c318ad5f935df51e6db4e83610c25c473e5c5e0ccc2bdd914d54522cc6f0dd2d

Analysis

max time kernel
32s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Seven.exe
Size 139KB
Sample240428-hk47eaac97
SHA256 afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
MD5 6503f847c3281ff85b304fc674b62580
SHA1 947536e0741c085f37557b7328b067ef97cb1a61
SHA512 abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP 3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Seven.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Seven.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Seven.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	Seven.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	SevenCopy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	SevenCopy.exe

Deletes itself 1 IoCs

pid	Process
3704	SevenCopy.exe

Executes dropped EXE 2 IoCs

pid	Process
3704	SevenCopy.exe
10260	SevenCopy.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Seven.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	SevenCopy.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	SevenCopy.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\SevenCopy.exe	cmd.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	cmd.exe
File created	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\Seven.dll	cmd.exe
File opened for modification	C:\Windows\System32\SevenCopy.exe	attrib.exe
File created	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	cmd.exe
File opened for modification	C:\Windows\System32\Seven.runtimeconfig.json	attrib.exe
File opened for modification	C:\Windows\System32\Seven.dll	attrib.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
896	powershell.exe
896	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 896	2972	Seven.exe	88
PID 2972 wrote to memory of 896	2972	Seven.exe	88
PID 2972 wrote to memory of 1256	2972	Seven.exe	91
PID 2972 wrote to memory of 1256	2972	Seven.exe	91
PID 2972 wrote to memory of 1884	2972	Seven.exe	92
PID 2972 wrote to memory of 1884	2972	Seven.exe	92
PID 2972 wrote to memory of 5040	2972	Seven.exe	93
PID 2972 wrote to memory of 5040	2972	Seven.exe	93
PID 2972 wrote to memory of 2688	2972	Seven.exe	94
PID 2972 wrote to memory of 2688	2972	Seven.exe	94
PID 2972 wrote to memory of 2964	2972	Seven.exe	95
PID 2972 wrote to memory of 2964	2972	Seven.exe	95
PID 2972 wrote to memory of 2700	2972	Seven.exe	96
PID 2972 wrote to memory of 2700	2972	Seven.exe	96
PID 2972 wrote to memory of 4740	2972	Seven.exe	97
PID 2972 wrote to memory of 4740	2972	Seven.exe	97
PID 4740 wrote to memory of 2052	4740	cmd.exe	98
PID 4740 wrote to memory of 2052	4740	cmd.exe	98
PID 5040 wrote to memory of 4892	5040	cmd.exe	99
PID 5040 wrote to memory of 4892	5040	cmd.exe	99
PID 2700 wrote to memory of 5104	2700	cmd.exe	100
PID 2700 wrote to memory of 5104	2700	cmd.exe	100
PID 2972 wrote to memory of 3704	2972	Seven.exe	102
PID 2972 wrote to memory of 3704	2972	Seven.exe	102
PID 3704 wrote to memory of 4520	3704	SevenCopy.exe	103
PID 3704 wrote to memory of 4520	3704	SevenCopy.exe	103
PID 3704 wrote to memory of 3344	3704	SevenCopy.exe	105
PID 3704 wrote to memory of 3344	3704	SevenCopy.exe	105
PID 3704 wrote to memory of 3396	3704	SevenCopy.exe	106
PID 3704 wrote to memory of 3396	3704	SevenCopy.exe	106
PID 3704 wrote to memory of 1160	3704	SevenCopy.exe	108
PID 3704 wrote to memory of 1160	3704	SevenCopy.exe	108
PID 3704 wrote to memory of 4936	3704	SevenCopy.exe	109
PID 3704 wrote to memory of 4936	3704	SevenCopy.exe	109
PID 3704 wrote to memory of 2016	3704	SevenCopy.exe	112
PID 3704 wrote to memory of 2016	3704	SevenCopy.exe	112
PID 3704 wrote to memory of 5036	3704	SevenCopy.exe	114
PID 3704 wrote to memory of 5036	3704	SevenCopy.exe	114
PID 3704 wrote to memory of 2012	3704	SevenCopy.exe	115
PID 3704 wrote to memory of 2012	3704	SevenCopy.exe	115
PID 3704 wrote to memory of 2796	3704	SevenCopy.exe	116
PID 3704 wrote to memory of 2796	3704	SevenCopy.exe	116
PID 3704 wrote to memory of 4168	3704	SevenCopy.exe	121
PID 3704 wrote to memory of 4168	3704	SevenCopy.exe	121
PID 3704 wrote to memory of 2172	3704	SevenCopy.exe	122
PID 3704 wrote to memory of 2172	3704	SevenCopy.exe	122
PID 3704 wrote to memory of 3900	3704	SevenCopy.exe	123
PID 3704 wrote to memory of 3900	3704	SevenCopy.exe	123
PID 3704 wrote to memory of 3024	3704	SevenCopy.exe	124
PID 3704 wrote to memory of 3024	3704	SevenCopy.exe	124
PID 3704 wrote to memory of 2944	3704	SevenCopy.exe	125
PID 3704 wrote to memory of 2944	3704	SevenCopy.exe	125
PID 3704 wrote to memory of 2516	3704	SevenCopy.exe	127
PID 3704 wrote to memory of 2516	3704	SevenCopy.exe	127
PID 4520 wrote to memory of 2844	4520	cmd.exe	128
PID 4520 wrote to memory of 2844	4520	cmd.exe	128
PID 3704 wrote to memory of 1120	3704	SevenCopy.exe	129
PID 3704 wrote to memory of 1120	3704	SevenCopy.exe	129
PID 3344 wrote to memory of 2900	3344	cmd.exe	136
PID 3344 wrote to memory of 2900	3344	cmd.exe	136
PID 4936 wrote to memory of 2220	4936	cmd.exe	137
PID 4936 wrote to memory of 2220	4936	cmd.exe	137
PID 3024 wrote to memory of 4460	3024	cmd.exe	138
PID 3024 wrote to memory of 4460	3024	cmd.exe	138

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Seven.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1"	Seven.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5104	attrib.exe
4892	attrib.exe
2052	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Seven.exe
"C:\Users\Admin\AppData\Local\Temp\Seven.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
  2⤵
  PID:1256
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe
  2⤵
  - Drops file in System32 directory
  PID:1884
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\SevenCopy.exe
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
  2⤵
  - Drops file in System32 directory
  PID:2688
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
  2⤵
  - Drops file in System32 directory
  PID:2964
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Seven.dll
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Windows\System32\Seven.runtimeconfig.json
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
  "C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2844
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2900
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"
    3⤵
    PID:3396
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4340
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"
    3⤵
    PID:1160
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4872
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"
    3⤵
    PID:2016
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"
    3⤵
    PID:5036
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3680
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"
    3⤵
    PID:2012
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2956
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"
    3⤵
    PID:2796
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
    3⤵
    PID:4168
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:7084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
    3⤵
    PID:2172
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5316
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"
    3⤵
    PID:3900
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4460
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
    3⤵
    PID:2944
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:7508
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
    3⤵
    PID:2516
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:7540
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
    3⤵
    PID:1120
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11820
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\InvokePush.png"
    3⤵
    PID:1112
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14200
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"
    3⤵
    PID:2464
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14216
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ResolveClear.csv"
    3⤵
    PID:4384
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15072
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\StartCopy.txt"
    3⤵
    PID:2216
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"
    3⤵
    PID:4456
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CloseSelect.docx"
    3⤵
    PID:3148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\DisableRepair.csv"
    3⤵
    PID:4316
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"
    3⤵
    PID:4364
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15016
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\GetSearch.xlsx"
    3⤵
    PID:3092
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\NewUnlock.xlsx"
    3⤵
    PID:2772
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"
    3⤵
    PID:4472
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15192
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\OutConfirm.docx"
    3⤵
    PID:1660
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"
    3⤵
    PID:5104
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14800
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"
    3⤵
    PID:5000
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnblockDisconnect.xls"
    3⤵
    PID:608
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ProtectRedo.xml"
    3⤵
    PID:3992
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15080
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ResumeUnprotect.lnk"
    3⤵
    PID:2112
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UnregisterConvert.docx"
    3⤵
    PID:1256
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14776
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\WritePing.docx"
    3⤵
    PID:5100
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15088
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\WriteRequest.pptx"
    3⤵
    PID:860
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15272
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
    3⤵
    PID:220
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14860
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
    3⤵
    PID:3028
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14904
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RemoveMeasure.html"
    3⤵
    PID:4284
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14868
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\DismountRedo.jpg"
    3⤵
    PID:1900
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"
    3⤵
    PID:628
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14816
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RemoveUninstall.bmp"
    3⤵
    PID:5008
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\RevokeSync.png"
    3⤵
    PID:4720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SendInitialize.jpg"
    3⤵
    PID:4500
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14876
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\StartRemove.png"
    3⤵
    PID:3172
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14792
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BackupCopy.odt"
    3⤵
    PID:376
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15332
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ExitStart.pptx"
    3⤵
    PID:5132
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15008
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\LimitOpen.png"
    3⤵
    PID:5152
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResetUpdate.docx"
    3⤵
    PID:5164
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnblockGrant.asp"
    3⤵
    PID:5188
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WatchRepair.csv"
    3⤵
    PID:5208
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1300
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510859.txt"
    3⤵
    PID:5220
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15340
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
    3⤵
    PID:5236
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14924
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2573.txt"
    3⤵
    PID:5256
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2588
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2594.txt"
    3⤵
    PID:5452
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2573.txt"
    3⤵
    PID:5480
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15264
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2594.txt"
    3⤵
    PID:5504
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4936
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
    3⤵
    PID:5516
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4576
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
    3⤵
    PID:5528
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070937929.html"
    3⤵
    PID:5540
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4992
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
    3⤵
    PID:5556
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15488
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
    3⤵
    PID:5572
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1204
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
    3⤵
    PID:5588
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3156
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
    3⤵
    PID:5600
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2264
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
    3⤵
    PID:5612
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
    3⤵
    PID:5632
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
    3⤵
    PID:5652
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
    3⤵
    PID:5676
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
    3⤵
    PID:5692
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
    3⤵
    PID:5720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"
    3⤵
    PID:5740
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15124
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"
    3⤵
    PID:5756
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5272
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"
    3⤵
    PID:5784
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15512
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"
    3⤵
    PID:5800
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15740
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"
    3⤵
    PID:5820
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2984
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"
    3⤵
    PID:5840
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"
    3⤵
    PID:5856
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15140
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"
    3⤵
    PID:5872
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15844
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"
    3⤵
    PID:5896
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15748
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"
    3⤵
    PID:5912
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"
    3⤵
    PID:5940
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2204
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"
    3⤵
    PID:5960
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"
    3⤵
    PID:5980
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4216
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"
    3⤵
    PID:5992
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3020
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"
    3⤵
    PID:6004
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16032
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"
    3⤵
    PID:6016
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15172
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"
    3⤵
    PID:6032
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15132
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"
    3⤵
    PID:6052
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"
    3⤵
    PID:6076
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"
    3⤵
    PID:6100
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"
    3⤵
    PID:6112
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15304
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"
    3⤵
    PID:6124
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12704
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"
    3⤵
    PID:6136
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2800
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"
    3⤵
    PID:3372
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"
    3⤵
    PID:3804
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1908
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"
    3⤵
    PID:2160
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15836
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"
    3⤵
    PID:5128
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4188
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"
    3⤵
    PID:5184
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1876
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"
    3⤵
    PID:5232
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"
    3⤵
    PID:5644
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16024
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"
    3⤵
    PID:6148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16056
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"
    3⤵
    PID:6164
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15504
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"
    3⤵
    PID:6176
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"
    3⤵
    PID:6200
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"
    3⤵
    PID:6228
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15724
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"
    3⤵
    PID:6248
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"
    3⤵
    PID:6268
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16168
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"
    3⤵
    PID:6284
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15668
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"
    3⤵
    PID:6316
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"
    3⤵
    PID:6336
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"
    3⤵
    PID:6360
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15056
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"
    3⤵
    PID:6372
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16072
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"
    3⤵
    PID:6388
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3320
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"
    3⤵
    PID:6420
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2084
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"
    3⤵
    PID:6440
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14968
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"
    3⤵
    PID:6468
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"
    3⤵
    PID:6484
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16176
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"
    3⤵
    PID:6500
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"
    3⤵
    PID:6512
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1680
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"
    3⤵
    PID:6532
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15716
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"
    3⤵
    PID:6544
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4280
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"
    3⤵
    PID:6560
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1644
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"
    3⤵
    PID:6572
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16004
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"
    3⤵
    PID:6592
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15884
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"
    3⤵
    PID:6604
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3344
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"
    3⤵
    PID:6616
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16012
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"
    3⤵
    PID:6636
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:872
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"
    3⤵
    PID:6660
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15692
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"
    3⤵
    PID:6676
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"
    3⤵
    PID:6692
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16360
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"
    3⤵
    PID:6712
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"
    3⤵
    PID:6732
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8648
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"
    3⤵
    PID:6744
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11308
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"
    3⤵
    PID:6756
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"
    3⤵
    PID:6768
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14248
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"
    3⤵
    PID:6780
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"
    3⤵
    PID:6800
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11284
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"
    3⤵
    PID:6820
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"
    3⤵
    PID:6832
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11248
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"
    3⤵
    PID:6852
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14656
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"
    3⤵
    PID:6864
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14632
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"
    3⤵
    PID:6876
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14740
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"
    3⤵
    PID:6892
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15156
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"
    3⤵
    PID:6916
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14960
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"
    3⤵
    PID:6940
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15164
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"
    3⤵
    PID:6960
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15788
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"
    3⤵
    PID:6976
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15228
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"
    3⤵
    PID:6988
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"
    3⤵
    PID:7000
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9720
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"
    3⤵
    PID:7012
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:13136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"
    3⤵
    PID:7028
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"
    3⤵
    PID:7044
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:652
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"
    3⤵
    PID:7064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12332
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836920720375.txt"
    3⤵
    PID:7076
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14456
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837673235315.txt"
    3⤵
    PID:7088
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16112
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838035795288.txt"
    3⤵
    PID:7100
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11964
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838223107009.txt"
    3⤵
    PID:7112
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3024
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838301576473.txt"
    3⤵
    PID:7124
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15148
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838338840824.txt"
    3⤵
    PID:7136
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15212
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838521861617.txt"
    3⤵
    PID:7148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838595500613.txt"
    3⤵
    PID:7164
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:11980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838635878820.txt"
    3⤵
    PID:5464
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:12324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840260629574.txt"
    3⤵
    PID:5536
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14232
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840892874528.txt"
    3⤵
    PID:840
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8908
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844391404585.txt"
    3⤵
    PID:7180
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:8772
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844691426618.txt"
    3⤵
    PID:7200
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:9312
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844995168251.txt"
    3⤵
    PID:7220
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15676
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845411700161.txt"
    3⤵
    PID:7244
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2664
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845809349073.txt"
    3⤵
    PID:7792
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15496
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846010706410.txt"
    3⤵
    PID:7804
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847286016159.txt"
    3⤵
    PID:7816
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847585307268.txt"
    3⤵
    PID:7836
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15860
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847885345947.txt"
    3⤵
    PID:7848
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848185514733.txt"
    3⤵
    PID:7860
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16120
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848943443912.txt"
    3⤵
    PID:7872
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15732
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579864486974019.txt"
    3⤵
    PID:7884
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"
    3⤵
    PID:7896
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"
    3⤵
    PID:7908
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15472
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"
    3⤵
    PID:7920
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15804
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\a9whdnbl.default-release\pkcs11.txt"
    3⤵
    PID:7932
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6WJSJ70T\known_providers_download_v1[1].xml"
    3⤵
    PID:7944
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GHECI205\update100[1].xml"
    3⤵
    PID:7956
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16104
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"
    3⤵
    PID:7984
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"
    3⤵
    PID:7996
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16436
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"
    3⤵
    PID:8008
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16856
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"
    3⤵
    PID:8028
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"
    3⤵
    PID:8056
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16800
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"
    3⤵
    PID:8068
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16152
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"
    3⤵
    PID:8096
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15772
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"
    3⤵
    PID:8124
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4faffe29-6c64-4865-b2b6-53e28d7b5b9e}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:8148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4faffe29-6c64-4865-b2b6-53e28d7b5b9e}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:8164
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4faffe29-6c64-4865-b2b6-53e28d7b5b9e}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:8184
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15812
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{50955674-1487-4cd6-bef1-60084ee7c8a3}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:5716
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16096
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{50955674-1487-4cd6-bef1-60084ee7c8a3}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:5816
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{50955674-1487-4cd6-bef1-60084ee7c8a3}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:5924
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{64307d17-ad17-4a20-816f-fbadedd1058d}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:5972
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15920
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{64307d17-ad17-4a20-816f-fbadedd1058d}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:6064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15828
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{64307d17-ad17-4a20-816f-fbadedd1058d}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:4612
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15948
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\appsconversions.txt"
    3⤵
    PID:6508
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\appsglobals.txt"
    3⤵
    PID:6048
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15632
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\appssynonyms.txt"
    3⤵
    PID:6120
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15868
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\settingsconversions.txt"
    3⤵
    PID:6328
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16872
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\settingsglobals.txt"
    3⤵
    PID:6540
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{39732ae0-d359-4410-999e-70f740134109}\settingssynonyms.txt"
    3⤵
    PID:6632
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15584
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b0d77648-6980-423f-9d4d-7c0fe74ff606}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:6888
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16080
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b0d77648-6980-423f-9d4d-7c0fe74ff606}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:7176
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16276
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b0d77648-6980-423f-9d4d-7c0fe74ff606}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:6764
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.0.filtertrie.intermediate.txt"
    3⤵
    PID:7040
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15432
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.1.filtertrie.intermediate.txt"
    3⤵
    PID:7108
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16380
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.2.filtertrie.intermediate.txt"
    3⤵
    PID:7328
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16920
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"
    3⤵
    PID:6588
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15400
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"
    3⤵
    PID:8196
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15288
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"
    3⤵
    PID:8220
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15820
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"
    3⤵
    PID:8236
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16128
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"
    3⤵
    PID:8256
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15928
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"
    3⤵
    PID:8268
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15708
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"
    3⤵
    PID:8280
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"
    3⤵
    PID:8292
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15552
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"
    3⤵
    PID:8304
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16772
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"
    3⤵
    PID:8316
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16412
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"
    3⤵
    PID:8332
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15528
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"
    3⤵
    PID:8344
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15956
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"
    3⤵
    PID:8360
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16088
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"
    3⤵
    PID:8372
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15568
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"
    3⤵
    PID:8400
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"
    3⤵
    PID:8424
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16144
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"
    3⤵
    PID:8440
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15904
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"
    3⤵
    PID:8460
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15408
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2P3G45R4\microsoft.windows[1].xml"
    3⤵
    PID:8488
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16048
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LR6RU4I1\www.bing[1].xml"
    3⤵
    PID:8516
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16352
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"
    3⤵
    PID:8532
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16984
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"
    3⤵
    PID:8548
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"
    3⤵
    PID:8568
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"
    3⤵
    PID:8588
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"
    3⤵
    PID:8616
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"
    3⤵
    PID:8636
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"
    3⤵
    PID:8652
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15896
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"
    3⤵
    PID:8672
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16848
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"
    3⤵
    PID:8700
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16204
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"
    3⤵
    PID:8712
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"
    3⤵
    PID:8728
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16420
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"
    3⤵
    PID:8744
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"
    3⤵
    PID:8760
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15480
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"
    3⤵
    PID:8780
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16040
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"
    3⤵
    PID:8792
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:14888
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"
    3⤵
    PID:8804
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"
    3⤵
    PID:8816
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16824
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"
    3⤵
    PID:8832
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"
    3⤵
    PID:8848
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:532
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"
    3⤵
    PID:8860
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4088
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"
    3⤵
    PID:8872
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"
    3⤵
    PID:8888
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16792
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"
    3⤵
    PID:8900
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16188
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"
    3⤵
    PID:8912
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16976
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"
    3⤵
    PID:8924
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16428
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"
    3⤵
    PID:8940
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"
    3⤵
    PID:8956
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16816
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"
    3⤵
    PID:8968
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16608
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"
    3⤵
    PID:8984
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16592
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"
    3⤵
    PID:9000
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"
    3⤵
    PID:9012
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15652
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"
    3⤵
    PID:9024
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1720
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"
    3⤵
    PID:9040
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"
    3⤵
    PID:9052
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"
    3⤵
    PID:9064
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"
    3⤵
    PID:9076
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"
    3⤵
    PID:9092
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"
    3⤵
    PID:9112
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"
    3⤵
    PID:9124
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"
    3⤵
    PID:9136
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"
    3⤵
    PID:9148
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16600
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"
    3⤵
    PID:9172
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"
    3⤵
    PID:9184
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15540
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"
    3⤵
    PID:9200
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16260
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"
    3⤵
    PID:6912
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16284
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"
    3⤵
    PID:9220
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:16268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"
    3⤵
    PID:9236
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"
    3⤵
    PID:9252
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"
    3⤵
    PID:9268
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15364
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"
    3⤵
    PID:9284
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:15576
- - C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe
    "C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:10260
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"
      4⤵
      PID:17372
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:19024
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"
      4⤵
      PID:17396
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"
      4⤵
      PID:16216
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"
      4⤵
      PID:17412
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:19012
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"
      4⤵
      PID:17428
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"
      4⤵
      PID:17660
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"
      4⤵
      PID:17676
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:19076
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\BackupCopy.odt"
      4⤵
      PID:17696
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:18996
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ExitStart.pptx"
      4⤵
      PID:18068
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\LimitOpen.png"
      4⤵
      PID:18084
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResetUpdate.docx"
      4⤵
      PID:18108
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\UnblockGrant.asp"
      4⤵
      PID:18124
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WatchRepair.csv"
      4⤵
      PID:18144
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510859.txt"
      4⤵
      PID:18160
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
      4⤵
      PID:18176
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2573.txt"
      4⤵
      PID:18196
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2594.txt"
      4⤵
      PID:18216
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2573.txt"
      4⤵
      PID:18240
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2594.txt"
      4⤵
      PID:18256
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"
      4⤵
      PID:18276
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
      4⤵
      PID:18292
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070937929.html"
      4⤵
      PID:18308
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"
      4⤵
      PID:18324
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"
      4⤵
      PID:18340
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"
      4⤵
      PID:18360
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"
      4⤵
      PID:18376
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"
      4⤵
      PID:18392
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:19004
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"
      4⤵
      PID:18408
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"
      4⤵
      PID:18424
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"
      4⤵
      PID:17392
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"
      4⤵
      PID:17752
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"
      4⤵
      PID:17768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edge_shutdown_ms.txt.420

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.420
Size 16B
SHA256 d28ca33b4aa50c72e43aefbad0a6f7c630c15ab356adfa9f9e05be5600699c79
MD5 7b2e3163fd3dfe87219ea74b3642af1d
SHA1 8c40865147813e554e8f74345c7811a0fcbe1195
SHA512 d1ec2daf1943cf5b31e08d6fb1048a4f754d050fdf58b2c1acd70452c87d3252897317ef47527d36e984fff19ab15a961b75a7225574a180fa4258e980bff6aa
MD5 SHA1 SHA512

Submit Download

iecompatdata.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.420
Size 2KB
SHA256 5910fcb4482dd12e202860f1fc72fa144aa27b390fa275901092f9214398fe9d
MD5 79c6d2f86802a292f41fa3c385f61fae
SHA1 c64a66a9a2f645bcb309ea9d10813f557a05294f
SHA512 cbe4311403e3bdc10e33ca0ff2d8a380346769a01a9cddfce292eb5da3ef506a47570f301868acc7bf4e52b1a483dc984b9f35bdfbaea976f3da388e099bc6e5
MD5 SHA1 SHA512

Submit Download

brndlog.txt.420

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.420
Size 6KB
SHA256 a70c90b6c03579b7520a6081cced5c98a6b59e51e8c8ae514f542ce4f245b6e5
MD5 95097a993217d71bcdeffe63ae875f73
SHA1 888087932af94ad2d2027f7e78a03a998f4318e8
SHA512 193411bd96268113ec9020d5c34c19459efe14034590f9c7435b05086585358353fa7779731c1bb43d0ec602e12e1f32501369a8e7ba71edd341b81cb551a105
SSDEEP 192:0K3QE8gu4+nJRjwJExXzdmuc0vT4dervaUJcBZuS:0K3Q1g8oJoXQuPL4wZO5
MD5 SHA1 SHA512 SSDEEP

Submit Download

excel.exe_Rules.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml.420
Size 321KB
SHA256 012a9ca399cafc89ce6de583f6759e283aaa6ace0ba18b879a70e67c71cd28d1
MD5 585002fd4d920042c3df96a55b15265e
SHA1 8a3460d110c788735ee5318452be9d66e26cf803
SHA512 5fdf32a7e064818cc8d3ce3dc3f12c11766630f76d58f93e7b0f44e093175cc2e584d34f05b85ac13747a1db297fe1e4de59333caa8daefd1900abfc43842d59
SSDEEP 6144:/6ALpRBtVeWs1WaFaZsZAHIPBeNH8VU9kn5//CrVZTbdAGHQntp9:/6ALZvIWq5ZAoP48jn5//CrzBHMtj
MD5 SHA1 SHA512 SSDEEP

Submit Download

msoia.exe_Rules.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml.420
Size 560B
SHA256 b9166a5fb3af0a1ca977221e0cd131e4c33a6bfb7e48bdde79822e9d69592784
MD5 ce7a2191490b33f6635bf3172acee6d8
SHA1 f02feff3160bca6d14b7169de2cb713c2310630b
SHA512 c801dacde4163bdf7ed6c21eb13e5acf2a7ce71b3f6f5a003e58f8580f2651b7adc543a3e680da9183262a1cb87bb796762b8ae86a1c8637cddd1f937f5231ca
MD5 SHA1 SHA512

Submit Download

office2016setup.exe_Rules.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml.420
Size 100KB
SHA256 c5da6142ec5f836293652b73c9bf8fd91847c35f16cb5956e188ec6a7b1c0315
MD5 6df18ce09245971e338740f870084394
SHA1 a40043b2edff084d0524361d9854440eec48dede
SHA512 f345482afaf6130cef932814a0dd957fb0c7ddf88190f634c911c4eb909a9f8032cf834ae898875a5f7a61df7a5669602cf1a426145e6a1902433477d86eeec8
SSDEEP 1536:9/HtO8tLuCuH0Q6JQwfDv3KhglH1jJw+GzMxTJfV36zcs5wyjXmQunKM9avfYu:a8tLusQfq1jJRq8x96zcsdXmQuntGwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

officeclicktorun.exe_Rules.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.420
Size 130KB
SHA256 4869597258a3ae224079a5ff5d841113e544af2403c4911e9c1776d811ba149c
MD5 971626d372e843e06a467e87531980b7
SHA1 afc29ec325c6cffe180db538f1ea37f084b5cc07
SHA512 796f07f0e93ce9deebe926f6d24f843cf572a0fcf14e156629768d612cb01964fac9cd258e992894556c8bef13c63f0f19de88aa8ccdd6896b45045c66459413
SSDEEP 3072:bQpb4cpZKXq4FPSV9VxTOHhuGzZS72cjMfo75SozqH:bEb4cpwRKV9mlzZS9MDoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

onenote.exe_Rules.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.420
Size 270KB
SHA256 8666046bf445502116e8b34da531e987589159616ddd727fc4623c8f3f0f2fea
MD5 85146fe4b4856a1b57a6172c66bbd2c9
SHA1 6c9bffc717198baad4466b6ac7faf1588de5118e
SHA512 42561081193f7720810936336fd3dddd1e08e2ca6ae39751f124a8798282eb7972f42acffac320d5d6adec84b747de2ce86117b7117e9675d2338acd2f5667ef
SSDEEP 6144:/6ALpRBtVeWs1WaFaFVjmYiX5x8f1k+WyON4F8QHv:/6ALZvIWqL9xOk+7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

winword.exe_Rules.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.420
Size 333KB
SHA256 eca3a52060f14ed8976fd20828d69c0acdd26f7e575d8f5152fdd371329f35ea
MD5 b2d58c31fa5c5e0610a191cd225ddf8c
SHA1 162d4827ae036ed28d1a32ea1432717278a043fb
SHA512 7382ff2ea0df08e7d65ee254f688c4b2e084f2ac664731f53c0afe2f30e1f1ddcafcc7feda0521cc9d43abf8aaf7164e52bf13782cf5281928398e8d82b9323b
SSDEEP 6144:/6ALcg/QyJCHNcnOo6GxTIfI2ajOUmop8utY9KPT4v3PN+R7R5N2H:/6ALcnHroVTItfUtpf+IPTgoH2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

alertIcon.png.420

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.420
Size 720B
SHA256 14cf318ff227a7a73e5441eb91cd513fe134714b58a8b1863495f3abe4ab2f71
MD5 7292c68b20c58e9c78acb05ca8c9d56e
SHA1 e01722906f89a7a3a728c8c385ac9d306bc485ad
SHA512 95c0da6794cee8c658d1f9bed5b303e2b4f861c979b598f69876bd57ddc2e31fd03996ceed01253783bf5f4d8c9fbe303514844633c14f2286f083781099b425
MD5 SHA1 SHA512

Submit Download

OneDrive.VisualElementsManifest.xml.420

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.420
Size 352B
SHA256 ae915fa3382bd04ed86f8b628a2d2c9232c9119e3e02098ea926a4e7f1ae41f3
MD5 83930b510ce271650edd8d5e457fd006
SHA1 9b4a2f832b345311ecd0cc5aa073f4992db964b8
SHA512 b11219dec88c6018eeb32a53b85516e4400f87a19ca215cdd0523750adbb748728903c3d52f88525ed4cc53827d634502c981e0fad453cef205d0599208970f3
MD5 SHA1 SHA512

Submit Download

0.1.filtertrie.intermediate.txt.420

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.1.filtertrie.intermediate.txt.420
Size 16B
SHA256 1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a
MD5 e8aaa566651759e399714d464cdfb390
SHA1 373942a3618c8d5ff0ba8aab8e22d4a64e5641ae
SHA512 23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2
MD5 SHA1 SHA512

Submit Download

0.2.filtertrie.intermediate.txt.420

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{f578b9fa-923e-4119-85fa-9e428f164eed}\0.2.filtertrie.intermediate.txt.420
Size 16B
SHA256 4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3
MD5 209371fb985ae536f7a01b2cbf06fdeb
SHA1 6e5d735e5a6aef442f3342931eaf47d505763578
SHA512 53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe
MD5 SHA1 SHA512

Submit Download

AppCache133579838301576473.txt.420

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579838301576473.txt.420
Size 77KB
SHA256 8469ae9f082752bef98142f433d75823c8378b07e9a5ce1edbb22e2700352e1e
MD5 4bd03afa1579f59c1e9160bb1acbf235
SHA1 315a4e98267b8d9e6a4b9350d7fdc58943d9488c
SHA512 3e1fc296fe24111e8ff40f88c1160742a83a161a19f67729b491455840a32d2856f8cae6c5b6e06803ac735ecc1df951c9fcc1c2d9ec4dc499d8f984d2196464
SSDEEP 1536:VZzPTng3wNQtDjEE04qGnQ/gVauh44LhQTm6PYQyDZau:VVngYQQ/gVB1sm6P6au
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133579840892874528.txt.420

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579840892874528.txt.420
Size 47KB
SHA256 a128f39f65bd1068191be32727905f92217b625bde930a65ffae3250ec557373
MD5 22e53dc5709ced95e3c83af5804336a6
SHA1 0163069ed72c9616e06d8997c1f5d7fba597b0e0
SHA512 ce53d6e40b75737475193824dba4026508f9315be3a79698c3f5529863fad78bec5456b7e6f5971b08d5df5d753bc3dfe83dfa0aecb180d67ce970f6f2ef8dea
SSDEEP 768:mp4t4uQqsXHDJWOLbo3FqAy4A/9j7klrD8xQFKLA/r0W37uFz7WgFkEKya9TwYAq:mO4u/OnoVvy7/8rD8eF4AT0W37upCUan
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133579847286016159.txt.420

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847286016159.txt.420
Size 66KB
SHA256 5a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242
MD5 4a90573d4e1350bb3cb06a825fbd66de
SHA1 3f3ce3606d802cd06dda067fa2a07dfa745c90df
SHA512 b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c
SSDEEP 1536:YWJY/+Z+VugIe2l7CXatCl31z1bHqMOPAbGpmGJsroVYC:YWS/v3gm5lF1vSNh
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroadcastMsg_1713510859.txt.420

Path C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510859.txt.420
Size 16B
SHA256 57535fe04df416b5a689aa33f01d8e939f1d91fcae25c0c3cf8192baf417b1fe
MD5 bea21141aa401823a718b5744650822b
SHA1 bbe9cee4379b81dcf6fdf92aff28f2209563ce50
SHA512 281f779891962273de9f795dea1917044247dbbe427d111b43027c08ad70577aeffbbb6dc8e68cb0013ebd1ce6103e10f1c71c7e144e75df15c76865ed9c9a08
MD5 SHA1 SHA512

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20240419_070937929.html.420

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070937929.html.420
Size 93KB
SHA256 3625e71cb796864bb08d776e101cfeb2422a05947d0920182fe92703da07c74f
MD5 70200c83f44a81bfed68498b23a1ee77
SHA1 404128976cfb6f17fb256050a4f2480e0d974f37
SHA512 b6b93fcb273842ca69cc6e715296f46984fc6365e4c21aee6510fcc585e4f1fa442eaede9deeb0bd9d6cf523c1b0a5032a95fe9be7e2b62cbbb212bc6f42ad94
SSDEEP 1536:9112uov4HLa1LkuUZ8qdQ25DGY9+X04n2Mi3zil3vNChTv02M/nKBnNM:/p8WZuCNdQ2p/+XTij43lCRQeNM
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jsvjqztf.t5j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsvjqztf.t5j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420

Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420
Size 1KB
SHA256 3e9ee1259500010abeb1a50b1d70f83dc65d50a170f28355c851b3f7ce933ceb
MD5 cca7c79ae5dc63d750fc64ba22ef449e
SHA1 71511a46162198d238a903897e95e3765b1f815d
SHA512 46847c81c82ce0d6ff79271c971296c6b7a5d9cf07012829c5c9b3e4ef79db4f3042c8d19d924b1a5eaf9e00b4521b4bc1286608bcb0db03dfad7d4e0398981f
MD5 SHA1 SHA512

Submit Download

dd_vcredistMSI2573.txt.420

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2573.txt.420
Size 427KB
SHA256 cfdba04d6ade142728e0918f52b57cbadfe56f0df0d18702f143ce830ac9956c
MD5 99ca1eaf89ac2053978f9d29140d9f64
SHA1 709f3d6b2bcbe45d55f1c5a8484fdb1c87f222f5
SHA512 97ed31d2470daa5ef4dde695c3fb03958c75ebabfd5ce62e64404e5649e7e6e250b4ed4e3b1f2e3f1bb701326a98f6539c94502b5a9644b818d6896026451340
SSDEEP 12288:dvQaCor70pGaCpCu4TyfRYlsekbgkEDQb:dvQpy0pG9Cug9DkbgkFb
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistMSI2594.txt.420

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2594.txt.420
Size 415KB
SHA256 9eaf1fcac9dd9bd744b99162699f4d5ac524315a7bf552df73189b22df6b4b41
MD5 c0a9a1d38767d3b07c29f2e5e804c57c
SHA1 d1cbbf7800d93177342064f842bd3b8f04bc5861
SHA512 50eb71c6a672e4e0ea0382b27d4bb169aa051faf09fe418db36af5388fd078da6b65cd3b0068f753983ad90f5efa8c35b16e33306fcae56981b8c84e33ceb53e
SSDEEP 12288:oIP5pDjUzI/TVbT6lc0OXAzBkj4eHBUYMDx:o25p3K2TumvHBmt
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI2573.txt.420

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2573.txt.420
Size 11KB
SHA256 1581e6531de7fda2ac8d1456b76bf58c457d2ce5f025a02cfd8992c80965fcae
MD5 8e7782df6d4713ce6be82df6510286cc
SHA1 e26c249392715a5dae519aca80ee0c311c4e58a1
SHA512 bf281df3897e1b8cacbecd8be01437b9f31d8da875d0e11c459b764f3ee54355e21b897befcd075375613a34e2bb1a1bddfedaaf313259d5d3f8607cf185d14b
SSDEEP 192:b5yJXEJJUirrc28KL9OtZkb+KUzjiT/0Ekr5aSrtjRDEhsNUlFZZl:b6ttKBO3k1x0JrBB9AhQkZD
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI2594.txt.420

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2594.txt.420
Size 11KB
SHA256 d7b046c2d7e2c96f9f9cf98a5bc84bd5886bba45b7d80783a773b86976b786f5
MD5 6714412832373c3aa0260aff1ad6fb70
SHA1 1d47b2bc80e3003e51fdfede23fca9394dbffe68
SHA512 f392f9e8346a4328e745c09fc776739871f238ebad5411aea5c2769379b7fcc5629b18784b48180db33c70da34d3201b9c99c18875637e6867335b37f2ff89ca
SSDEEP 192:AqthRvFBCnK4edtjxsoEM78a9o34tDLgRFXQ/m5LGEZuPDZ+hKzubks8Ski2T:Aq7RdBCnK4eHOoV/9o39FA/m5LEP4KzF
MD5 SHA1 SHA512 SSDEEP

Submit Download

jawshtml.html.420

Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html.420
Size 16B
SHA256 7852451b2b252515f369b14bd765135c2e11fee72276b5020e3ed61513c5611a
MD5 65e115805f15f9cda5eb01e8f742d121
SHA1 e3ecf29bfa71ce07baf8d02009afb8766f35981b
SHA512 dccbfdd893e5806fa1418e48e0c0c72ec2d1266ee7de48fce34bf3f74bda7e0682e8bf90de53594f34c3d5682c8164d9f6b6ea3977619be8487c2e339faa1ada
MD5 SHA1 SHA512

Submit Download

mapping.csv.420

Path C:\Users\Admin\AppData\Local\Temp\mapping.csv.420
Size 120KB
SHA256 63f8f0d578669353be78d86d0173e8f49202fd56f88d36bbefcae31b55d9ac8a
MD5 42c12f9e321e00ee8f2ec180e7863e24
SHA1 8d32c5df1057f7d040c919fbea6af11a274d2374
SHA512 c917ed0f9013642a6fe7968315d8454db9173b75e54184449682f75d8e5c02bdc77895e08e15eeb595de6811c09c5fbe0b85982e664223e28d351d2dd10225b2
SSDEEP 3072:BjCqr1MAejg1M4ttBzVRRDd9mMWeaClwXQD:BjCs1Wg1rBJRR3IkhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupCopy.odt.420

Path C:\Users\Admin\AppData\Roaming\BackupCopy.odt.420
Size 124KB
SHA256 ed19cb7599821b5dfb6ae5a3bedea050845d772775568635b5d582b9832125b4
MD5 b60f1c9e23458e0129656c9d5502de8c
SHA1 34cc6812f156947cc30535e14d76fc34593a3e8c
SHA512 5b7981f8dbed60a94e8f21376c17c7e84f3ea0ded04f52547ee649d7f7907549a2b642cc4b9fc773e1fe60dad7e84fdea74c92398fd87cb7f20771dab9886966
SSDEEP 3072:2XCHyi5FnkewoamG7AnoOqbffdwychYhhW3w4bi/4j:2XCHyivUJmGsoOqbfGSDWg4bG4j
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExitStart.pptx.420

Path C:\Users\Admin\AppData\Roaming\ExitStart.pptx.420
Size 362KB
SHA256 c0d6f0254678bbe7e8d1535269e954407ca15ada5ee90060fe7f7613be9c68c2
MD5 c62c7c3163825e95d5c8b720af824f30
SHA1 342cb8e9f6ccab31e14ecc778299399da5d9d615
SHA512 365523fb59748fcd077ffbbe7a42d6ed74c96f32257e30fbb8ebe7c5bce830e3835e97a9d2feea000ba48c84eaecc2de4cf14ed930c97a739ad9dc00552bed84
SSDEEP 6144:XBsNT6Q9sxz0+YlKP8DSgJ5dQxQvjb/T2uQCXXJMaMTrhxEJOjHx5SGwmpwj:02tk88DVrm2H/ACSVvhGJy5wj
MD5 SHA1 SHA512 SSDEEP

Submit Download

LimitOpen.png.420

Path C:\Users\Admin\AppData\Roaming\LimitOpen.png.420
Size 190KB
SHA256 43eb2038222810235cce73e3374e29b71bfac854080466907b3fb039a81bd8fc
MD5 0ef38a805bcd027cf6a794ab3b5682f5
SHA1 0842c3d5d29302ac9058365810b29973c8c4f7c8
SHA512 3990557929de8360d82ab110879f433a97024fc87b3f0d1ba9cb7fd4486e79ffd25808a95d584254d5282cb56967e7c759fbb845a15976394cec78d7133b8cf2
SSDEEP 3072:s0mVfgwUj/l5n3OWTEdujah0GHGT5cyWNLXvJAFoCsKftsngyfDJKsQm3HpbkqKc:sNVaj/lk2Exh0LTKLXvmoCF1spDvz3Jz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ResetUpdate.docx.420

Path C:\Users\Admin\AppData\Roaming\ResetUpdate.docx.420
Size 148KB
SHA256 bb90771bbffd7abcf5252a38bb113f388e110ffeb2eb81490e6c0ec4741208d3
MD5 5ef08aacd3f1c8f458a9577073e8a5e0
SHA1 164b5d0d3d3083b7017c3278bc10d87743a07f79
SHA512 e9589debd218c8c716fd78ace2e489d841220fca72157baa36cbb8f06bd9834bf5634974239a0c6a8b603edde5c729280c2978f356b111053eed5428bfe61f2d
SSDEEP 3072:utVUH/KWRP63KB3HWTFsNYguXOxaHxR2Dzt24kak65unf0ySg1/r:utVUfRRPd0FsNYIayXDuf0yr
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnblockGrant.asp.420

Path C:\Users\Admin\AppData\Roaming\UnblockGrant.asp.420
Size 129KB
SHA256 bf16d527218f17496e5c1504d13c337dd1074c08bbf803e422f9ba08098d492f
MD5 6a58c6e4493eb161981ce0b255ccce44
SHA1 7e4188a72c24b5d32a13d49766c612a1ee4dab9b
SHA512 d740b505b07b95268db99b0926cbc1765b788d70674cccf2539a1ff6ab8d0621ba6e03bdaf35097a11188fe974a0952e65cf2148845ba18e8d761dbd5873e2c1
SSDEEP 3072:34iGVT/oHFHYsJsyPn4DsQeG5uvXkHUUuDpFQj:IjVTAlHRXgDsuek0Lpg
MD5 SHA1 SHA512 SSDEEP

Submit Download

WatchRepair.csv.420

Path C:\Users\Admin\AppData\Roaming\WatchRepair.csv.420
Size 247KB
SHA256 70bfad4e5445d6f41c25e3e7e15c0fe950ae32f9085e8e22221ae0a802ff0697
MD5 004fadc97e0f6f3e89ac5e33735f28b1
SHA1 d8526c408e473192e65762679623715a9ec695eb
SHA512 dd7634a2340c507cf412c32898cab1eec579adaa02d544b62102a7ebef9f3e70a5afe482242b08ffd7a593e60f18840200b2e15fd61a1702f30ae967957856cb
SSDEEP 6144:bBAS7zhN1+HC747EC5L6BLBXIoUTefKDGyj7jFkcY36NW5i7YMf:N7N1B747aBLB4oUyCl3J1Y36Q2B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desktop.lnk.420

Path C:\Users\Admin\Links\Desktop.lnk.420
Size 512B
SHA256 3dba2890323ca8adb1371cc469f60802637779a9ed3b26c59e171452189bd324
MD5 449d58fc15843bb46ae1185c10d85bfd
SHA1 71823f59c66128670ac4af84ca63f8d2600eb295
SHA512 f557be5df1cdf5f4640274c0f277cd79560f8d25dde8a2874623ad91d48a07040b57112cf9043ab5b7987308bdd2668402431438fc663e05311d8bddb628080a
MD5 SHA1 SHA512

Submit Download

Downloads.lnk.420

Path C:\Users\Admin\Links\Downloads.lnk.420
Size 944B
SHA256 89e799cf7133ad8cbc63816d24386e192df43328a9e5a75693d037dac49e2b6f
MD5 74dbee12289a0c9dbf11ec0a1493af66
SHA1 f311ff077fb027ee0e7165268187ff4e45e86c17
SHA512 97f3eab4840402b393d824aa237d3b7bede4fe78f2ed120cc0f7ab8a4d74a7c54730e1b85feade36fa999fd3ac99d18199b65490645769479852a3067720bd7b
MD5 SHA1 SHA512

Submit Download

Seven.dll

Path C:\Windows\System32\Seven.dll
Size 1.0MB
SHA256 09d1acbd245a5bdf8b14925a0c77ad9aafcf7fbc7215fa0a5adbd90a2b0c0468
MD5 53ba567ffbf422aab775b79576a542bd
SHA1 5935b4ad859558879413af1defdd8292e5ef4351
SHA512 d6062e40bf05ef24fd9a052f2e56e15dbedb1557b59581a8a8d4cd9038ee169842b5671b4002d0d795a49354c4ae64c1ea8c04a0b5ee76dc64d5142e79dc9a49
SSDEEP 24576:cAiJ8gQiQEQih5o/W7yqj1dlMud+enn7TGS876qjZvaGtA32R:ngQiZ9YqyqJLd+enn78fjkGt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Seven.runtimeconfig.json

Path C:\Windows\System32\Seven.runtimeconfig.json
Size 340B
SHA256 28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
MD5 253333997e82f7d44ea8072dfae6db39
SHA1 03b9744e89327431a619505a7c72fd497783d884
SHA512 56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
MD5 SHA1 SHA512

Submit Download

SevenCopy.exe

Path C:\Windows\System32\SevenCopy.exe
Size 139KB
SHA256 afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
MD5 6503f847c3281ff85b304fc674b62580
SHA1 947536e0741c085f37557b7328b067ef97cb1a61
SHA512 abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
SSDEEP 3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x64_001_vcRuntimeAdditional_x64.log.420

Path C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.420
Size 190KB
SHA256 f23668c18195d7ad93dfe5a38c354cd60b70a4f8e3599640522fb1ac5913d93e
MD5 1f50296f6eef349de113760e5c80df1c
SHA1 df13634e73c16d1f8c81e8b82f7a4b0beabcf74e
SHA512 b34f27361a0f6a0cf4bd75470071ed7ecd5283d09dd64112a76159147ce313b5faf331132d83514bcc6b42fcc08fb530927a6cc1b573eba0bc0bbc466e082e32
SSDEEP 3072:EmzT2kylLQWRguaHp96+EqNH4/ZQ6yVJD8sx4tD0V6m/cyLhOvFYmdS8TC7X7c/S:EmOkiLQhNKHiH4/mbd8ek0MecYMFYsC1
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2013_x86_000_vcRuntimeMinimum_x86.log.420

Path C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.420
Size 170KB
SHA256 4b0195406b5489aa8049eca68fd2b07aa14f5521e9b8bc24f46b8c4bf50c8a05
MD5 b7032e03568af793c65e810f59456348
SHA1 7e08ccb8b06cfd9d5011ad813fbc85ba26e1953f
SHA512 ac740d447eb5fcaca7ba3da067976355ae4abb67b6e329416627e31428b07cc7bea63b4e545d86c619a7228b0be5a3cff6e7c6f21812f1df82ffc9cf2c3efe58
SSDEEP 3072:H4TOdtociOz8iVIYfrrOZL7Ql31xO2OZ666SE5vWiM3s5T2N:H4CPoD0V3frrm7Ur2MDvWR8QN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x64_001_vcRuntimeAdditional_x64.log.420

Path C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.420
Size 129KB
SHA256 99499c0889ec4eea44a43ae65a0e0231e6383db13743bb337d219c4d77e7c65a
MD5 843fcc7c7b7ef3c43152df5f97475562
SHA1 e0ae1df0eddd04bd5feadce44dbfc4ee34f27346
SHA512 c4755b0a8bed9be822147b45341ebb1f955c3a587113f6f66a4d5d011500b2e43f66b35633066a3f255a554503a14c55057dfec25721df31d0aa53b45c293582
SSDEEP 3072:dTY4aZVO9ZtdGNr5SEvsmOhGdYCTPzSBj:dBCV+Or5DoGs9
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x86_000_vcRuntimeMinimum_x86.log.420

Path C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.420
Size 123KB
SHA256 d798f9ae20bf074722e6cbb5f60be4ede7857e269bad2c6df3ddde1b3ee4f266
MD5 a1a5e6e4f7f3aef1061ee092b703006d
SHA1 02d22711ec2284cc6e316440036c5fde58cd93ba
SHA512 3a8d1a2fbbf1d8327f5f446c610ab0973404d062681fc43fedfd2704caac209928ec9b370396360902e04933ed3a1a4bfae0806cc42ff81ba64d6461e7197b81
SSDEEP 3072:lxypWvE52+ig3o69Ih58sqqylwdkh+oIi:ipWvUJigbI9TdDFi
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2022_x86_001_vcRuntimeAdditional_x86.log.420

Path C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.420
Size 135KB
SHA256 7396243f815ab381c17a45fa5834587d6fad3c2a0ab93542a671c0d400454cd0
MD5 19a6e374aaafa970492c486663365be2
SHA1 0fa346d4036727aeac84ddfdaece37649551f80c
SHA512 390623f7c632a420c9ec206e9069450239be2105e7fbe084a7ca9a812da34dbc830d9bd2c78ffa84123481d7dbb0018c73418093da9411c0b6bbf99da3cac104
SSDEEP 3072:UZo0Xj+eyESFwclBM1e+oSoXOZqVPEEmkAo/YJGS:UZol5b5lse+oSoXOZwPEEzAogJz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/896-0-0x0000025042ED0000-0x0000025042EF2000-memory.dmp

Download

memory/896-10-0x00007FF953590000-0x00007FF954051000-memory.dmp

Download

memory/896-12-0x000002502A6A0000-0x000002502A6B0000-memory.dmp

Download

memory/896-11-0x000002502A6A0000-0x000002502A6B0000-memory.dmp

Download

memory/896-15-0x00007FF953590000-0x00007FF954051000-memory.dmp

Download

memory/17752-447-0x00007FF715A20000-0x00007FF715A87000-memory.dmp

Download

memory/18160-445-0x00007FF715A20000-0x00007FF715A87000-memory.dmp

Download

memory/18324-448-0x00007FF715A20000-0x00007FF715A87000-memory.dmp

Download