4d9d50f47898d76d5ed5449c744f35b557677e44c5d82c7432393101b40ad9cc

Analysis

max time kernel
231s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Seven.exe
Size

139KB
MD5

6503f847c3281ff85b304fc674b62580
SHA1

947536e0741c085f37557b7328b067ef97cb1a61
SHA256

afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512

abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP

3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Seven.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Seven.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation Seven.exe
Deletes itself 1 IoCs

Processes:

SevenCopy.exe

pid process

1572 SevenCopy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	Seven.exe

Executes dropped EXE 64 IoCs

Processes:

SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exe

pid	process
1572	SevenCopy.exe
11484	SevenCopy.exe
12156	SevenCopy.exe
8556	SevenCopy.exe
6532	SevenCopy.exe
11792	SevenCopy.exe
6332	SevenCopy.exe
8172	SevenCopy.exe
2576	SevenCopy.exe
5764	SevenCopy.exe
956	SevenCopy.exe
1632	SevenCopy.exe
10840	SevenCopy.exe
17376	SevenCopy.exe
16964	SevenCopy.exe
17280	SevenCopy.exe
15848	SevenCopy.exe
8716	SevenCopy.exe
8208	SevenCopy.exe
1600	SevenCopy.exe
15940	SevenCopy.exe
17044	SevenCopy.exe
16416	SevenCopy.exe
15676	SevenCopy.exe
15944	SevenCopy.exe
3320	SevenCopy.exe
15364	SevenCopy.exe
4356	SevenCopy.exe
7032	SevenCopy.exe
12216	SevenCopy.exe
17832	SevenCopy.exe
13168	SevenCopy.exe
17300	SevenCopy.exe
13816	SevenCopy.exe
15964	SevenCopy.exe
1000	SevenCopy.exe
6924	SevenCopy.exe
9996	SevenCopy.exe
4152	SevenCopy.exe
7064	SevenCopy.exe
7668	SevenCopy.exe
17732	SevenCopy.exe
17660	SevenCopy.exe
14812	SevenCopy.exe
15688	SevenCopy.exe
11552	SevenCopy.exe
16504	SevenCopy.exe
16124	SevenCopy.exe
8936	SevenCopy.exe
15428	SevenCopy.exe
7924	SevenCopy.exe
17764	SevenCopy.exe
16904	SevenCopy.exe
16848	SevenCopy.exe
5996	SevenCopy.exe
16912	SevenCopy.exe
16032	SevenCopy.exe
16700	SevenCopy.exe
17856	SevenCopy.exe
17292	SevenCopy.exe
15508	SevenCopy.exe
7792	SevenCopy.exe
17488	SevenCopy.exe
10868	SevenCopy.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Seven.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Seven.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

Processes:

SevenCopy.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SevenCopy.exe

Drops file in System32 directory 64 IoCs

Processes:

description	ioc	process
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt
File opened for modification	C:\Windows\System32\Seven.dll	cmd.exe
File created	C:\Windows\system32\EncryptedLog.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt	SevenCopy.exe
File created	C:\Windows\system32\KeyAndIV.txt
File created	C:\Windows\system32\EncryptedLog.txt
File created	C:\Windows\system32\KeyAndIV.txt

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

2140 powershell.exe
2140 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2140 powershell.exe

pid	process
2140	powershell.exe
2140	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2140	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Seven.execmd.execmd.execmd.exeSevenCopy.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4396 wrote to memory of 2140	4396	Seven.exe	powershell.exe
PID 4396 wrote to memory of 2140	4396	Seven.exe	powershell.exe
PID 4396 wrote to memory of 396	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 396	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 5040	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 5040	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 4948	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 4948	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 388	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 388	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 4104	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 4104	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 2296	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 2296	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 3272	4396	Seven.exe	cmd.exe
PID 4396 wrote to memory of 3272	4396	Seven.exe	cmd.exe
PID 3272 wrote to memory of 4832	3272	cmd.exe	attrib.exe
PID 3272 wrote to memory of 4832	3272	cmd.exe	attrib.exe
PID 4948 wrote to memory of 1976	4948	cmd.exe	attrib.exe
PID 4948 wrote to memory of 1976	4948	cmd.exe	attrib.exe
PID 2296 wrote to memory of 4660	2296	cmd.exe	attrib.exe
PID 2296 wrote to memory of 4660	2296	cmd.exe	attrib.exe
PID 4396 wrote to memory of 1572	4396	Seven.exe	SevenCopy.exe
PID 4396 wrote to memory of 1572	4396	Seven.exe	SevenCopy.exe
PID 1572 wrote to memory of 2684	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 2684	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3752	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3752	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 2648	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 2648	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 1936	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 1936	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 1296	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 1296	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 5024	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 5024	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 4516	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 4516	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3544	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3544	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3212	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3212	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3672	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3672	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 4176	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 4176	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 456	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 456	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 1484	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 1484	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3668	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3668	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3448	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 3448	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 2340	1572	SevenCopy.exe	cmd.exe
PID 1572 wrote to memory of 2340	1572	SevenCopy.exe	cmd.exe
PID 3448 wrote to memory of 4844	3448	cmd.exe	choice.exe
PID 3448 wrote to memory of 4844	3448	cmd.exe	choice.exe
PID 3672 wrote to memory of 3860	3672	cmd.exe	choice.exe
PID 3672 wrote to memory of 3860	3672	cmd.exe	choice.exe
PID 2684 wrote to memory of 1712	2684	cmd.exe	choice.exe
PID 2684 wrote to memory of 1712	2684	cmd.exe	choice.exe
PID 3668 wrote to memory of 3392	3668	cmd.exe	choice.exe
PID 3668 wrote to memory of 3392	3668	cmd.exe	choice.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

Seven.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

4832 attrib.exe
1976 attrib.exe
4660 attrib.exe

pid	process
4832	attrib.exe
1976	attrib.exe
4660	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
2⤵
PID:396

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe
2⤵
PID:5040

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4948

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\SevenCopy.exe
3⤵
- Views/modifies file attributes
PID:1976

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
2⤵
- Drops file in System32 directory
PID:388

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
2⤵
PID:4104

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.dll
3⤵
- Views/modifies file attributes
PID:4660

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
2⤵
- Suspicious use of WriteProcessMemory
PID:3272

C:\Windows\system32\attrib.exe
attrib +h C:\Windows\System32\Seven.runtimeconfig.json
3⤵
- Views/modifies file attributes
PID:4832

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
3⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1712

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
3⤵
PID:3752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
3⤵
PID:2648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
3⤵
PID:1936

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
3⤵
PID:1296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
3⤵
PID:5024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3612

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
3⤵
PID:4516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
3⤵
PID:3544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:3212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4916

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3860

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
3⤵
PID:4176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5116

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
3⤵
PID:1484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2432

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
3⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
3⤵
PID:2340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2904

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
3⤵
PID:3556

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\RedoSplit.jpg"
3⤵
PID:3444

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ResetConfirm.jpg"
3⤵
PID:4576

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\SaveProtect.html"
3⤵
PID:2088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12916

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\WatchMount.lnk"
3⤵
PID:1980

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7456

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ApproveCompress.ppt"
3⤵
PID:1464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
3⤵
PID:4632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15208

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CompleteUnlock.xlsx"
3⤵
PID:1640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12956

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\EditBlock.pptx"
3⤵
PID:3384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7824

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
3⤵
PID:3012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12940

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\LockUnlock.pptx"
3⤵
PID:1816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13236

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
3⤵
PID:2844

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\OutConvertFrom.ppt"
3⤵
PID:2140

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ReadCompare.ppt"
3⤵
PID:1036

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
3⤵
PID:2316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RemoveCheckpoint.doc"
3⤵
PID:4244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RestoreUndo.xml"
3⤵
PID:1636

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:7852

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
3⤵
PID:3872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\WriteUninstall.txt"
3⤵
PID:3284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15236

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\BlockStop.html"
3⤵
PID:2608

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ClearConvert.php"
3⤵
PID:4800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\CopyResize.xls"
3⤵
PID:2456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\RenameWrite.jpg"
3⤵
PID:1336

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ResizeAssert.pptx"
3⤵
PID:5236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15808

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
3⤵
PID:5260

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15288

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
3⤵
PID:5288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ImportMeasure.png"
3⤵
PID:5300

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RegisterGrant.pdf"
3⤵
PID:5316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15244

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ResetConvertFrom.csv"
3⤵
PID:5340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4888

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\UninstallProtect.doc"
3⤵
PID:5356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15264

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\DenyGrant.png"
3⤵
PID:5376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\GetSubmit.jpg"
3⤵
PID:5388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
3⤵
PID:5400

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ConvertRegister.asp"
3⤵
PID:5416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15332

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\GrantClose.jpg"
3⤵
PID:5428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResolveSet.odt"
3⤵
PID:5448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15312

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\RestoreRename.txt"
3⤵
PID:5468

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SubmitEnter.doc"
3⤵
PID:5484

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15296

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713511184.txt"
3⤵
PID:5500

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4420

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
3⤵
PID:5520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:456

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29AC.txt"
3⤵
PID:5548

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:512

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29CD.txt"
3⤵
PID:5564

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29AC.txt"
3⤵
PID:5592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15340

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29CD.txt"
3⤵
PID:5616

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4504

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
3⤵
PID:5636

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5036

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
3⤵
PID:5808

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_071507928.html"
3⤵
PID:5828

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2292

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
3⤵
PID:5840

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15784

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
3⤵
PID:5860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1996

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
3⤵
PID:5888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
3⤵
PID:5908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2372

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
3⤵
PID:5928

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15304

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
3⤵
PID:5944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15348

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
3⤵
PID:5960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12704

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
3⤵
PID:5972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10480

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
3⤵
PID:5988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
3⤵
PID:6004

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:5104

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
3⤵
PID:6016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
3⤵
PID:6028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11800

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
3⤵
PID:6044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
3⤵
PID:6056

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3108

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
3⤵
PID:6068

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
3⤵
PID:6080

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
3⤵
PID:6092

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10716

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
3⤵
PID:6108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16032

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
3⤵
PID:6120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
3⤵
PID:6132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10324

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
3⤵
PID:2900

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
3⤵
PID:4288

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15596

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
3⤵
PID:636

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1844

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
3⤵
PID:640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
3⤵
PID:2056

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
3⤵
PID:5440

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15876

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
3⤵
PID:5492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12684

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
3⤵
PID:5608

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14648

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
3⤵
PID:5668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
3⤵
PID:5516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10060

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
3⤵
PID:6152

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:12232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
3⤵
PID:6180

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9960

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
3⤵
PID:6192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11284

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
3⤵
PID:6208

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13796

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
3⤵
PID:6236

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
3⤵
PID:6252

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:9752

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
3⤵
PID:6276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
3⤵
PID:6296

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
3⤵
PID:6312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:11276

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
3⤵
PID:6332

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
3⤵
PID:6356

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
3⤵
PID:6380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14664

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
3⤵
PID:6392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
3⤵
PID:6416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
3⤵
PID:6444

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4132

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
3⤵
PID:6904

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4412

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
3⤵
PID:6924

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
3⤵
PID:6940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
3⤵
PID:6956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15684

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
3⤵
PID:6968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1780

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
3⤵
PID:6988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16048

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
3⤵
PID:7000

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16064

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
3⤵
PID:7020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16040

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
3⤵
PID:7040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1416

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
3⤵
PID:7052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14684

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
3⤵
PID:7064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15516

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
3⤵
PID:7076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
3⤵
PID:7088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15716

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
3⤵
PID:7104

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:436

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
3⤵
PID:7116

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16080

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
3⤵
PID:7128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
3⤵
PID:7144

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15668

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
3⤵
PID:7156

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3472

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
3⤵
PID:5628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15468

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
3⤵
PID:5856

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:768

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
3⤵
PID:5880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15384

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
3⤵
PID:5476

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3232

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
3⤵
PID:5884

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
3⤵
PID:5924

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
3⤵
PID:5848

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
3⤵
PID:6204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
3⤵
PID:6412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15944

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
3⤵
PID:5984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3180

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
3⤵
PID:6040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15920

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
3⤵
PID:6088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15500

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
3⤵
PID:6128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16388

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
3⤵
PID:4188

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
3⤵
PID:5208

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
3⤵
PID:5412

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16168

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
3⤵
PID:6272

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4600

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
3⤵
PID:6388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16396

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
3⤵
PID:7172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16096

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
3⤵
PID:7192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:228

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
3⤵
PID:7212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
3⤵
PID:7232

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2616

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
3⤵
PID:7248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
3⤵
PID:7268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
3⤵
PID:7280

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4624

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
3⤵
PID:7292

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3620

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
3⤵
PID:7304

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16680

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
3⤵
PID:7316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16716

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
3⤵
PID:7328

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
3⤵
PID:7340

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839446140267.txt"
3⤵
PID:7352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840135824682.txt"
3⤵
PID:7368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16732

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840503567844.txt"
3⤵
PID:7392

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16152

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840700580475.txt"
3⤵
PID:7424

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15792

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840746051862.txt"
3⤵
PID:7448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15736

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840805647182.txt"
3⤵
PID:7468

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16016

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579841000679404.txt"
3⤵
PID:7492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4060

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579841044461171.txt"
3⤵
PID:7512

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15912

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579841103643755.txt"
3⤵
PID:7532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16024

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844203170839.txt"
3⤵
PID:7552

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3520

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847726247611.txt"
3⤵
PID:7572

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15604

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848027779190.txt"
3⤵
PID:7592

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15832

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848328601309.txt"
3⤵
PID:7612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848720705765.txt"
3⤵
PID:7632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16588

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579849175070968.txt"
3⤵
PID:7652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15400

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579849319456479.txt"
3⤵
PID:7672

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579850631342657.txt"
3⤵
PID:7692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579850930939937.txt"
3⤵
PID:7712

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15816

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579851238643505.txt"
3⤵
PID:7732

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579851531594146.txt"
3⤵
PID:7752

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15824

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579852325460694.txt"
3⤵
PID:7772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579863163863286.txt"
3⤵
PID:7792

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15588

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
3⤵
PID:7816

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16280

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
3⤵
PID:7836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1560

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:7860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:112

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l594d31n.default-release\pkcs11.txt"
3⤵
PID:7872

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\known_providers_download_v1[1].xml"
3⤵
PID:7948

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\update100[1].xml"
3⤵
PID:7960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16144

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
3⤵
PID:7972

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
3⤵
PID:7984

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
3⤵
PID:7996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4988

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
3⤵
PID:8008

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
3⤵
PID:8020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
3⤵
PID:8032

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
3⤵
PID:8052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3488

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
3⤵
PID:8064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16200

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{51622a83-c5a1-47aa-894c-769a99748b42}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15848

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{51622a83-c5a1-47aa-894c-769a99748b42}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8096

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16596

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{51622a83-c5a1-47aa-894c-769a99748b42}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15492

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6c613df7-8dbd-45ee-a171-440cf264e3f5}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8128

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15628

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6c613df7-8dbd-45ee-a171-440cf264e3f5}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16784

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6c613df7-8dbd-45ee-a171-440cf264e3f5}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fd820bc5-80b5-4018-af8a-9c592792a5b5}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15652

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fd820bc5-80b5-4018-af8a-9c592792a5b5}\0.1.filtertrie.intermediate.txt"
3⤵
PID:6596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3632

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fd820bc5-80b5-4018-af8a-9c592792a5b5}\0.2.filtertrie.intermediate.txt"
3⤵
PID:6660

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3752

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\appsconversions.txt"
3⤵
PID:5820

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\appsglobals.txt"
3⤵
PID:6428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3744

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\appssynonyms.txt"
3⤵
PID:6996

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16008

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\settingsconversions.txt"
3⤵
PID:8228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15580

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\settingsglobals.txt"
3⤵
PID:8256

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15840

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{06d6dbf2-6fa7-4f0e-b51d-f65b2b277c45}\settingssynonyms.txt"
3⤵
PID:8276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1820

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0dc5dae9-fb25-4269-96d8-d7c2b39a1144}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15392

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0dc5dae9-fb25-4269-96d8-d7c2b39a1144}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8332

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0dc5dae9-fb25-4269-96d8-d7c2b39a1144}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15768

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.0.filtertrie.intermediate.txt"
3⤵
PID:8384

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15776

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.1.filtertrie.intermediate.txt"
3⤵
PID:8408

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15636

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.2.filtertrie.intermediate.txt"
3⤵
PID:8428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15424

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
3⤵
PID:8448

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15724

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
3⤵
PID:8476

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16192

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
3⤵
PID:8496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15556

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
3⤵
PID:8516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15564

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
3⤵
PID:8544

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16532

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
3⤵
PID:8564

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16896

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
3⤵
PID:8584

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16548

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
3⤵
PID:8612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16812

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
3⤵
PID:8632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16360

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
3⤵
PID:8656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16516

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
3⤵
PID:8672

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16160

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
3⤵
PID:8692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16176

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
3⤵
PID:8708

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4100

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
3⤵
PID:8724

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
3⤵
PID:8744

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16404

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
3⤵
PID:8772

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3908

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
3⤵
PID:8792

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1000

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
3⤵
PID:8820

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2972

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3ART8LJX\microsoft.windows[1].xml"
3⤵
PID:8840

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16212

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZMTSYCJM\www.bing[1].xml"
3⤵
PID:8860

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15084

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
3⤵
PID:8880

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16056

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
3⤵
PID:8908

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15644

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
3⤵
PID:8920

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16184

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
3⤵
PID:8932

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15620

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
3⤵
PID:8944

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15408

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
3⤵
PID:8956

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16508

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
3⤵
PID:8968

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16856

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
3⤵
PID:8980

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16796

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
3⤵
PID:8992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15416

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
3⤵
PID:9004

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15376

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
3⤵
PID:9016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16128

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
3⤵
PID:9028

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16524

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
3⤵
PID:9040

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16804

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
3⤵
PID:9052

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15612

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
3⤵
PID:9064

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3656

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
3⤵
PID:9092

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:3204

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
3⤵
PID:9112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16296

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
3⤵
PID:9132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15800

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
3⤵
PID:9148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2708

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
3⤵
PID:9160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15368

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
3⤵
PID:9184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1752

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
3⤵
PID:9196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
3⤵
PID:7016

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15884

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
3⤵
PID:5368

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15952

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
3⤵
PID:7220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16556

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
3⤵
PID:7388

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:4352

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
3⤵
PID:10024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16288

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
3⤵
PID:10044

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16104

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
3⤵
PID:10072

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16740

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
3⤵
PID:10088

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15476

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
3⤵
PID:10104

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16112

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
3⤵
PID:10132

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16700

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
3⤵
PID:10144

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15992

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
3⤵
PID:10164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16748

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
3⤵
PID:10176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15928

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
3⤵
PID:10196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15572

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
3⤵
PID:10228

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1936

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
3⤵
PID:6636

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16724

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
3⤵
PID:6700

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16540

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
3⤵
PID:7768

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1880

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
3⤵
PID:7868

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16580

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
3⤵
PID:8048

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16500

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
3⤵
PID:6692

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:17072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
3⤵
PID:6352

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
3⤵
PID:7072

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
3⤵
PID:8380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16676

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
3⤵
PID:8488

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
3⤵
PID:6164

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15692

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
3⤵
PID:8648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:16572

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
3⤵
PID:8684

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15116

C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
3⤵
- Executes dropped EXE
PID:11484

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
4⤵
PID:17932

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
4⤵
PID:17948

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ConvertRegister.asp"
4⤵
PID:17964

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\GrantClose.jpg"
4⤵
PID:17980

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResolveSet.odt"
4⤵
PID:18072

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\RestoreRename.txt"
4⤵
PID:18088

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SubmitEnter.doc"
4⤵
PID:18104

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713511184.txt"
4⤵
PID:18120

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
4⤵
PID:18136

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29AC.txt"
4⤵
PID:18156

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29CD.txt"
4⤵
PID:18172

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29AC.txt"
4⤵
PID:18188

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29CD.txt"
4⤵
PID:18204

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:18068

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
4⤵
PID:18220

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
4⤵
PID:18236

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_071507928.html"
4⤵
PID:18252

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
4⤵
PID:18268

C:\Windows\SYSTEM32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
4⤵
PID:18284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8852

C:\Windows\System32\SevenCopy.exe
C:\Windows\System32\SevenCopy.exe
1⤵
- Executes dropped EXE
PID:12156

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
2⤵
PID:7312

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:10332

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
2⤵
PID:1988

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:3324

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
2⤵
PID:5516

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:5776

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
2⤵
PID:5492

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:5300

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
2⤵
PID:6576

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:9856

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
2⤵
PID:10528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:5604

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
2⤵
PID:4056

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:9272

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
2⤵
- Executes dropped EXE
PID:8556

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
3⤵
PID:5600

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:13776

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
3⤵
PID:5176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:14668

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
3⤵
PID:14652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15132

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
3⤵
PID:5528

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:6672

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
3⤵
PID:15112

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:10640

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
3⤵
PID:3124

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1856

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
3⤵
PID:3012

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:15096

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
3⤵
- Executes dropped EXE
PID:6532

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
4⤵
PID:13220

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:15152

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
4⤵
PID:11836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:10708

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
4⤵
PID:6032

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:14948

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
4⤵
PID:5580

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:15156

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
4⤵
PID:7740

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:11832

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
4⤵
PID:9276

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:11296

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
4⤵
PID:15120

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:7808

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
4⤵
- Executes dropped EXE
PID:11792

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
5⤵
PID:6640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:1640

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
5⤵
PID:10020

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:4464

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
5⤵
PID:11024

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:13800

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
5⤵
PID:7380

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:4496

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
5⤵
PID:6648

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:5556

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
5⤵
PID:5180

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:6024

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
5⤵
PID:15192

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:5540

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
5⤵
- Executes dropped EXE
PID:6332

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
6⤵
PID:6148

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:1036

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
6⤵
PID:11316

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:4272

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
6⤵
PID:10696

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:1820

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
6⤵
PID:5432

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:7876

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
6⤵
PID:1176

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:6868

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
6⤵
PID:2456

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:5484

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
6⤵
PID:5436

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:10032

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
6⤵
- Executes dropped EXE
PID:8172

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
7⤵
PID:11116

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:8836

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
7⤵
PID:15172

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:12248

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
7⤵
PID:9464

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:5192

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
7⤵
PID:5160

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:6304

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
7⤵
PID:15264

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:2772

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
7⤵
PID:5656

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:12668

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
7⤵
PID:1928

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:5948

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
7⤵
- Executes dropped EXE
PID:2576

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
8⤵
PID:8508

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:9388

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
8⤵
PID:4348

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:12252

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
8⤵
PID:4344

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:3492

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
8⤵
PID:6460

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:3744

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
8⤵
PID:5596

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:12348

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
8⤵
PID:2076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:14372

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
8⤵
PID:3108

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
9⤵
PID:13676

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
8⤵
- Executes dropped EXE
PID:5764

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"
9⤵
PID:6836

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:15788

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt"
9⤵
PID:7896

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:6996

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt"
9⤵
PID:15248

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:6224

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
9⤵
PID:15244

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:15640

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt"
9⤵
PID:1416

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:15432

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.1.filtertrie.intermediate.txt"
9⤵
PID:10628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:16888

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.2.filtertrie.intermediate.txt"
9⤵
PID:5800

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
10⤵
PID:16864

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
9⤵
- Executes dropped EXE
PID:956

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
10⤵
- Executes dropped EXE
PID:1632

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
11⤵
- Executes dropped EXE
PID:10840

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
12⤵
- Executes dropped EXE
PID:17376

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
13⤵
- Executes dropped EXE
PID:16964

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
14⤵
- Executes dropped EXE
PID:17280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
15⤵
- Executes dropped EXE
PID:15848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
16⤵
- Executes dropped EXE
PID:8716

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
17⤵
- Executes dropped EXE
PID:8208

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
18⤵
- Executes dropped EXE
PID:1600

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
19⤵
- Executes dropped EXE
PID:15940

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
20⤵
- Executes dropped EXE
PID:17044

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
21⤵
- Executes dropped EXE
PID:16416

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
22⤵
- Executes dropped EXE
PID:15676

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
23⤵
PID:3632

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
24⤵
PID:5352

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
23⤵
- Executes dropped EXE
PID:15944

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
24⤵
- Executes dropped EXE
PID:3320

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
25⤵
- Executes dropped EXE
PID:15364

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
26⤵
- Executes dropped EXE
PID:4356

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
27⤵
- Executes dropped EXE
PID:7032

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
28⤵
- Executes dropped EXE
PID:12216

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
29⤵
- Executes dropped EXE
PID:17832

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
30⤵
- Executes dropped EXE
PID:13168

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
31⤵
- Executes dropped EXE
PID:17300

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
32⤵
- Executes dropped EXE
PID:13816

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
33⤵
- Executes dropped EXE
PID:15964

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
34⤵
- Executes dropped EXE
PID:1000

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
35⤵
- Executes dropped EXE
PID:6924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
36⤵
- Executes dropped EXE
PID:9996

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
37⤵
- Executes dropped EXE
PID:4152

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
38⤵
- Executes dropped EXE
PID:7064

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
39⤵
- Executes dropped EXE
PID:7668

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
40⤵
- Executes dropped EXE
PID:17732

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
41⤵
- Executes dropped EXE
PID:17660

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:14812

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
43⤵
- Executes dropped EXE
PID:15688

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
44⤵
- Executes dropped EXE
PID:11552

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
45⤵
- Executes dropped EXE
PID:16504

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
46⤵
- Executes dropped EXE
PID:16124

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
47⤵
- Executes dropped EXE
PID:8936

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
48⤵
- Executes dropped EXE
PID:15428

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
49⤵
- Executes dropped EXE
PID:7924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
50⤵
- Executes dropped EXE
PID:17764

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
51⤵
- Executes dropped EXE
PID:16904

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
52⤵
- Executes dropped EXE
PID:16848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
53⤵
- Executes dropped EXE
PID:5996

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
54⤵
- Executes dropped EXE
PID:16912

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
55⤵
- Executes dropped EXE
PID:16032

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
56⤵
- Executes dropped EXE
PID:16700

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
57⤵
- Executes dropped EXE
PID:17856

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
58⤵
- Executes dropped EXE
PID:17292

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
59⤵
- Executes dropped EXE
PID:15508

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
60⤵
- Executes dropped EXE
PID:7792

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
61⤵
- Executes dropped EXE
PID:17488

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
62⤵
- Executes dropped EXE
PID:10868

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
63⤵
PID:8164

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
64⤵
PID:15792

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
65⤵
PID:11688

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
66⤵
PID:7692

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
65⤵
- Drops file in System32 directory
PID:12800

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
66⤵
PID:9940

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
67⤵
PID:9764

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
66⤵
PID:10004

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
67⤵
PID:14764

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
68⤵
PID:14744

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
67⤵
PID:7284

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
68⤵
PID:10888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
69⤵
PID:10048

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
68⤵
PID:5344

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
69⤵
PID:11428

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
70⤵
PID:8184

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
69⤵
PID:8780

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
70⤵
PID:9496

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
71⤵
PID:11040

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
70⤵
PID:8348

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
71⤵
PID:6668

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
72⤵
PID:14644

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
71⤵
- Drops file in System32 directory
PID:9188

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
72⤵
PID:7612

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
73⤵
PID:8340

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
72⤵
PID:9200

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
73⤵
PID:9184

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
74⤵
PID:11056

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
73⤵
PID:8328

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
74⤵
PID:8928

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
75⤵
PID:8116

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
74⤵
PID:11988

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
75⤵
PID:14532

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
76⤵
PID:15052

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
75⤵
PID:11596

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
76⤵
PID:11640

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
77⤵
PID:7820

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
76⤵
PID:12908

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
77⤵
PID:8960

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
78⤵
PID:8980

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
77⤵
PID:14384

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587409094973359.txt"
78⤵
PID:13980

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
79⤵
PID:11848

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
78⤵
PID:13188

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
79⤵
PID:12064

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
80⤵
PID:12888

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
81⤵
PID:13032

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
82⤵
PID:5904

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
83⤵
PID:8224

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
84⤵
PID:6112

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
85⤵
PID:13156

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
86⤵
PID:14604

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
85⤵
PID:10136

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
86⤵
PID:14212

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
87⤵
PID:10028

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
86⤵
- Drops file in System32 directory
PID:7736

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
87⤵
PID:5620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
88⤵
PID:7672

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
87⤵
PID:13956

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
88⤵
PID:13844

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
89⤵
PID:14348

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
88⤵
PID:11604

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
89⤵
PID:14468

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
90⤵
PID:7472

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
89⤵
PID:12272

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
90⤵
PID:12196

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
91⤵
PID:10828

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
90⤵
PID:10192

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
91⤵
PID:13864

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
92⤵
PID:11108

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
91⤵
PID:13060

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
92⤵
PID:10400

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
93⤵
PID:11336

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
92⤵
PID:9760

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
93⤵
PID:9520

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
94⤵
PID:12468

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
93⤵
PID:8124

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
94⤵
PID:7652

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
95⤵
PID:12148

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
94⤵
PID:13084

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
95⤵
PID:11876

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
96⤵
PID:8784

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
95⤵
PID:9088

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
96⤵
PID:9888

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
97⤵
PID:9740

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
96⤵
PID:11892

C:\Windows\System32\cmd.exe
"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
97⤵
PID:8268

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
98⤵
PID:10852

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
97⤵
PID:14472

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
98⤵
PID:18408

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
99⤵
PID:4452

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
100⤵
PID:3928

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
101⤵
PID:3396

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
102⤵
PID:2052

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
103⤵
PID:18188

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
104⤵
PID:4596

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
105⤵
PID:18308

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
106⤵
- Drops file in System32 directory
PID:516

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
107⤵
- Drops file in System32 directory
PID:9076

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
108⤵
PID:3812

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
109⤵
PID:14560

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
110⤵
PID:6516

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
111⤵
PID:5144

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
112⤵
PID:9900

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
113⤵
PID:2528

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
114⤵
PID:5456

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
115⤵
PID:8824

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
116⤵
PID:6048

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
117⤵
PID:5584

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
118⤵
PID:6120

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
119⤵
PID:6240

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
120⤵
PID:11812

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
121⤵
PID:4668

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
122⤵
PID:15564

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
123⤵
PID:13780

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
124⤵
PID:6672

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
125⤵
PID:5152

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
126⤵
PID:4296

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
127⤵
PID:15200

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
128⤵
PID:15384

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
129⤵
PID:6316

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
130⤵
PID:11268

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
131⤵
PID:15116

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
132⤵
PID:9172

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
133⤵
PID:11528

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
134⤵
PID:11456

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
135⤵
PID:8768

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
136⤵
PID:9692

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
137⤵
PID:13448

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
138⤵
PID:5484

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
139⤵
PID:3988

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
140⤵
PID:4916

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
141⤵
PID:6304

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
142⤵
PID:15240

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
143⤵
PID:5360

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
144⤵
PID:16196

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
145⤵
PID:2312

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
146⤵
PID:4384

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
147⤵
PID:4132

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
148⤵
PID:760

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
149⤵
PID:5592

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
150⤵
PID:8624

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
151⤵
PID:14504

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
152⤵
PID:10992

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
153⤵
PID:5748

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
154⤵
PID:16380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
155⤵
PID:14832

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
156⤵
PID:10092

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
157⤵
PID:17500

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
158⤵
PID:2616

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
159⤵
PID:5332

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
160⤵
PID:17268

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
161⤵
PID:18212

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
162⤵
PID:13424

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
163⤵
PID:3952

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
164⤵
PID:7964

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
165⤵
PID:17624

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
166⤵
PID:3488

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
167⤵
PID:16740

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
168⤵
PID:13548

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
169⤵
PID:7960

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
170⤵
PID:15416

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
171⤵
PID:10576

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
172⤵
PID:9280

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
173⤵
PID:16552

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
174⤵
PID:12016

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
175⤵
PID:14404

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
176⤵
PID:13700

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
177⤵
PID:8864

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
178⤵
PID:10776

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
179⤵
PID:12988

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
180⤵
PID:11996

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
181⤵
PID:2576

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
182⤵
PID:10284

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
183⤵
- Drops file in System32 directory
PID:6764

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
184⤵
PID:7276

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
185⤵
PID:4436

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
186⤵
- Drops file in System32 directory
PID:16136

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
187⤵
PID:400

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
188⤵
PID:7244

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
189⤵
- Drops file in System32 directory
PID:8432

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
190⤵
PID:15456

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
191⤵
PID:13736

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
192⤵
PID:768

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
193⤵
PID:14320

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
194⤵
PID:13820

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
195⤵
PID:6412

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
196⤵
PID:6068

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
197⤵
PID:10076

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
198⤵
PID:14748

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
199⤵
PID:13016

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
200⤵
PID:9472

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
201⤵
PID:7512

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
202⤵
PID:16416

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
203⤵
PID:14636

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
204⤵
PID:14192

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
205⤵
PID:12336

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
206⤵
PID:9572

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
207⤵
PID:10476

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
208⤵
PID:16364

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
209⤵
PID:8724

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
210⤵
PID:11324

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
211⤵
PID:8456

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
212⤵
PID:9040

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
213⤵
PID:15904

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
214⤵
PID:14176

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
215⤵
- Drops file in System32 directory
PID:12924

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
216⤵
PID:14304

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
217⤵
PID:16812

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
218⤵
- Drops file in System32 directory
PID:9136

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
219⤵
PID:11708

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
220⤵
- Drops file in System32 directory
PID:4604

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
221⤵
PID:14380

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
222⤵
PID:452

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
223⤵
- Drops file in System32 directory
PID:12836

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
224⤵
PID:8244

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
225⤵
PID:6288

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
226⤵
PID:7064

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
227⤵
PID:12468

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
228⤵
PID:11436

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
229⤵
PID:17588

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
230⤵
PID:8916

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
231⤵
PID:17660

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
232⤵
PID:11564

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
233⤵
PID:2244

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
234⤵
- Drops file in System32 directory
PID:2088

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
235⤵
PID:1892

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
236⤵
PID:18296

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
237⤵
- Drops file in System32 directory
PID:3372

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
238⤵
PID:9872

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
239⤵
PID:6064

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
240⤵
PID:5104

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
241⤵
PID:1256

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
242⤵
PID:9092

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
243⤵
PID:8912

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
244⤵
- Drops file in System32 directory
PID:7696

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
245⤵
PID:2384

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
246⤵
PID:16032

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
247⤵
PID:16976

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
248⤵
- Drops file in System32 directory
PID:17640

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
249⤵
PID:6588

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
250⤵
PID:6896

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
251⤵
PID:8476

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
252⤵
PID:17432

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
253⤵
PID:11992

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
254⤵
PID:16732

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
255⤵
- Drops file in System32 directory
PID:9592

C:\Windows\System32\SevenCopy.exe
"C:\Windows\System32\SevenCopy.exe"
256⤵
PID:10708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.420
Filesize
16B

MD5
5f9306189696122b8af4233aea418421

SHA1
74aa322e05b612bd5461a268cd436e20579c4ef3

SHA256
8ee53077d72d6b7de4ea5cdc8092a8a0b8a95cdd73e00941ae1ae681e1597f96

SHA512
6c1448b8730eeae85e8e0fae2a2595188ecf2d38a8e86aedc59ad0a591d2a7cb35c43dcb096778cae38a4550a99a1cf5faa69e8f92d5d36ad1ad1314f649051c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.420
Filesize
6KB

MD5
b568b4d5ef6beedc7b280c17ea374f0c

SHA1
f7ba5390370261f4628473b2480cd0e2c7ffa829

SHA256
ae0ff7c8b48b5567fa5f53070b74cc85914dd99e4ba75c28c0b7c250ed81845e

SHA512
417011bc42daac3d2e6596e9a1ade6bbb232d037f7ca6f697676d328be9bdaedb1125afa4d2cea9ad52ee76b32d88b1bd23fdb64b8d1d7c41e6ef0dc91af8942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.420
Filesize
352B

MD5
83930b510ce271650edd8d5e457fd006

SHA1
9b4a2f832b345311ecd0cc5aa073f4992db964b8

SHA256
ae915fa3382bd04ed86f8b628a2d2c9232c9119e3e02098ea926a4e7f1ae41f3

SHA512
b11219dec88c6018eeb32a53b85516e4400f87a19ca215cdd0523750adbb748728903c3d52f88525ed4cc53827d634502c981e0fad453cef205d0599208970f3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{028e0355-c905-472a-a283-e9b917fabb95}\0.0.filtertrie.intermediate.txt.420
Filesize
28KB

MD5
4d4cba128b55392ff16ac4d714eb061b

SHA1
0435a26a1627cc57338c613e2937eb96cd1cc6a0

SHA256
2b911c21a0ae0d5e87c6acde84bbf9eae05d652fb91aede87be7f30526f87216

SHA512
317b30bc1fea6edae7776e54fac3c8ab1d457bc0d07690e33ef54302b5bf812dc00d98377e303b21997f55d6bc78fc42864321ae0470daff634ebeec86481f30

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.1.filtertrie.intermediate.txt.420
Filesize
16B

MD5
e8aaa566651759e399714d464cdfb390

SHA1
373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

SHA256
1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

SHA512
23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{64987acc-59da-4839-bbed-20b8b0feb713}\0.2.filtertrie.intermediate.txt.420
Filesize
16B

MD5
209371fb985ae536f7a01b2cbf06fdeb

SHA1
6e5d735e5a6aef442f3342931eaf47d505763578

SHA256
4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

SHA512
53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840746051862.txt.420
Filesize
77KB

MD5
8c8699799855f5ab38ff56c774afcda5

SHA1
06d98b4e89bed2c30087f147e406a85b2eeaebe3

SHA256
de083b617b8528d6b44ff8eaedb6113ebce0296fe06a8fad0536598921d87834

SHA512
1ff303014c355fb36e1158c29a57e970e976d130c86b759abea0c34533b493ecaf25466403d8fdd51f2cfc52c98aa4d31e006fe119090205294bda90c6366e03

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844203170839.txt.420
Filesize
47KB

MD5
22e53dc5709ced95e3c83af5804336a6

SHA1
0163069ed72c9616e06d8997c1f5d7fba597b0e0

SHA256
a128f39f65bd1068191be32727905f92217b625bde930a65ffae3250ec557373

SHA512
ce53d6e40b75737475193824dba4026508f9315be3a79698c3f5529863fad78bec5456b7e6f5971b08d5df5d753bc3dfe83dfa0aecb180d67ce970f6f2ef8dea

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579850631342657.txt.420
Filesize
66KB

MD5
4a90573d4e1350bb3cb06a825fbd66de

SHA1
3f3ce3606d802cd06dda067fa2a07dfa745c90df

SHA256
5a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242

SHA512
b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt.420
Filesize
75KB

MD5
f8986559f15db3a6c0812096578ed41e

SHA1
54d7afa68254af0873ae6537812dcaffaebb391e

SHA256
a72f3d9014b8f543f2d3a998961442e542f5336093ac36ba14b72be59b3d2195

SHA512
cbaf9208e832504f710be8515d8c56aeb282ca91adc9d0a01134096a1da90a6d574228acb31db265ebc3e701f4e869461c420e4bb606014e4a57a4a75dc90e55

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408496063260.txt.420
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587408790918632.txt.420
Filesize
62KB

MD5
eddd87ee089591cd1781db7f06ebb1d1

SHA1
a897b6df5b26c7d20d70691821c2f14dc1bb16d9

SHA256
df9cc88044e44ec23e60c22b361f5c27ee21f3354f6791f782fdf5e2bd03c95c

SHA512
c510df837d8486a4ed19f20bf38cb135df53f5aad9377c1056422ffd40d3900f1ff666431e86734e7d338256498ab8d8739da802f3f8a9ae101af8a851772da1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713511184.txt.420
Filesize
16B

MD5
bea21141aa401823a718b5744650822b

SHA1
bbe9cee4379b81dcf6fdf92aff28f2209563ce50

SHA256
57535fe04df416b5a689aa33f01d8e939f1d91fcae25c0c3cf8192baf417b1fe

SHA512
281f779891962273de9f795dea1917044247dbbe427d111b43027c08ad70577aeffbbb6dc8e68cb0013ebd1ce6103e10f1c71c7e144e75df15c76865ed9c9a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_071507928.html.420
Filesize
93KB

MD5
1de50472ec3880960a4cf3ca12f47f6a

SHA1
f7569d52e5cf3c80fe24dae32a6cd2dfeb1d1502

SHA256
04021de98a39cf003bcfe0e20335189ea93add2e3e0c0ad1b6aacef0ee282dc7

SHA512
703ef8a3fe92c3369314e6f9507d75bdb09765339169841ba96022d07791e2c885f2d694671b9e1a622fb2d35d6ee1b49b8b66e2166c259186b84ebe60f11fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3panlrpw.hjz.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420
Filesize
1KB

MD5
56a9d9af9ad5639d66b2a9e3b42c65f3

SHA1
52f466e46ce8b40cb11979b229bb5d71db97477f

SHA256
f6bd4339203780b5cc7b8df0a5a4de66468bac56ee12e42c31d9eae0194bfaca

SHA512
777a7a3d0cef26eaa8d518ae76df76ba950627a35d3eff730b5e84b58a93ec9d8da4868c8b7fb8ed42345643c70a4431a3d238ab62874ad2a4c1412c90a245ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29AC.txt.420
Filesize
426KB

MD5
ecc0ae6d0cf95d3dadddb0cda24001a6

SHA1
ac484140713639e9d62cce6074a0b483c56952a0

SHA256
f0383d3be06c849e41a9878c0820cf6cc0968fbc8ac91e901cdc293e85384093

SHA512
64ce1039d196786e8a27eed8bf89bf5fa6e555921181881ec01ae6e56256ce56f51b2d1f80f39aa62af98456c8be02b17c99ddd564f9f72d66f27999059f1f09

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI29CD.txt.420
Filesize
414KB

MD5
20eba0be33e1eeb49525df3317f2b5eb

SHA1
a57ff8d093edd6b5d618363e3bde39cc1ec31d16

SHA256
28fa7e65b585d3533aec75e8acf62be5fe9fd2aca4b1bca6f5fe344a127e777b

SHA512
5f9a901237be624aa4a66caf118025c1735f1f4775246a9a75281e88c8b49daa4b1f5c85bbcd4db9072fdc09126232682d582e09b0ccd8448209457a0e80348a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29AC.txt.420
Filesize
11KB

MD5
56093742fb785f8b6551a8e18c5cb82b

SHA1
1a10539de37f8387aa866bd85e261eb44c78c994

SHA256
44a159eb656819459d5e5bcf2c03a08997e624c3ca4af73727cbc8261b8d6cea

SHA512
e606e1e9bc6977a98059effbe8de810960683498574b35138b3c666f81cccf8239a4bd4c7d71e3f078398e705dd58b68bf2d86e7d84f9a9372d3e10060f5a278

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI29CD.txt.420
Filesize
11KB

MD5
15d718633dce42ec33ea6d16a2134eae

SHA1
9904e8979358f017a7d2f75c7c065b60ffb37731

SHA256
e6db13396fe9fe572b1a150bffc5e3c285c22acf35770641a28b18b0435cea1a

SHA512
957d2e8830b2677a624c122ef3200785b3d919233fedbc1cc69acf279d2ee9fa434bc69b8a0609e969ed6b51e6900b13f2f43dc537c0c4f47f772253300523f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jawshtml.html.420
Filesize
16B

MD5
65e115805f15f9cda5eb01e8f742d121

SHA1
e3ecf29bfa71ce07baf8d02009afb8766f35981b

SHA256
7852451b2b252515f369b14bd765135c2e11fee72276b5020e3ed61513c5611a

SHA512
dccbfdd893e5806fa1418e48e0c0c72ec2d1266ee7de48fce34bf3f74bda7e0682e8bf90de53594f34c3d5682c8164d9f6b6ea3977619be8487c2e339faa1ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\mapping.csv.420
Filesize
120KB

MD5
42c12f9e321e00ee8f2ec180e7863e24

SHA1
8d32c5df1057f7d040c919fbea6af11a274d2374

SHA256
63f8f0d578669353be78d86d0173e8f49202fd56f88d36bbefcae31b55d9ac8a

SHA512
c917ed0f9013642a6fe7968315d8454db9173b75e54184449682f75d8e5c02bdc77895e08e15eeb595de6811c09c5fbe0b85982e664223e28d351d2dd10225b2

Download Submit
C:\Users\Admin\AppData\Roaming\ConvertRegister.asp.420
Filesize
363KB

MD5
eb405b1c345bd467569ebfc4ac8ffca0

SHA1
688618c11e2bd043186b7cda05d33b7e3d6b2cc9

SHA256
00a2745806c9ffdbc4f0978f650008b99cf53d1b51b731ad824119b192fcf75a

SHA512
9c8007b59527a93fdc6de3860067cf7c07f6f5104baa008efc1173493f67c72a5871974b9bc8f6721748eb65db56de8f3ea2ad098f6ee8383cfa04c0d89f2412

Download Submit
C:\Users\Admin\AppData\Roaming\GrantClose.jpg.420
Filesize
636KB

MD5
1a9e955ded6de16d90103177f8ffc020

SHA1
b2932f1db001348cd843580e040b4f4a8652cdf8

SHA256
a3a9bc07cca12e6ff2365eed5f04af1ced12fe0ea0b5eb22082f96e501e0959a

SHA512
8ae33557fb187d6edf405b10e74314ef86a8a1bbabc7993abc4a80c8f71ff7f5309f6555ba425a4a4f789f4382cb10853fbb736a77ab18d067b38b2e5edadd19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk.420
Filesize
512B

MD5
d798608a815b4865b9a4eedd32c6dfa1

SHA1
462f9d2de15d2ef2fcf948476f004b7a23da2a47

SHA256
24cc4102607e64cbf51ea59afe037df7a0a03290be8a783700b01aedce3aa861

SHA512
6b388415f36c7692b1aaf2195ce1a9b564d794eb21e1b62da978e312b372abbf5ad5c8d30cc74afb2f16ada33f22e2cc5862f832bea132b64cc6ba11366b3828

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420
Filesize
51KB

MD5
f14ebdbbc002c8ca15a7b7e139b01b25

SHA1
361c8e0f9e1480937b44cb208b65da4cd85d3d52

SHA256
c4ac4b34f8ac38a53e2eb6f1b35fefc01cd61c9c325e6ddf5f2d54de518515b8

SHA512
a9b2de5fd410db8e58b10fd8b0d854c8c9b191cc4157d38adb07600ee89110665169849d84692a749798db7063de233d837d31f1b0a85b248bad7f32ee4fb269

Download Submit
C:\Users\Admin\AppData\Roaming\ResolveSet.odt.420
Filesize
418KB

MD5
de884078f5c0af01704c2f7d10c264e6

SHA1
c5839ffa9f4e4308c60e153d4d117161a0115bea

SHA256
1e08162f3ffbfa6cd3601030e3b1d06b4317277aeed948d630802164c041cd30

SHA512
60833b7afbf273661741071d470458188d397fc25770661374fa39618308285026450257a45ec6f4917b53990c105cdb78c405dc89acd14519c32c3df5a30eac

Download Submit
C:\Users\Admin\AppData\Roaming\RestoreRename.txt.420
Filesize
272KB

MD5
7376b70e7a6347ad26cfe84f4c25dc45

SHA1
ed1d8d3fb5e06865872a6a63015a94b51a751d3c

SHA256
72441b1827446ef0a242a01ce53eb335e1153ab347325c5b6f1582872a3a1515

SHA512
5fa34172dd1286dfa47793eedc033f9f6e0024428e1b6a0f331e303b2e6880cff8787a828607cd1126821584060e2337519c2170c4491d242db989a8055d9f62

Download Submit
C:\Users\Admin\AppData\Roaming\SubmitEnter.doc.420
Filesize
345KB

MD5
1db036fa7d82f974719ff27fedca2aa0

SHA1
9ed643f2ab8761b74b637f67ab6d4a55c39e4f27

SHA256
d15987d1ec1d25abe089bf86e1248e56fd468430533a528e6b9b7eec7e57e8d6

SHA512
c0a9568d583bd43cfde4d06e8e24c29c68f177a197b1a92c0d84d0b05d59d0198900f5d09d9f186ce7123b7f4041f0482a49c95d1a832e42a74aac2c12adc36c

Download Submit
C:\Users\Admin\Links\Desktop.lnk.420
Filesize
512B

MD5
15707b9e98efee8282b0e3e85517bbd9

SHA1
53e285b828207bf492cf51662098454dd5f5cb4f

SHA256
a378b2fe576c99f7cfdee9ea836c8524e15ac2f2795e3be28507aed64cefb58f

SHA512
37b569f5154650358098486594ce660e93b14a704b8c029dd40ada256d360710e45abc35b63cfdf5b4a14fcc72d0bad4cdb291041f7e7c30722d0a76b52f120a

Download Submit
C:\Users\Admin\Links\Downloads.lnk.420
Filesize
944B

MD5
b126372508b319e60f7866e4c5cf39d8

SHA1
5e3d250740dfa398cd6a756a6b97e40ab31333a5

SHA256
02e05127a0af6e79115df721e9d8f30997a899c29ada5ebd743f25e4a60464c0

SHA512
602fcaafba1f9c3bbe4529eb2df0aceb0e2fa09e87b6e37a2f23a5523b0645e4c08e049b6c47e3695d739a6f6d3b9c4ea9eea7fe902fff3013f26d52e68fa09c

Download Submit
C:\Windows\System32\Seven.dll
Filesize
1.0MB

MD5
5ede7c5c09c58dd2b55c153a058c8746

SHA1
4f147e97e311084917164b4818f811b4cfa0fad6

SHA256
f2e78f66ffaf1dcaf7f8d8411a8f0223b059a18e7923cd44dad39960e3c5a9fe

SHA512
7048366a680ae8fc2878b4ccdb8078b0f3bb1a5ef5e3388a6d0f1ebd63ec26f4a958552401f5feed31bbee3cddd965cefa581e77814b2dfad0d76e2c652f4f9a

Download Submit
C:\Windows\System32\Seven.runtimeconfig.json
Filesize
340B

MD5
253333997e82f7d44ea8072dfae6db39

SHA1
03b9744e89327431a619505a7c72fd497783d884

SHA256
28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

SHA512
56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

Download Submit
C:\Windows\System32\SevenCopy.exe
Filesize
139KB

MD5
6503f847c3281ff85b304fc674b62580

SHA1
947536e0741c085f37557b7328b067ef97cb1a61

SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f

SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174

Download Submit
memory/2140-10-0x00007FF84DED0000-0x00007FF84E991000-memory.dmp

Filesize
10.8MB

Download
memory/2140-12-0x0000017EE2030000-0x0000017EE2040000-memory.dmp

Filesize
64KB

Download
memory/2140-7-0x0000017EE2000000-0x0000017EE2022000-memory.dmp

Filesize
136KB

Download
memory/2140-15-0x0000017EFA550000-0x0000017EFA76C000-memory.dmp

Filesize
2.1MB

Download
memory/2140-16-0x00007FF84DED0000-0x00007FF84E991000-memory.dmp

Filesize
10.8MB

Download
memory/2140-11-0x0000017EE2030000-0x0000017EE2040000-memory.dmp

Filesize
64KB

Download