Analysis
-
max time kernel
131s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 07:27
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240426-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation SevenCopy.exe -
Deletes itself 1 IoCs
Processes:
SevenCopy.exepid process 4540 SevenCopy.exe -
Executes dropped EXE 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exepid process 4540 SevenCopy.exe 12792 SevenCopy.exe 8320 SevenCopy.exe 4356 SevenCopy.exe 2212 SevenCopy.exe 14192 SevenCopy.exe 14516 SevenCopy.exe 15396 SevenCopy.exe 8136 SevenCopy.exe 6300 SevenCopy.exe 10656 SevenCopy.exe 15500 SevenCopy.exe 7732 SevenCopy.exe 7828 SevenCopy.exe 6148 SevenCopy.exe 7084 SevenCopy.exe 15216 SevenCopy.exe 15612 SevenCopy.exe 14840 SevenCopy.exe 10400 SevenCopy.exe 10348 SevenCopy.exe 16316 SevenCopy.exe 5492 SevenCopy.exe 11456 SevenCopy.exe 7124 SevenCopy.exe 7728 SevenCopy.exe 5868 SevenCopy.exe 6152 SevenCopy.exe 9736 SevenCopy.exe 7276 SevenCopy.exe 6496 SevenCopy.exe 15772 SevenCopy.exe 16060 SevenCopy.exe 15076 SevenCopy.exe 11552 SevenCopy.exe 16000 SevenCopy.exe 15240 SevenCopy.exe 2120 SevenCopy.exe 13776 SevenCopy.exe 9600 SevenCopy.exe 12320 SevenCopy.exe 16364 SevenCopy.exe 1920 SevenCopy.exe 8868 SevenCopy.exe 16264 SevenCopy.exe 2828 SevenCopy.exe 10036 SevenCopy.exe 11228 SevenCopy.exe 15712 SevenCopy.exe 4728 SevenCopy.exe 16704 SevenCopy.exe 8344 SevenCopy.exe 17472 SevenCopy.exe 12248 SevenCopy.exe 17480 SevenCopy.exe 15784 SevenCopy.exe 16048 SevenCopy.exe 17228 SevenCopy.exe 16796 SevenCopy.exe 10184 SevenCopy.exe 10032 SevenCopy.exe 5960 SevenCopy.exe 9184 SevenCopy.exe 7184 SevenCopy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops desktop.ini file(s) 7 IoCs
Processes:
SevenCopy.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Documents\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Music\desktop.ini SevenCopy.exe -
Drops file in System32 directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4048 powershell.exe 4048 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4048 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Seven.execmd.execmd.execmd.exeSevenCopy.execmd.execmd.execmd.execmd.exedescription pid process target process PID 712 wrote to memory of 4048 712 Seven.exe powershell.exe PID 712 wrote to memory of 4048 712 Seven.exe powershell.exe PID 712 wrote to memory of 3444 712 Seven.exe cmd.exe PID 712 wrote to memory of 3444 712 Seven.exe cmd.exe PID 712 wrote to memory of 1368 712 Seven.exe cmd.exe PID 712 wrote to memory of 1368 712 Seven.exe cmd.exe PID 712 wrote to memory of 2540 712 Seven.exe cmd.exe PID 712 wrote to memory of 2540 712 Seven.exe cmd.exe PID 712 wrote to memory of 3760 712 Seven.exe cmd.exe PID 712 wrote to memory of 3760 712 Seven.exe cmd.exe PID 712 wrote to memory of 4976 712 Seven.exe cmd.exe PID 712 wrote to memory of 4976 712 Seven.exe cmd.exe PID 712 wrote to memory of 4452 712 Seven.exe cmd.exe PID 712 wrote to memory of 4452 712 Seven.exe cmd.exe PID 712 wrote to memory of 1996 712 Seven.exe cmd.exe PID 712 wrote to memory of 1996 712 Seven.exe cmd.exe PID 4452 wrote to memory of 4448 4452 cmd.exe attrib.exe PID 4452 wrote to memory of 4448 4452 cmd.exe attrib.exe PID 2540 wrote to memory of 4460 2540 cmd.exe attrib.exe PID 2540 wrote to memory of 4460 2540 cmd.exe attrib.exe PID 1996 wrote to memory of 4544 1996 cmd.exe attrib.exe PID 1996 wrote to memory of 4544 1996 cmd.exe attrib.exe PID 712 wrote to memory of 4540 712 Seven.exe SevenCopy.exe PID 712 wrote to memory of 4540 712 Seven.exe SevenCopy.exe PID 4540 wrote to memory of 2444 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2444 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 3604 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 3604 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 4512 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 4512 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1340 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1340 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 3772 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 3772 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2032 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2032 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1332 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1332 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2040 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2040 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2692 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2692 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 4700 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 4700 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1988 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1988 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2672 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 2672 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1928 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1928 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1296 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1296 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1028 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 1028 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 4140 4540 SevenCopy.exe cmd.exe PID 4540 wrote to memory of 4140 4540 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3052 4512 cmd.exe choice.exe PID 4512 wrote to memory of 3052 4512 cmd.exe choice.exe PID 1332 wrote to memory of 1468 1332 cmd.exe choice.exe PID 1332 wrote to memory of 1468 1332 cmd.exe choice.exe PID 1340 wrote to memory of 4968 1340 cmd.exe cmd.exe PID 1340 wrote to memory of 4968 1340 cmd.exe cmd.exe PID 2444 wrote to memory of 5028 2444 cmd.exe Conhost.exe PID 2444 wrote to memory of 5028 2444 cmd.exe Conhost.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 4448 attrib.exe 4544 attrib.exe 4460 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\SevenCopy.exe3⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\CopyStop.odt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ConnectWatch.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\DebugBackup.csv"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\DebugSuspend.pdf"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ExitComplete.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\FindJoin.xls"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ImportPush.ppt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\NewConvertFrom.pdf"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RepairPop.odt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ResizeSwitch.docx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\SelectUpdate.xls"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\StepSet.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UndoRename.docx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ApproveDeny.asp"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ResolveImport.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SubmitWait.doc"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\MoveStep.php"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\UnlockPublish.bmp"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\ConvertAdd.bmp"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\GrantSplit.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\MountSearch.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RegisterStep.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\ResolveRename.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SendCompress.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SwitchStep.bmp"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\AddConvert.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\MergeSync.xls"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SaveFind.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SubmitStart.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SyncRevoke.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnlockLock.xlsx"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510821.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI24F4.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2518.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI24F4.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2518.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070859354.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837245521736.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837928247116.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838254684814.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838451029087.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838515694078.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838567180292.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838750839126.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838812679810.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838854958362.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839873338736.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840507559806.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844022702774.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844322952340.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844624250116.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844979319796.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845400670849.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845577900100.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847200385598.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847499992299.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847800283963.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848100459721.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848894597947.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579887868586853.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\pkcs11.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I50YRZD3\update100[1].xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X2NSSXLH\known_providers_download_v1[1].xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ebe6a11-de91-4077-996f-4f928bc5976b}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ebe6a11-de91-4077-996f-4f928bc5976b}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ebe6a11-de91-4077-996f-4f928bc5976b}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39cbc589-0e9f-4643-9bd1-14b1344aa8da}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39cbc589-0e9f-4643-9bd1-14b1344aa8da}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{39cbc589-0e9f-4643-9bd1-14b1344aa8da}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f6a3bdb4-87ea-4b27-a81d-ba59c547355c}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f6a3bdb4-87ea-4b27-a81d-ba59c547355c}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f6a3bdb4-87ea-4b27-a81d-ba59c547355c}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\appsconversions.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\appsglobals.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\appssynonyms.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\settingsconversions.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\settingsglobals.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c8c8a0c5-5b6a-469a-ad55-8725a0448738}\settingssynonyms.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3ca7e305-e169-4803-b267-dc38483a5382}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3ca7e305-e169-4803-b267-dc38483a5382}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{3ca7e305-e169-4803-b267-dc38483a5382}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fadcd841-1261-4517-ac09-1289a2098b6f}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\EGU4Q1MN\microsoft.windows[1].xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RGTD1OIS\www.bing[1].xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\AddConvert.jpg"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\MergeSync.xls"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SaveFind.png"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SubmitStart.lnk"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\SyncRevoke.xml"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnlockLock.xlsx"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510821.txt"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI24F4.txt"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2518.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI24F4.txt"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2518.txt"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"4⤵
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"9⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628639622458.txt"10⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587628922397332.txt"10⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"10⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.0.filtertrie.intermediate.txt"10⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"10⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"10⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.1.filtertrie.intermediate.txt"11⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aaad6daa-26aa-412d-a1ba-edd7e1f70dd2}\0.2.filtertrie.intermediate.txt"11⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"11⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"14⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"17⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"18⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"19⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"21⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 322⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"21⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"22⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"23⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"24⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"25⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"26⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"27⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"28⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"31⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"35⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"37⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"39⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"40⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"41⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"42⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"43⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"44⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"45⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"46⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"47⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"48⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"49⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"50⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"51⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"52⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"53⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"56⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"57⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"58⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"59⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"60⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"62⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"63⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"64⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"65⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"66⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"67⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"68⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"69⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"70⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"71⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"72⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"73⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"74⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"75⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"76⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"77⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"78⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"79⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"80⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"81⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"82⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"83⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"84⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"85⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"86⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"87⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"88⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"89⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"90⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"91⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"92⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"93⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"94⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"95⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"96⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"97⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"98⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"99⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"100⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"101⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"102⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"103⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"104⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"105⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"106⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"107⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"108⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"109⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"110⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"111⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"112⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"113⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"114⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"115⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"116⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"117⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"118⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"119⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"120⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"121⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"122⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"123⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"124⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"125⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"126⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"127⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"128⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"129⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"130⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"131⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"132⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"133⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"134⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"135⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"136⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"137⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"138⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"139⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"140⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"141⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"142⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"143⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"144⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"145⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"146⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"147⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"148⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"149⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"150⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"151⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"152⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"153⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"154⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"155⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"156⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"157⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"158⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"159⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"160⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"161⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"162⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"163⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"164⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"165⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"166⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"167⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"168⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"169⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"170⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"171⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"172⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"173⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"174⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"175⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"176⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"177⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"178⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"179⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"180⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"181⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"182⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"183⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"184⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"185⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"186⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"187⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"188⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"189⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"190⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"191⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"192⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"193⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"194⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"195⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"196⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"197⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"198⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"199⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"200⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"201⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"202⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"203⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"204⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"205⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"206⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"207⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"208⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"209⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"210⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"211⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"212⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"213⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"214⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"215⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"216⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"217⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"218⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"219⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"220⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"221⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"222⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"223⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"224⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"225⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"226⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"227⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"228⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"229⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"230⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"231⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"232⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"233⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"234⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"235⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"236⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"237⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"238⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"239⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"240⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"241⤵
- Checks computer location settings