.txt"
4⤵
PID:18160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
4⤵
PID:18176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2573.txt"
4⤵
PID:18196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2594.txt"
4⤵
PID:18216

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2573.txt"
4⤵
PID:18240

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2594.txt"
4⤵
PID:18256

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
4⤵
PID:18276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
4⤵
PID:18292

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070937929.html"
4⤵
PID:18308

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
4⤵
PID:18324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
4⤵
PID:18340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
4⤵
PID:18360

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
4⤵
PID:18376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
4⤵
PID:18392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:19004

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
4⤵
PID:18408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
4⤵
PID:18424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
4⤵
PID:17392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
4⤵
PID:17752

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
4⤵
PID:17768

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.420
Filesize
16B

MD5
7b2e3163fd3dfe87219ea74b3642af1d

SHA1
8c40865147813e554e8f74345c7811a0fcbe1195

SHA256
d28ca33b4aa50c72e43aefbad0a6f7c630c15ab356adfa9f9e05be5600699c79

SHA512
d1ec2daf1943cf5b31e08d6fb1048a4f754d050fdf58b2c1acd70452c87d3252897317ef47527d36e984fff19ab15a961b75a7225574a180fa4258e980bff6aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.420
Filesize
2KB

MD5
79c6d2f86802a292f41fa3c385f61fae

SHA1
c64a66a9a2f645bcb309ea9d10813f557a05294f

SHA256
5910fcb4482dd12e202860f1fc72fa144aa27b390fa275901092f9214398fe9d

SHA512
cbe4311403e3bdc10e33ca0ff2d8a380346769a01a9cddfce292eb5da3ef506a47570f301868acc7bf4e52b1a483dc984b9f35bdfbaea976f3da388e099bc6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.420
Filesize
6KB

MD5
95097a993217d71bcdeffe63ae875f73

SHA1
888087932af94ad2d2027f7e78a03a998f4318e8

SHA256
a70c90b6c03579b7520a6081cced5c98a6b59e51e8c8ae514f542ce4f245b6e5

SHA512
193411bd96268113ec9020d5c34c19459efe14034590f9c7435b05086585358353fa7779731c1bb43d0ec602e12e1f32501369a8e7ba71edd341b81cb551a105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml.420
Filesize
321KB

MD5
585002fd4d920042c3df96a55b15265e

SHA1
8a3460d110c788735ee5318452be9d66e26cf803

SHA256
012a9ca399cafc89ce6de583f6759e283aaa6ace0ba18b879a70e67c71cd28d1

SHA512
5fdf32a7e064818cc8d3ce3dc3f12c11766630f76d58f93e7b0f44e093175cc2e584d34f05b85ac13747a1db297fe1e4de59333caa8daefd1900abfc43842d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml.420
Filesize
560B

MD5
ce7a2191490b33f6635bf3172acee6d8

SHA1
f02feff3160bca6d14b7169de2cb713c2310630b

SHA256
b9166a5fb3af0a1ca977221e0cd131e4c33a6bfb7e48bdde79822e9d69592784

SHA512
c801dacde4163bdf7ed6c21eb13e5acf2a7ce71b3f6f5a003e58f8580f2651b7adc543a3e680da9183262a1cb87bb796762b8ae86a1c8637cddd1f937f5231ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml.420
Filesize
100KB

MD5
6df18ce09245971e338740f870084394

SHA1
a40043b2edff084d0524361d9854440eec48dede

SHA256
c5da6142ec5f836293652b73c9bf8fd91847c35f16cb5956e188ec6a7b1c0315

SHA512
f345482afaf6130cef932814a0dd957fb0c7ddf88190f634c911c4eb909a9f8032cf834ae898875a5f7a61df7a5669602cf1a426145e6a1902433477d86eeec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.420
Filesize
130KB

MD5
971626d372e843e06a467e87531980b7

SHA1
afc29ec325c6cffe180db538f1ea37f084b5cc07

SHA256
4869597258a3ae224079a5ff5d841113e544af2403c4911e9c1776d811ba149c

SHA512
796f07f0e93ce9deebe926f6d24f843cf572a0fcf14e156629768d612cb01964fac9cd258e992894556c8bef13c63f0f19de88aa8ccdd6896b45045c66459413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.420
Filesize
270KB

MD5
85146fe4b4856a1b57a6172c66bbd2c9

SHA1
6c9bffc717198baad4466b6ac7faf1588de5118e

SHA256
8666046bf445502116e8b34da531e987589159616ddd727fc4623c8f3f0f2fea

SHA512
42561081193f7720810936336fd3dddd1e08e2ca6ae39751f124a8798282eb7972f42acffac320d5d6adec84b747de2ce86117b7117e9675d2338acd2f5667ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.420
Filesize
333KB

MD5
b2d58c31fa5c5e0610a191cd225ddf8c

SHA1
162d4827ae036ed28d1a32ea1432717278a043fb

SHA256
eca3a52060f14ed8976fd20828d69c0acdd26f7e575d8f5152fdd371329f35ea

SHA512
7382ff2ea0df08e7d65ee254f688c4b2e084f2ac664731f53c0afe2f30e1f1ddcafcc7feda0521cc9d43abf8aaf7164e52bf13782cf5281928398e8d82b9323b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.420
Filesize
720B

MD5
7292c68b20c58e9c78acb05ca8c9d56e

SHA1
e01722906f89a7a3a728c8c385ac9d306bc485ad

SHA256
14cf318ff227a7a73e5441eb91cd513fe134714b58a8b1863495f3abe4ab2f71

SHA512
95c0da6794cee8c658d1f9bed5b303e2b4f861c979b598f69876bd57ddc2e31fd03996ceed01253783bf5f4d8c9fbe303514844633c14f2286f083781099b425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.420
Filesize
352B

MD5
83930b510ce271650edd8d5e457fd006

SHA1
9b4a2f832b345311ecd0cc5aa073f4992db964b8

SHA256
ae915fa3382bd04ed86f8b628a2d2c9232c9119e3e02098ea926a4e7f1ae41f3

SHA512
b11219dec88c6018eeb32a53b85516e4400f87a19ca215cdd0523750adbb748728903c3d52f88525ed4cc53827d634502c981e0fad453cef205d0599208970f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.1.filtertrie.intermediate.txt.420
Filesize
16B

MD5
e8aaa566651759e399714d464cdfb390

SHA1
373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

SHA256
1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

SHA512
23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.2.filtertrie.intermediate.txt.420
Filesize
16B

MD5
209371fb985ae536f7a01b2cbf06fdeb

SHA1
6e5d735e5a6aef442f3342931eaf47d505763578

SHA256
4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

SHA512
53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838301576473.txt.420
Filesize
77KB

MD5
4bd03afa1579f59c1e9160bb1acbf235

SHA1
315a4e98267b8d9e6a4b9350d7fdc58943d9488c

SHA256
8469ae9f082752bef98142f433d75823c8378b07e9a5ce1edbb22e2700352e1e

SHA512
3e1fc296fe24111e8ff40f88c1160742a83a161a19f67729b491455840a32d2856f8cae6c5b6e06803ac735ecc1df951c9fcc1c2d9ec4dc499d8f984d2196464

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840892874528.txt.420
Filesize
47KB

MD5
22e53dc5709ced95e3c83af5804336a6

SHA1
0163069ed72c9616e06d8997c1f5d7fba597b0e0

SHA256
a128f39f65bd1068191be32727905f92217b625bde930a65ffae3250ec557373

SHA512
ce53d6e40b75737475193824dba4026508f9315be3a79698c3f5529863fad78bec5456b7e6f5971b08d5df5d753bc3dfe83dfa0aecb180d67ce970f6f2ef8dea

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847286016159.txt.420
Filesize
66KB

MD5
4a90573d4e1350bb3cb06a825fbd66de

SHA1
3f3ce3606d802cd06dda067fa2a07dfa745c90df

SHA256
5a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242

SHA512
b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510859.txt.420
Filesize
16B

MD5
bea21141aa401823a718b5744650822b

SHA1
bbe9cee4379b81dcf6fdf92aff28f2209563ce50

SHA256
57535fe04df416b5a689aa33f01d8e939f1d91fcae25c0c3cf8192baf417b1fe

SHA512
281f779891962273de9f795dea1917044247dbbe427d111b43027c08ad70577aeffbbb6dc8e68cb0013ebd1ce6103e10f1c71c7e144e75df15c76865ed9c9a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070937929.html.420
Filesize
93KB

MD5
70200c83f44a81bfed68498b23a1ee77

SHA1
404128976cfb6f17fb256050a4f2480e0d974f37

SHA256
3625e71cb796864bb08d776e101cfeb2422a05947d0920182fe92703da07c74f

SHA512
b6b93fcb273842ca69cc6e715296f46984fc6365e4c21aee6510fcc585e4f1fa442eaede9deeb0bd9d6cf523c1b0a5032a95fe9be7e2b62cbbb212bc6f42ad94

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsvjqztf.t5j.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420
Filesize
1KB

MD5
cca7c79ae5dc63d750fc64ba22ef449e

SHA1
71511a46162198d238a903897e95e3765b1f815d

SHA256
3e9ee1259500010abeb1a50b1d70f83dc65d50a170f28355c851b3f7ce933ceb

SHA512
46847c81c82ce0d6ff79271c971296c6b7a5d9cf07012829c5c9b3e4ef79db4f3042c8d19d924b1a5eaf9e00b4521b4bc1286608bcb0db03dfad7d4e0398981f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2573.txt.420
Filesize
427KB

MD5
99ca1eaf89ac2053978f9d29140d9f64

SHA1
709f3d6b2bcbe45d55f1c5a8484fdb1c87f222f5

SHA256
cfdba04d6ade142728e0918f52b57cbadfe56f0df0d18702f143ce830ac9956c

SHA512
97ed31d2470daa5ef4dde695c3fb03958c75ebabfd5ce62e64404e5649e7e6e250b4ed4e3b1f2e3f1bb701326a98f6539c94502b5a9644b818d6896026451340

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2594.txt.420
Filesize
415KB

MD5
c0a9a1d38767d3b07c29f2e5e804c57c

SHA1
d1cbbf7800d93177342064f842bd3b8f04bc5861

SHA256
9eaf1fcac9dd9bd744b99162699f4d5ac524315a7bf552df73189b22df6b4b41

SHA512
50eb71c6a672e4e0ea0382b27d4bb169aa051faf09fe418db36af5388fd078da6b65cd3b0068f753983ad90f5efa8c35b16e33306fcae56981b8c84e33ceb53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2573.txt.420
Filesize
11KB

MD5
8e7782df6d4713ce6be82df6510286cc

SHA1
e26c249392715a5dae519aca80ee0c311c4e58a1

SHA256
1581e6531de7fda2ac8d1456b76bf58c457d2ce5f025a02cfd8992c80965fcae

SHA512
bf281df3897e1b8cacbecd8be01437b9f31d8da875d0e11c459b764f3ee54355e21b897befcd075375613a34e2bb1a1bddfedaaf313259d5d3f8607cf185d14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2594.txt.420
Filesize
11KB

MD5
6714412832373c3aa0260aff1ad6fb70

SHA1
1d47b2bc80e3003e51fdfede23fca9394dbffe68

SHA256
d7b046c2d7e2c96f9f9cf98a5bc84bd5886bba45b7d80783a773b86976b786f5

SHA512
f392f9e8346a4328e745c09fc776739871f238ebad5411aea5c2769379b7fcc5629b18784b48180db33c70da34d3201b9c99c18875637e6867335b37f2ff89ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\jawshtml.html.420
Filesize
16B

MD5
65e115805f15f9cda5eb01e8f742d121

SHA1
e3ecf29bfa71ce07baf8d02009afb8766f35981b

SHA256
7852451b2b252515f369b14bd765135c2e11fee72276b5020e3ed61513c5611a

SHA512
dccbfdd893e5806fa1418e48e0c0c72ec2d1266ee7de48fce34bf3f74bda7e0682e8bf90de53594f34c3d5682c8164d9f6b6ea3977619be8487c2e339faa1ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\mapping.csv.420
Filesize
120KB

MD5
42c12f9e321e00ee8f2ec180e7863e24

SHA1
8d32c5df1057f7d040c919fbea6af11a274d2374

SHA256
63f8f0d578669353be78d86d0173e8f49202fd56f88d36bbefcae31b55d9ac8a

SHA512
c917ed0f9013642a6fe7968315d8454db9173b75e54184449682f75d8e5c02bdc77895e08e15eeb595de6811c09c5fbe0b85982e664223e28d351d2dd10225b2

Download Submit
C:\Users\Admin\AppData\Roaming\BackupCopy.odt.420
Filesize
124KB

MD5
b60f1c9e23458e0129656c9d5502de8c

SHA1
34cc6812f156947cc30535e14d76fc34593a3e8c

SHA256
ed19cb7599821b5dfb6ae5a3bedea050845d772775568635b5d582b9832125b4

SHA512
5b7981f8dbed60a94e8f21376c17c7e84f3ea0ded04f52547ee649d7f7907549a2b642cc4b9fc773e1fe60dad7e84fdea74c92398fd87cb7f20771dab9886966

Download Submit
C:\Users\Admin\AppData\Roaming\ExitStart.pptx.420
Filesize
362KB

MD5
c62c7c3163825e95d5c8b720af824f30

SHA1
342cb8e9f6ccab31e14ecc778299399da5d9d615

SHA256
c0d6f0254678bbe7e8d1535269e954407ca15ada5ee90060fe7f7613be9c68c2

SHA512
365523fb59748fcd077ffbbe7a42d6ed74c96f32257e30fbb8ebe7c5bce830e3835e97a9d2feea000ba48c84eaecc2de4cf14ed930c97a739ad9dc00552bed84

Download Submit
C:\Users\Admin\AppData\Roaming\LimitOpen.png.420
Filesize
190KB

MD5
0ef38a805bcd027cf6a794ab3b5682f5

SHA1
0842c3d5d29302ac9058365810b29973c8c4f7c8

SHA256
43eb2038222810235cce73e3374e29b71bfac854080466907b3fb039a81bd8fc

SHA512
3990557929de8360d82ab110879f433a97024fc87b3f0d1ba9cb7fd4486e79ffd25808a95d584254d5282cb56967e7c759fbb845a15976394cec78d7133b8cf2

Download Submit
C:\Users\Admin\AppData\Roaming\ResetUpdate.docx.420
Filesize
148KB

MD5
5ef08aacd3f1c8f458a9577073e8a5e0

SHA1
164b5d0d3d3083b7017c3278bc10d87743a07f79

SHA256
bb90771bbffd7abcf5252a38bb113f388e110ffeb2eb81490e6c0ec4741208d3

SHA512
e9589debd218c8c716fd78ace2e489d841220fca72157baa36cbb8f06bd9834bf5634974239a0c6a8b603edde5c729280c2978f356b111053eed5428bfe61f2d

Download Submit
C:\Users\Admin\AppData\Roaming\UnblockGrant.asp.420
Filesize
129KB

MD5
6a58c6e4493eb161981ce0b255ccce44

SHA1
7e4188a72c24b5d32a13d49766c612a1ee4dab9b

SHA256
bf16d527218f17496e5c1504d13c337dd1074c08bbf803e422f9ba08098d492f

SHA512
d740b505b07b95268db99b0926cbc1765b788d70674cccf2539a1ff6ab8d0621ba6e03bdaf35097a11188fe974a0952e65cf2148845ba18e8d761dbd5873e2c1

Download Submit
C:\Users\Admin\AppData\Roaming\WatchRepair.csv.420
Filesize
247KB

MD5
004fadc97e0f6f3e89ac5e33735f28b1

SHA1
d8526c408e473192e65762679623715a9ec695eb

SHA256
70bfad4e5445d6f41c25e3e7e15c0fe950ae32f9085e8e22221ae0a802ff0697

SHA512
dd7634a2340c507cf412c32898cab1eec579adaa02d544b62102a7ebef9f3e70a5afe482242b08ffd7a593e60f18840200b2e15fd61a1702f30ae967957856cb

Download Submit
C:\Users\Admin\Links\Desktop.lnk.420
Filesize
512B

MD5
449d58fc15843bb46ae1185c10d85bfd

SHA1
71823f59c66128670ac4af84ca63f8d2600eb295

SHA256
3dba2890323ca8adb1371cc469f60802637779a9ed3b26c59e171452189bd324

SHA512
f557be5df1cdf5f4640274c0f277cd79560f8d25dde8a2874623ad91d48a07040b57112cf9043ab5b7987308bdd2668402431438fc663e05311d8bddb628080a

Download Submit
C:\Users\Admin\Links\Downloads.lnk.420
Filesize
944B

MD5
74dbee12289a0c9dbf11ec0a1493af66

SHA1
f311ff077fb027ee0e7165268187ff4e45e86c17

SHA256
89e799cf7133ad8cbc63816d24386e192df43328a9e5a75693d037dac49e2b6f

SHA512
97f3eab4840402b393d824aa237d3b7bede4fe78f2ed120cc0f7ab8a4d74a7c54730e1b85feade36fa999fd3ac99d18199b65490645769479852a3067720bd7b

Download Submit
C:\Windows\System32\Seven.dll
Filesize
1.0MB

MD5
53ba567ffbf422aab775b79576a542bd

SHA1
5935b4ad859558879413af1defdd8292e5ef4351

SHA256
09d1acbd245a5bdf8b14925a0c77ad9aafcf7fbc7215fa0a5adbd90a2b0c0468

SHA512
d6062e40bf05ef24fd9a052f2e56e15dbedb1557b59581a8a8d4cd9038ee169842b5671b4002d0d795a49354c4ae64c1ea8c04a0b5ee76dc64d5142e79dc9a49

Download Submit
C:\Windows\System32\Seven.runtimeconfig.json
Filesize
340B

MD5
253333997e82f7d44ea8072dfae6db39

SHA1
03b9744e89327431a619505a7c72fd497783d884

SHA256
28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

SHA512
56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

Download Submit
C:\Windows\System32\SevenCopy.exe
Filesize
139KB

MD5
6503f847c3281ff85b304fc674b62580

SHA1
947536e0741c085f37557b7328b067ef97cb1a61

SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.420
Filesize
190KB

MD5
1f50296f6eef349de113760e5c80df1c

SHA1
df13634e73c16d1f8c81e8b82f7a4b0beabcf74e

SHA256
f23668c18195d7ad93dfe5a38c354cd60b70a4f8e3599640522fb1ac5913d93e

SHA512
b34f27361a0f6a0cf4bd75470071ed7ecd5283d09dd64112a76159147ce313b5faf331132d83514bcc6b42fcc08fb530927a6cc1b573eba0bc0bbc466e082e32

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.420
Filesize
170KB

MD5
b7032e03568af793c65e810f59456348

SHA1
7e08ccb8b06cfd9d5011ad813fbc85ba26e1953f

SHA256
4b0195406b5489aa8049eca68fd2b07aa14f5521e9b8bc24f46b8c4bf50c8a05

SHA512
ac740d447eb5fcaca7ba3da067976355ae4abb67b6e329416627e31428b07cc7bea63b4e545d86c619a7228b0be5a3cff6e7c6f21812f1df82ffc9cf2c3efe58

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.420
Filesize
129KB

MD5
843fcc7c7b7ef3c43152df5f97475562

SHA1
e0ae1df0eddd04bd5feadce44dbfc4ee34f27346

SHA256
99499c0889ec4eea44a43ae65a0e0231e6383db13743bb337d219c4d77e7c65a

SHA512
c4755b0a8bed9be822147b45341ebb1f955c3a587113f6f66a4d5d011500b2e43f66b35633066a3f255a554503a14c55057dfec25721df31d0aa53b45c293582

Download Submit
C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.420
Filesize
123KB

MD5
a1a5e6e4f7f3aef1061ee092b703006d

SHA1
02d22711ec2284cc6e316440036c5fde58cd93ba

SHA256
d798f9ae20bf074722e6cbb5f60be4ede7857e269bad2c6df3ddde1b3ee4f266

SHA512
3a8d1a2fbbf1d8327f5f446c610ab0973404d062681fc43fedfd2704caac209928ec9b370396360902e04933ed3a1a4bfae0806cc42ff81ba64d6461e7197b81

Download Submit
C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.420
Filesize
135KB

MD5
19a6e374aaafa970492c486663365be2

SHA1
0fa346d4036727aeac84ddfdaece37649551f80c

SHA256
7396243f815ab381c17a45fa5834587d6fad3c2a0ab93542a671c0d400454cd0

SHA512
390623f7c632a420c9ec206e9069450239be2105e7fbe084a7ca9a812da34dbc830d9bd2c78ffa84123481d7dbb0018c73418093da9411c0b6bbf99da3cac104

Download Submit
memory/896-0-0x0000025042ED0000-0x0000025042EF2000-memory.dmp

Filesize
136KB

Download
memory/896-10-0x00007FF953590000-0x00007FF954051000-memory.dmp

Filesize
10.8MB

Download
memory/896-12-0x000002502A6A0000-0x000002502A6B0000-memory.dmp

Filesize
64KB

Download
memory/896-11-0x000002502A6A0000-0x000002502A6B0000-memory.dmp

Filesize
64KB

Download
memory/896-15-0x00007FF953590000-0x00007FF954051000-memory.dmp

Filesize
10.8MB

Download
memory/17752-447-0x00007FF715A20000-0x00007FF715A87000-memory.dmp

Filesize
412KB

Download
memory/18160-445-0x00007FF715A20000-0x00007FF715A87000-memory.dmp

Filesize
412KB

Download
memory/18324-448-0x00007FF715A20000-0x00007FF715A87000-memory.dmp

Filesize
412KB

Download