Analysis
-
max time kernel
199s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 03:04
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Processes:
Seven.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SevenCopy.exe -
Deletes itself 1 IoCs
Processes:
SevenCopy.exepid process 2956 SevenCopy.exe -
Executes dropped EXE 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exepid process 2956 SevenCopy.exe 14928 SevenCopy.exe 7920 SevenCopy.exe 17996 SevenCopy.exe 6408 SevenCopy.exe 4888 SevenCopy.exe 5656 SevenCopy.exe 2628 SevenCopy.exe 12120 SevenCopy.exe 9240 SevenCopy.exe 8524 SevenCopy.exe 9060 SevenCopy.exe 14992 SevenCopy.exe 9812 SevenCopy.exe 10360 SevenCopy.exe 10644 SevenCopy.exe 9236 SevenCopy.exe 15332 SevenCopy.exe 14988 SevenCopy.exe 8460 SevenCopy.exe 12024 SevenCopy.exe 10000 SevenCopy.exe 11200 SevenCopy.exe 11900 SevenCopy.exe 15284 SevenCopy.exe 16232 SevenCopy.exe 8296 SevenCopy.exe 15840 SevenCopy.exe 10244 SevenCopy.exe 16276 SevenCopy.exe 10568 SevenCopy.exe 12012 SevenCopy.exe 11500 SevenCopy.exe 12380 SevenCopy.exe 10480 SevenCopy.exe 8504 SevenCopy.exe 11716 SevenCopy.exe 9908 SevenCopy.exe 11244 SevenCopy.exe 8424 SevenCopy.exe 12844 SevenCopy.exe 9920 SevenCopy.exe 9064 SevenCopy.exe 3376 SevenCopy.exe 13364 SevenCopy.exe 12000 SevenCopy.exe 10160 SevenCopy.exe 3276 SevenCopy.exe 16296 SevenCopy.exe 1764 SevenCopy.exe 14608 SevenCopy.exe 13024 SevenCopy.exe 14128 SevenCopy.exe 14016 SevenCopy.exe 12824 SevenCopy.exe 5044 SevenCopy.exe 11836 SevenCopy.exe 10004 SevenCopy.exe 11624 SevenCopy.exe 17056 SevenCopy.exe 15204 SevenCopy.exe 10696 SevenCopy.exe 15132 SevenCopy.exe 12320 SevenCopy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops desktop.ini file(s) 7 IoCs
Processes:
SevenCopy.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Music\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini SevenCopy.exe -
Drops file in System32 directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt -
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 16476 regedit.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1600 powershell.exe 1600 powershell.exe 17912 powershell.exe 17912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exepowershell.exemmc.exedescription pid process Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 17912 powershell.exe Token: 33 12404 mmc.exe Token: SeIncBasePriorityPrivilege 12404 mmc.exe Token: 33 12404 mmc.exe Token: SeIncBasePriorityPrivilege 12404 mmc.exe Token: 33 12404 mmc.exe Token: SeIncBasePriorityPrivilege 12404 mmc.exe Token: 33 12404 mmc.exe Token: SeIncBasePriorityPrivilege 12404 mmc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mmc.exepid process 12404 mmc.exe 12404 mmc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Seven.execmd.execmd.execmd.exeSevenCopy.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3196 wrote to memory of 1600 3196 Seven.exe powershell.exe PID 3196 wrote to memory of 1600 3196 Seven.exe powershell.exe PID 3196 wrote to memory of 1188 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 1188 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 1928 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 1928 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 3500 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 3500 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 4908 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 4908 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 3544 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 3544 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 4156 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 4156 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 424 3196 Seven.exe cmd.exe PID 3196 wrote to memory of 424 3196 Seven.exe cmd.exe PID 4156 wrote to memory of 1128 4156 cmd.exe attrib.exe PID 4156 wrote to memory of 1128 4156 cmd.exe attrib.exe PID 3500 wrote to memory of 1824 3500 cmd.exe attrib.exe PID 3500 wrote to memory of 1824 3500 cmd.exe attrib.exe PID 424 wrote to memory of 2308 424 cmd.exe attrib.exe PID 424 wrote to memory of 2308 424 cmd.exe attrib.exe PID 3196 wrote to memory of 2956 3196 Seven.exe SevenCopy.exe PID 3196 wrote to memory of 2956 3196 Seven.exe SevenCopy.exe PID 2956 wrote to memory of 3976 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 3976 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1048 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1048 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4248 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4248 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4980 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4980 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 348 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 348 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4284 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4284 2956 SevenCopy.exe cmd.exe PID 3976 wrote to memory of 536 3976 cmd.exe choice.exe PID 3976 wrote to memory of 536 3976 cmd.exe choice.exe PID 2956 wrote to memory of 3048 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 3048 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1744 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1744 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4144 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 4144 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1368 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1368 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 2952 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 2952 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 3448 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 3448 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1964 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1964 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 3912 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 3912 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1504 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1504 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1644 2956 SevenCopy.exe cmd.exe PID 2956 wrote to memory of 1644 2956 SevenCopy.exe cmd.exe PID 1048 wrote to memory of 4572 1048 cmd.exe choice.exe PID 1048 wrote to memory of 4572 1048 cmd.exe choice.exe PID 348 wrote to memory of 636 348 cmd.exe choice.exe PID 348 wrote to memory of 636 348 cmd.exe choice.exe PID 4980 wrote to memory of 3804 4980 cmd.exe choice.exe PID 4980 wrote to memory of 3804 4980 cmd.exe choice.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 1128 attrib.exe 1824 attrib.exe 2308 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3196 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe2⤵PID:1188
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe2⤵PID:1928
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\SevenCopy.exe3⤵
- Views/modifies file attributes
PID:1824 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵PID:4908
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵PID:3544
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Views/modifies file attributes
PID:1128 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:536
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"3⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4572
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"3⤵PID:4248
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5044
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"3⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"3⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:636
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"3⤵PID:4284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4472
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"3⤵PID:3048
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4644
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"3⤵PID:1744
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1656
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"3⤵PID:4144
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3008
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"3⤵PID:1368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4568
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"3⤵PID:2952
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4460
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"3⤵PID:3448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"3⤵PID:1964
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2724
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"3⤵PID:3912
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1904
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"3⤵PID:1504
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"3⤵PID:1644
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4972
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\InitializeDebug.csv"3⤵PID:4444
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\RepairCheckpoint.png"3⤵PID:404
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7052
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\UnprotectDismount.odt"3⤵PID:3360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7744
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"3⤵PID:3104
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7216
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CompareDisable.html"3⤵PID:3432
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6228
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CopyDismount.odt"3⤵PID:1396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6136
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ExitSelect.xls"3⤵PID:4516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7452
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"3⤵PID:888
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7716
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\LockMerge.doc"3⤵PID:1968
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8908
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\MergeClose.csv"3⤵PID:2256
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5924
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"3⤵PID:1128
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7068
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"3⤵PID:2016
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RedoGrant.html"3⤵PID:1824
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8692
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RestartResize.pdf"3⤵PID:2036
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7464
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"3⤵PID:2076
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8724
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ExitStart.png"3⤵PID:3656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\GroupRead.xls"3⤵PID:1616
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8708
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UnlockConvertFrom.png"3⤵PID:4156
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7472
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\WaitDisable.odt"3⤵PID:808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8348
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"3⤵PID:1960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"3⤵PID:4772
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\DisableOptimize.txt"3⤵PID:2792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7480
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RepairExit.xml"3⤵PID:972
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8776
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\AddExpand.png"3⤵PID:2268
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8716
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\EnterConvertFrom.bmp"3⤵PID:640
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7268
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\HideStep.bmp"3⤵PID:4708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"3⤵PID:5152
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7276
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\AssertRestart.xls"3⤵PID:5184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7260
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BlockSplit.csv"3⤵PID:5196
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8752
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\RedoEnter.html"3⤵PID:5208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7176
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SyncOut.odt"3⤵PID:5220
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8768
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135575.txt"3⤵PID:5232
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8336
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"3⤵PID:5348
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8760
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI46F8.txt"3⤵PID:5376
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8744
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4719.txt"3⤵PID:5408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5908
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI46F8.txt"3⤵PID:5424
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4719.txt"3⤵PID:5436
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8320
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"3⤵PID:5548
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124211808.html"3⤵PID:5560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7340
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"3⤵PID:5572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7284
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"3⤵PID:5588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7416
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"3⤵PID:5600
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8736
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"3⤵PID:5612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8796
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"3⤵PID:5628
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7408
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"3⤵PID:5640
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7636
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"3⤵PID:5652
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7672
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"3⤵PID:5668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8944
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"3⤵PID:5680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7536
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"3⤵PID:5692
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"3⤵PID:5716
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11380
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"3⤵PID:5832
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7680
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"3⤵PID:5952
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8568
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"3⤵PID:6128
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"3⤵PID:6140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9928
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"3⤵PID:3492
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"3⤵PID:2032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8648
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"3⤵PID:2120
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"3⤵PID:2368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12608
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"3⤵PID:5180
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13736
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"3⤵PID:5216
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12116
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"3⤵PID:5296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8672
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"3⤵PID:5860
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12972
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"3⤵PID:5828
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"3⤵PID:5884
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11228
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"3⤵PID:6308
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7852
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"3⤵PID:6460
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7920
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"3⤵PID:6472
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"3⤵PID:6484
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13228
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"3⤵PID:6500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6152
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"3⤵PID:6520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8140
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"3⤵PID:6540
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7696
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"3⤵PID:6560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13988
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"3⤵PID:6580
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7400
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"3⤵PID:6600
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4912
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"3⤵PID:6636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13064
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"3⤵PID:6656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9744
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"3⤵PID:6676
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13756
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"3⤵PID:6804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12616
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"3⤵PID:6816
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14180
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"3⤵PID:6840
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"3⤵PID:6852
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13728
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"3⤵PID:6864
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14004
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"3⤵PID:6876
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13696
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"3⤵PID:7008
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1636
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"3⤵PID:7028
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13580
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"3⤵PID:7076
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:636
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"3⤵PID:6672
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"3⤵PID:6952
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"3⤵PID:6968
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11376
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"3⤵PID:7372
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13484
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"3⤵PID:7564
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14172
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"3⤵PID:7580
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4472
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"3⤵PID:7592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15224
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"3⤵PID:7792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14872
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"3⤵PID:7804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14024
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"3⤵PID:7988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15280
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"3⤵PID:8100
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"3⤵PID:7024
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14188
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"3⤵PID:6496
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15232
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"3⤵PID:7232
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15216
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"3⤵PID:7312
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14492
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"3⤵PID:7588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"3⤵PID:8256
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15176
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"3⤵PID:8276
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15188
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"3⤵PID:8292
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15272
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"3⤵PID:8408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15480
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"3⤵PID:8420
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1760
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"3⤵PID:8432
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14580
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"3⤵PID:8444
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3620
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"3⤵PID:8456
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15396
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"3⤵PID:8468
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15328
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"3⤵PID:8500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"3⤵PID:8516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5072
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"3⤵PID:8528
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"3⤵PID:8540
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15296
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"3⤵PID:8556
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15048
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"3⤵PID:8572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14976
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"3⤵PID:8596
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14568
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"3⤵PID:8624
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"3⤵PID:8660
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"3⤵PID:8680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15488
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"3⤵PID:8844
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15168
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"3⤵PID:8872
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"3⤵PID:8888
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14728
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"3⤵PID:8984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14452
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"3⤵PID:8996
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15036
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"3⤵PID:9024
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4988
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"3⤵PID:9044
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1912
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"3⤵PID:9064
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15616
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"3⤵PID:9076
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"3⤵PID:9156
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15596
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"3⤵PID:9172
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15464
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"3⤵PID:9200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15472
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085317810659.txt"3⤵PID:8400
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15828
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086001319549.txt"3⤵PID:9356
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15684
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086355232539.txt"3⤵PID:9412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086552915319.txt"3⤵PID:9428
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15692
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086595780251.txt"3⤵PID:9688
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15504
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086655653155.txt"3⤵PID:9720
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15304
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086850584383.txt"3⤵PID:9736
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086893003160.txt"3⤵PID:9988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16084
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586087795228297.txt"3⤵PID:10004
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15756
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088460765966.txt"3⤵PID:10020
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586091572288709.txt"3⤵PID:10040
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586091872548960.txt"3⤵PID:10080
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15836
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092173205007.txt"3⤵PID:9152
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15516
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092601552477.txt"3⤵PID:10284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15648
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093036863700.txt"3⤵PID:10304
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15960
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093200486649.txt"3⤵PID:10472
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15668
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586094498261003.txt"3⤵PID:10496
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586094798035805.txt"3⤵PID:10516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15660
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095097931457.txt"3⤵PID:10528
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16028
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095989946285.txt"3⤵PID:10540
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16004
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586115613587491.txt"3⤵PID:10552
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14988
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586118591362150.txt"3⤵PID:10572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"3⤵PID:10588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"3⤵PID:10600
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵PID:10612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16108
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\AlternateServices.txt"3⤵PID:10656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\pkcs11.txt"3⤵PID:10668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16380
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\47kntzet.default-release\SiteSecurityServiceState.txt"3⤵PID:10680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16296
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\79ZXHV21\update100[1].xml"3⤵PID:10692
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16036
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\known_providers_download_v1[1].xml"3⤵PID:10836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1652
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"3⤵PID:10872
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"3⤵PID:10888
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3068
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"3⤵PID:10908
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:572
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"3⤵PID:10920
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"3⤵PID:10936
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1208
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"3⤵PID:10948
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"3⤵PID:10964
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16320
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"3⤵PID:11092
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1972
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{06616d33-cf6f-4703-a592-5aa43910d224}\0.0.filtertrie.intermediate.txt"3⤵PID:11120
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{06616d33-cf6f-4703-a592-5aa43910d224}\0.1.filtertrie.intermediate.txt"3⤵PID:11140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3968
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{06616d33-cf6f-4703-a592-5aa43910d224}\0.2.filtertrie.intermediate.txt"3⤵PID:11152
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3120
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1c0efad5-11a9-43be-ac0a-d76de83af8d0}\0.0.filtertrie.intermediate.txt"3⤵PID:11172
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16172
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1c0efad5-11a9-43be-ac0a-d76de83af8d0}\0.1.filtertrie.intermediate.txt"3⤵PID:11196
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15792
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1c0efad5-11a9-43be-ac0a-d76de83af8d0}\0.2.filtertrie.intermediate.txt"3⤵PID:11212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16044
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{56864828-c8c2-48f7-a667-1fbb776ff6e5}\0.0.filtertrie.intermediate.txt"3⤵PID:11232
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2888
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{56864828-c8c2-48f7-a667-1fbb776ff6e5}\0.1.filtertrie.intermediate.txt"3⤵PID:11364
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{56864828-c8c2-48f7-a667-1fbb776ff6e5}\0.2.filtertrie.intermediate.txt"3⤵PID:11384
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16184
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d1669a30-2a3d-43f6-a5eb-0ad9d7a810e0}\appsconversions.txt"3⤵PID:11432
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d1669a30-2a3d-43f6-a5eb-0ad9d7a810e0}\appsglobals.txt"3⤵PID:11460
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16136
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d1669a30-2a3d-43f6-a5eb-0ad9d7a810e0}\appssynonyms.txt"3⤵PID:11480
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3272
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d1669a30-2a3d-43f6-a5eb-0ad9d7a810e0}\settingsconversions.txt"3⤵PID:11504
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16416
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d1669a30-2a3d-43f6-a5eb-0ad9d7a810e0}\settingsglobals.txt"3⤵PID:11520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15920
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d1669a30-2a3d-43f6-a5eb-0ad9d7a810e0}\settingssynonyms.txt"3⤵PID:11536
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3939122f-6798-4420-925b-d3c0fb29d607}\0.0.filtertrie.intermediate.txt"3⤵PID:11548
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4152
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3939122f-6798-4420-925b-d3c0fb29d607}\0.1.filtertrie.intermediate.txt"3⤵PID:11560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16392
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3939122f-6798-4420-925b-d3c0fb29d607}\0.2.filtertrie.intermediate.txt"3⤵PID:11576
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16020
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7aecc611-26d7-49be-ae95-c7e71c0ec540}\0.0.filtertrie.intermediate.txt"3⤵PID:11588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15944
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7aecc611-26d7-49be-ae95-c7e71c0ec540}\0.1.filtertrie.intermediate.txt"3⤵PID:11600
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15928
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7aecc611-26d7-49be-ae95-c7e71c0ec540}\0.2.filtertrie.intermediate.txt"3⤵PID:11612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1032
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"3⤵PID:11624
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4056
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"3⤵PID:11636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:836
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"3⤵PID:11648
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2956
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"3⤵PID:11668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1856
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"3⤵PID:11680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4416
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"3⤵PID:11692
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16148
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"3⤵PID:11704
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3576
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"3⤵PID:11776
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"3⤵PID:11788
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16372
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"3⤵PID:11948
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"3⤵PID:12140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16348
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"3⤵PID:12172
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3796
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"3⤵PID:12188
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16284
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"3⤵PID:12204
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3524
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"3⤵PID:12248
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"3⤵PID:12272
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16400
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"3⤵PID:10168
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2576
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"3⤵PID:10944
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1944
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3MKUANJA\microsoft.windows[1].xml"3⤵PID:10984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BJFSASHJ\www.bing[1].xml"3⤵PID:11620
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1508
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"3⤵PID:12224
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16568
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"3⤵PID:12132
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4088
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"3⤵PID:12304
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4616
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"3⤵PID:12324
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16720
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"3⤵PID:12340
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"3⤵PID:12392
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"3⤵PID:12408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3032
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"3⤵PID:12420
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1940
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"3⤵PID:12448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3648
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"3⤵PID:12468
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5924
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"3⤵PID:12488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1592
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"3⤵PID:12504
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6688
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"3⤵PID:12520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16728
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"3⤵PID:12540
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2088
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"3⤵PID:12552
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4916
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"3⤵PID:12836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3644
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"3⤵PID:12868
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16852
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"3⤵PID:13056
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"3⤵PID:13068
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16640
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"3⤵PID:13084
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4408
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"3⤵PID:13100
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2752
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"3⤵PID:13124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"3⤵PID:11804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3640
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"3⤵PID:12184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:464
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"3⤵PID:11988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"3⤵PID:1704
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"3⤵PID:12516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16712
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"3⤵PID:4676
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15336
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"3⤵PID:4452
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16492
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"3⤵PID:2920
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2240
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"3⤵PID:12708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"3⤵PID:13028
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17088
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"3⤵PID:3804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"3⤵PID:13332
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16928
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"3⤵PID:13344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"3⤵PID:13360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1644
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"3⤵PID:13504
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1612
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"3⤵PID:13520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17104
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"3⤵PID:13544
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1120
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"3⤵PID:13560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17224
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"3⤵PID:13788
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"3⤵PID:14088
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16660
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"3⤵PID:14100
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16816
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"3⤵PID:1656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"3⤵PID:14368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16888
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"3⤵PID:14436
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"3⤵PID:14456
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16792
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"3⤵PID:14472
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17008
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"3⤵PID:14556
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16824
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"3⤵PID:14572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16968
-
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"3⤵
- Executes dropped EXE
PID:14928 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"4⤵PID:17292
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:7700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"4⤵PID:17308
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:18100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\AssertRestart.xls"4⤵PID:17324
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:6368
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BlockSplit.csv"4⤵PID:17340
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\RedoEnter.html"4⤵PID:17356
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17948
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SyncOut.odt"4⤵PID:17372
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:7468
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135575.txt"4⤵PID:17388
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17932
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"4⤵PID:17404
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17664
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI46F8.txt"4⤵PID:4512
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:7072
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4719.txt"4⤵PID:6796
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17304
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI46F8.txt"4⤵PID:17352
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:7204
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4719.txt"4⤵PID:17420
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:6360
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"4⤵PID:17440
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:5804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124211808.html"4⤵PID:17520
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"4⤵PID:17596
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"4⤵PID:17640
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:2040
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"4⤵PID:17656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:8220
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"4⤵PID:17680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:724
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"4⤵PID:17696
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:1608
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"4⤵PID:17772
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"4⤵PID:17788
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"4⤵PID:17804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"4⤵PID:17820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"4⤵PID:17836
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"4⤵PID:17852
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"4⤵PID:17868
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:3320
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"4⤵PID:17884
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"4⤵PID:17900
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"4⤵PID:17916
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"4⤵PID:17932
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"4⤵PID:17948
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"4⤵PID:17964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"4⤵PID:17980
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"4⤵PID:17996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"4⤵PID:18012
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"4⤵PID:18028
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"4⤵PID:18124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"4⤵PID:18152
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"4⤵PID:18308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"4⤵PID:18348
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:6076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"4⤵PID:17332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"4⤵PID:17288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"4⤵PID:17636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:9940
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"4⤵PID:6384
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:2184
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"4⤵PID:17748
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"4⤵PID:18008
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:7464
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"4⤵PID:17784
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"4⤵PID:17860
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 18428 -s 2961⤵PID:6136
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 18180 -ip 181801⤵PID:7340
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:17912
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Executes dropped EXE
PID:7920 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"2⤵PID:5632
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2196
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"2⤵PID:4956
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5184
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"2⤵PID:4012
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5152
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"2⤵PID:5244
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6616
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"2⤵PID:6008
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1960
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"2⤵PID:7984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:7292
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"2⤵
- Executes dropped EXE
PID:17996 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"3⤵PID:3712
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2812
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"3⤵PID:7124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5444
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"3⤵PID:6548
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6160
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"3⤵PID:5644
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8908
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"3⤵PID:8948
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8764
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵PID:5556
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8712
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"3⤵
- Executes dropped EXE
PID:6408 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"4⤵PID:9980
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:4960
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"4⤵PID:2284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:18416
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"4⤵PID:7668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17332
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"4⤵PID:8032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17748
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"4⤵PID:10228
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:18428
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"4⤵PID:5272
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17784
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"4⤵
- Executes dropped EXE
PID:4888 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"5⤵PID:2144
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:2548
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"5⤵PID:7208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:6352
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"5⤵PID:3484
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:6156
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"5⤵PID:16428
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:6764
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"5⤵PID:900
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:6000
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"5⤵PID:5140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:7088
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"5⤵
- Executes dropped EXE
PID:5656 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"6⤵PID:7136
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:6104
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"6⤵PID:1588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:9744
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"6⤵PID:5420
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:6660
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"6⤵PID:5772
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:6696
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"6⤵PID:6348
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:1084
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"6⤵PID:6028
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:14196
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"6⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"7⤵PID:7184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:12484
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"7⤵PID:5664
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:9328
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"7⤵PID:5608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:6528
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"7⤵PID:2188
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:6736
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"7⤵PID:7960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:7580
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"7⤵PID:6288
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:6976
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"7⤵
- Executes dropped EXE
PID:12120 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"8⤵PID:7616
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:1964
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"8⤵PID:5792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:8588
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"8⤵PID:7612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:9752
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"8⤵PID:14052
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:8484
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"8⤵PID:6636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:14376
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"8⤵PID:7576
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:7520
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"8⤵
- Executes dropped EXE
PID:9240 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"9⤵PID:9032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:7804
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"9⤵PID:14496
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:7316
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"9⤵PID:15016
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:7504
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"9⤵PID:14024
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:10252
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"9⤵PID:9196
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:7304
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"9⤵PID:14176
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:9660
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"9⤵
- Executes dropped EXE
PID:8524 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"10⤵PID:10036
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:8996
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"10⤵PID:9192
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:15720
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"10⤵PID:7976
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:15716
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"10⤵PID:9404
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:10120
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"10⤵PID:13732
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:6880
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"10⤵PID:14712
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:9820
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"10⤵
- Executes dropped EXE
PID:9060 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"11⤵PID:9396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:15224
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk"11⤵PID:7896
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:11984
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt"11⤵PID:10060
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:9168
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470849427717.txt"11⤵PID:15628
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:13764
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470877224933.txt"11⤵PID:8384
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:14568
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"11⤵PID:7968
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:10880
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"11⤵
- Executes dropped EXE
PID:14992 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"12⤵
- Executes dropped EXE
PID:9812 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"13⤵
- Executes dropped EXE
PID:10360 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"14⤵
- Executes dropped EXE
PID:10644 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"15⤵
- Executes dropped EXE
PID:9236 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"16⤵
- Executes dropped EXE
PID:15332 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"17⤵
- Executes dropped EXE
PID:14988 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
PID:8460 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"19⤵
- Executes dropped EXE
PID:12024 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"20⤵
- Executes dropped EXE
PID:10000 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"21⤵
- Executes dropped EXE
PID:11200 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"22⤵
- Executes dropped EXE
PID:11900 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"23⤵
- Executes dropped EXE
PID:15284 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:16232 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
PID:8296 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15840 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:10244 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"28⤵
- Executes dropped EXE
PID:16276 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"29⤵
- Executes dropped EXE
PID:10568 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"30⤵
- Executes dropped EXE
PID:12012 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"31⤵
- Executes dropped EXE
PID:11500 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"32⤵
- Executes dropped EXE
PID:12380 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"33⤵PID:9424
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 334⤵PID:10780
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"33⤵
- Executes dropped EXE
PID:10480 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"34⤵PID:7360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 335⤵PID:12180
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"34⤵
- Executes dropped EXE
PID:8504 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"35⤵PID:8556
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 336⤵PID:10600
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"35⤵
- Executes dropped EXE
PID:11716 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"36⤵PID:8428
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 337⤵PID:11660
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"36⤵
- Executes dropped EXE
PID:9908 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"37⤵PID:11164
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 338⤵PID:9012
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"37⤵
- Executes dropped EXE
PID:11244 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"38⤵PID:10588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 339⤵PID:16168
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
PID:8424 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"39⤵PID:10904
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 340⤵PID:11892
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"39⤵
- Executes dropped EXE
PID:12844 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"40⤵PID:11424
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 341⤵PID:9320
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"40⤵
- Executes dropped EXE
PID:9920 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"41⤵PID:2172
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 342⤵PID:16104
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
PID:9064 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587471353827230.txt"42⤵PID:16200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 343⤵PID:13776
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"42⤵
- Executes dropped EXE
PID:3376 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"43⤵
- Executes dropped EXE
PID:13364 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"44⤵
- Executes dropped EXE
PID:12000 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"45⤵
- Executes dropped EXE
PID:10160 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"46⤵
- Executes dropped EXE
PID:3276 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"47⤵PID:16684
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 348⤵PID:3576
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"47⤵
- Executes dropped EXE
PID:16296 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"48⤵PID:4764
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 349⤵PID:13292
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"48⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"49⤵PID:13276
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 350⤵PID:16592
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"49⤵
- Executes dropped EXE
PID:14608 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"50⤵PID:12356
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 351⤵PID:15140
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"50⤵
- Executes dropped EXE
PID:13024 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"51⤵PID:11296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 352⤵PID:13000
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"51⤵
- Executes dropped EXE
PID:14128 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"52⤵PID:10676
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 353⤵PID:12204
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"52⤵
- Executes dropped EXE
PID:14016 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"53⤵PID:10508
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 354⤵PID:12292
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"53⤵
- Executes dropped EXE
PID:12824 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"54⤵PID:13528
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 355⤵PID:4068
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
PID:5044 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"55⤵PID:2956
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 356⤵PID:4896
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"55⤵
- Executes dropped EXE
PID:11836 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"56⤵PID:14212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 357⤵PID:16804
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
PID:10004 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"57⤵PID:1816
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 358⤵PID:4504
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"57⤵
- Executes dropped EXE
PID:11624 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"58⤵PID:17072
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 359⤵PID:16848
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"58⤵
- Executes dropped EXE
PID:17056 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"59⤵
- Executes dropped EXE
PID:15204 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:10696 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"61⤵
- Executes dropped EXE
PID:15132 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"62⤵
- Executes dropped EXE
PID:12320 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"63⤵PID:14080
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"64⤵
- Drops file in System32 directory
PID:13748 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"65⤵PID:12984
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"66⤵
- Drops file in System32 directory
PID:11536 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"67⤵
- Checks computer location settings
PID:13828 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"68⤵PID:13904
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"69⤵PID:11160
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"70⤵PID:12644
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"71⤵PID:16556
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"72⤵PID:16960
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"73⤵
- Checks computer location settings
PID:16992 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"74⤵
- Drops file in System32 directory
PID:12668 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"75⤵PID:12152
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"76⤵PID:14880
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 377⤵PID:13924
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"76⤵PID:14572
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"77⤵PID:13704
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 378⤵PID:13500
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"77⤵PID:13004
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"78⤵PID:10868
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 379⤵PID:17088
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"78⤵PID:14400
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"79⤵PID:15824
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 380⤵PID:13512
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"79⤵PID:5924
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"80⤵PID:4972
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 381⤵PID:14840
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"80⤵PID:13900
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"81⤵PID:12708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 382⤵PID:16900
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"81⤵PID:13824
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"82⤵PID:12524
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"83⤵PID:13372
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"84⤵PID:13780
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"85⤵PID:17728
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"86⤵PID:18048
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"87⤵PID:17360
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"88⤵PID:7252
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"89⤵PID:17476
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"90⤵PID:17272
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"91⤵PID:7912
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"92⤵
- Checks computer location settings
PID:18376 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"93⤵PID:7928
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"94⤵PID:7788
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"95⤵PID:18036
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"96⤵PID:17868
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"97⤵PID:18024
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"98⤵PID:8172
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"99⤵PID:8700
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"100⤵PID:5136
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"101⤵PID:16252
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"102⤵PID:5544
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"103⤵PID:1620
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3104⤵PID:7220
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"103⤵
- Drops file in System32 directory
PID:3604 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"104⤵PID:9368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3105⤵PID:18160
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"104⤵PID:9572
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"105⤵PID:17500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3106⤵PID:18200
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"105⤵PID:17380
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"106⤵PID:4348
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3107⤵PID:5832
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"106⤵PID:2844
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"107⤵PID:17836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3108⤵PID:17984
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"107⤵PID:17840
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"108⤵PID:748
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3109⤵PID:3656
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"108⤵PID:8740
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"109⤵PID:4712
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3110⤵PID:6500
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"109⤵PID:18016
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"110⤵PID:4140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3111⤵PID:6532
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"110⤵PID:5748
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"111⤵PID:12156
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3112⤵PID:7424
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"111⤵PID:7172
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"112⤵PID:6808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3113⤵PID:10096
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"112⤵PID:13736
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"113⤵PID:9780
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3114⤵PID:8308
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"113⤵
- Drops file in System32 directory
PID:14388 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"114⤵PID:9212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3115⤵PID:1112
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"114⤵PID:10424
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"115⤵PID:2196
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3116⤵PID:7084
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"115⤵PID:15848
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"116⤵PID:5520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 3117⤵PID:6096
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"116⤵PID:6852
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"117⤵
- Drops file in System32 directory
PID:8364 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"118⤵
- Checks computer location settings
PID:9708 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"119⤵PID:2432
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"120⤵PID:6016
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"121⤵
- Checks computer location settings
- Drops file in System32 directory
PID:8632 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"122⤵PID:12016
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"123⤵
- Drops file in System32 directory
PID:6548 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"124⤵PID:7528
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"125⤵
- Checks computer location settings
PID:18128 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"126⤵PID:5812
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"127⤵PID:5160
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"128⤵PID:10192
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"129⤵PID:3704
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"130⤵PID:3160
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"131⤵PID:5468
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"132⤵
- Checks computer location settings
PID:15304 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"133⤵PID:16428
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"134⤵PID:5376
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"135⤵PID:15128
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"136⤵
- Drops file in System32 directory
PID:11028 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"137⤵PID:1000
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"138⤵
- Checks computer location settings
PID:1588 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"139⤵PID:4116
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"140⤵
- Drops file in System32 directory
PID:11352 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"141⤵PID:8460
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"142⤵PID:6736
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"143⤵PID:5664
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"144⤵PID:6984
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"145⤵PID:9956
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"146⤵PID:6916
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"147⤵PID:7520
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"148⤵PID:9488
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"149⤵PID:13228
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"150⤵PID:8056
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"151⤵PID:7436
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"152⤵PID:8104
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"153⤵
- Checks computer location settings
- Drops file in System32 directory
PID:15448 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"154⤵PID:13988
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"155⤵PID:14848
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"156⤵PID:15752
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"157⤵PID:8540
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"158⤵PID:14020
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"159⤵PID:7976
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"160⤵PID:8844
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"161⤵PID:9892
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"162⤵
- Checks computer location settings
PID:13488 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"163⤵PID:15288
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"164⤵PID:16336
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"165⤵PID:10060
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"166⤵PID:15180
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"167⤵PID:15864
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"168⤵PID:16228
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"169⤵PID:9360
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"170⤵
- Checks computer location settings
PID:10308 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"171⤵PID:10268
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"172⤵PID:10416
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"173⤵PID:9680
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"174⤵PID:12512
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"175⤵PID:10256
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"176⤵PID:10292
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Runs regedit.exe
PID:16476
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:12404
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt.420Filesize
16B
MD5d3aa3357eadc5ff72b680b1f69d83e19
SHA1f42391c6ecc842cc2c0bc7e9fff2edd798558954
SHA256b9e67d78b43bc18e384005cb77e6d144f6413aa8573958c9360a36c81492ce1c
SHA5129f6a932d54de5ccc57f940e288bed5e8ce253336afd3cb5b678b6ba4a86bec8cfb350bdf6ee185da1aba59d4ad2df24db1b3a4753074b374683f1fa0610a4282
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.420Filesize
16B
MD54c1f82594ad6c8193632221711516900
SHA1d235d15dd90b82638ae24b5e4162ba55f3724056
SHA256ca18aeaf94dedea3e812ea96b38c19a8e9fa0a7abca2da73b9b2038fb2ad1b13
SHA5126be488ee113e9661b0b7ab5c41d5b5f8470a96b077da1693a1b8686a39904315102fc148475db52adbe665ee11c02b00f0f16d8eb95059e38b4f80c36502e2c9
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.420Filesize
2KB
MD579c6d2f86802a292f41fa3c385f61fae
SHA1c64a66a9a2f645bcb309ea9d10813f557a05294f
SHA2565910fcb4482dd12e202860f1fc72fa144aa27b390fa275901092f9214398fe9d
SHA512cbe4311403e3bdc10e33ca0ff2d8a380346769a01a9cddfce292eb5da3ef506a47570f301868acc7bf4e52b1a483dc984b9f35bdfbaea976f3da388e099bc6e5
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.420Filesize
6KB
MD5fd7250b1cc86bfce5e24dd51ba2bbac7
SHA19a7308f5ac5ce436223215b38d439f2006ef3933
SHA25657aa30f06a4d38ad02fabf43f2f376e1aff6c38b07ce9e324fdeabff6c4b21a8
SHA512a21edfc4e0c51266c07fac35407bc4c83cd0622b5ac2872b606f49e509fa6f7aca8eb4750510d76608a1b89bf84de1f4ae98525755709874bbe7d701a6a2a953
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml.420Filesize
321KB
MD5585002fd4d920042c3df96a55b15265e
SHA18a3460d110c788735ee5318452be9d66e26cf803
SHA256012a9ca399cafc89ce6de583f6759e283aaa6ace0ba18b879a70e67c71cd28d1
SHA5125fdf32a7e064818cc8d3ce3dc3f12c11766630f76d58f93e7b0f44e093175cc2e584d34f05b85ac13747a1db297fe1e4de59333caa8daefd1900abfc43842d59
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml.420Filesize
560B
MD5ce7a2191490b33f6635bf3172acee6d8
SHA1f02feff3160bca6d14b7169de2cb713c2310630b
SHA256b9166a5fb3af0a1ca977221e0cd131e4c33a6bfb7e48bdde79822e9d69592784
SHA512c801dacde4163bdf7ed6c21eb13e5acf2a7ce71b3f6f5a003e58f8580f2651b7adc543a3e680da9183262a1cb87bb796762b8ae86a1c8637cddd1f937f5231ca
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml.420Filesize
100KB
MD56df18ce09245971e338740f870084394
SHA1a40043b2edff084d0524361d9854440eec48dede
SHA256c5da6142ec5f836293652b73c9bf8fd91847c35f16cb5956e188ec6a7b1c0315
SHA512f345482afaf6130cef932814a0dd957fb0c7ddf88190f634c911c4eb909a9f8032cf834ae898875a5f7a61df7a5669602cf1a426145e6a1902433477d86eeec8
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.420Filesize
130KB
MD5971626d372e843e06a467e87531980b7
SHA1afc29ec325c6cffe180db538f1ea37f084b5cc07
SHA2564869597258a3ae224079a5ff5d841113e544af2403c4911e9c1776d811ba149c
SHA512796f07f0e93ce9deebe926f6d24f843cf572a0fcf14e156629768d612cb01964fac9cd258e992894556c8bef13c63f0f19de88aa8ccdd6896b45045c66459413
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.420Filesize
270KB
MD585146fe4b4856a1b57a6172c66bbd2c9
SHA16c9bffc717198baad4466b6ac7faf1588de5118e
SHA2568666046bf445502116e8b34da531e987589159616ddd727fc4623c8f3f0f2fea
SHA51242561081193f7720810936336fd3dddd1e08e2ca6ae39751f124a8798282eb7972f42acffac320d5d6adec84b747de2ce86117b7117e9675d2338acd2f5667ef
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.420Filesize
332KB
MD5a2ec35656944eafa1336bfe5f098a06e
SHA18de63e27e9e3a9a5c02b3b9e92d024f78ca1c68e
SHA2565a06a1372e9a993eb5ddfb7be5359c018d5aecf6fb99298dd60d111d90501f19
SHA512f259ffc7f1ae145db87e7a93c2b6c05a800b1869dca41a229bb575d36cc51db5592a1e335c6712204ff56c7f22833b264c0dd5ac147bc2cc7c93d595dcd04401
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.420Filesize
5KB
MD57ddfa22afa17b213b92a2d706cedb7d4
SHA13ce6e66634953a4676609f17dd7c917288151cb7
SHA256568c811db6c7f33dce5723a3e73934cf7639f6fbffa43f2699ecc471953d083a
SHA512119b92a454857cedb6707217f2f59d886ba075b5585616343c86708bf78a6e299a34b7d1a66471feaddeb970197be5a0a0cc273044762c69eae1331b1acf5860
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.420Filesize
7KB
MD5af406b2f60e1bdc11f38941d4c8ee789
SHA1c2a5e8544d6d052f31d4be12b56bcc79c7075228
SHA256f2f3321fae628993beeb9510f3413887be214dd23d438c59ee4fc04ce5577e19
SHA51206d53eb7a72a654613e6d6c950664fe6dee076f14fa5bf454bceb658e5c02c00f183d82374587e9c3bddac9a7c224db047fbccd51551a29e18feef59e753c492
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.420Filesize
8KB
MD520212b619de20ca8036bcfa143b448a5
SHA1257258f87b8b35b6269a59f62832d91e978dcda8
SHA25656567fdd908eb6c58aecf155741eca281ab127131056baba63c25b5882160180
SHA512e427ae838380b97dd33d4bdd507bacac8788aabd095223d5f73b4ccd341d10aca6eb9b9b1da51adb78666cfe3746e5847e71103464bbc9b55c802777f14593da
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.420Filesize
10KB
MD53bc42eb1eccdfafa617b61474724dac2
SHA16a26940a2e23be374d418ec2ec606b50f84bb0a5
SHA25688cd551ed0c80aea22a7cc6bfb3bf7dcb9f49abc7b7bff007f7532157f1298c1
SHA51208a12861bb2320022298b5f1707f245671ce8a46766b4700f47a66d6bbeab79285d156ecd6fb32058ebecaf5b8a52691f4a6801177bfc3867f865130e5a2d678
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.420Filesize
7KB
MD579aa301d332168d9ecfba9705dc6f18f
SHA1f47eb9382e85cf252f7ba4fcaa983e71d9031097
SHA25690662bf8645df521077b9de4fbb61b355791f2b7638d0250b6b0b21c3b5d418b
SHA5122819fdb2dd5851bb19455176ef6016ae44789552632cda589ad07c89d54f1c8b91f00f0c060ba83b64946b8973463441eb60f82835d2f4b95ac22a5d2dfc6e78
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.420Filesize
4KB
MD53dff36784bd6d115206129782508df22
SHA1b84b2cd5fa681000cfe543e09e0cd1af0e0e2645
SHA2562a43eb1ff6700e2111e4737de83ea2af08c9bd2369dbd3253cfd6c2b7d0db60b
SHA5125c5e2378920f60f91f5f512c04ef63f5b056c03a90be965bcd5c293d7f9b39c9d292ff9f8e037f8aef98d3ceaa7d8bf5545d23713fd24076c2eecf2823ea76df
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.420Filesize
7KB
MD56482ceacd5de556c906e9174ea213ac4
SHA19656e3a8e1315f109c3f4cc4d7df5427919ed736
SHA2568d789177af9a428e3e035d4b574983aa577d227f341b12800d0a4dfebc20c84a
SHA5128c7dd9b2fd53b38b20f38a1cd79d1c7d63c93f6d50fa12b81856cced8ddba7b840e50dc44a927d56f7553e5b6436d352abfedf5b885328ab65af8992781d8d2d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html.420Filesize
6KB
MD5a3a2e4e16aaaa6cca6e15f9c90eb7dfe
SHA154e9f7ad2b8e11526c7006dffe24cb2376d546ba
SHA2565ba1dbcb7f628236eb28138e59539ab100dcb9c6c8dc58970780edc8deee4e6e
SHA512830788686f299d92dddb14c23b5fe3161d438362a7a235ef74ae3fb6cf6043bf39ecc91cbd4f28c605198b8982326ba38f975f525b4375ed146c8acc642e1b04
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.420Filesize
14KB
MD5c7a6875d4b6bd830b490da8514d4ac8c
SHA15cf2cb12dd45468f56c07fdda90066982bb21a41
SHA2565d0cb829307b1ac8ed6ce598bfdc25a10bcf31fa253d78ff65576472e21c7aa8
SHA512245b0a07e81f2bab9ea6dad29629059e54d83940dbf90b1caec564733c29230380e25e87f06f48da04ff653236fa46dc168bb6bc65a96e8b20663e432f5f84a2
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.420Filesize
10KB
MD5ae81ade97d2022bc559f821233eaf251
SHA14d2db669aed5219ebd52b0275dfcbee823364006
SHA25651ef1bccb57ec7f93b6e4e6aaca6234b3d2e1fa7c88af2e3b24b7635bf73ff3b
SHA512a662848e8eb903f3183c4e6c8d72f7200c6cdbd284c7427652d7ea786de624d330e542ecc0965d9988a1e0dd32756208119ecd3d709ddb6be4f75f1b5451f561
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.420Filesize
10KB
MD5f5d45c66151be312d7930f8dd76d263c
SHA139607f30eab1acb130a6f3bc33826dadc791a3d2
SHA256886066767cd98f0571bf04e7028232c05e670ba855de71fa9f29c5d217a96bd8
SHA512719ed3b7fcea5153beb0c7b310b39f249a2b6e043e24bc501435478f5e5fff37b65d0787aad72de377fcfd6ee7f783154ea53da48e513b6d7add850c83d4c492
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html.420Filesize
6KB
MD5c3588d56a93318f10a1f793601c624dc
SHA1c86a79454eec483d8af919daa89f11650ca89535
SHA25680483d2a355989aa4caad3b74ea89a8e7a85af2e693c11ebf968bab3637dd668
SHA51248079d6cae5d6128fb1ed2531d1df0dabe08fb758edf6091be2d1c745c105062924b15ed23e024d52be0f44bf64d86defc6ca6aca67588749262382a23c94fa6
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.420Filesize
4KB
MD52137052f3a4740453eef134d833fe515
SHA1899afc8803980257f87f68fce70526f44e4681cf
SHA256b9f30902704f6f64d5f9677182f9021a43e57a03bf72729bcb4d7b4e59f902d2
SHA5128f39d8c36087f04695360cc7321ed275ef2df6dfa5d5d139551e0096dd4659058165db778d936cfe81e2ee6cf42d672efadf664d0840617c7cc11c42c493463f
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.420Filesize
8KB
MD55ac6e918f45de88df57be721161ea6b0
SHA199a9798c124b034be5c62013d6b0ca141d1d3562
SHA25676a0f92020287fd0c32485b054fd08ab0bf8248f3fe3ec7b50455b22ab67ea05
SHA512932321e9768b216971ec621a2fa884351cca2baef5226e0b5747d0709b851ed09ba3f2d33306a1cd2deb9f4ce4b33227f36bc16468668b7c71b632a974a44c6b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.420Filesize
9KB
MD53add9f876b690d3d8e2960d9a9c94a5b
SHA1e8c47cc3c90b5ab817be43aedfff0fbbe4011f62
SHA256cc7ed7956b82eca55f9c4baaf1e4b37bfce9397b859edea361f1b9c3903a6ae8
SHA51244a4804b2147d40e82b2d408354a0fa733744119e4beb8cca5366a604db87b48fd3a92e1ffdf15664d6dac14b1110af5e1b7df496d54b7c42d8d262ac67b8385
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.420Filesize
7KB
MD5072f453a89a4d3038e6cbd578a6321c0
SHA19441cd7523057c477a1968b7a91fb9dd21194820
SHA256681b66383128c1a3ac22997173fce26ff2de8ba5b809e5f960b8a680767b56a3
SHA512faa4fa5355d6c1346a48f79d3b12bd9f993d9df404ed11c31fc007eb482797a4acd6393a306685beef1519dc0724af187ca81eae4bae3fa00d1dc363cdff2040
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html.420Filesize
1KB
MD550f45ddb88b60bc37c52c35948da6226
SHA120e39190857e0247db2cdf7d2e55b438f09e0397
SHA2567cbcfe19dc39c2883117b0372707f79b083d98bcbd0dd99e45d3821125a09646
SHA512e2e9c3486bedf3e0ccef99856ebdfaf7226e5a47004ea129bda2df66ee0d29ce9bf520d8097cd6b7b7923497298a4a4f0abb623b7905f89408e4014d4c6e8c24
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.420Filesize
47KB
MD52bbffea67fd3664e3428d14f1b21ae9f
SHA10c324e5ff82f8a1e5b3e70597f71c263cbb07b6c
SHA25689e64f11995f8f665bc064c907d33fb86cba32653ba256ed847a51bf89a91c30
SHA51245eb9dce53dc40117dd5c38aeb1c8e4ad3bde1f7a1bac5e2e38e708cdbb09576ead26cdd807b21bb820b9a5df11901a3e615cf76946c03a0cf16ef3b734a7346
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.420Filesize
2KB
MD565213d2df4e3bc35bcb0e2085d1546ba
SHA14d7721f81ff9097a76698f92e1a5656dd226c9a5
SHA256fb446df7daca5f6615250fe0873de17ab96b2d668f21959e0a57e5ed56f10280
SHA5125099c07b3db82f3d371c585307b0060fd63e93769d6714f1ae72ace9639c3bec328d270ac9e6d644e4c404ad128d1bcc5dadbb835c6421be491186bc20b1fb7d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.420Filesize
720B
MD57292c68b20c58e9c78acb05ca8c9d56e
SHA1e01722906f89a7a3a728c8c385ac9d306bc485ad
SHA25614cf318ff227a7a73e5441eb91cd513fe134714b58a8b1863495f3abe4ab2f71
SHA51295c0da6794cee8c658d1f9bed5b303e2b4f861c979b598f69876bd57ddc2e31fd03996ceed01253783bf5f4d8c9fbe303514844633c14f2286f083781099b425
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png.420Filesize
656B
MD5236cd2abd158f2bd276dc0f8d91e8ab6
SHA1793fad5583aaf119c46c3683cf139a19e87341cc
SHA256530afdda1fd2319112eb9a2695c8ade5830519d9999fc8fb1bb9c556b483ad33
SHA512c2028106029196b4665be0ed9a5662453ed7ab4d91f34d4e6f527b84cdbc8245f7516f128055d17ba62928953a48bd4fc2d21b6a9177fbc53087b180f08f7310
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.420Filesize
864B
MD51c58bf2b6fef0f0adabc8525584ffa1d
SHA13a32959040b3527078de824bdc16161d64949f17
SHA2565b478d42e551d6185f46cdc7c2b06b0a647b41c9f10e3ee374556fe0f9216da2
SHA512953f108fd4de1e7d1723ea4f16aeba03d46eb03c0871b4e8635362006af41ff0a024083a80ebbeaceae5a681455beeb8b33881d6bc459aa1ea087a807ad41fa0
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png.420Filesize
992B
MD5c455efbd6bf02c728bd34fc5609f24e1
SHA1a0c67cb44a5bb33de333221b771058fc163d9a52
SHA256cd770dfeb9dad9c406e163381448e6628bcbf3aab3614c4083f2a50cd767c0cc
SHA512644edb71ff2ec0bc5d983cc907484f167931c0e591dce7ebc3cf74220bbb551f280e6d7bf732ac25b517b3ad929cdba5a8930eb01bffaeb71bff12157b58733c
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png.420Filesize
1KB
MD57738095d6f7a265d783fbe963094d5b9
SHA1520782fcc3f82a1f781502af95fcc96e24c3680a
SHA256a016c9c5d952228e0c68ea9be6aea5c513f35f9a2c728639ca49ecf91a89ef32
SHA5121e612071afac4b13c388ad73a7111e813a9d86a41d8d51580678301bce82a51a9039d7448abee408fe24870b3adcb484751afa6120e48391d80af2dfe3cc04ec
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.420Filesize
352B
MD583930b510ce271650edd8d5e457fd006
SHA19b4a2f832b345311ecd0cc5aa073f4992db964b8
SHA256ae915fa3382bd04ed86f8b628a2d2c9232c9119e3e02098ea926a4e7f1ae41f3
SHA512b11219dec88c6018eeb32a53b85516e4400f87a19ca215cdd0523750adbb748728903c3d52f88525ed4cc53827d634502c981e0fad453cef205d0599208970f3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7aecc611-26d7-49be-ae95-c7e71c0ec540}\0.1.filtertrie.intermediate.txt.420Filesize
16B
MD5e8aaa566651759e399714d464cdfb390
SHA1373942a3618c8d5ff0ba8aab8e22d4a64e5641ae
SHA2561a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a
SHA51223f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7aecc611-26d7-49be-ae95-c7e71c0ec540}\0.2.filtertrie.intermediate.txt.420Filesize
16B
MD5209371fb985ae536f7a01b2cbf06fdeb
SHA16e5d735e5a6aef442f3342931eaf47d505763578
SHA2564cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3
SHA51253203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086595780251.txt.420Filesize
77KB
MD54848a8901309f36f06c194b02f866368
SHA116d3c530c084994aeac63d12cf8d2c1abd67859a
SHA2561f627a465b309fb84f9c29c93cc8bf0d09829c109343e0ce7341b98c398ed9cd
SHA512294d089e1611c61e91eb1ad53ed808f2e08f57d76f484c83adcc6a0be2f60a8be5022e94d217c0d59ee3138fe8a25dc3d2d73b85fe74765ac98213cc19caa4e1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088460765966.txt.420Filesize
47KB
MD5007cdeeef4694b382d2a181c27773629
SHA174087753dd3baf84c932cdd46a55d25c629d13cc
SHA256b4fe3e4b415ed5d9b4c345a4c80801ce47b2ea32eba257a6f0634554637f96ef
SHA512f9865ed1bbff04a4b3c0a63b3803a54c82d81182c6abc0bbc9823a1b464a72525fa091fe7f4f211d1ada2f1f6c4eb6f63461295cf59d7b10337b0b46b88f878b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586094498261003.txt.420Filesize
66KB
MD549decfe81666667c457426ab0aaef75f
SHA1acc34ab1529ea7dd693f03363c142bdef769a7cd
SHA256a43dba137e9a0e50daf794f7b2969acd3dd4232f05736aa7112ef57b86216de4
SHA512bd0dd2daf63f9deddca74b6ee2f36c54efe05f920a33af26b14609850e87f9743169c6f7f5552bd38a3bc5257a29b5fe16950bba31ec1f62d56c5fff3ec5b302
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587470836483139.txt.420Filesize
62KB
MD5fa857eda8e8755189415dbd365022f7f
SHA14c99d5630a26cecebe8068b15d3b98e3e686b28a
SHA256f9cdd6248aea0dbffd41e7b1289044158625d67867fe16a054fe130fac09beb3
SHA512176f663e422a715c760a8eb587fe7bb2cf673f488c5f3eed2c673261246b0d7aa4c31f9d63e84d0a67011878d8618cb682e4fb4a0347a5b2a5b782cd32286325
-
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135575.txt.420Filesize
16B
MD5bea21141aa401823a718b5744650822b
SHA1bbe9cee4379b81dcf6fdf92aff28f2209563ce50
SHA25657535fe04df416b5a689aa33f01d8e939f1d91fcae25c0c3cf8192baf417b1fe
SHA512281f779891962273de9f795dea1917044247dbbe427d111b43027c08ad70577aeffbbb6dc8e68cb0013ebd1ce6103e10f1c71c7e144e75df15c76865ed9c9a08
-
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124211808.html.420Filesize
94KB
MD577ac0e9a5f9203e1525c7ffcf7958905
SHA1fb9d617163d84f71acbaaf4780d6eaf27d8d0e69
SHA256f112cac2f4c92767181ba007dd1de7b9f0fc6be4e0435ee3605370f381fb9cbb
SHA512a0498499535823d6cdf6aa6043d4523342e24f78250c94949870a52f8715faf41536d5baa962079c8fddf8f49f49a128f75a8c7bf8f10926e31a442be0438513
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rrptwlp2.j53.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420Filesize
1KB
MD534640c14059149c7a27227eb455a870f
SHA11cfc7c3e2df68be1a89efbd00d38861c5f7ba7f2
SHA256f3b22cc59eb86449d0a65bd39591b881d8e352877d8fe4426a075f0e64c4a134
SHA512edda8c3e5044ba564cbf3c279e184c62339ee86a7debe335b1c61ca5bc1672c9d55a19e5f390d9fe55823a086af0dd482c03d9441a873761a72711128e6e88cf
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI46F8.txt.420Filesize
425KB
MD576002bff63649eb5fcec3d31f1477382
SHA1250a34f7142a906162f790fb1c2e277e6452e42d
SHA2566a1c8792d4ea4fa1bc8f8ee638526eab59555ff6e45c25e78d98859b3edf4b1a
SHA5125497011de9486743c4396c614c6463182e6b7524f8f98617edf29b0f862c5d2b928b5aa7a7d75b8ec99941fb57afc13f4f07988882c1e0779b13c06033253985
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4719.txt.420Filesize
413KB
MD5a21557d8cdba06bc13307196ed1b34f0
SHA1a135f7edad1d5cbe88800eda15b58eb1bb1c09b4
SHA25696077dd9a5778592fe9fc95b7c014e119d346be14c33581bdf655f36188cf69f
SHA5127374d63344727f488729c0d2bd7b15e4696b163298f4e904f23da01dbbb0c609e641081fec456a0fdc2c2aec04e3738108d06ffdec4008aa8384e7ff7785ebab
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI46F8.txt.420Filesize
11KB
MD50da92f0ba482e35752fa9335366197f4
SHA139056fb2a1b619e45c9d538a138d6558e4dbfc21
SHA256d010778abbff47a79443c9dd0e4112a9440d95ab80bd92164d95fca65c167738
SHA512a6985df17fcfa744dcbc3b9d3255d52dd4197edd9018e3c3cec00a563e67900cec70a600ef9fb6ca8e34469e04898ea58ce5c6723a28a4490877da16a8bce02a
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4719.txt.420Filesize
11KB
MD514defdafdb4497d2cf132279973890e4
SHA12b5689c8a61c40651225cd57edcb8fff6d1fbf29
SHA256e05c99439d12745d7503646701ce839f454e0997037763346af04e2ebda1de48
SHA5123116af5cc7a0feda7d26cd23123ff3e24065ddc66303f56d165d3d9170bb584467506b4711ed8b3dd8773f2d74781f207eb31f6e4aea5f64eec7269b8314c71c
-
C:\Users\Admin\AppData\Local\Temp\jawshtml.html.420Filesize
16B
MD565e115805f15f9cda5eb01e8f742d121
SHA1e3ecf29bfa71ce07baf8d02009afb8766f35981b
SHA2567852451b2b252515f369b14bd765135c2e11fee72276b5020e3ed61513c5611a
SHA512dccbfdd893e5806fa1418e48e0c0c72ec2d1266ee7de48fce34bf3f74bda7e0682e8bf90de53594f34c3d5682c8164d9f6b6ea3977619be8487c2e339faa1ada
-
C:\Users\Admin\AppData\Roaming\AssertRestart.xls.420Filesize
176KB
MD57b6ac3869819e01e74397230d92c7d7a
SHA17b3132a50c84bf8aa490da982dfdc931540449c1
SHA256d5c0b3aafc7b50b59fae8474556b73fa451f7f1d6a94516613180ec53e74bb57
SHA51217c773740708240556385eec2f88ac6a052499edca6e47e5f8412367eadd3902a88a287cbdee0e08d3348bf7b3a1765c2ff49df268199a6266052ddee0b39120
-
C:\Users\Admin\AppData\Roaming\BlockSplit.csv.420Filesize
266KB
MD5609be2d5c2ba39343dfd801a78278b35
SHA10471566048c4e2b7f7b3ae887efde9780d2ce124
SHA256319eccc1d046a99356e6f2f3305031254e4482db46875dd0228161ae43e80cbe
SHA512190e5966d9c297fdac1faedb4a8fed22ef296b3df413989360bb8b793ad65e301351d75383600cfca42968893729969d053646cd7f5f49ecc3d30b8fa81da55b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk.420Filesize
336B
MD56669ab634db0485b2d997500b1c6e57b
SHA1866b37a8913c558ec4734021391a8d33e7405223
SHA256f901184a6b378e69315d9e9c75a7476ff00b56bb61b6ace653fe87077a073c22
SHA512fd50e104fd59f5655cc74f4e2b9d7df23ce828d9463eeb1920768aa21802d7a51fc24624b990db9a1fbd7e2651c591e971ba46276587383c83a3b28afb34d644
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\New folder.lnk.420Filesize
512B
MD54cbda32301d3b285c41b913b0b830322
SHA1efb1ca048e7fb26db35cb75c7d02a8f349d0046d
SHA256d995c97cd527f313618705df78757a342e70cdb11be8f330c63b1ab01a1653d7
SHA512098a36f80c67447ce6e449e47984b374a1d0d37e8425fa8e04ef2b27589196ab23fe34bf2b34d217e7fab928e596a296568521ea84e71e333cb19f470bd54ae9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420Filesize
51KB
MD54927e0cb561d4450afc0b847853f42f2
SHA14a3645773d95ed07b59272871f2e88c399adf0dc
SHA2568ed353d134b8d10b78f61ed8bfc614aacaff504a1d0659be1d245ca97c759384
SHA5125ec501ba8e731ab4ca7df72887850bd560e65151d03a32be9839948df2f12d38ab921bf3a30fd73e41262925aa1b43ad1b8b9b3eb6e500f82c1985cfb34145c0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420Filesize
51KB
MD5f14ebdbbc002c8ca15a7b7e139b01b25
SHA1361c8e0f9e1480937b44cb208b65da4cd85d3d52
SHA256c4ac4b34f8ac38a53e2eb6f1b35fefc01cd61c9c325e6ddf5f2d54de518515b8
SHA512a9b2de5fd410db8e58b10fd8b0d854c8c9b191cc4157d38adb07600ee89110665169849d84692a749798db7063de233d837d31f1b0a85b248bad7f32ee4fb269
-
C:\Users\Admin\AppData\Roaming\RedoEnter.html.420Filesize
124KB
MD53894a7a3fb97b4a2029cb3de22d562e6
SHA1ce55c7a0ecc8db21d28178c79b189eeb8dd3ae7a
SHA2568206f6d939efb250d9ff1258d1673dcd79e1db9145b65a769f4a3aabe4528b56
SHA512a2d356c39302ad15af4bd1b8401870dce0c8fa14cefa2a34af56ee406e82243946d1ff7170113584c4fa6743db3f4a35f5cd4ba0e82bec0dddc42deb8e1ee1b2
-
C:\Users\Admin\AppData\Roaming\SyncOut.odt.420Filesize
233KB
MD56a2c3469febeb6b10ea8842b36799941
SHA1315086996cd6a15ac63a6fb39b62a30480042e96
SHA25677fbd362f840e9221e2b7cb201a4f4d6edce0e0b1adbc86136d148924759ff13
SHA512d037df122fb76e10cc1144018b478a5cac2945b3a6ae733e6e5719f539643aa51d7457aaa73863bb04c9ffb2ed19257bb004416d5660823cc202c9f49593a9ed
-
C:\Users\Admin\Links\Desktop.lnk.420Filesize
512B
MD54ea8559c0c5a550fce02fd2232dfc6f9
SHA108f2671176ab311530eebfd31738efbeb6b0780b
SHA256d69bf5639840ae5c5c42b7d33b9db43575a14a8cae19e927aacad1b6c15cd28a
SHA512083d543db11794e409ccecfa97f70aa16681cbb508f5b1e29576fbf90c9a19c96c0227d66d5ac35f75dafd3a72f2d1b1478138161cd8044b975c5c26c1d4045b
-
C:\Users\Admin\Links\Downloads.lnk.420Filesize
944B
MD5146e62f4b9212728af52b03364e0ca95
SHA187057c2fbaf92801e00065e7cca833b448df96f1
SHA2561930ead91fbc0a1277380dd74ac9011f7fb4f9f061926f204989708554422ad6
SHA512f18b69ef4df38b62abc4046b5fa22ba49380b29b91e5a13d1c5f8a8dc4cea7c3b12ff5aedb100a151a6748ed69723c1fbe31d1323576ed7ff7da9e2a125e5bc1
-
C:\Windows\System32\Seven.dllFilesize
1.0MB
MD55085a3287ace94a94b9275b28f36f2c9
SHA1a76b4c329debda0613184d99ef4be5c55b285d49
SHA256c2be652db3cbe9114821f93f80a5feff21508b25cc0ae86fb7a00644283447b0
SHA51274a8ef9ae978e7e756df7646dd72e93ad01e07a160310e89f44fe0ae3c75d3cb36a850a35966e4459d547421e055151e68df5098db4f6fbb7b9401f5fec57a4c
-
C:\Windows\System32\Seven.runtimeconfig.jsonFilesize
340B
MD5253333997e82f7d44ea8072dfae6db39
SHA103b9744e89327431a619505a7c72fd497783d884
SHA25628329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
SHA51256d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
-
C:\Windows\System32\SevenCopy.exeFilesize
139KB
MD56503f847c3281ff85b304fc674b62580
SHA1947536e0741c085f37557b7328b067ef97cb1a61
SHA256afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
memory/1600-10-0x00007FFD6C830000-0x00007FFD6D2F1000-memory.dmpFilesize
10.8MB
-
memory/1600-12-0x000001FC9C6F0000-0x000001FC9C700000-memory.dmpFilesize
64KB
-
memory/1600-11-0x000001FC9C6F0000-0x000001FC9C700000-memory.dmpFilesize
64KB
-
memory/1600-15-0x00007FFD6C830000-0x00007FFD6D2F1000-memory.dmpFilesize
10.8MB
-
memory/1600-0-0x000001FC83F80000-0x000001FC83FA2000-memory.dmpFilesize
136KB
-
memory/7176-471-0x00007FFD8A220000-0x00007FFD8A4E9000-memory.dmpFilesize
2.8MB
-
memory/17748-470-0x00007FF69F860000-0x00007FF69F8C7000-memory.dmpFilesize
412KB
-
memory/17912-484-0x000001C562980000-0x000001C5629C4000-memory.dmpFilesize
272KB
-
memory/17912-485-0x000001C562A50000-0x000001C562AC6000-memory.dmpFilesize
472KB