57a08ad2522023dbce1976039ae67e5c7c84aa334061ca876f3bc8ba1b0c6d57

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Seven.exe
Size

139KB
MD5

6503f847c3281ff85b304fc674b62580
SHA1

947536e0741c085f37557b7328b067ef97cb1a61
SHA256

afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512

abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP

3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Seven.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Seven.exe
Deletes itself 1 IoCs

Processes:

SevenCopy.exe

pid process

3372 SevenCopy.exe
Executes dropped EXE 4 IoCs

Processes:

SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exe

pid process

3372 SevenCopy.exe
17356 SevenCopy.exe
4720 SevenCopy.exe
5168 SevenCopy.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Seven.exe

pid	process
3372	SevenCopy.exe

pid	process
3372	SevenCopy.exe
17356	SevenCopy.exe
4720	SevenCopy.exe
5168	SevenCopy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Seven.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 11 IoCs

Processes:

SevenCopy.exeSevenCopy.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	SevenCopy.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SevenCopy.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini	SevenCopy.exe
File opened for modification	C:\Program Files\desktop.ini	SevenCopy.exe

Drops file in System32 directory 8 IoCs

Processes:

cmd.execmd.execmd.exeSevenCopy.exe

description	ioc	process
File created	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File created	C:\Windows\System32\SevenCopy.exe	cmd.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	cmd.exe
File created	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\Seven.dll	cmd.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe

Drops file in Program Files directory 64 IoCs

Processes:

SevenCopy.exe

description	ioc	process
File opened for modification	C:\Program Files\InitializeEnter.wma	SevenCopy.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluEmptyStateCCFiles_280x192.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line_2x.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files\MeasureSwitch.dwg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_selectlist_checkmark_18.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons2x.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg	SevenCopy.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	SevenCopy.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up-pressed.gif	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\scan_poster.jpg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\empty.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_field_grabber.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\tr_get.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\el_get.svg	SevenCopy.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\es-es\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-hover.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-hover.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_hover.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fil_get.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-focus_32.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x_2x.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\next-arrow-hover.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-selector.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\zh-cn\ui-strings.js	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png	SevenCopy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pl-pl\ui-strings.js	SevenCopy.exe

Drops file in Windows directory 2 IoCs

Processes:

SevenCopy.exeSevenCopy.exe

description ioc process

File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe
File opened for modification C:\Windows\bfsvc.exe SevenCopy.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3936 powershell.exe
3936 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3936 powershell.exe

description	ioc	process
File opened for modification	C:\Windows\bfsvc.exe	SevenCopy.exe
File opened for modification	C:\Windows\bfsvc.exe	SevenCopy.exe

pid	process
3936	powershell.exe
3936	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3936	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Seven.exeSevenCopy.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4616 wrote to memory of 3936	4616	Seven.exe	powershell.exe
PID 4616 wrote to memory of 3936	4616	Seven.exe	powershell.exe
PID 4616 wrote to memory of 1504	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 1504	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 1004	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 1004	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 4408	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 4408	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 404	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 404	4616	Seven.exe	cmd.exe
PID 4616 wrote to memory of 3372	4616	Seven.exe	SevenCopy.exe
PID 4616 wrote to memory of 3372	4616	Seven.exe	SevenCopy.exe
PID 3372 wrote to memory of 2268	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 2268	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 3264	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 3264	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 3896	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 3896	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 4312	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 4312	3372	SevenCopy.exe	cmd.exe
PID 3264 wrote to memory of 1536	3264	cmd.exe	choice.exe
PID 3264 wrote to memory of 1536	3264	cmd.exe	choice.exe
PID 2268 wrote to memory of 4000	2268	cmd.exe	choice.exe
PID 2268 wrote to memory of 4000	2268	cmd.exe	choice.exe
PID 3372 wrote to memory of 5064	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 5064	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 392	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 392	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 1376	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 1376	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 1764	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 1764	3372	SevenCopy.exe	cmd.exe
PID 3896 wrote to memory of 3252	3896	cmd.exe	choice.exe
PID 3896 wrote to memory of 3252	3896	cmd.exe	choice.exe
PID 4312 wrote to memory of 2128	4312	cmd.exe	choice.exe
PID 4312 wrote to memory of 2128	4312	cmd.exe	choice.exe
PID 3372 wrote to memory of 5012	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 5012	3372	SevenCopy.exe	cmd.exe
PID 392 wrote to memory of 1760	392	cmd.exe	choice.exe
PID 392 wrote to memory of 1760	392	cmd.exe	choice.exe
PID 3372 wrote to memory of 880	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 880	3372	SevenCopy.exe	cmd.exe
PID 5064 wrote to memory of 772	5064	cmd.exe	choice.exe
PID 5064 wrote to memory of 772	5064	cmd.exe	choice.exe
PID 1376 wrote to memory of 4404	1376	cmd.exe	choice.exe
PID 1376 wrote to memory of 4404	1376	cmd.exe	choice.exe
PID 3372 wrote to memory of 4440	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 4440	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 744	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 744	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 2020	3372	SevenCopy.exe	cmd.exe
PID 3372 wrote to memory of 2020	3372	SevenCopy.exe	cmd.exe
PID 5012 wrote to memory of 3688	5012	cmd.exe	choice.exe
PID 5012 wrote to memory of 3688	5012	cmd.exe	choice.exe
PID 1764 wrote to memory of 3200	1764	cmd.exe	choice.exe
PID 1764 wrote to memory of 3200	1764	cmd.exe	choice.exe
PID 880 wrote to memory of 500	880	cmd.exe	choice.exe
PID 880 wrote to memory of 500	880	cmd.exe	choice.exe
PID 4440 wrote to memory of 1148	4440	cmd.exe	choice.exe
PID 4440 wrote to memory of 1148	4440	cmd.exe	choice.exe
PID 744 wrote to memory of 4252	744	cmd.exe	choice.exe
PID 744 wrote to memory of 4252	744	cmd.exe	choice.exe
PID 2020 wrote to memory of 4952	2020	cmd.exe	choice.exe
PID 2020 wrote to memory of 4952	2020	cmd.exe	choice.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
2⤵
PID:1504

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe
2⤵
- Drops file in System32 directory
PID:1004

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
2⤵
- Drops file in System32 directory
PID:4408

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Drops file in System32 directory
PID:404

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3372

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\DumpStack.log.tmp"
3⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\libsmartscreen.dll"
3⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1536

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:3896

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
3⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:5064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
3⤵
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1760

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3688

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:500

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1148

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4952

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:2368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:1972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
3⤵
PID:2492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:4676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:2456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3460

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\MeasureGroup.odt"
3⤵
PID:4912

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
3⤵
PID:1848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\PushFind.asp"
3⤵
PID:2900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\TestPush.txt"
3⤵
PID:2840

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ApproveRename.xlsx"
3⤵
PID:4044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13112

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
3⤵
PID:4452

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13240

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
3⤵
PID:2308

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
3⤵
PID:4628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
3⤵
PID:1760

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13372

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\SyncApprove.csv"
3⤵
PID:392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
3⤵
PID:3940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\CheckpointGrant.pdf"
3⤵
PID:1844

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13432

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ConvertFromUnlock.xlsx"
3⤵
PID:2676

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3788

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
3⤵
PID:3244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13400

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
3⤵
PID:1940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13416

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\SyncOptimize.bmp"
3⤵
PID:3692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\GroupPing.jpg"
3⤵
PID:1596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
3⤵
PID:2396

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13552

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\OutCheckpoint.bmp"
3⤵
PID:2268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SubmitOptimize.bmp"
3⤵
PID:2716

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\UseSearch.png"
3⤵
PID:1548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\CompleteOut.php"
3⤵
PID:5012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1708958184.txt"
3⤵
PID:3156

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13480

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
3⤵
PID:3604

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4733.txt"
3⤵
PID:2612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI476E.txt"
3⤵
PID:1344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4612

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4733.txt"
3⤵
PID:3708

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI476E.txt"
3⤵
PID:656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13516

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
3⤵
PID:2204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13456

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240226_142806984.html"
3⤵
PID:4376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
3⤵
PID:448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13464

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
3⤵
PID:4372

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13876

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"
3⤵
PID:5124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
3⤵
PID:5148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13944

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
3⤵
PID:5160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13580

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
3⤵
PID:5184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2456

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
3⤵
PID:5204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
3⤵
PID:5244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13800

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
3⤵
PID:5272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
3⤵
PID:5352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13728

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml"
3⤵
PID:5368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
3⤵
PID:5420

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
3⤵
PID:5440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
3⤵
PID:5464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
3⤵
PID:5496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
3⤵
PID:5540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
3⤵
PID:5576

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
3⤵
PID:5632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
3⤵
PID:5656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
3⤵
PID:5668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13788

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
3⤵
PID:5704

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13684

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
3⤵
PID:5744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
3⤵
PID:5804

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14016

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
3⤵
PID:5852

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
3⤵
PID:5904

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
3⤵
PID:5984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
3⤵
PID:6052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
3⤵
PID:6088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
3⤵
PID:6112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
3⤵
PID:6132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
3⤵
PID:5136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
3⤵
PID:5456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13952

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
3⤵
PID:5536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
3⤵
PID:5552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
3⤵
PID:3716

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
3⤵
PID:5596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14076

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
3⤵
PID:5848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
3⤵
PID:5900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
3⤵
PID:6128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14248

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
3⤵
PID:4684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
3⤵
PID:6156

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14172

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
3⤵
PID:6168

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14164

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
3⤵
PID:6184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
3⤵
PID:6196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14296

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
3⤵
PID:6208

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14452

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
3⤵
PID:6220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
3⤵
PID:6256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15436

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
3⤵
PID:6268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14044

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
3⤵
PID:6284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14436

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
3⤵
PID:6336

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
3⤵
PID:6356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
3⤵
PID:6368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14556

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
3⤵
PID:6384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
3⤵
PID:6448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
3⤵
PID:6508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14244

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
3⤵
PID:6524

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14796

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
3⤵
PID:6536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14288

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
3⤵
PID:6548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14500

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
3⤵
PID:6560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
3⤵
PID:6572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
3⤵
PID:6596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
3⤵
PID:6608

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
3⤵
PID:6628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
3⤵
PID:6648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15336

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
3⤵
PID:6660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
3⤵
PID:6672

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
3⤵
PID:6684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15984

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
3⤵
PID:6696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14516

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
3⤵
PID:6708

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
3⤵
PID:6720

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
3⤵
PID:6740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15004

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
3⤵
PID:6772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15600

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
3⤵
PID:6800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15124

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
3⤵
PID:6836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
3⤵
PID:6848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
3⤵
PID:6860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
3⤵
PID:6872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14460

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
3⤵
PID:6888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15344

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
3⤵
PID:6908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
3⤵
PID:6924

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
3⤵
PID:6936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14788

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
3⤵
PID:6956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15460

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
3⤵
PID:6972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15388

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
3⤵
PID:6988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
3⤵
PID:7000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
3⤵
PID:7020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
3⤵
PID:7040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
3⤵
PID:7064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14724

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
3⤵
PID:7084

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15568

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
3⤵
PID:7100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
3⤵
PID:7120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
3⤵
PID:7148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14772

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
3⤵
PID:7160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15664

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534304192412982.txt"
3⤵
PID:2540

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15640

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534304947485472.txt"
3⤵
PID:6108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305585063974.txt"
3⤵
PID:6332

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305838784240.txt"
3⤵
PID:6592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305993432169.txt"
3⤵
PID:6680

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306202011291.txt"
3⤵
PID:6824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15236

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306307497107.txt"
3⤵
PID:7172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14468

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306422958618.txt"
3⤵
PID:7192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306507732240.txt"
3⤵
PID:7204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14208

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306555234051.txt"
3⤵
PID:7224

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14660

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306724923844.txt"
3⤵
PID:7260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15148

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306797763586.txt"
3⤵
PID:7280

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15092

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306840988562.txt"
3⤵
PID:7308

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15084

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534307017966781.txt"
3⤵
PID:7324

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14476

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534308836037735.txt"
3⤵
PID:7356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534309389034619.txt"
3⤵
PID:7376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534317613489955.txt"
3⤵
PID:7396

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15044

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534317961932866.txt"
3⤵
PID:7424

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14764

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534318250199895.txt"
3⤵
PID:7444

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14716

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534318559014940.txt"
3⤵
PID:7464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15020

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534319484254322.txt"
3⤵
PID:7480

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320370810191.txt"
3⤵
PID:7492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320433840509.txt"
3⤵
PID:7508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15496

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320787987604.txt"
3⤵
PID:7620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534321887734465.txt"
3⤵
PID:7664

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534322186603302.txt"
3⤵
PID:7692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534322486594540.txt"
3⤵
PID:7768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534322811216526.txt"
3⤵
PID:7780

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534323118972512.txt"
3⤵
PID:7856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15428

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534325129811261.txt"
3⤵
PID:7880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534373105354107.txt"
3⤵
PID:7900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534373405515784.txt"
3⤵
PID:7920

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534376434371485.txt"
3⤵
PID:7952

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15768

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534376443638102.txt"
3⤵
PID:7964

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15172

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
3⤵
PID:7976

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15752

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
3⤵
PID:7988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:8000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\pkcs11.txt"
3⤵
PID:8012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15320

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\SiteSecurityServiceState.txt"
3⤵
PID:8024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\update100[1].xml"
3⤵
PID:8044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15824

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\known_providers_download_v1[1].xml"
3⤵
PID:8060

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15672

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
3⤵
PID:8084

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15060

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
3⤵
PID:8100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
3⤵
PID:8112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
3⤵
PID:8124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15864

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
3⤵
PID:8148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15288

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
3⤵
PID:8164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15840

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
3⤵
PID:6668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
3⤵
PID:6280

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15076

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4674030e-59d7-497d-98d6-56a048708d39}\0.0.filtertrie.intermediate.txt"
3⤵
PID:6932

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15760

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4674030e-59d7-497d-98d6-56a048708d39}\0.1.filtertrie.intermediate.txt"
3⤵
PID:3288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4674030e-59d7-497d-98d6-56a048708d39}\0.2.filtertrie.intermediate.txt"
3⤵
PID:7156

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14568

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ca6f6baa-a083-4f19-afba-44f740a3b31d}\0.0.filtertrie.intermediate.txt"
3⤵
PID:5652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15196

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ca6f6baa-a083-4f19-afba-44f740a3b31d}\0.1.filtertrie.intermediate.txt"
3⤵
PID:7416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14756

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ca6f6baa-a083-4f19-afba-44f740a3b31d}\0.2.filtertrie.intermediate.txt"
3⤵
PID:6656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14428

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe1f2851-ffca-4750-ab86-7885527899b0}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8232

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe1f2851-ffca-4750-ab86-7885527899b0}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe1f2851-ffca-4750-ab86-7885527899b0}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\appsconversions.txt"
3⤵
PID:8272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16008

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\appsglobals.txt"
3⤵
PID:8292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\appssynonyms.txt"
3⤵
PID:8316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\settingsconversions.txt"
3⤵
PID:8336

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\settingsglobals.txt"
3⤵
PID:8368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15108

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9da409e3-1501-4b80-b9e5-05e99d54d7a1}\settingssynonyms.txt"
3⤵
PID:8384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3820ea15-52b4-4e59-b13e-e1ee641f148c}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8444

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3820ea15-52b4-4e59-b13e-e1ee641f148c}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15444

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3820ea15-52b4-4e59-b13e-e1ee641f148c}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8476

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15028

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15012

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8576

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
3⤵
PID:8600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
3⤵
PID:8640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15328

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
3⤵
PID:8652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15272

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
3⤵
PID:8664

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
3⤵
PID:8684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
3⤵
PID:8740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15648

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
3⤵
PID:8756

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
3⤵
PID:8772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
3⤵
PID:8788

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
3⤵
PID:8808

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15608

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
3⤵
PID:8824

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
3⤵
PID:8844

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14576

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
3⤵
PID:8868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
3⤵
PID:8888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15140

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.73.6_0\128.png"
3⤵
PID:8908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xml"
3⤵
PID:8924

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14584

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\L8PNJOBX\www.bing[1].xml"
3⤵
PID:8936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
3⤵
PID:8960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15576

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
3⤵
PID:9136

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15164

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
3⤵
PID:9156

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15556

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
3⤵
PID:9168

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
3⤵
PID:9184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15364

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
3⤵
PID:9196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
3⤵
PID:9208

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15976

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
3⤵
PID:6732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
3⤵
PID:4440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
3⤵
PID:6856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
3⤵
PID:6920

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
3⤵
PID:6968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15592

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
3⤵
PID:6996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16500

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
3⤵
PID:7276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15244

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
3⤵
PID:1488

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
3⤵
PID:6192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
3⤵
PID:7596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
3⤵
PID:6760

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
3⤵
PID:9236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15992

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
3⤵
PID:9248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14864

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
3⤵
PID:9264

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14684

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
3⤵
PID:9292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
3⤵
PID:9324

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15872

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
3⤵
PID:9352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
3⤵
PID:9368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
3⤵
PID:9408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14636

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
3⤵
PID:9428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
3⤵
PID:9448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15052

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
3⤵
PID:9504

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
3⤵
PID:9524

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
3⤵
PID:9544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13768

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
3⤵
PID:9560

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
3⤵
PID:9584

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15372

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
3⤵
PID:9600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13620

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
3⤵
PID:9624

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15452

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
3⤵
PID:7248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
3⤵
PID:7296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13736

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
3⤵
PID:7816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
3⤵
PID:7876

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
3⤵
PID:7972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
3⤵
PID:8212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15468

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
3⤵
PID:8308

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15296

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
3⤵
- Executes dropped EXE
PID:17356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2960

C:\Windows\System32\SevenCopy.exe
C:\Windows\System32\SevenCopy.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
PID:4720

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587402818800414.txt"
2⤵
PID:6040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:13428

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587403064032086.txt"
2⤵
PID:3312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:5412

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
2⤵
- Executes dropped EXE
PID:5168

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.1.filtertrie.intermediate.txt.420
Filesize
16B

MD5
e8aaa566651759e399714d464cdfb390

SHA1
373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

SHA256
1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

SHA512
23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{ce768a4c-504b-440a-b79c-5ab95e593c51}\0.2.filtertrie.intermediate.txt.420
Filesize
16B

MD5
209371fb985ae536f7a01b2cbf06fdeb

SHA1
6e5d735e5a6aef442f3342931eaf47d505763578

SHA256
4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

SHA512
53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534305993432169.txt.420
Filesize
77KB

MD5
db44cb2671c7026f63884176766183d1

SHA1
7851453d3ea5e376b55fd7dbe14cf2cb947e9167

SHA256
d2330fe9ab0056f4e3e1d8c6cf9f496e583852eb79de3baae825f077c8d60d5f

SHA512
e5ea725104677c0898e70d44e742196c9a8f24418712a3d5ee9f8946798c94e141eb57050deefbacfb4813ef5f3b16256414637290149fa93fa65f6625d253fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534306555234051.txt.420
Filesize
64KB

MD5
11ac6741b0cd7bcd3b9db6d37810ac50

SHA1
6d18291d18a9ea517b76b75a6d422314d21826d6

SHA256
2ee2af334d7553d06d93619d903d2041c6a9853fb59d10a9b03c54825794feab

SHA512
e47db917c98276a01fc9cef626cd457e74297ffeb48160cc5072fe760b6f724607c655cea15541d8b3db67126322cb6fbc7c548955bc33f30cc2f087f5414ed3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534320433840509.txt.420
Filesize
63KB

MD5
cb2b816748fd39bd5bfc656a1be9d6a0

SHA1
62565896f63691f980fec52952e3335ee8b865d1

SHA256
09481df47b3c1bf52da64c8e07b30bc0a6aaa75823d734315a31ba88a67a7c57

SHA512
55e9ea5f30ba88e6adfc5845b86375999d7e9ed906bde0cf3f35b63b537965a13996d2e5578991fd76149bd32cb1393e46bf732e8943b77328d1482898468298

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133534373405515784.txt.420
Filesize
74KB

MD5
fddc513bd21beef0e8f2aea6a5ad1a0b

SHA1
5d16b0701d6c12b7046bd4f7869a4cb837e847d6

SHA256
a2a13a8523ab383728401c59fa556c9ee53ea54b73b4feef0bea17b432fe6e30

SHA512
07b146f3bb5216fd6817fddafc56e4b67d1a40d8c7a20fafc5c38903aa54468832aabcedcf69a1a9691322e0d24e98b74cd03928758144177c37fc2fb22fd93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
Filesize
139KB

MD5
6503f847c3281ff85b304fc674b62580

SHA1
947536e0741c085f37557b7328b067ef97cb1a61

SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_epmyejjl.ss1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\Seven.dll
Filesize
1.0MB

MD5
4e0813b6cf8252db48a9d9735ea80364

SHA1
addaa968e917a607ee47b4a82564aeb2c6750cb1

SHA256
baca452e4559e44c7e9461aca7231ccc439b23ec1783b749b694bbdb02187eaf

SHA512
8c243724845d98c7f76f9886efb58f42c9fd8ab05b1910f6a098eb2983e0b69fd83e9f7201e7ae1c579b06ca3a9704cb69cd1c4e0dfd5f782bcf086d44f1ef9e

Download Submit
C:\Windows\System32\Seven.runtimeconfig.json
Filesize
340B

MD5
253333997e82f7d44ea8072dfae6db39

SHA1
03b9744e89327431a619505a7c72fd497783d884

SHA256
28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

SHA512
56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

Download Submit
memory/3936-11-0x0000021AF5020000-0x0000021AF5030000-memory.dmp

Filesize
64KB

Download
memory/3936-16-0x00007FFE88960000-0x00007FFE89421000-memory.dmp

Filesize
10.8MB

Download
memory/3936-12-0x0000021AF5020000-0x0000021AF5030000-memory.dmp

Filesize
64KB

Download
memory/3936-13-0x0000021AF5020000-0x0000021AF5030000-memory.dmp

Filesize
64KB

Download
memory/3936-10-0x00007FFE88960000-0x00007FFE89421000-memory.dmp

Filesize
10.8MB

Download
memory/3936-0-0x0000021AF5030000-0x0000021AF5052000-memory.dmp

Filesize
136KB

Download