d46db22f04f5e99b7f46a0472ac399ebd6b2eef8b7cc9e792a8476c1558c66fd

Analysis

max time kernel
180s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Seven.exe
Size

139KB
MD5

6503f847c3281ff85b304fc674b62580
SHA1

947536e0741c085f37557b7328b067ef97cb1a61
SHA256

afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512

abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP

3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Seven.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation Seven.exe
Deletes itself 1 IoCs

Processes:

SevenCopy.exe

pid process

3824 SevenCopy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	Seven.exe

Executes dropped EXE 64 IoCs

Processes:

SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exe

pid	process
3824	SevenCopy.exe
14036	SevenCopy.exe
3936	SevenCopy.exe
6404	SevenCopy.exe
18004	SevenCopy.exe
4272	SevenCopy.exe
3952	SevenCopy.exe
11284	SevenCopy.exe
11268	SevenCopy.exe
212	SevenCopy.exe
6076	SevenCopy.exe
6884	SevenCopy.exe
14016	SevenCopy.exe
14316	SevenCopy.exe
6920	SevenCopy.exe
7684	SevenCopy.exe
15104	SevenCopy.exe
9708	SevenCopy.exe
14688	SevenCopy.exe
5620	SevenCopy.exe
9956	SevenCopy.exe
14364	SevenCopy.exe
13680	SevenCopy.exe
5716	SevenCopy.exe
11516	SevenCopy.exe
13880	SevenCopy.exe
10168	SevenCopy.exe
5516	SevenCopy.exe
3060	SevenCopy.exe
15464	SevenCopy.exe
14704	SevenCopy.exe
16468	SevenCopy.exe
6712	SevenCopy.exe
688	SevenCopy.exe
5984	SevenCopy.exe
14916	SevenCopy.exe
6516	SevenCopy.exe
5800	SevenCopy.exe
15064	SevenCopy.exe
7936	SevenCopy.exe
7392	SevenCopy.exe
16640	SevenCopy.exe
13872	SevenCopy.exe
9228	SevenCopy.exe
7340	SevenCopy.exe
14836	SevenCopy.exe
15500	SevenCopy.exe
17016	SevenCopy.exe
14600	SevenCopy.exe
12696	SevenCopy.exe
6528	SevenCopy.exe
9436	SevenCopy.exe
16264	SevenCopy.exe
8820	SevenCopy.exe
9820	SevenCopy.exe
12816	SevenCopy.exe
10220	SevenCopy.exe
15932	SevenCopy.exe
16720	SevenCopy.exe
17444	SevenCopy.exe
9648	SevenCopy.exe
16316	SevenCopy.exe
10096	SevenCopy.exe
17540	SevenCopy.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Seven.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

Processes:

SevenCopy.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SevenCopy.exe

Drops file in System32 directory 64 IoCs

Processes:

description	ioc	process
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

11844 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

460 powershell.exe
460 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 460 powershell.exe

pid	process
11844	NOTEPAD.EXE

pid	process
460	powershell.exe
460	powershell.exe

description	pid	process
Token: SeDebugPrivilege	460	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Seven.execmd.execmd.execmd.exeSevenCopy.execmd.exe

description	pid	process	target process
PID 4340 wrote to memory of 460	4340	Seven.exe	powershell.exe
PID 4340 wrote to memory of 460	4340	Seven.exe	powershell.exe
PID 4340 wrote to memory of 3084	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 3084	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 4596	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 4596	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 3156	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 3156	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 1772	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 1772	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 3616	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 3616	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 752	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 752	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 64	4340	Seven.exe	cmd.exe
PID 4340 wrote to memory of 64	4340	Seven.exe	cmd.exe
PID 752 wrote to memory of 3348	752	cmd.exe	attrib.exe
PID 752 wrote to memory of 3348	752	cmd.exe	attrib.exe
PID 64 wrote to memory of 3496	64	cmd.exe	attrib.exe
PID 64 wrote to memory of 3496	64	cmd.exe	attrib.exe
PID 3156 wrote to memory of 3960	3156	cmd.exe	attrib.exe
PID 3156 wrote to memory of 3960	3156	cmd.exe	attrib.exe
PID 4340 wrote to memory of 3824	4340	Seven.exe	SevenCopy.exe
PID 4340 wrote to memory of 3824	4340	Seven.exe	SevenCopy.exe
PID 3824 wrote to memory of 2112	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2112	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1704	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1704	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 4452	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 4452	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1560	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1560	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1276	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1276	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 828	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 828	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 4360	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 4360	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2408	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2408	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2332	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2332	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1964	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1964	3824	SevenCopy.exe	cmd.exe
PID 2112 wrote to memory of 888	2112	cmd.exe	choice.exe
PID 2112 wrote to memory of 888	2112	cmd.exe	choice.exe
PID 3824 wrote to memory of 4852	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 4852	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1496	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1496	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2292	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2292	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 3656	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 3656	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2296	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2296	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2304	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2304	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 4008	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 4008	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2512	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 2512	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1540	3824	SevenCopy.exe	cmd.exe
PID 3824 wrote to memory of 1540	3824	SevenCopy.exe	cmd.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

3348 attrib.exe
3496 attrib.exe
3960 attrib.exe

pid	process
3348	attrib.exe
3496	attrib.exe
3960	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
2⤵
PID:3084

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe
2⤵
PID:4596

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3156

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\SevenCopy.exe
3⤵
- Views/modifies file attributes
PID:3960

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
2⤵
PID:1772

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
2⤵
PID:3616

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.dll
3⤵
- Views/modifies file attributes
PID:3348

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Suspicious use of WriteProcessMemory
PID:64

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.runtimeconfig.json
3⤵
- Views/modifies file attributes
PID:3496

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
3⤵
PID:1704

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5688

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
3⤵
PID:4452

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
3⤵
PID:1560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6140

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
3⤵
PID:1276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
3⤵
PID:828

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
3⤵
PID:4360

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
3⤵
PID:2408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6328

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:2332

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5272

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:1964

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:4852

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:1496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6572

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:2292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:3656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6360

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:2296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6556

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:2304

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6536

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
3⤵
PID:4008

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9876

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
3⤵
PID:2512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CheckpointSelect.xml"
3⤵
PID:1540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9864

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\DebugCopy.pptx"
3⤵
PID:4880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
3⤵
PID:2948

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6580

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
3⤵
PID:1604

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
3⤵
PID:552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6588

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RequestBackup.docx"
3⤵
PID:4836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
3⤵
PID:3300

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10328

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\AssertOpen.txt"
3⤵
PID:4888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\CompressExpand.ppt"
3⤵
PID:4924

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\InvokeWrite.asp"
3⤵
PID:1628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\PopUnlock.pptx"
3⤵
PID:1048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10336

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UndoResize.lnk"
3⤵
PID:4264

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10308

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
3⤵
PID:2024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10300

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
3⤵
PID:3904

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10316

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ConfirmExport.jpg"
3⤵
PID:4324

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\UnprotectSearch.xlsx"
3⤵
PID:4172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\WriteJoin.html"
3⤵
PID:5108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10292

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\EnterResolve.jpg"
3⤵
PID:3960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\GetGroup.bmp"
3⤵
PID:3348

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\MountStep.bmp"
3⤵
PID:2952

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9348

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
3⤵
PID:4636

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RemoveLimit.jpg"
3⤵
PID:448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SkipLock.bmp"
3⤵
PID:4500

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13664

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\UnregisterOptimize.bmp"
3⤵
PID:4596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BackupHide.pptx"
3⤵
PID:64

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14344

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ConvertFromUse.txt"
3⤵
PID:4128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\LockUse.txt"
3⤵
PID:1844

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13360

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnblockWait.jpg"
3⤵
PID:688

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510821.txt"
3⤵
PID:5096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
3⤵
PID:1952

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI24F4.txt"
3⤵
PID:2816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11736

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2518.txt"
3⤵
PID:2096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI24F4.txt"
3⤵
PID:4200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2518.txt"
3⤵
PID:2424

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
3⤵
PID:1528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
3⤵
PID:2716

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12908

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070859354.html"
3⤵
PID:2968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14640

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
3⤵
PID:1036

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
3⤵
PID:4620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14608

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
3⤵
PID:3616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
3⤵
PID:5124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14600

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
3⤵
PID:5212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14460

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
3⤵
PID:5228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
3⤵
PID:5260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
3⤵
PID:5276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
3⤵
PID:5296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
3⤵
PID:5320

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
3⤵
PID:5344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
3⤵
PID:5356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
3⤵
PID:5368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
3⤵
PID:5384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
3⤵
PID:5576

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14440

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
3⤵
PID:5600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
3⤵
PID:5620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
3⤵
PID:5660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
3⤵
PID:5680

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
3⤵
PID:5744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
3⤵
PID:5756

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
3⤵
PID:5772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
3⤵
PID:5784

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14452

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
3⤵
PID:5800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
3⤵
PID:5812

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
3⤵
PID:5824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7056

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
3⤵
PID:5848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
3⤵
PID:5868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
3⤵
PID:5888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13476

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
3⤵
PID:6100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
3⤵
PID:752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
3⤵
PID:3816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
3⤵
PID:1216

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:8324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
3⤵
PID:3044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9724

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
3⤵
PID:4408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
3⤵
PID:5340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
3⤵
PID:5536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
3⤵
PID:5560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14724

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
3⤵
PID:5656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14884

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
3⤵
PID:5996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14776

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
3⤵
PID:6272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15084

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
3⤵
PID:6284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
3⤵
PID:6512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
3⤵
PID:6548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
3⤵
PID:6728

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14836

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
3⤵
PID:6740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
3⤵
PID:6752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
3⤵
PID:6764

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
3⤵
PID:6784

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15044

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
3⤵
PID:6796

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
3⤵
PID:6808

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14828

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
3⤵
PID:6944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
3⤵
PID:6956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
3⤵
PID:6976

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15076

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
3⤵
PID:7004

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15520

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
3⤵
PID:2416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
3⤵
PID:5936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15092

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
3⤵
PID:6280

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
3⤵
PID:6544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:636

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
3⤵
PID:5768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
3⤵
PID:6176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
3⤵
PID:6792

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15552

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
3⤵
PID:6632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15536

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
3⤵
PID:6504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14008

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
3⤵
PID:6760

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
3⤵
PID:7180

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2924

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
3⤵
PID:7192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15608

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
3⤵
PID:7204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15060

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
3⤵
PID:7216

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
3⤵
PID:7228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
3⤵
PID:7244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
3⤵
PID:7256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
3⤵
PID:7268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
3⤵
PID:7288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
3⤵
PID:7300

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
3⤵
PID:7316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
3⤵
PID:7328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2112

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
3⤵
PID:7340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15544

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
3⤵
PID:7384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
3⤵
PID:7396

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
3⤵
PID:7408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
3⤵
PID:7420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15028

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
3⤵
PID:7440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
3⤵
PID:7452

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
3⤵
PID:7468

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
3⤵
PID:7484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
3⤵
PID:7496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
3⤵
PID:7508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16148

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
3⤵
PID:7520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15452

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
3⤵
PID:7532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
3⤵
PID:7544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
3⤵
PID:7556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
3⤵
PID:7576

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837245521736.txt"
3⤵
PID:7592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15052

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837928247116.txt"
3⤵
PID:7624

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838254684814.txt"
3⤵
PID:7648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838451029087.txt"
3⤵
PID:7664

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838515694078.txt"
3⤵
PID:7676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15208

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838567180292.txt"
3⤵
PID:7692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838750839126.txt"
3⤵
PID:7708

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838812679810.txt"
3⤵
PID:7720

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838854958362.txt"
3⤵
PID:7740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839873338736.txt"
3⤵
PID:7764

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15336

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840507559806.txt"
3⤵
PID:7776

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844022702774.txt"
3⤵
PID:7788

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15660

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844322952340.txt"
3⤵
PID:7808

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15792

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844624250116.txt"
3⤵
PID:7820

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15864

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844979319796.txt"
3⤵
PID:7832

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15272

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845400670849.txt"
3⤵
PID:7852

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15328

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845577900100.txt"
3⤵
PID:7864

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16048

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847200385598.txt"
3⤵
PID:6804

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847499992299.txt"
3⤵
PID:6968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16104

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847800283963.txt"
3⤵
PID:8608

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848100459721.txt"
3⤵
PID:8624

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15528

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848894597947.txt"
3⤵
PID:8640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16040

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579873757962705.txt"
3⤵
PID:8660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15840

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
3⤵
PID:8696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
3⤵
PID:8712

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:8732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\pkcs11.txt"
3⤵
PID:8748

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I50YRZD3\update100[1].xml"
3⤵
PID:8768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X2NSSXLH\known_providers_download_v1[1].xml"
3⤵
PID:8788

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15384

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
3⤵
PID:8824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
3⤵
PID:8836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
3⤵
PID:8848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
3⤵
PID:8860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
3⤵
PID:8888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15760

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
3⤵
PID:8904

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
3⤵
PID:8936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15776

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
3⤵
PID:8956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15728

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27ce644e-4f71-4493-81f8-1feeaee7a9c2}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8976

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27ce644e-4f71-4493-81f8-1feeaee7a9c2}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{27ce644e-4f71-4493-81f8-1feeaee7a9c2}\0.2.filtertrie.intermediate.txt"
3⤵
PID:9008

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15600

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ebe6a11-de91-4077-996f-4f928bc5976b}\0.0.filtertrie.intermediate.txt"
3⤵
PID:9020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15468

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ebe6a11-de91-4077-996f-4f928bc5976b}\0.1.filtertrie.intermediate.txt"
3⤵
PID:9032

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16056

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ebe6a11-de91-4077-996f-4f928bc5976b}\0.2.filtertrie.intermediate.txt"
3⤵
PID:9060

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39cbc589-0e9f-4643-9bd1-14b1344aa8da}\0.0.filtertrie.intermediate.txt"
3⤵
PID:9096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39cbc589-0e9f-4643-9bd1-14b1344aa8da}\0.1.filtertrie.intermediate.txt"
3⤵
PID:9112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15344

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39cbc589-0e9f-4643-9bd1-14b1344aa8da}\0.2.filtertrie.intermediate.txt"
3⤵
PID:9128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\appsconversions.txt"
3⤵
PID:9168

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\appsglobals.txt"
3⤵
PID:9192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\appssynonyms.txt"
3⤵
PID:9212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15768

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\settingsconversions.txt"
3⤵
PID:7732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\settingsglobals.txt"
3⤵
PID:220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\settingssynonyms.txt"
3⤵
PID:9428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3ca7e305-e169-4803-b267-dc38483a5382}\0.0.filtertrie.intermediate.txt"
3⤵
PID:9456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15576

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3ca7e305-e169-4803-b267-dc38483a5382}\0.1.filtertrie.intermediate.txt"
3⤵
PID:9476

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3ca7e305-e169-4803-b267-dc38483a5382}\0.2.filtertrie.intermediate.txt"
3⤵
PID:9516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15460

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.0.filtertrie.intermediate.txt"
3⤵
PID:9540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16112

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.1.filtertrie.intermediate.txt"
3⤵
PID:9556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15568

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.2.filtertrie.intermediate.txt"
3⤵
PID:9572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
3⤵
PID:9596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
3⤵
PID:9620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
3⤵
PID:9652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15784

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
3⤵
PID:9672

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
3⤵
PID:9960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
3⤵
PID:9976

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
3⤵
PID:10000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
3⤵
PID:7672

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
3⤵
PID:10812

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
3⤵
PID:11040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
3⤵
PID:11212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
3⤵
PID:11224

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
3⤵
PID:11484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
3⤵
PID:11500

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
3⤵
PID:11536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4908

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
3⤵
PID:11548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16756

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
3⤵
PID:11560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
3⤵
PID:11572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\EGU4Q1MN\microsoft.windows[1].xml"
3⤵
PID:11584

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RGTD1OIS\www.bing[1].xml"
3⤵
PID:11932

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
3⤵
PID:11948

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16984

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
3⤵
PID:11968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
3⤵
PID:11984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16824

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
3⤵
PID:12012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
3⤵
PID:12028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
3⤵
PID:12044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
3⤵
PID:12060

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
3⤵
PID:12088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17108

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
3⤵
PID:12136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
3⤵
PID:12152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
3⤵
PID:12168

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
3⤵
PID:12184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
3⤵
PID:12200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
3⤵
PID:12216

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
3⤵
PID:12232

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14432

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
3⤵
PID:12248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
3⤵
PID:12260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
3⤵
PID:12272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
3⤵
PID:12284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15736

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
3⤵
PID:11036

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
3⤵
PID:10892

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15752

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
3⤵
PID:12292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16840

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
3⤵
PID:12312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16672

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
3⤵
PID:12328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17240

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
3⤵
PID:12340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16992

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
3⤵
PID:12356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17448

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
3⤵
PID:12368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
3⤵
PID:12380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
3⤵
PID:12392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
3⤵
PID:12432

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
3⤵
PID:12444

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17544

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
3⤵
PID:12456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
3⤵
PID:12472

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
3⤵
PID:12484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17260

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
3⤵
PID:12496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
3⤵
PID:12508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17208

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
3⤵
PID:12524

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
3⤵
PID:12872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17372

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
3⤵
PID:13108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17296

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
3⤵
PID:12868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16976

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
3⤵
PID:11944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17344

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
3⤵
PID:12040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
3⤵
PID:12072

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17216

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
3⤵
PID:12256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17328

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
3⤵
PID:11220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
3⤵
PID:12492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17552

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
3⤵
PID:12916

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
3⤵
PID:12988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
3⤵
PID:13024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17636

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
3⤵
PID:13324

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17312

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
3⤵
- Executes dropped EXE
PID:14036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
4⤵
PID:17828

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
4⤵
PID:17848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
4⤵
PID:17864

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
4⤵
PID:17880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:5692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
4⤵
PID:17896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
4⤵
PID:17912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18428

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
4⤵
PID:17928

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
4⤵
PID:17944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:776

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
4⤵
PID:17968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:6420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
4⤵
PID:17984

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
4⤵
PID:18180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
4⤵
PID:18196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BackupHide.pptx"
4⤵
PID:18212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ConvertFromUse.txt"
4⤵
PID:18260

C:\Windows\System32\SevenCopy.exe
C:\Windows\System32\SevenCopy.exe
1⤵
- Executes dropped EXE
PID:3936

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
2⤵
PID:7068

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:4072

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
2⤵
PID:9360

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:6396

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
2⤵
- Executes dropped EXE
PID:6404

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
3⤵
PID:3716

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6864

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
3⤵
PID:6860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9220

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
3⤵
- Executes dropped EXE
PID:18004

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
4⤵
PID:4448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:8952

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
4⤵
PID:1504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:3644

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
4⤵
- Executes dropped EXE
PID:4272

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
5⤵
PID:4912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:8276

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
5⤵
PID:2140

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:8264

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
5⤵
- Executes dropped EXE
PID:3952

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
6⤵
PID:5648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:5880

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
6⤵
PID:3496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:3356

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
6⤵
- Executes dropped EXE
PID:11284

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
7⤵
PID:5872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:1368

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
7⤵
PID:5868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:4848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
7⤵
- Executes dropped EXE
PID:11268

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
8⤵
PID:744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:1796

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
8⤵
PID:4588

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:3232

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
8⤵
- Executes dropped EXE
PID:212

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
9⤵
PID:4988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:13524

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
9⤵
PID:1676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:6104

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
9⤵
- Executes dropped EXE
PID:6076

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
10⤵
PID:4552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:5748

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt"
10⤵
PID:7116

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:5744

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
10⤵
- Executes dropped EXE
PID:6884

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt"
11⤵
PID:1128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:7380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
11⤵
- Executes dropped EXE
PID:14016

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
12⤵
- Executes dropped EXE
PID:14316

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
13⤵
- Executes dropped EXE
PID:6920

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
14⤵
- Executes dropped EXE
PID:7684

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
15⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15104

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:9708

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
17⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:14688

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
18⤵
- Executes dropped EXE
PID:5620

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
19⤵
PID:14620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
20⤵
PID:6256

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
19⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:9956

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
20⤵
PID:5244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
21⤵
PID:10196

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
20⤵
- Executes dropped EXE
PID:14364

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
21⤵
PID:11532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
22⤵
PID:5280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
21⤵
- Executes dropped EXE
PID:13680

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
22⤵
PID:7144

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
23⤵
PID:6704

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
22⤵
- Executes dropped EXE
PID:5716

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
23⤵
PID:9848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
24⤵
PID:14940

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
23⤵
- Executes dropped EXE
PID:11516

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
24⤵
PID:14984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
25⤵
PID:7148

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
24⤵
- Executes dropped EXE
PID:13880

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
25⤵
PID:1528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
26⤵
PID:7348

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
25⤵
- Executes dropped EXE
PID:10168

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
26⤵
PID:13620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
27⤵
PID:15944

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
26⤵
- Executes dropped EXE
PID:5516

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
27⤵
PID:5740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
28⤵
PID:5184

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
27⤵
- Executes dropped EXE
PID:3060

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
28⤵
PID:15032

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
29⤵
PID:11832

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
28⤵
- Executes dropped EXE
PID:15464

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
29⤵
PID:10268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
30⤵
PID:15332

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:14704

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
30⤵
- Executes dropped EXE
PID:16468

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
31⤵
- Executes dropped EXE
PID:6712

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
32⤵
- Executes dropped EXE
PID:688

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
33⤵
- Executes dropped EXE
PID:5984

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
34⤵
- Executes dropped EXE
PID:14916

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
35⤵
- Executes dropped EXE
PID:6516

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
36⤵
- Executes dropped EXE
PID:5800

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15064

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7936

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
39⤵
- Executes dropped EXE
PID:7392

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
40⤵
- Executes dropped EXE
PID:16640

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
41⤵
- Executes dropped EXE
PID:13872

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
42⤵
- Executes dropped EXE
PID:9228

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
43⤵
- Executes dropped EXE
PID:7340

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
44⤵
- Executes dropped EXE
PID:14836

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
45⤵
- Executes dropped EXE
PID:15500

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
46⤵
- Executes dropped EXE
PID:17016

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
47⤵
- Executes dropped EXE
PID:14600

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
48⤵
- Executes dropped EXE
PID:12696

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
49⤵
- Executes dropped EXE
PID:6528

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
50⤵
- Executes dropped EXE
PID:9436

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
51⤵
- Executes dropped EXE
PID:16264

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
52⤵
PID:8852

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
53⤵
PID:8144

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
52⤵
- Executes dropped EXE
PID:8820

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
53⤵
PID:6260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
54⤵
PID:11864

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
53⤵
- Executes dropped EXE
PID:9820

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
54⤵
PID:9164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
55⤵
PID:6932

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
54⤵
- Executes dropped EXE
PID:12816

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
55⤵
PID:8556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
56⤵
PID:10928

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
55⤵
- Executes dropped EXE
PID:10220

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
56⤵
PID:7492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
57⤵
PID:10524

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
56⤵
- Executes dropped EXE
PID:15932

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
57⤵
PID:16260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
58⤵
PID:16132

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:16720

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
58⤵
PID:9844

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
59⤵
PID:15536

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
58⤵
- Executes dropped EXE
PID:17444

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
59⤵
PID:9692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
60⤵
PID:14020

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
59⤵
- Executes dropped EXE
PID:9648

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
60⤵
PID:15908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
61⤵
PID:16428

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:16316

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
61⤵
PID:17288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
62⤵
PID:16504

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
61⤵
- Executes dropped EXE
PID:10096

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"
62⤵
PID:16284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
63⤵
PID:6976

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
62⤵
- Executes dropped EXE
PID:17540

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
63⤵
PID:12740

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
64⤵
PID:13484

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
65⤵
PID:10140

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
66⤵
PID:7900

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
67⤵
PID:7292

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
68⤵
PID:9624

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
69⤵
PID:15860

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
70⤵
PID:3244

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
71⤵
PID:17264

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
72⤵
PID:17396

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
73⤵
PID:16716

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
74⤵
PID:11592

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
75⤵
- Drops file in System32 directory
PID:9160

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
76⤵
PID:17688

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
77⤵
PID:17652

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
78⤵
PID:17460

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
79⤵
PID:15380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
80⤵
PID:16388

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
81⤵
PID:9920

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
82⤵
PID:11708

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
83⤵
PID:17720

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
84⤵
PID:17328

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
85⤵
PID:16872

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
86⤵
PID:17156

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
87⤵
PID:17628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
88⤵
PID:10052

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
87⤵
PID:17108

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
88⤵
PID:14200

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
89⤵
PID:5696

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
88⤵
PID:7932

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
89⤵
PID:8656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
90⤵
PID:13752

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
89⤵
PID:13948

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
90⤵
PID:9764

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
91⤵
PID:7500

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
90⤵
PID:11880

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
91⤵
PID:11096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
92⤵
PID:13660

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
91⤵
PID:13440

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
92⤵
PID:11940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
93⤵
PID:13640

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
92⤵
PID:14308

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
93⤵
PID:10136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
94⤵
PID:12496

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
93⤵
PID:8040

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
94⤵
PID:220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
95⤵
PID:11120

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
94⤵
PID:10128

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
95⤵
PID:10012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
96⤵
PID:14196

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
95⤵
- Drops file in System32 directory
PID:10076

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
96⤵
PID:11392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
97⤵
PID:10024

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
96⤵
- Drops file in System32 directory
PID:12552

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
97⤵
PID:14556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
98⤵
PID:7708

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
97⤵
PID:2160

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
98⤵
PID:10216

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
99⤵
- Drops file in System32 directory
PID:13976

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
100⤵
PID:12924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
101⤵
PID:12352

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
102⤵
PID:7468

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
103⤵
- Drops file in System32 directory
PID:12524

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
104⤵
PID:8480

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
105⤵
- Drops file in System32 directory
PID:7732

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
106⤵
PID:11316

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
107⤵
PID:12264

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
108⤵
PID:13392

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
109⤵
PID:10412

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
110⤵
PID:12248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
111⤵
- Drops file in System32 directory
PID:9068

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
112⤵
PID:13600

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
113⤵
PID:14084

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
114⤵
- Drops file in System32 directory
PID:13968

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
115⤵
- Drops file in System32 directory
PID:14236

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
116⤵
PID:12768

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
117⤵
PID:12448

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
118⤵
- Drops file in System32 directory
PID:11744

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
119⤵
PID:13644

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
120⤵
PID:11348

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
121⤵
PID:13508

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
122⤵
PID:13636

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
123⤵
PID:17788

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
124⤵
PID:18156

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
125⤵
PID:18164

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
126⤵
- Drops file in System32 directory
PID:8932

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
127⤵
PID:452

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
128⤵
PID:2516

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
129⤵
PID:2360

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
130⤵
- Drops file in System32 directory
PID:1956

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
131⤵
PID:17840

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
132⤵
PID:3104

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
133⤵
- Drops file in System32 directory
PID:3652

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
134⤵
PID:3240

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
135⤵
PID:8288

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
136⤵
PID:5848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
137⤵
- Drops file in System32 directory
PID:18268

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
138⤵
PID:2080

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
139⤵
PID:5424

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
140⤵
PID:10336

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
141⤵
- Drops file in System32 directory
PID:10284

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
142⤵
- Drops file in System32 directory
PID:17980

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
143⤵
PID:5248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
144⤵
PID:9628

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
145⤵
PID:1460

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
146⤵
PID:8368

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
147⤵
PID:14408

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
148⤵
PID:6572

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
149⤵
PID:14472

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
150⤵
PID:10628

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
151⤵
PID:10984

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
152⤵
- Drops file in System32 directory
PID:8952

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
153⤵
PID:5216

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
154⤵
PID:11252

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
155⤵
PID:9428

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
156⤵
PID:3268

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
157⤵
PID:7476

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
158⤵
PID:2952

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
159⤵
PID:14636

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
160⤵
PID:4748

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
161⤵
PID:10332

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
162⤵
PID:5536

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
163⤵
PID:744

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
164⤵
PID:6996

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
165⤵
PID:11288

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
166⤵
PID:6904

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
167⤵
PID:10924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
168⤵
PID:14944

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
169⤵
PID:11196

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
170⤵
PID:7364

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
171⤵
PID:14012

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
172⤵
PID:14264

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
173⤵
PID:12372

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
174⤵
PID:5912

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
175⤵
PID:5724

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
176⤵
PID:6616

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
177⤵
PID:14644

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
178⤵
PID:9636

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
179⤵
PID:8912

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
180⤵
- Drops file in System32 directory
PID:14620

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
181⤵
PID:15296

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
182⤵
PID:2876

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
183⤵
PID:8220

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
184⤵
PID:7856

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
185⤵
PID:5260

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
186⤵
PID:5276

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
187⤵
PID:9988

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
188⤵
PID:15320

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
189⤵
PID:9388

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
190⤵
- Drops file in System32 directory
PID:13664

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
191⤵
- Drops file in System32 directory
PID:5800

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
192⤵
PID:12020

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
193⤵
PID:15944

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
194⤵
PID:7448

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
195⤵
PID:5184

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
196⤵
- Drops file in System32 directory
PID:6880

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
197⤵
PID:15288

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
198⤵
PID:9652

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
199⤵
PID:13872

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
200⤵
PID:7924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
201⤵
PID:9640

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
202⤵
PID:10768

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
203⤵
PID:16800

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
204⤵
PID:16724

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
205⤵
PID:9992

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
206⤵
- Drops file in System32 directory
PID:9400

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
207⤵
PID:9508

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
208⤵
PID:16048

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
209⤵
PID:9816

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
210⤵
PID:15948

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
211⤵
PID:15716

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
212⤵
PID:9820

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
213⤵
PID:10832

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
214⤵
PID:9828

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
215⤵
- Drops file in System32 directory
PID:8908

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
216⤵
PID:15128

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
217⤵
PID:15996

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
218⤵
PID:16036

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
219⤵
PID:3252

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
220⤵
PID:16980

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
221⤵
PID:4248

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
222⤵
PID:8608

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
223⤵
PID:15728

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
224⤵
- Drops file in System32 directory
PID:12788

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
225⤵
PID:10280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
226⤵
PID:7848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
227⤵
PID:8764

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
228⤵
PID:9140

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
229⤵
PID:16184

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
230⤵
PID:17228

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
231⤵
PID:6160

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
232⤵
- Drops file in System32 directory
PID:16700

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
233⤵
- Drops file in System32 directory
PID:15388

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
234⤵
PID:15860

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
235⤵
PID:9300

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
236⤵
PID:15088

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
237⤵
- Drops file in System32 directory
PID:10656

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
238⤵
PID:16476

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
239⤵
PID:12880

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
240⤵
PID:16344

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
241⤵
PID:11712

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
242⤵
- Drops file in System32 directory
PID:16604

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
243⤵
PID:17688

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
244⤵
- Drops file in System32 directory
PID:17652

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
245⤵
PID:17460

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
246⤵
PID:15380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
247⤵
PID:16412

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
248⤵
PID:8668

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
249⤵
PID:17440

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
250⤵
PID:17004

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
251⤵
- Drops file in System32 directory
PID:17772

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
252⤵
PID:17580

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
253⤵
PID:11640

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
254⤵
PID:14144

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
255⤵
- Drops file in System32 directory
PID:12128

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
256⤵
PID:7932

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
257⤵
PID:12600

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
258⤵
PID:12048

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
259⤵
PID:10224

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
260⤵
PID:7496

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
261⤵
PID:12312

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
262⤵
PID:7992

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
263⤵
PID:13120

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
264⤵
PID:11056

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
265⤵
PID:8420

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
266⤵
PID:3132

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
267⤵
- Drops file in System32 directory
PID:12252

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
268⤵
PID:11780

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
269⤵
PID:12388

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
270⤵
PID:3844

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
271⤵
PID:14192

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
272⤵
PID:11016

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
273⤵
PID:12508

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
274⤵
PID:11096

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
275⤵
- Drops file in System32 directory
PID:10520

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
276⤵
- Drops file in System32 directory
PID:13116

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
277⤵
PID:13276

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
278⤵
PID:12336

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
279⤵
PID:220

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
280⤵
PID:2072

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
281⤵
PID:10608

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
282⤵
PID:12504

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
283⤵
- Drops file in System32 directory
PID:17988

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
284⤵
PID:11072

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
285⤵
PID:6748

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
286⤵
PID:9596

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
287⤵
PID:14204

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
288⤵
- Drops file in System32 directory
PID:3396

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
289⤵
PID:13748

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
290⤵
PID:11500

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
291⤵
PID:11808

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
292⤵
PID:13000

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
293⤵
PID:12344

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
294⤵
PID:14668

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
295⤵
PID:7228

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
296⤵
PID:14164

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
297⤵
PID:13436

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
298⤵
PID:5692

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
299⤵
PID:17880

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
300⤵
PID:1636

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
301⤵
PID:9940

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
302⤵
PID:2784

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
303⤵
PID:4116

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
304⤵
PID:18092

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
305⤵
PID:18168

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
306⤵
PID:18384

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
307⤵
- Drops file in System32 directory
PID:18336

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
308⤵
PID:2744

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
309⤵
PID:17380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
310⤵
- Drops file in System32 directory
PID:2316

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
311⤵
PID:2016

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
312⤵
PID:8404

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
313⤵
- Drops file in System32 directory
PID:6872

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
314⤵
PID:10884

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
315⤵
- Drops file in System32 directory
PID:8280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
316⤵
PID:8064

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
317⤵
PID:5496

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
318⤵
- Drops file in System32 directory
PID:4940

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
319⤵
PID:648

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
320⤵
PID:8968

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
321⤵
PID:11472

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
322⤵
PID:4800

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
323⤵
- Drops file in System32 directory
PID:13388

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
324⤵
PID:18028

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
325⤵
PID:14792

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
326⤵
PID:8268

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
327⤵
PID:14712

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
328⤵
- Drops file in System32 directory
PID:1524

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
329⤵
- Drops file in System32 directory
PID:10532

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
330⤵
- Drops file in System32 directory
PID:5772

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
331⤵
- Drops file in System32 directory
PID:1696

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
332⤵
PID:7908

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
333⤵
PID:1772

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
334⤵
PID:5008

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EncryptedLog.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:11844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.1.filtertrie.intermediate.txt.420
Filesize
16B

MD5
e8aaa566651759e399714d464cdfb390

SHA1
373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

SHA256
1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

SHA512
23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.2.filtertrie.intermediate.txt.420
Filesize
16B

MD5
209371fb985ae536f7a01b2cbf06fdeb

SHA1
6e5d735e5a6aef442f3342931eaf47d505763578

SHA256
4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

SHA512
53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838515694078.txt.420
Filesize
77KB

MD5
ccd6899680ab969cf8307cf47dd4f4e8

SHA1
2c59cfa65c4365a9296dae439358d8642ae6f3c0

SHA256
017f27ce648318c3d6f3e763bef01ae0375d1d606865a9b442d97ac7db4a0f74

SHA512
6e3f92ad5bc44810d0db428e05aeb5d174bf7b0d0546dba679ecb5e5afdb8e37b13c32101ced5f3f39690642d78be556f77d11ac4509e7ffb5b07930e79cd001

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839873338736.txt.420
Filesize
47KB

MD5
a1a3feea7a332f9e97a62bc975eb8016

SHA1
1b28c0cf1ab5c10eb4cf0bad4618f213dd793ff7

SHA256
d4fee481ae945c46b3093d6d0b13c48453915d8ee8adc8b8acef0b551bced32b

SHA512
7539948701264c387a24768cb7d7c8e006f9cf7a64bce07c5f5eea84ec05e02d08d1c8e7c422185781cbea06139960259584116dec63ccc667ae91f76801a5c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847200385598.txt.420
Filesize
66KB

MD5
4a90573d4e1350bb3cb06a825fbd66de

SHA1
3f3ce3606d802cd06dda067fa2a07dfa745c90df

SHA256
5a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242

SHA512
b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424458736812.txt.420
Filesize
75KB

MD5
f8986559f15db3a6c0812096578ed41e

SHA1
54d7afa68254af0873ae6537812dcaffaebb391e

SHA256
a72f3d9014b8f543f2d3a998961442e542f5336093ac36ba14b72be59b3d2195

SHA512
cbaf9208e832504f710be8515d8c56aeb282ca91adc9d0a01134096a1da90a6d574228acb31db265ebc3e701f4e869461c420e4bb606014e4a57a4a75dc90e55

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587424758566142.txt.420
Filesize
62KB

MD5
eddd87ee089591cd1781db7f06ebb1d1

SHA1
a897b6df5b26c7d20d70691821c2f14dc1bb16d9

SHA256
df9cc88044e44ec23e60c22b361f5c27ee21f3354f6791f782fdf5e2bd03c95c

SHA512
c510df837d8486a4ed19f20bf38cb135df53f5aad9377c1056422ffd40d3900f1ff666431e86734e7d338256498ab8d8739da802f3f8a9ae101af8a851772da1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zipfkcar.5hb.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\BackupHide.pptx.420
Filesize
271KB

MD5
2a8c1474e4ac57343d63794a420905e5

SHA1
e76d87c364825f875f227132ba2470f4fc0f29ed

SHA256
a6ba378855db3e8bb53aa217f4a0f88caef90bb9bb7b6586641f2d66ae8585db

SHA512
09fe56e0a5496afced85d5461edab7edcc7231878967b14cb2439dda3637dd71031c18818b8458830169835bee5c7c4c4a22710e7e6a7cbfdb78c0e1dbe8e484

Download Submit
C:\Users\Admin\AppData\Roaming\ConvertFromUse.txt.420
Filesize
394KB

MD5
5a1aba3fde137d236d4c06e7aa42b245

SHA1
316c4d80d17f48204b7558bcddc24f159b6a1365

SHA256
11bee1e80cb5850e707f979ff9006b9d79e92847f18a2bdec2719d639d5cd510

SHA512
212bb12b96e5c3844830e7eeba3ddfaab0544ae5c93408b1ee0f48adbe990e833f72057bd6f3886240e8874b2b5e5974a5dabfd0c67b6c37d9c6fd4c509b78d5

Download Submit
C:\Users\Admin\AppData\Roaming\LockUse.txt.420
Filesize
286KB

MD5
fd27503b45afa70faa0c470857cff257

SHA1
d4574f78db85df354dd96d7c5f1e118f862c2f72

SHA256
c5de329041849d43a91b9cd8899e0ef602406bf22a99e8cc5a495d177fd02cba

SHA512
871035098e56e28ce57121226ff485b0709744e675562978dd504565c4ba6c11b6cfd163bfc3475b66800ae787b66d29ddb9510617e17f4f11f62ef953078594

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk.420
Filesize
592B

MD5
6b55baa2764730dbc0e45d0194799f0d

SHA1
cbfb99b68d01e1502355f4ea55acdd2f5bb76ebb

SHA256
6275e1e471f7099e61283f30606acafe806de8b8809e05743d590c06ee2e892f

SHA512
d6a9e660f3f0000ac67ad2551b0d984c440cb48dc0ea7adec8b81a80d7dd5cbea2da705f4b9471cfdca71c6e9f9565d38dfa0892ba296e6b0f490f06c2ccaa2d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420
Filesize
51KB

MD5
f14ebdbbc002c8ca15a7b7e139b01b25

SHA1
361c8e0f9e1480937b44cb208b65da4cd85d3d52

SHA256
c4ac4b34f8ac38a53e2eb6f1b35fefc01cd61c9c325e6ddf5f2d54de518515b8

SHA512
a9b2de5fd410db8e58b10fd8b0d854c8c9b191cc4157d38adb07600ee89110665169849d84692a749798db7063de233d837d31f1b0a85b248bad7f32ee4fb269

Download Submit
C:\Users\Admin\Links\Desktop.lnk.420
Filesize
512B

MD5
98b5a18c28eb9582c2a3c9431cee76d9

SHA1
649648758a1fa999dc6226af8444857ad13ada40

SHA256
6eee7ecce7b32b37b8c9b81c82730dd98571d6fb297dc72bbb72f1b69aa0166a

SHA512
01873b912b0c80a993125f57336a2ba5398b68ddc33bff2076f74133d7bd96e56959d929acebb75240f694b1aeb0aedb60b1a79c24033bdc1af73d930ae30f9a

Download Submit
C:\Users\Admin\Links\Downloads.lnk.420
Filesize
944B

MD5
e4e01dc37a05a80ebdf4bc20d365ce23

SHA1
024a2d69ce66255377d3e7aa92da0033f70c0794

SHA256
4ff5c6975f00f95e65037bebdb136eaa5fcef379adfa4d4416d04ab100115a82

SHA512
ea6f64722471709b6905473ef84b986c3698fc42cd240c5a4c838429ca136fffd4aeda0cefb2b20c6053d6c47552526f98be6b29a5cc0f552f4a60327a7c71ae

Download Submit
C:\Windows\System32\Seven.dll
Filesize
1.0MB

MD5
044614900c17a4bf3465dbb735fdd246

SHA1
4a6bbb32573dd50f89f944f5d1b8027b50f928b6

SHA256
7f61a42f9b86b7c0f18a396bc00595525d81738a99356b113d97514613a88624

SHA512
f3abdb50888d503cce4a03b02befab3b29e55af8c3485aa196ab32b3b0a37d181d2e7cee91025a3be6631a942a60d790063691abbab74c0336fac77b0233b08f

Download Submit
C:\Windows\System32\Seven.runtimeconfig.json
Filesize
340B

MD5
253333997e82f7d44ea8072dfae6db39

SHA1
03b9744e89327431a619505a7c72fd497783d884

SHA256
28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

SHA512
56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

Download Submit
C:\Windows\System32\SevenCopy.exe
Filesize
139KB

MD5
6503f847c3281ff85b304fc674b62580

SHA1
947536e0741c085f37557b7328b067ef97cb1a61

SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

Download Submit
C:\vcredist2010_x86.log.html.420
Filesize
80KB

MD5
b530096bb276998442fc2abf6d6ec96b

SHA1
6b0a44bbdd54311e32ad40827cb952683dbb924a

SHA256
cc005ec88ec509ebe39d762fc17fe2846b6cf32136a2466cd1b727afe9a3386f

SHA512
b342fa3982e860a147dee334df78ed30f48cebde86cb769b47890fc03cc28e12d645f30f74889f2321e322799055803076862b8df8938e296814f4f2ab4f22a5

Download Submit
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.420
Filesize
208KB

MD5
aa5b549409da72f78a0866e496c5b5e7

SHA1
b2988809a8b047cea18e5a3ba8ea69881c338ec8

SHA256
fdf61191d63abe0db185f9315ae409bc31e4e73415255aa5333846cf1ca78fd5

SHA512
79ec8a6559849846c8129ff8cc80a120ee0f14c00d762a5a73c4f55255980069a438aad6dac66b396426366ff8e7d3b2b68f014fd30f9da3a4a6074f11d35632

Download Submit
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.420
Filesize
170KB

MD5
7515dd0187a213b1e70f09c81fbb13e9

SHA1
95ec0d010840aca32444c801baaf99896add9537

SHA256
f55b2bb6070f457bf8c513a291895ff95d68f4ea2e30c4fa3fc8ef8d3afc8333

SHA512
5439f75ae447fab8ae0662200c253e0f4e4d7d2d207b03b4f9790aead4f86a2ab3d253f88a0201ced71909f036ff4b5b53d5ef834d4a2d04da0b64eb6f6b2da5

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.420
Filesize
190KB

MD5
1c858b5ea3174d9ea01eaab3f7932e7b

SHA1
5947dbf487c2afead0a579b2037c36191bae0b31

SHA256
85284ecbdff5d1eee37459fb87276cba34ae9fc50210085d7f671f266b507862

SHA512
0153aa5c716722313bdc985ffa48eebee9e1232a70697e772949f26ffe4ce4ff07e644916bc17de71f3d2daff615b7ac10885e31ce8068cea9b367631a977d1b

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.420
Filesize
170KB

MD5
800d2b6eabfa155ccd1a5322ea32b098

SHA1
1752427a39b24c00a586094d9b984983e483c317

SHA256
a2215864e2bea20d10928992b17b01f246c580e1e9acbf21720285a15a3047c6

SHA512
c40c71d4919104f6c2b5bd96fddc0bdb1d0e5dcbd6e4a73dca24a0dbcf68a6462e5234c8147a9a6b478877b5b6bc5996aa89674f57362f35b1606190cec30af7

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.420
Filesize
198KB

MD5
ec6650a1d9c425ef2ca1dc7f5454f868

SHA1
31b03084042067d19ab31c371e5c5b854735ca9a

SHA256
8cff868684e73e9cacc8f8dc7585fb144110e042e3034e3f606e5f495018b45b

SHA512
904ee570bcf474bbb68fd5a498b71f3a28b757d6b9c82104749b64808708f7539af7d4fa2350c3e2fa1979357c60f43d192e29f0ff5f51370fe549eee59ad93a

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.420
Filesize
123KB

MD5
f1d01de5dadb209394f1b8071664fd3d

SHA1
3a6d5032fd67bbec76295542fec98b0eb49ef0ee

SHA256
d44f3c35df42764de1614c02b1d47ed447d221d61a7d8d6a4a7e6c82122a0584

SHA512
5cef4eb4bfdaf2bbe277a66f1547c16de38af6a832f09fa23b6d5952627de8d13c03b0150dea7c0360505b36aba96659116912325696db9c1678bf0059a83a0e

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.420
Filesize
129KB

MD5
578253cef087c7208ad718c7ca228cff

SHA1
fe65ee5ab56e3a163f23f955e983876de729aa7a

SHA256
9c30e5df5add806d1eddfc7e7f54aecc878ae0468360fc056c158ed6d4858ea5

SHA512
9a6ec0495d135b1a988bd172fc11eec6e499a67f6462db47f179557784df7e544896dcc594217f8aad437f5b7b61f14e45fc96bf91c4c2891436f4f3ec483a00

Download Submit
C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.420
Filesize
123KB

MD5
fc9d51542d15fe1dd59a0c037ab4a2bd

SHA1
8fe0ccf4cfc7b4731042fae12bba1f30c8e59a48

SHA256
8dbc39542f76805e7f9220ac5527cb852ed7085501993cba42ccc606f66bfafe

SHA512
01bcfaaab293739ec0f45c63deeb8807398d359e5eb5cd0ff9e3816103e79cdb7149dcfc2d47726958b96d86c27109bd308b24feb8c43a2393488dd540c1a6eb

Download Submit
C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.420
Filesize
135KB

MD5
675a1a8a2f83efdc37a98b5fa86e725e

SHA1
1cb6323992586a4d690a0e0de245f2dff2eecc5f

SHA256
ac4f3a1b4e951965a0fb4b244eaa9309f2e6d0da32d46d01da4cb43411d5bc8a

SHA512
64f67bf32f246916d13280cedf11a4d3782b7bb0291b1ec45a3a43afbb96a8e0cfd223c54c3c263d447acc490c3bae8232bcb9601cbda10bf2dab8da7738553d

Download Submit
memory/460-0-0x000001A671F70000-0x000001A671F92000-memory.dmp

Filesize
136KB

Download
memory/460-15-0x00007FF890090000-0x00007FF890B51000-memory.dmp

Filesize
10.8MB

Download
memory/460-11-0x000001A672120000-0x000001A672130000-memory.dmp

Filesize
64KB

Download
memory/460-12-0x000001A672120000-0x000001A672130000-memory.dmp

Filesize
64KB

Download
memory/460-10-0x00007FF890090000-0x00007FF890B51000-memory.dmp

Filesize
10.8MB

Download
memory/17984-398-0x00007FF64E960000-0x00007FF64E9C7000-memory.dmp

Filesize
412KB

Download
memory/18180-399-0x00007FF64E960000-0x00007FF64E9C7000-memory.dmp

Filesize
412KB

Download