Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSeven.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Seven.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SevenCopy.exe -
Deletes itself 1 IoCs
Processes:
SevenCopy.exepid process 4512 SevenCopy.exe -
Executes dropped EXE 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exepid process 4512 SevenCopy.exe 11764 SevenCopy.exe 11176 SevenCopy.exe 4132 SevenCopy.exe 8032 SevenCopy.exe 14496 SevenCopy.exe 13528 SevenCopy.exe 1900 SevenCopy.exe 1976 SevenCopy.exe 14384 SevenCopy.exe 10268 SevenCopy.exe 2924 SevenCopy.exe 6860 SevenCopy.exe 3804 SevenCopy.exe 14788 SevenCopy.exe 4320 SevenCopy.exe 6280 SevenCopy.exe 11108 SevenCopy.exe 9580 SevenCopy.exe 10660 SevenCopy.exe 14248 SevenCopy.exe 12076 SevenCopy.exe 6644 SevenCopy.exe 7456 SevenCopy.exe 9164 SevenCopy.exe 5868 SevenCopy.exe 6980 SevenCopy.exe 6632 SevenCopy.exe 5156 SevenCopy.exe 12952 SevenCopy.exe 6892 SevenCopy.exe 15216 SevenCopy.exe 4836 SevenCopy.exe 16868 SevenCopy.exe 10376 SevenCopy.exe 16496 SevenCopy.exe 16144 SevenCopy.exe 8416 SevenCopy.exe 6844 SevenCopy.exe 6920 SevenCopy.exe 15228 SevenCopy.exe 14952 SevenCopy.exe 12908 SevenCopy.exe 10232 SevenCopy.exe 1040 SevenCopy.exe 12040 SevenCopy.exe 5464 SevenCopy.exe 9668 SevenCopy.exe 14920 SevenCopy.exe 7352 SevenCopy.exe 15712 SevenCopy.exe 12284 SevenCopy.exe 15264 SevenCopy.exe 15804 SevenCopy.exe 13136 SevenCopy.exe 5856 SevenCopy.exe 11060 SevenCopy.exe 15036 SevenCopy.exe 9692 SevenCopy.exe 5228 SevenCopy.exe 15728 SevenCopy.exe 14892 SevenCopy.exe 5492 SevenCopy.exe 12444 SevenCopy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops desktop.ini file(s) 7 IoCs
Processes:
SevenCopy.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Music\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini SevenCopy.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini SevenCopy.exe -
Drops file in System32 directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 372 powershell.exe 372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 372 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Seven.execmd.execmd.execmd.exeSevenCopy.execmd.exedescription pid process target process PID 2312 wrote to memory of 372 2312 Seven.exe powershell.exe PID 2312 wrote to memory of 372 2312 Seven.exe powershell.exe PID 2312 wrote to memory of 2076 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 2076 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 1040 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 1040 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 3280 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 3280 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 2344 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 2344 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 3244 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 3244 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 856 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 856 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 4784 2312 Seven.exe cmd.exe PID 2312 wrote to memory of 4784 2312 Seven.exe cmd.exe PID 3280 wrote to memory of 3504 3280 cmd.exe attrib.exe PID 3280 wrote to memory of 3504 3280 cmd.exe attrib.exe PID 856 wrote to memory of 1492 856 cmd.exe attrib.exe PID 856 wrote to memory of 1492 856 cmd.exe attrib.exe PID 4784 wrote to memory of 4352 4784 cmd.exe attrib.exe PID 4784 wrote to memory of 4352 4784 cmd.exe attrib.exe PID 2312 wrote to memory of 4512 2312 Seven.exe SevenCopy.exe PID 2312 wrote to memory of 4512 2312 Seven.exe SevenCopy.exe PID 4512 wrote to memory of 2448 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 2448 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 2464 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 2464 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 2924 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 2924 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3260 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3260 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1096 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1096 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3396 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3396 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 4624 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 4624 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 220 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 220 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1908 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1908 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1056 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1056 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1960 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1960 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1084 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1084 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 736 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 736 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 4944 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 4944 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3296 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3296 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3168 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 3168 4512 SevenCopy.exe cmd.exe PID 2448 wrote to memory of 5032 2448 cmd.exe choice.exe PID 2448 wrote to memory of 5032 2448 cmd.exe choice.exe PID 4512 wrote to memory of 1916 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 1916 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 760 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 760 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 208 4512 SevenCopy.exe cmd.exe PID 4512 wrote to memory of 208 4512 SevenCopy.exe cmd.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 3504 attrib.exe 1492 attrib.exe 4352 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe2⤵PID:2076
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe2⤵PID:1040
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\SevenCopy.exe3⤵
- Views/modifies file attributes
PID:3504 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵PID:2344
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵PID:3244
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Views/modifies file attributes
PID:1492 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5032
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"3⤵PID:2464
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"3⤵PID:2924
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8088
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"3⤵PID:3260
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8028
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"3⤵PID:1096
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"3⤵PID:3396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8172
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"3⤵PID:4624
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11788
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"3⤵PID:220
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"3⤵PID:1908
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"3⤵PID:1056
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8048
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"3⤵PID:1960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8020
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"3⤵PID:1084
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5048
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"3⤵PID:736
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:7028
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"3⤵PID:4944
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:6600
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"3⤵PID:3296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8060
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"3⤵PID:3168
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9016
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\GrantPing.xml"3⤵PID:1916
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9888
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\PingConvert.png"3⤵PID:760
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12808
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"3⤵PID:208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\ConvertSelect.xlsx"3⤵PID:4828
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"3⤵PID:4908
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12984
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\FormatUnregister.xls"3⤵PID:3712
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13212
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\GroupConvertTo.pdf"3⤵PID:2988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"3⤵PID:4608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\PingOut.txt"3⤵PID:4488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9896
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"3⤵PID:3704
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12824
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\SendShow.html"3⤵PID:3408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"3⤵PID:3900
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13028
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnprotectSwitch.pdf"3⤵PID:4316
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14892
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UseUnlock.txt"3⤵PID:4172
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10120
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\PushFormat.lnk"3⤵PID:1724
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13020
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SyncNew.lnk"3⤵PID:4560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14980
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UnprotectMerge.sql"3⤵PID:3480
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14408
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"3⤵PID:2844
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12548
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"3⤵PID:3908
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15132
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ConvertFromSelect.asp"3⤵PID:5076
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15184
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\PingRestore.doc"3⤵PID:4352
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13664
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RepairSet.ppt"3⤵PID:4436
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\SwitchSkip.docx"3⤵PID:4780
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15676
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\InitializeOut.png"3⤵PID:4848
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15060
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\MeasureEnable.png"3⤵PID:3980
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15284
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"3⤵PID:1180
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4864
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SearchRestore.png"3⤵PID:4520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\CompressMeasure.xlsx"3⤵PID:4932
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15516
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135623.txt"3⤵PID:3596
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15544
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"3⤵PID:4008
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14928
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4767.txt"3⤵PID:4800
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15152
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI4785.txt"3⤵PID:4612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15608
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4767.txt"3⤵PID:1040
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI4785.txt"3⤵PID:4784
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15208
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"3⤵PID:3136
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15216
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124244853.html"3⤵PID:732
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"3⤵PID:5116
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15160
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"3⤵PID:4492
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15564
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"3⤵PID:2592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15224
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"3⤵PID:2680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15592
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"3⤵PID:3200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4652
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"3⤵PID:5040
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15016
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"3⤵PID:1276
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15256
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"3⤵PID:1248
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15584
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"3⤵PID:4964
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14884
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"3⤵PID:5020
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15416
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"3⤵PID:5200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2932
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"3⤵PID:5212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15660
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"3⤵PID:5228
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"3⤵PID:5244
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15668
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"3⤵PID:5256
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15024
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"3⤵PID:5268
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15472
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"3⤵PID:5280
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15528
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"3⤵PID:5296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"3⤵PID:5312
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15576
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"3⤵PID:5332
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15040
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"3⤵PID:5348
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12084
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"3⤵PID:5372
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"3⤵PID:5392
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16116
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"3⤵PID:5412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"3⤵PID:5424
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15808
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"3⤵PID:5448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"3⤵PID:5468
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"3⤵PID:5488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15032
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"3⤵PID:5500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15824
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"3⤵PID:5516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15408
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"3⤵PID:5552
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"3⤵PID:5572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15652
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"3⤵PID:5588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15008
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"3⤵PID:5616
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14968
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"3⤵PID:5636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15536
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"3⤵PID:5660
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"3⤵PID:5676
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15816
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"3⤵PID:5688
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"3⤵PID:5704
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15432
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"3⤵PID:5724
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"3⤵PID:5744
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"3⤵PID:5768
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14944
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"3⤵PID:5788
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15392
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"3⤵PID:5816
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15600
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"3⤵PID:5836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15116
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"3⤵PID:5856
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15984
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"3⤵PID:5868
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14912
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"3⤵PID:5880
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15048
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"3⤵PID:5892
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"3⤵PID:5916
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15628
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"3⤵PID:5928
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11488
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"3⤵PID:5944
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"3⤵PID:5956
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16488
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"3⤵PID:5968
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13772
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"3⤵PID:6000
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15480
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"3⤵PID:6016
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16748
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"3⤵PID:6036
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12156
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"3⤵PID:6056
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13536
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"3⤵PID:6072
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12104
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"3⤵PID:6096
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10688
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"3⤵PID:6132
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16352
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"3⤵PID:1900
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"3⤵PID:2984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13712
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"3⤵PID:4976
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:12164
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"3⤵PID:2076
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11140
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"3⤵PID:4480
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14064
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"3⤵PID:1412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14004
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"3⤵PID:5192
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11148
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"3⤵PID:5344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14812
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"3⤵PID:4292
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14072
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"3⤵PID:6164
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15684
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"3⤵PID:6184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15080
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"3⤵PID:6212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1452
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"3⤵PID:6232
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11592
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"3⤵PID:6244
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16428
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"3⤵PID:6260
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13920
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"3⤵PID:6276
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11560
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"3⤵PID:6300
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11528
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"3⤵PID:6320
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"3⤵PID:6336
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15488
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"3⤵PID:6364
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16276
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"3⤵PID:6380
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"3⤵PID:6396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10300
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"3⤵PID:6412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1272
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"3⤵PID:6432
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9544
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"3⤵PID:6448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13912
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"3⤵PID:6464
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13904
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"3⤵PID:6484
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11172
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"3⤵PID:6504
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14012
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"3⤵PID:6520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"3⤵PID:6536
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10268
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"3⤵PID:6564
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13896
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"3⤵PID:6580
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"3⤵PID:6604
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:13764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085283434455.txt"3⤵PID:6620
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10328
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085974792496.txt"3⤵PID:6644
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:8820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086317073445.txt"3⤵PID:6664
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086519152652.txt"3⤵PID:6684
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15192
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086555234279.txt"3⤵PID:6708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11600
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086620185634.txt"3⤵PID:6736
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10340
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086815225668.txt"3⤵PID:6752
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11196
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086853243211.txt"3⤵PID:6780
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16924
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088793491543.txt"3⤵PID:6792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:9040
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092054450232.txt"3⤵PID:6808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11620
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092354938018.txt"3⤵PID:6828
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15508
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092655135271.txt"3⤵PID:6856
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093013592831.txt"3⤵PID:6876
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093414998340.txt"3⤵PID:6984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093611520420.txt"3⤵PID:6576
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3948
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586094898087075.txt"3⤵PID:7184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095217155403.txt"3⤵PID:7236
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15352
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095516139448.txt"3⤵PID:7248
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15772
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096443529014.txt"3⤵PID:7260
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16756
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586125607904783.txt"3⤵PID:7272
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586128553472758.txt"3⤵PID:7284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"3⤵PID:7312
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15788
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"3⤵PID:7332
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵PID:7344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\AlternateServices.txt"3⤵PID:7356
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15752
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\pkcs11.txt"3⤵PID:7368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15888
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qzr7kws6.default-release\SiteSecurityServiceState.txt"3⤵PID:7384
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16408
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LT2C7GL0\known_providers_download_v1[1].xml"3⤵PID:7396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15904
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LT2C7GL0\update100[1].xml"3⤵PID:7408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17416
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"3⤵PID:7420
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14720
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"3⤵PID:7436
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15880
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"3⤵PID:7468
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"3⤵PID:7488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15168
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"3⤵PID:7508
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16504
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"3⤵PID:7524
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15644
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"3⤵PID:7556
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15272
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"3⤵PID:7568
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15324
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{240c3801-fa6a-41cb-a8e2-5d3f770d75d7}\0.0.filtertrie.intermediate.txt"3⤵PID:7580
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15716
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{240c3801-fa6a-41cb-a8e2-5d3f770d75d7}\0.1.filtertrie.intermediate.txt"3⤵PID:7592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{240c3801-fa6a-41cb-a8e2-5d3f770d75d7}\0.2.filtertrie.intermediate.txt"3⤵PID:7604
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16368
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8b119eff-4ed1-47a6-ab91-72a5834c3b26}\0.0.filtertrie.intermediate.txt"3⤵PID:7620
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16640
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8b119eff-4ed1-47a6-ab91-72a5834c3b26}\0.1.filtertrie.intermediate.txt"3⤵PID:7632
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16436
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{8b119eff-4ed1-47a6-ab91-72a5834c3b26}\0.2.filtertrie.intermediate.txt"3⤵PID:7644
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16632
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f687c9c8-e86e-41a7-8a90-6b2a0060f479}\0.0.filtertrie.intermediate.txt"3⤵PID:7656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15368
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f687c9c8-e86e-41a7-8a90-6b2a0060f479}\0.1.filtertrie.intermediate.txt"3⤵PID:7668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16672
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f687c9c8-e86e-41a7-8a90-6b2a0060f479}\0.2.filtertrie.intermediate.txt"3⤵PID:7680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17504
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{dd282d2a-b45a-4cd5-9176-f709afbbc54d}\appsconversions.txt"3⤵PID:7692
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16956
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{dd282d2a-b45a-4cd5-9176-f709afbbc54d}\appsglobals.txt"3⤵PID:7704
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17112
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{dd282d2a-b45a-4cd5-9176-f709afbbc54d}\appssynonyms.txt"3⤵PID:7724
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16324
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{dd282d2a-b45a-4cd5-9176-f709afbbc54d}\settingsconversions.txt"3⤵PID:7736
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16908
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{dd282d2a-b45a-4cd5-9176-f709afbbc54d}\settingsglobals.txt"3⤵PID:7748
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14904
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{dd282d2a-b45a-4cd5-9176-f709afbbc54d}\settingssynonyms.txt"3⤵PID:7760
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15376
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a6d57969-7825-478a-b7ac-83dc68d8319a}\0.0.filtertrie.intermediate.txt"3⤵PID:7776
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a6d57969-7825-478a-b7ac-83dc68d8319a}\0.1.filtertrie.intermediate.txt"3⤵PID:7792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16224
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a6d57969-7825-478a-b7ac-83dc68d8319a}\0.2.filtertrie.intermediate.txt"3⤵PID:7804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16480
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a7b82f7c-73a1-4f1e-b6f0-3c377fa780a8}\0.0.filtertrie.intermediate.txt"3⤵PID:7816
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15620
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a7b82f7c-73a1-4f1e-b6f0-3c377fa780a8}\0.1.filtertrie.intermediate.txt"3⤵PID:7828
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:4896
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{a7b82f7c-73a1-4f1e-b6f0-3c377fa780a8}\0.2.filtertrie.intermediate.txt"3⤵PID:7840
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17240
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"3⤵PID:7856
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"3⤵PID:7868
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16300
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"3⤵PID:7880
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15072
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"3⤵PID:7892
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17232
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"3⤵PID:7904
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15832
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"3⤵PID:7916
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16772
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"3⤵PID:7932
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15732
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"3⤵PID:7952
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17088
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"3⤵PID:7964
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15936
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"3⤵PID:7976
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16084
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"3⤵PID:7992
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17264
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"3⤵PID:8012
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16900
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"3⤵PID:8040
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"3⤵PID:8068
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16196
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"3⤵PID:8116
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"3⤵PID:8140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15896
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"3⤵PID:8160
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17536
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"3⤵PID:8184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16884
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\JGTP21KH\www.bing[1].xml"3⤵PID:8200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1692
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\M1A8XLO2\microsoft.windows[1].xml"3⤵PID:8216
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15384
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"3⤵PID:8236
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16344
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"3⤵PID:8264
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17104
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"3⤵PID:8284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17256
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"3⤵PID:8304
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17248
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"3⤵PID:8324
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16400
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"3⤵PID:8340
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14920
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"3⤵PID:8360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17272
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"3⤵PID:8380
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16420
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"3⤵PID:8412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"3⤵PID:8432
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16068
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"3⤵PID:8452
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16764
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"3⤵PID:8472
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"3⤵PID:8488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16392
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"3⤵PID:8508
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15300
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"3⤵PID:8528
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"3⤵PID:8552
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15200
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"3⤵PID:8572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"3⤵PID:8592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16892
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"3⤵PID:8612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16232
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"3⤵PID:8632
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15108
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"3⤵PID:8652
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16108
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"3⤵PID:8672
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"3⤵PID:8700
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16656
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"3⤵PID:8724
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17280
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"3⤵PID:8744
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16160
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"3⤵PID:8824
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15796
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"3⤵PID:8928
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16204
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"3⤵PID:8948
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16212
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"3⤵PID:8960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17424
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"3⤵PID:8972
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16536
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"3⤵PID:8984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14608
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"3⤵PID:8996
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16520
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"3⤵PID:9008
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16168
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"3⤵PID:9028
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17224
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"3⤵PID:9048
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16944
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"3⤵PID:9060
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17512
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"3⤵PID:9072
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15344
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"3⤵PID:9084
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16916
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"3⤵PID:9096
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17520
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"3⤵PID:9112
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"3⤵PID:9124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16528
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"3⤵PID:9140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"3⤵PID:9152
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"3⤵PID:9172
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15316
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"3⤵PID:9184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15464
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"3⤵PID:9196
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:16932
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"3⤵PID:9208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17464
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"3⤵PID:7160
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17528
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"3⤵PID:5608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15400
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"3⤵PID:5996
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:15760
-
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"3⤵
- Executes dropped EXE
PID:11764 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"4⤵PID:17876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"4⤵PID:17892
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"4⤵PID:17908
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"4⤵PID:17924
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"4⤵PID:17948
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"4⤵PID:17964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"4⤵PID:17980
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:17904
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"4⤵PID:17996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"4⤵PID:18036
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:18060
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"4⤵PID:18052
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"4⤵PID:18068
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"4⤵PID:18088
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:18404
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"4⤵PID:18116
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:18096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"4⤵PID:18140
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"4⤵PID:18316
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"4⤵PID:18332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\CompressMeasure.xlsx"4⤵PID:18348
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135623.txt"4⤵PID:18364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"4⤵PID:18380
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:11176 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"2⤵PID:1224
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:6792
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"2⤵PID:5100
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4500
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"2⤵PID:6488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4136
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4132 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"3⤵PID:2460
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10604
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"3⤵PID:14324
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:11976
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵PID:1908
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:10568
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:8032 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"4⤵PID:10300
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:9980
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"4⤵PID:14568
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:6040
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"4⤵PID:14560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:6400
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:14496 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"5⤵PID:7328
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:11648
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"5⤵PID:3576
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:11104
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"5⤵PID:13588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:12220
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"5⤵
- Executes dropped EXE
PID:13528 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"6⤵PID:5972
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:4676
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"6⤵PID:4960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:5060
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"6⤵PID:4624
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:11084
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1900 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"7⤵PID:6960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:14808
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"7⤵PID:1992
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:8104
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"7⤵PID:2988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:3900
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"7⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"8⤵PID:10368
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:12976
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"8⤵PID:11532
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:12964
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"8⤵PID:10256
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:4808
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"8⤵
- Executes dropped EXE
PID:14384 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"9⤵PID:13808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:8804
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"9⤵PID:11076
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:6624
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"9⤵PID:11592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:11612
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"9⤵
- Executes dropped EXE
PID:10268 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"10⤵PID:4408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:7552
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"10⤵PID:4488
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:9252
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"10⤵PID:6808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:5764
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"10⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"11⤵PID:8400
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:5600
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"11⤵PID:8136
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:4088
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"11⤵PID:12984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:7180
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"11⤵
- Executes dropped EXE
PID:6860 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"12⤵PID:6464
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 313⤵PID:8776
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"12⤵PID:11212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 313⤵PID:6068
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"12⤵PID:5208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 313⤵PID:8808
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"12⤵
- Executes dropped EXE
PID:3804 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607622269186.txt"13⤵PID:11120
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 314⤵PID:14848
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587607913461245.txt"13⤵PID:4748
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 314⤵PID:2992
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"13⤵
- Executes dropped EXE
PID:14788 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"14⤵
- Executes dropped EXE
PID:4320 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"15⤵
- Executes dropped EXE
PID:6280 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"16⤵
- Executes dropped EXE
PID:11108 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"17⤵
- Executes dropped EXE
PID:9580 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"18⤵
- Executes dropped EXE
PID:10660 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"19⤵
- Executes dropped EXE
PID:14248 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"20⤵
- Executes dropped EXE
PID:12076 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"21⤵
- Executes dropped EXE
PID:6644 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"22⤵
- Executes dropped EXE
PID:7456 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"23⤵
- Executes dropped EXE
PID:9164 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"24⤵
- Executes dropped EXE
PID:5868 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"25⤵
- Executes dropped EXE
PID:6980 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"26⤵
- Executes dropped EXE
PID:6632 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"27⤵
- Executes dropped EXE
PID:5156 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
PID:12952 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"29⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6892 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
PID:15216 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"31⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"32⤵
- Executes dropped EXE
PID:16868 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"33⤵
- Executes dropped EXE
PID:10376 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"34⤵
- Executes dropped EXE
PID:16496 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
PID:16144 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"36⤵
- Executes dropped EXE
PID:8416 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"37⤵
- Executes dropped EXE
PID:6844 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"38⤵
- Executes dropped EXE
PID:6920 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"39⤵
- Executes dropped EXE
PID:15228 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"40⤵
- Executes dropped EXE
PID:14952 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:12908 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:10232 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"43⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"44⤵
- Executes dropped EXE
PID:12040 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"45⤵
- Executes dropped EXE
PID:5464 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
PID:9668 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"47⤵
- Executes dropped EXE
PID:14920 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"48⤵
- Executes dropped EXE
PID:7352 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"49⤵
- Executes dropped EXE
PID:15712 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"50⤵
- Executes dropped EXE
PID:12284 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
PID:15264 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"52⤵
- Executes dropped EXE
PID:15804 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
PID:13136 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"54⤵
- Executes dropped EXE
PID:5856 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"55⤵
- Executes dropped EXE
PID:11060 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15036 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"57⤵
- Executes dropped EXE
PID:9692 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"58⤵
- Executes dropped EXE
PID:5228 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"59⤵
- Executes dropped EXE
PID:15728 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"60⤵
- Executes dropped EXE
PID:14892 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"61⤵
- Executes dropped EXE
PID:5492 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"62⤵
- Executes dropped EXE
PID:12444 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"63⤵
- Checks computer location settings
PID:7780 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"64⤵
- Checks computer location settings
PID:11812 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"65⤵PID:17228
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"66⤵PID:6416
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"67⤵
- Checks computer location settings
PID:17340 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"68⤵
- Checks computer location settings
PID:15752 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"69⤵PID:15856
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"70⤵PID:13428
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"71⤵
- Checks computer location settings
PID:11056 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"72⤵PID:16028
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"73⤵PID:6256
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"74⤵
- Checks computer location settings
PID:8912 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"75⤵
- Checks computer location settings
PID:12628 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"76⤵
- Checks computer location settings
PID:4436 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"77⤵
- Checks computer location settings
PID:17524 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"78⤵
- Checks computer location settings
PID:17468 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"79⤵PID:4148
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"80⤵PID:17768
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"81⤵PID:16404
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"82⤵PID:16844
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"83⤵PID:17792
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"84⤵PID:16560
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"85⤵PID:16824
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"86⤵PID:17680
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"87⤵PID:17536
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"88⤵PID:17232
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"89⤵
- Drops file in System32 directory
PID:17856 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"90⤵
- Drops file in System32 directory
PID:17136 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"91⤵PID:16428
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"92⤵PID:7764
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"93⤵PID:5376
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"94⤵
- Checks computer location settings
PID:10488 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"95⤵PID:6516
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"96⤵
- Drops file in System32 directory
PID:6588 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"97⤵PID:8184
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"98⤵
- Drops file in System32 directory
PID:7548 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"99⤵PID:9624
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"100⤵
- Checks computer location settings
PID:9520 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"101⤵
- Checks computer location settings
PID:6340 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"102⤵
- Drops file in System32 directory
PID:11580 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"103⤵
- Checks computer location settings
PID:2276 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"104⤵PID:14512
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"105⤵
- Checks computer location settings
PID:10236 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"106⤵
- Checks computer location settings
PID:10476 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"107⤵
- Drops file in System32 directory
PID:5812 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"108⤵
- Checks computer location settings
PID:8944 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"109⤵PID:13988
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"110⤵
- Checks computer location settings
PID:13748 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"111⤵PID:1852
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"112⤵PID:10972
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"113⤵PID:13156
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"114⤵
- Checks computer location settings
PID:7740 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"115⤵PID:5636
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"116⤵PID:7824
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"117⤵PID:7416
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"118⤵
- Drops file in System32 directory
PID:14308 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"119⤵PID:5948
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"120⤵PID:13104
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"121⤵PID:6016
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"122⤵PID:14448
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"123⤵PID:8448
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"124⤵PID:11416
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"125⤵
- Drops file in System32 directory
PID:5816 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"126⤵PID:12636
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"127⤵
- Drops file in System32 directory
PID:11840 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"128⤵PID:9592
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"129⤵
- Drops file in System32 directory
PID:6128 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"130⤵PID:8880
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"131⤵PID:7664
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"132⤵PID:9752
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"133⤵PID:7812
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"134⤵PID:9136
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"135⤵PID:10808
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"136⤵PID:13552
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"137⤵
- Checks computer location settings
PID:7972 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"138⤵
- Checks computer location settings
- Drops file in System32 directory
PID:18324 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"139⤵PID:18280
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"140⤵
- Checks computer location settings
PID:18268 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"141⤵PID:1524
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"142⤵PID:2244
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"143⤵PID:12544
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"144⤵PID:18128
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"145⤵PID:18016
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"146⤵PID:740
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"147⤵
- Checks computer location settings
PID:3652 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"148⤵PID:8052
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"149⤵PID:11668
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"150⤵PID:14392
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"151⤵
- Checks computer location settings
PID:8792 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"152⤵
- Checks computer location settings
- Drops file in System32 directory
PID:14544 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"153⤵
- Drops file in System32 directory
PID:8028 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"154⤵PID:5320
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"155⤵PID:11240
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"156⤵
- Checks computer location settings
PID:9416 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"157⤵
- Checks computer location settings
PID:3192 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"158⤵
- Checks computer location settings
- Drops file in System32 directory
PID:8092 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"159⤵
- Drops file in System32 directory
PID:3460 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"160⤵
- Drops file in System32 directory
PID:13904 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"161⤵PID:11476
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"162⤵
- Drops file in System32 directory
PID:5660 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"163⤵PID:3308
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"164⤵
- Checks computer location settings
PID:6880 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"165⤵
- Drops file in System32 directory
PID:3956 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"166⤵PID:4892
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"167⤵PID:372
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"168⤵PID:3168
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"169⤵
- Drops file in System32 directory
PID:5696 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"170⤵PID:10012
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"171⤵PID:3104
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"172⤵PID:7900
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"173⤵PID:9368
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"174⤵PID:14488
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"175⤵
- Checks computer location settings
PID:12512 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"176⤵PID:12220
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"177⤵
- Drops file in System32 directory
PID:6056 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"178⤵PID:3480
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"179⤵PID:9580
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"180⤵PID:9292
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"181⤵
- Checks computer location settings
PID:11552 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"182⤵PID:2356
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"183⤵PID:3984
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"184⤵
- Checks computer location settings
PID:12164 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"185⤵PID:11528
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"186⤵PID:8368
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"187⤵PID:14696
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"188⤵PID:10204
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"189⤵PID:10364
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"190⤵PID:6644
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"191⤵
- Drops file in System32 directory
PID:6448 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"192⤵PID:3856
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"193⤵PID:6300
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"194⤵PID:14860
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"195⤵PID:10336
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"196⤵PID:12984
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"197⤵PID:8920
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"198⤵PID:12460
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"199⤵PID:5208
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"200⤵PID:14832
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"201⤵
- Checks computer location settings
PID:13276 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"202⤵PID:15704
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"203⤵PID:6500
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"204⤵
- Drops file in System32 directory
PID:6224 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"205⤵
- Drops file in System32 directory
PID:5340 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"206⤵
- Drops file in System32 directory
PID:16216 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"207⤵
- Checks computer location settings
PID:10388 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"208⤵
- Checks computer location settings
- Drops file in System32 directory
PID:15568 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"209⤵
- Drops file in System32 directory
PID:15340 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"210⤵PID:5500
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"211⤵PID:7336
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"212⤵
- Checks computer location settings
PID:10500 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"213⤵PID:14956
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"214⤵
- Drops file in System32 directory
PID:5604 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"215⤵
- Checks computer location settings
PID:15228 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"216⤵
- Checks computer location settings
PID:14952 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"217⤵PID:12908
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"218⤵
- Checks computer location settings
PID:10232 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"219⤵
- Drops file in System32 directory
PID:16180 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"220⤵
- Drops file in System32 directory
PID:12040 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"221⤵
- Checks computer location settings
PID:5464 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"222⤵PID:9668
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"223⤵PID:8344
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"224⤵
- Checks computer location settings
PID:7352 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"225⤵PID:15712
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"226⤵PID:8700
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"227⤵PID:15812
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"228⤵PID:16692
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"229⤵PID:7172
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"230⤵
- Drops file in System32 directory
PID:11044 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"231⤵PID:1276
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"232⤵
- Checks computer location settings
PID:14896 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"233⤵PID:16936
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"234⤵PID:16012
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"235⤵PID:17132
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"236⤵PID:7752
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"237⤵PID:2904
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"238⤵PID:10212
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"239⤵PID:5384
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"240⤵PID:16636
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"241⤵PID:12492
-