Analysis
-
max time kernel
127s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 07:59
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240226-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Processes:
Seven.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation -
Executes dropped EXE 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exepid process 17888 SevenCopy.exe 5088 SevenCopy.exe 12548 SevenCopy.exe 14852 SevenCopy.exe 11580 SevenCopy.exe 15820 SevenCopy.exe 4140 SevenCopy.exe 16396 SevenCopy.exe 7472 SevenCopy.exe 7360 SevenCopy.exe 19104 SevenCopy.exe 6620 SevenCopy.exe 16632 SevenCopy.exe 8868 SevenCopy.exe 16872 SevenCopy.exe 17200 SevenCopy.exe 16560 SevenCopy.exe 18324 SevenCopy.exe 16528 SevenCopy.exe 11544 SevenCopy.exe 5216 SevenCopy.exe 18176 SevenCopy.exe 3452 SevenCopy.exe 5788 SevenCopy.exe 5952 SevenCopy.exe 13992 SevenCopy.exe 5272 SevenCopy.exe 15164 SevenCopy.exe 9012 SevenCopy.exe 7452 SevenCopy.exe 7096 SevenCopy.exe 5052 SevenCopy.exe 11300 SevenCopy.exe 6196 SevenCopy.exe 11884 SevenCopy.exe 3588 SevenCopy.exe 5240 SevenCopy.exe 8632 SevenCopy.exe 8276 SevenCopy.exe 6896 SevenCopy.exe 9428 SevenCopy.exe 7072 SevenCopy.exe 7248 SevenCopy.exe 3512 SevenCopy.exe 3268 SevenCopy.exe 8588 SevenCopy.exe 11168 SevenCopy.exe 1360 SevenCopy.exe 10428 SevenCopy.exe 6200 SevenCopy.exe 7396 SevenCopy.exe 10988 SevenCopy.exe 13580 SevenCopy.exe 5764 SevenCopy.exe 6960 SevenCopy.exe 8656 SevenCopy.exe 5232 SevenCopy.exe 620 SevenCopy.exe 8728 SevenCopy.exe 7516 SevenCopy.exe 9464 SevenCopy.exe 9952 SevenCopy.exe 8680 SevenCopy.exe 1136 SevenCopy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops desktop.ini file(s) 7 IoCs
Processes:
Seven.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Music\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Seven.exe -
Drops file in System32 directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.execmd.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\System32\Seven.runtimeconfig.json cmd.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 17756 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 16276 powershell.exe 16276 powershell.exe 16276 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 16276 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Seven.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3916 wrote to memory of 912 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 912 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4396 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4396 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 2448 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 2448 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4924 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4924 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 2588 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 2588 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4424 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4424 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 1728 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 1728 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 3508 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 3508 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4140 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4140 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4700 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4700 3916 Seven.exe cmd.exe PID 912 wrote to memory of 860 912 cmd.exe choice.exe PID 912 wrote to memory of 860 912 cmd.exe choice.exe PID 3916 wrote to memory of 3520 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 3520 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 1960 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 1960 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 3992 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 3992 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 1212 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 1212 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4368 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 4368 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 2480 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 2480 3916 Seven.exe cmd.exe PID 4396 wrote to memory of 4616 4396 cmd.exe choice.exe PID 4396 wrote to memory of 4616 4396 cmd.exe choice.exe PID 2448 wrote to memory of 3204 2448 cmd.exe choice.exe PID 2448 wrote to memory of 3204 2448 cmd.exe choice.exe PID 1728 wrote to memory of 4724 1728 cmd.exe choice.exe PID 1728 wrote to memory of 4724 1728 cmd.exe choice.exe PID 3508 wrote to memory of 852 3508 cmd.exe choice.exe PID 3508 wrote to memory of 852 3508 cmd.exe choice.exe PID 2588 wrote to memory of 4780 2588 cmd.exe choice.exe PID 2588 wrote to memory of 4780 2588 cmd.exe choice.exe PID 4924 wrote to memory of 680 4924 cmd.exe cmd.exe PID 4924 wrote to memory of 680 4924 cmd.exe cmd.exe PID 4424 wrote to memory of 3712 4424 cmd.exe choice.exe PID 4424 wrote to memory of 3712 4424 cmd.exe choice.exe PID 4700 wrote to memory of 3368 4700 cmd.exe choice.exe PID 4700 wrote to memory of 3368 4700 cmd.exe choice.exe PID 4140 wrote to memory of 3968 4140 cmd.exe choice.exe PID 4140 wrote to memory of 3968 4140 cmd.exe choice.exe PID 3520 wrote to memory of 760 3520 cmd.exe choice.exe PID 3520 wrote to memory of 760 3520 cmd.exe choice.exe PID 1212 wrote to memory of 1232 1212 cmd.exe choice.exe PID 1212 wrote to memory of 1232 1212 cmd.exe choice.exe PID 3992 wrote to memory of 3320 3992 cmd.exe choice.exe PID 3992 wrote to memory of 3320 3992 cmd.exe choice.exe PID 4368 wrote to memory of 1148 4368 cmd.exe choice.exe PID 4368 wrote to memory of 1148 4368 cmd.exe choice.exe PID 1960 wrote to memory of 3076 1960 cmd.exe cmd.exe PID 1960 wrote to memory of 3076 1960 cmd.exe cmd.exe PID 3916 wrote to memory of 1072 3916 Seven.exe cmd.exe PID 3916 wrote to memory of 1072 3916 Seven.exe cmd.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 17592 attrib.exe 17680 attrib.exe 17688 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ExitNew.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\Microsoft Edge.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\RedoInitialize.sql"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\SetWrite.jpg"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\MergeSkip.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\PublishDismount.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RestartClear.pptx"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RestoreGroup.ppt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\TraceInitialize.doc"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnblockComplete.xls"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\WatchCheckpoint.odt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\FindUnlock.ppt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\RegisterOpen.asp"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\RestoreCompress.sql"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\UnpublishMove.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\AddClear.doc"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\CompleteSplit.odt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\RestartUninstall.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\ShowRestart.pptx"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\UpdateBlock.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\AddConvertTo.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\ApproveBackup.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\MeasureDeny.jpg"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\ProtectRegister.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\SuspendRead.jpg"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WatchSend.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510760.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2423.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2444.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2423.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2444.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070754832.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579835457774835.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836141765126.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836483615703.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836682528016.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836733239332.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836783703172.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836981256278.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837021664834.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579837083692897.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839229142017.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839862707029.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579843399304604.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579843699334215.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844001652099.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844429906359.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579844875458812.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579845029017678.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846343471163.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846643053585.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846943099428.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579847245340448.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579848035000739.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579877632470186.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rvwtj7c1.default-release\pkcs11.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BB8X2UQ6\known_providers_download_v1[1].xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BB8X2UQ6\update100[1].xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5f98dfbc-d190-4f34-a237-f2961dbcdeff}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5f98dfbc-d190-4f34-a237-f2961dbcdeff}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5f98dfbc-d190-4f34-a237-f2961dbcdeff}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{67975700-d2b2-4a71-8e96-05a15cacc0a8}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{67975700-d2b2-4a71-8e96-05a15cacc0a8}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{67975700-d2b2-4a71-8e96-05a15cacc0a8}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe4f1e15-1969-4a4a-8da0-99d448e0ba6e}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe4f1e15-1969-4a4a-8da0-99d448e0ba6e}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fe4f1e15-1969-4a4a-8da0-99d448e0ba6e}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsglobals.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appssynonyms.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\settingsconversions.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\settingsglobals.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\settingssynonyms.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{8f5f7d6f-f4d4-4e8b-9de9-d290eb248e4b}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{8f5f7d6f-f4d4-4e8b-9de9-d290eb248e4b}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{8f5f7d6f-f4d4-4e8b-9de9-d290eb248e4b}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{9341b00b-3c0d-4d61-852c-de825c5f186d}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{9341b00b-3c0d-4d61-852c-de825c5f186d}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{9341b00b-3c0d-4d61-852c-de825c5f186d}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1AUF482D\www.bing[1].xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TZRV4DXW\microsoft.windows[1].xml"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe2⤵
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\SevenCopy.exe3⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Drops file in System32 directory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WatchSend.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510760.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2423.txt"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2444.txt"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2444.txt"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\mapping.csv"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070754832.html"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"3⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EncryptedLog.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587648064567117.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"2⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587648064567117.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587648064567117.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"4⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587648064567117.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"5⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587648064567117.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"6⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587648064567117.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"7⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587648064567117.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"8⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.1.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.2.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.1.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.2.filtertrie.intermediate.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt"9⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"12⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"13⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"14⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"17⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"18⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 319⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"18⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"19⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 320⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"19⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"20⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 321⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"20⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"21⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 322⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"21⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"22⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 323⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"22⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"23⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 324⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"24⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 325⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"24⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"25⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 326⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"26⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 327⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"26⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"27⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 328⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"28⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 329⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"28⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"29⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 330⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"29⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"30⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 331⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"30⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"31⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"32⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"33⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"34⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"37⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"38⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"39⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"40⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"41⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"43⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"44⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"45⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"46⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"47⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"49⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"50⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"51⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"52⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"54⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"55⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"57⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"58⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"59⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"61⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"62⤵
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"64⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"65⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"66⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"67⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"68⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"69⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"70⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"71⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"72⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"73⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"74⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"75⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"76⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"77⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"78⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"79⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"80⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"81⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"82⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"83⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"84⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"85⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"86⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"87⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"88⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"89⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"90⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"91⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"92⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"93⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"94⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"95⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"96⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"97⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"98⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"99⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"100⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"101⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"102⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"103⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"104⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"105⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"106⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"107⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"108⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"109⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"110⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"111⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"112⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"113⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"114⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"115⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"116⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"117⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"118⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"119⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"120⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"121⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"122⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"123⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"124⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"125⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"126⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"127⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"128⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"129⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"130⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"131⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"132⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"133⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"134⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"135⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"136⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"137⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"138⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"139⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"140⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"141⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"142⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"143⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"144⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"145⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"146⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"147⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"148⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"149⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"150⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"151⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"152⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"153⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"154⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"155⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"156⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"157⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"158⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"159⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"160⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"161⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"162⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"163⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"164⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"165⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"166⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"167⤵
- Checks computer location settings
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"168⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"169⤵
- Drops file in System32 directory
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"170⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"171⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"172⤵
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"173⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.420Filesize
16B
MD5e43343d05c86484fb4a9bacb5ad0f032
SHA12d5f52030500894046ea52e8db0c9ab9dd8127d6
SHA256286e57c71197b181c0b677307b6355088009a82df1d64c2589ad2a44b96b2563
SHA512cbb70fa7159d946c313729f40ba696a57af3f342649e6b1d9f85855f11c5ea1e3eb46db9e9287d8ed08ee2f7afe5b90e6cc60cfe6c76978d3d5ce79b3a9b469a
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.420Filesize
6KB
MD57ed93f71434f187feabe47e25aebda1c
SHA1ff3f3b5b266e8c028d89b6951df2951e67315ad9
SHA2566a7ed767913973b9e964017f54131104533516adf73ab2f93fa342afa4e51f46
SHA512c8b1e3275f10942f9e92a1bcd51d3db2a37f72354310176c10d45873475094eafa045982be6bfc2c9e30d9ed87d4e7e9d032cfc42a2197e15517c4b7fd5f917e
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml.420Filesize
321KB
MD5585002fd4d920042c3df96a55b15265e
SHA18a3460d110c788735ee5318452be9d66e26cf803
SHA256012a9ca399cafc89ce6de583f6759e283aaa6ace0ba18b879a70e67c71cd28d1
SHA5125fdf32a7e064818cc8d3ce3dc3f12c11766630f76d58f93e7b0f44e093175cc2e584d34f05b85ac13747a1db297fe1e4de59333caa8daefd1900abfc43842d59
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml.420Filesize
100KB
MD56df18ce09245971e338740f870084394
SHA1a40043b2edff084d0524361d9854440eec48dede
SHA256c5da6142ec5f836293652b73c9bf8fd91847c35f16cb5956e188ec6a7b1c0315
SHA512f345482afaf6130cef932814a0dd957fb0c7ddf88190f634c911c4eb909a9f8032cf834ae898875a5f7a61df7a5669602cf1a426145e6a1902433477d86eeec8
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.420Filesize
130KB
MD5971626d372e843e06a467e87531980b7
SHA1afc29ec325c6cffe180db538f1ea37f084b5cc07
SHA2564869597258a3ae224079a5ff5d841113e544af2403c4911e9c1776d811ba149c
SHA512796f07f0e93ce9deebe926f6d24f843cf572a0fcf14e156629768d612cb01964fac9cd258e992894556c8bef13c63f0f19de88aa8ccdd6896b45045c66459413
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml.420Filesize
270KB
MD585146fe4b4856a1b57a6172c66bbd2c9
SHA16c9bffc717198baad4466b6ac7faf1588de5118e
SHA2568666046bf445502116e8b34da531e987589159616ddd727fc4623c8f3f0f2fea
SHA51242561081193f7720810936336fd3dddd1e08e2ca6ae39751f124a8798282eb7972f42acffac320d5d6adec84b747de2ce86117b7117e9675d2338acd2f5667ef
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.420Filesize
332KB
MD5a2ec35656944eafa1336bfe5f098a06e
SHA18de63e27e9e3a9a5c02b3b9e92d024f78ca1c68e
SHA2565a06a1372e9a993eb5ddfb7be5359c018d5aecf6fb99298dd60d111d90501f19
SHA512f259ffc7f1ae145db87e7a93c2b6c05a800b1869dca41a229bb575d36cc51db5592a1e335c6712204ff56c7f22833b264c0dd5ac147bc2cc7c93d595dcd04401
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.420Filesize
5KB
MD57ddfa22afa17b213b92a2d706cedb7d4
SHA13ce6e66634953a4676609f17dd7c917288151cb7
SHA256568c811db6c7f33dce5723a3e73934cf7639f6fbffa43f2699ecc471953d083a
SHA512119b92a454857cedb6707217f2f59d886ba075b5585616343c86708bf78a6e299a34b7d1a66471feaddeb970197be5a0a0cc273044762c69eae1331b1acf5860
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.420Filesize
7KB
MD5af406b2f60e1bdc11f38941d4c8ee789
SHA1c2a5e8544d6d052f31d4be12b56bcc79c7075228
SHA256f2f3321fae628993beeb9510f3413887be214dd23d438c59ee4fc04ce5577e19
SHA51206d53eb7a72a654613e6d6c950664fe6dee076f14fa5bf454bceb658e5c02c00f183d82374587e9c3bddac9a7c224db047fbccd51551a29e18feef59e753c492
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.420Filesize
8KB
MD520212b619de20ca8036bcfa143b448a5
SHA1257258f87b8b35b6269a59f62832d91e978dcda8
SHA25656567fdd908eb6c58aecf155741eca281ab127131056baba63c25b5882160180
SHA512e427ae838380b97dd33d4bdd507bacac8788aabd095223d5f73b4ccd341d10aca6eb9b9b1da51adb78666cfe3746e5847e71103464bbc9b55c802777f14593da
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.420Filesize
2KB
MD5117b11840457bb459a7de042aeaf905c
SHA1e8ea99d0a748a512e3a6d8b8a3954ec2dfb9f549
SHA256c82ceb7025d365cb99c623060b4676c4b8c61393818ff5cf48ae51dc5dee4dd5
SHA51220a3d7c86d4d5388c4a6a2d91067b3d7484e5506422747e77237ad31f53f8af407919f12468975402a9fba1d91e0c2f03f316a2b2224d87e56e87facfb022165
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.420Filesize
10KB
MD53bc42eb1eccdfafa617b61474724dac2
SHA16a26940a2e23be374d418ec2ec606b50f84bb0a5
SHA25688cd551ed0c80aea22a7cc6bfb3bf7dcb9f49abc7b7bff007f7532157f1298c1
SHA51208a12861bb2320022298b5f1707f245671ce8a46766b4700f47a66d6bbeab79285d156ecd6fb32058ebecaf5b8a52691f4a6801177bfc3867f865130e5a2d678
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.420Filesize
7KB
MD579aa301d332168d9ecfba9705dc6f18f
SHA1f47eb9382e85cf252f7ba4fcaa983e71d9031097
SHA25690662bf8645df521077b9de4fbb61b355791f2b7638d0250b6b0b21c3b5d418b
SHA5122819fdb2dd5851bb19455176ef6016ae44789552632cda589ad07c89d54f1c8b91f00f0c060ba83b64946b8973463441eb60f82835d2f4b95ac22a5d2dfc6e78
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.420Filesize
4KB
MD53dff36784bd6d115206129782508df22
SHA1b84b2cd5fa681000cfe543e09e0cd1af0e0e2645
SHA2562a43eb1ff6700e2111e4737de83ea2af08c9bd2369dbd3253cfd6c2b7d0db60b
SHA5125c5e2378920f60f91f5f512c04ef63f5b056c03a90be965bcd5c293d7f9b39c9d292ff9f8e037f8aef98d3ceaa7d8bf5545d23713fd24076c2eecf2823ea76df
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.420Filesize
7KB
MD56482ceacd5de556c906e9174ea213ac4
SHA19656e3a8e1315f109c3f4cc4d7df5427919ed736
SHA2568d789177af9a428e3e035d4b574983aa577d227f341b12800d0a4dfebc20c84a
SHA5128c7dd9b2fd53b38b20f38a1cd79d1c7d63c93f6d50fa12b81856cced8ddba7b840e50dc44a927d56f7553e5b6436d352abfedf5b885328ab65af8992781d8d2d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html.420Filesize
6KB
MD5a3a2e4e16aaaa6cca6e15f9c90eb7dfe
SHA154e9f7ad2b8e11526c7006dffe24cb2376d546ba
SHA2565ba1dbcb7f628236eb28138e59539ab100dcb9c6c8dc58970780edc8deee4e6e
SHA512830788686f299d92dddb14c23b5fe3161d438362a7a235ef74ae3fb6cf6043bf39ecc91cbd4f28c605198b8982326ba38f975f525b4375ed146c8acc642e1b04
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.420Filesize
14KB
MD5c7a6875d4b6bd830b490da8514d4ac8c
SHA15cf2cb12dd45468f56c07fdda90066982bb21a41
SHA2565d0cb829307b1ac8ed6ce598bfdc25a10bcf31fa253d78ff65576472e21c7aa8
SHA512245b0a07e81f2bab9ea6dad29629059e54d83940dbf90b1caec564733c29230380e25e87f06f48da04ff653236fa46dc168bb6bc65a96e8b20663e432f5f84a2
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.420Filesize
10KB
MD5ae81ade97d2022bc559f821233eaf251
SHA14d2db669aed5219ebd52b0275dfcbee823364006
SHA25651ef1bccb57ec7f93b6e4e6aaca6234b3d2e1fa7c88af2e3b24b7635bf73ff3b
SHA512a662848e8eb903f3183c4e6c8d72f7200c6cdbd284c7427652d7ea786de624d330e542ecc0965d9988a1e0dd32756208119ecd3d709ddb6be4f75f1b5451f561
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.420Filesize
10KB
MD5f5d45c66151be312d7930f8dd76d263c
SHA139607f30eab1acb130a6f3bc33826dadc791a3d2
SHA256886066767cd98f0571bf04e7028232c05e670ba855de71fa9f29c5d217a96bd8
SHA512719ed3b7fcea5153beb0c7b310b39f249a2b6e043e24bc501435478f5e5fff37b65d0787aad72de377fcfd6ee7f783154ea53da48e513b6d7add850c83d4c492
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html.420Filesize
6KB
MD5c3588d56a93318f10a1f793601c624dc
SHA1c86a79454eec483d8af919daa89f11650ca89535
SHA25680483d2a355989aa4caad3b74ea89a8e7a85af2e693c11ebf968bab3637dd668
SHA51248079d6cae5d6128fb1ed2531d1df0dabe08fb758edf6091be2d1c745c105062924b15ed23e024d52be0f44bf64d86defc6ca6aca67588749262382a23c94fa6
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.420Filesize
4KB
MD52137052f3a4740453eef134d833fe515
SHA1899afc8803980257f87f68fce70526f44e4681cf
SHA256b9f30902704f6f64d5f9677182f9021a43e57a03bf72729bcb4d7b4e59f902d2
SHA5128f39d8c36087f04695360cc7321ed275ef2df6dfa5d5d139551e0096dd4659058165db778d936cfe81e2ee6cf42d672efadf664d0840617c7cc11c42c493463f
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.420Filesize
8KB
MD55ac6e918f45de88df57be721161ea6b0
SHA199a9798c124b034be5c62013d6b0ca141d1d3562
SHA25676a0f92020287fd0c32485b054fd08ab0bf8248f3fe3ec7b50455b22ab67ea05
SHA512932321e9768b216971ec621a2fa884351cca2baef5226e0b5747d0709b851ed09ba3f2d33306a1cd2deb9f4ce4b33227f36bc16468668b7c71b632a974a44c6b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.420Filesize
9KB
MD53add9f876b690d3d8e2960d9a9c94a5b
SHA1e8c47cc3c90b5ab817be43aedfff0fbbe4011f62
SHA256cc7ed7956b82eca55f9c4baaf1e4b37bfce9397b859edea361f1b9c3903a6ae8
SHA51244a4804b2147d40e82b2d408354a0fa733744119e4beb8cca5366a604db87b48fd3a92e1ffdf15664d6dac14b1110af5e1b7df496d54b7c42d8d262ac67b8385
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.420Filesize
7KB
MD5072f453a89a4d3038e6cbd578a6321c0
SHA19441cd7523057c477a1968b7a91fb9dd21194820
SHA256681b66383128c1a3ac22997173fce26ff2de8ba5b809e5f960b8a680767b56a3
SHA512faa4fa5355d6c1346a48f79d3b12bd9f993d9df404ed11c31fc007eb482797a4acd6393a306685beef1519dc0724af187ca81eae4bae3fa00d1dc363cdff2040
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html.420Filesize
1KB
MD550f45ddb88b60bc37c52c35948da6226
SHA120e39190857e0247db2cdf7d2e55b438f09e0397
SHA2567cbcfe19dc39c2883117b0372707f79b083d98bcbd0dd99e45d3821125a09646
SHA512e2e9c3486bedf3e0ccef99856ebdfaf7226e5a47004ea129bda2df66ee0d29ce9bf520d8097cd6b7b7923497298a4a4f0abb623b7905f89408e4014d4c6e8c24
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.420Filesize
47KB
MD52bbffea67fd3664e3428d14f1b21ae9f
SHA10c324e5ff82f8a1e5b3e70597f71c263cbb07b6c
SHA25689e64f11995f8f665bc064c907d33fb86cba32653ba256ed847a51bf89a91c30
SHA51245eb9dce53dc40117dd5c38aeb1c8e4ad3bde1f7a1bac5e2e38e708cdbb09576ead26cdd807b21bb820b9a5df11901a3e615cf76946c03a0cf16ef3b734a7346
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.420Filesize
2KB
MD565213d2df4e3bc35bcb0e2085d1546ba
SHA14d7721f81ff9097a76698f92e1a5656dd226c9a5
SHA256fb446df7daca5f6615250fe0873de17ab96b2d668f21959e0a57e5ed56f10280
SHA5125099c07b3db82f3d371c585307b0060fd63e93769d6714f1ae72ace9639c3bec328d270ac9e6d644e4c404ad128d1bcc5dadbb835c6421be491186bc20b1fb7d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.420Filesize
720B
MD57292c68b20c58e9c78acb05ca8c9d56e
SHA1e01722906f89a7a3a728c8c385ac9d306bc485ad
SHA25614cf318ff227a7a73e5441eb91cd513fe134714b58a8b1863495f3abe4ab2f71
SHA51295c0da6794cee8c658d1f9bed5b303e2b4f861c979b598f69876bd57ddc2e31fd03996ceed01253783bf5f4d8c9fbe303514844633c14f2286f083781099b425
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.420Filesize
672B
MD59f2e878913de5bff04dfd1dd8ddb6b3b
SHA1e74011551ae3f123fd2eb5e66647b6072da72e92
SHA2563c6ac633b8bc9e6b89157274c1648a9dbf33a9095ec7ded4394cca7b5a65d29f
SHA512ad3e91a784ad7449e47f90eedd18da65fed6807232b9ee05c89e831a0a9bda2fedb7f48ea68fd9e756a4ecdb866c275612ea2c67ada16d3c79efc83598aa71f8
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png.420Filesize
880B
MD55bd745aea264e813f912c2bd0252e62b
SHA18c8b6864e33f1da7143e59105eb998fcac0f1f9a
SHA25666d31d56a6cb5f029874dd61f50f36f76f6bfa66ccf3a29e1ad24ba08fa3a964
SHA512f2a90c1e2ae5d58366726cca2da2334f1490f465dd964c8091eba544a298374eccb57a989c518aaa0a2642d3459d8cc685f819fba052f38a9a8a5b1f1b038937
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png.420Filesize
816B
MD524ebc50ecbcd6bd5670b2350add1462e
SHA18c9552c44ac46ffcba1e6fbce839b542428fdd51
SHA256de209aa977927a0cd8507d4d8a776fded8c690b82cceef338cfdb708fb85d24d
SHA512f75a19137f81cf51d2ba01ca13a0ea27cdcc281821d5ed4626949ff0e11c1ef6f5a52aa6e3404bf14cba766fb9335a448c03c08987db8f668ab3e81d1d8fd09f
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.420Filesize
1KB
MD5b57ec3a89c6726bc15e1dc35826f6578
SHA11f6f531db4b88e294bc3289fc7596edd7121a5c1
SHA25620502faa3bfa98955786c303974aadba89cc512d4ccc39d92df7a135da11a1a1
SHA512ac01200b80cf80be4fe3349c30660a813d54a9c61631d4fb73942cef3e0c708434591bdf12390decd13b9fa15173db08be7252733eda40b10181725910ac70cd
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.420Filesize
3KB
MD56cf9e15ec355952ab508245ed98676d6
SHA132634a4d1966b7600934adaefa5f197236b81600
SHA25675ba529ff811da0eb8164b790bde9c91df14df3128f65d7a94857fbc2b02a180
SHA512c0c8cdcb90387f87eaea40b682bb9e54430afc3ca917d7292ce1e3127e8538d0c92ce96b38f447deda30aaaebd4b5f653457de8ae35666cb05defb361b1f53d2
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png.420Filesize
656B
MD5236cd2abd158f2bd276dc0f8d91e8ab6
SHA1793fad5583aaf119c46c3683cf139a19e87341cc
SHA256530afdda1fd2319112eb9a2695c8ade5830519d9999fc8fb1bb9c556b483ad33
SHA512c2028106029196b4665be0ed9a5662453ed7ab4d91f34d4e6f527b84cdbc8245f7516f128055d17ba62928953a48bd4fc2d21b6a9177fbc53087b180f08f7310
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png.420Filesize
864B
MD51c58bf2b6fef0f0adabc8525584ffa1d
SHA13a32959040b3527078de824bdc16161d64949f17
SHA2565b478d42e551d6185f46cdc7c2b06b0a647b41c9f10e3ee374556fe0f9216da2
SHA512953f108fd4de1e7d1723ea4f16aeba03d46eb03c0871b4e8635362006af41ff0a024083a80ebbeaceae5a681455beeb8b33881d6bc459aa1ea087a807ad41fa0
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png.420Filesize
992B
MD5c455efbd6bf02c728bd34fc5609f24e1
SHA1a0c67cb44a5bb33de333221b771058fc163d9a52
SHA256cd770dfeb9dad9c406e163381448e6628bcbf3aab3614c4083f2a50cd767c0cc
SHA512644edb71ff2ec0bc5d983cc907484f167931c0e591dce7ebc3cf74220bbb551f280e6d7bf732ac25b517b3ad929cdba5a8930eb01bffaeb71bff12157b58733c
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.420Filesize
1KB
MD57738095d6f7a265d783fbe963094d5b9
SHA1520782fcc3f82a1f781502af95fcc96e24c3680a
SHA256a016c9c5d952228e0c68ea9be6aea5c513f35f9a2c728639ca49ecf91a89ef32
SHA5121e612071afac4b13c388ad73a7111e813a9d86a41d8d51580678301bce82a51a9039d7448abee408fe24870b3adcb484751afa6120e48391d80af2dfe3cc04ec
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.420Filesize
3KB
MD5755de4fffcc51b6c3a30bed550da85ed
SHA1d46ba3e3e4d96470dc2821956ee0ea8de3c62fa7
SHA25648ccdd744a8d844b30519df4c44f0f2feb8225737cf359946caf4c7b4cb3b7a4
SHA5129eeb945e25a9fc1d6b1f3beb3fe899534b6d2697c2b4666f8702562273644822d622d8e6bd6d8b11382857d62b2314513f1adca76b7af2b43ee5c3f88184a77b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png.420Filesize
416B
MD558a51a59ac81f45b8236a77f17794537
SHA1459088c0becf03c86e8a55006911815339f4747a
SHA256ba115c59d79444dc7493bde8a967e97eabfcfb4060114c0bf9df75fc2935bac0
SHA5125f95b80eb58476d905f3b7bde41e95d97b33c2da4318bcfe5622710e7d9bb698048d6a03fd944dcab3a014b7dcb00e1f16cd1f9b1d04f9ccf30a1ae4563f4d4a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.420Filesize
528B
MD5cf5053be384f13da0be8137420601a41
SHA10e3c7aa31976d39022a44cae57da29932590a68f
SHA256af84ffbbe2f21880d0ecfbda3a9a2c55ebb1c18fc684beef2c454ef7241e9b87
SHA5125461e02261429f2da6ec8941839fa0aba6b5a4873c1b946ec8639512dc34b74910efdc96c832d340d1d93e379313faec1be2b3686f75d21bb2555a40477e7cdb
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png.420Filesize
592B
MD52ccd22e9453cbe16eb6d73acc1b12022
SHA15cf003421c00af48d49eb75557c9b8591d8db8a1
SHA256295f119c3f90a683604c8f797bc587545774a05ab039f25e4d1cd3bd2a12ff20
SHA5129f01eab806358da5f1a27e4cf62ea0300bd6be239f8a1de68d2b7d1dfad72d39652f2bc3c48fe6da683bad871708fc25d3d8e57a85a27eef5fa4bc582a2f91c3
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png.420Filesize
816B
MD5e4f1e528c3448767cf6dcab28c55a986
SHA1a9264ddc91b747c99f6268607a813b71aef70601
SHA25606993acea62b4063447ed286de823c27f0ab731bd2a21a47aba796c7064641ff
SHA512d6007ae2eac25ba3f7642d7ff92dd8874b6b8814a26ad5d6a1dde7970ade7f3bdd01b7a5581402edb8b299e74901256a2094105c4676415634fff0971d54c1ce
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.420Filesize
1KB
MD5017629e9f1b526457625d881479b8049
SHA18b1a7e73ca091330a30e35e74f0abbba5689494b
SHA256415ee601a4b31058cb6e7f37666eca90dd893009fe431d98347f52f2d744d6af
SHA5123715969ad196e40c90f244951ee735066e97c13d34ec4182797b8013cc19a520872f48397161bf64973935cef689deb796e7f1d8781b5c4fcbbc58767973ba81
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png.420Filesize
544B
MD5a5cd1134f05122dc994e009d41ca6209
SHA169967b5e9017102a0bb459d8f47e7fcacc1fbed3
SHA2562a3ebebfdba426703b0420dc32ac86bd5b2dc3f9aaea79a95563133446778849
SHA5122aeb5923d1f72b6b41468b74c020d26ba1d49792af5e0124a445d5c1617a8934e5030a2b19eb5204285918b5dffd61a005b374a076471814e03563196bd82f40
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.420Filesize
352B
MD583930b510ce271650edd8d5e457fd006
SHA19b4a2f832b345311ecd0cc5aa073f4992db964b8
SHA256ae915fa3382bd04ed86f8b628a2d2c9232c9119e3e02098ea926a4e7f1ae41f3
SHA512b11219dec88c6018eeb32a53b85516e4400f87a19ca215cdd0523750adbb748728903c3d52f88525ed4cc53827d634502c981e0fad453cef205d0599208970f3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{60551aa7-cf52-4b66-ade5-a0f9ddbabeaa}\0.0.filtertrie.intermediate.txt.420Filesize
3KB
MD5a73f181b5e4ee78643821d6950260f68
SHA1238cb72a2873f64637836e783083fbee29218d59
SHA256a36be3a9bb62c9a9ec40f40ba72dc8f01c8d5eb25a22d79bcf08bd9760e9cbd0
SHA512f1ef58e2c877d48954a49b3605707821d9575c102d28876ed8f2f70de864c41313b2a8d6fa51cf24fff3790848e3ff395fedcf608cada378b22bfc057d341bb1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a70de1d6-2997-4037-8e38-d517192e17fc}\0.0.filtertrie.intermediate.txt.420Filesize
28KB
MD54d4cba128b55392ff16ac4d714eb061b
SHA10435a26a1627cc57338c613e2937eb96cd1cc6a0
SHA2562b911c21a0ae0d5e87c6acde84bbf9eae05d652fb91aede87be7f30526f87216
SHA512317b30bc1fea6edae7776e54fac3c8ab1d457bc0d07690e33ef54302b5bf812dc00d98377e303b21997f55d6bc78fc42864321ae0470daff634ebeec86481f30
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{b583aaae-4ceb-4531-b715-85cb738f16be}\appsconversions.txt.420Filesize
1.4MB
MD59faee69c2364e2675cb65f98b92b6fea
SHA125caeff143682d4104c99256a63a6b6a9a9b53e9
SHA256fe53e36c3d6fe6c4ac4018d616026eaa9b812f79f7050672827c97cfea982bc6
SHA512c0c98d82521d2ec6ab5818c8d20492cc839405ee70805b5f888251bee4358db3faf0afc9d4a78088d3c0014204ac9d39e7b7fb9decaa013a7b8acbeacfa499b7
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{9341b00b-3c0d-4d61-852c-de825c5f186d}\0.1.filtertrie.intermediate.txt.420Filesize
16B
MD5e8aaa566651759e399714d464cdfb390
SHA1373942a3618c8d5ff0ba8aab8e22d4a64e5641ae
SHA2561a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a
SHA51223f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{9341b00b-3c0d-4d61-852c-de825c5f186d}\0.2.filtertrie.intermediate.txt.420Filesize
16B
MD5209371fb985ae536f7a01b2cbf06fdeb
SHA16e5d735e5a6aef442f3342931eaf47d505763578
SHA2564cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3
SHA51253203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836733239332.txt.420Filesize
77KB
MD5c0884ce2dd60d440f4fa378fa948da45
SHA1b2b1c4ceb82ca22b81aee582d7d1a83bd402d19f
SHA2568c68ef1ada6b6997f2449e4e77ec2f45a916d4532581c84da7ccd5eef2ab6480
SHA512e171e0eca50b2131cbf541867fc2e9cdcf0dff7368878904ffb7c835e75e337070555a1c67f09d1873aedaca1759664a40ca7fce0e48ac7f5afa100c8517a967
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839229142017.txt.420Filesize
47KB
MD5a7f497d5930f461b796f448c15182fe9
SHA19eafedf0c3d8be535ca3449bb68b00c5123e23fb
SHA25620758b7f599997f4c529ac8264a169b1bbd46d9362ffe9629e863792215a0131
SHA512fd6e91b82f6746ffe4bbbd92747ac6b1de2e872e4c80fc372469f1a3e2b7cd001eeea9a05e352d901c1ce50021604ff986b98c42ba10e7bdd5a9cc1f243df0e7
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846343471163.txt.420Filesize
66KB
MD54a90573d4e1350bb3cb06a825fbd66de
SHA13f3ce3606d802cd06dda067fa2a07dfa745c90df
SHA2565a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242
SHA512b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587647771652329.txt.420Filesize
75KB
MD5f8986559f15db3a6c0812096578ed41e
SHA154d7afa68254af0873ae6537812dcaffaebb391e
SHA256a72f3d9014b8f543f2d3a998961442e542f5336093ac36ba14b72be59b3d2195
SHA512cbaf9208e832504f710be8515d8c56aeb282ca91adc9d0a01134096a1da90a6d574228acb31db265ebc3e701f4e869461c420e4bb606014e4a57a4a75dc90e55
-
C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1713510760.txt.420Filesize
16B
MD5bea21141aa401823a718b5744650822b
SHA1bbe9cee4379b81dcf6fdf92aff28f2209563ce50
SHA25657535fe04df416b5a689aa33f01d8e939f1d91fcae25c0c3cf8192baf417b1fe
SHA512281f779891962273de9f795dea1917044247dbbe427d111b43027c08ad70577aeffbbb6dc8e68cb0013ebd1ce6103e10f1c71c7e144e75df15c76865ed9c9a08
-
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_070754832.html.420Filesize
93KB
MD5c9503a13f589ca4e15998277b9aed7be
SHA111a4a3829f3c59447bf9d649c204edc958a6ee32
SHA25680a5184fd0c48e1d62fb306a02f8ffc4ac5a3d2ce6a2de63992cc5b734455d15
SHA51277f6ec41ffa75b1d53ff78837f3cb2c09664b6f838de214c5906db0190fd6bdc556e6503fd8e9386c292badb84689095fbcea9d6988b66c1a72b1d348ed8370f
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qyhejahe.pvq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.420Filesize
1KB
MD52d889f9134dd7ac4d48f72b9eb3edb79
SHA13729c0afa5793bd5cf5dec0a7acaa9fd6cdfd7ef
SHA2563b511279c996a158bad758739b05e1f3c48156abb041ad31a513ed1fd849c00b
SHA512a0fc686f52ecd60a3f203b254cb55a68f12326933c6b31189d8f227e12daaefd88362a1ef85aadaa3aeadbc4d9a4be2e040fb699461400477d3a4e1932ca6b96
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2423.txt.420Filesize
425KB
MD537b1e2970b11253dcd278351c3a616a7
SHA1de26213fc0c14d834e1caaceafb6dbdba44d158d
SHA25660eb1656851301a94709fb9c3126ea4f44ee4f29d117e8f3e4aa287e9ab712f7
SHA512fe80c9fa659313c3ede58238e64eb5b660bd54b1ef0de0fde775e979f5f071e2b7e96a56b6918d5cb2954ca0b54283ba6c9823269cd77bad153b31d9b9d938d1
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2444.txt.420Filesize
414KB
MD527bf5cce980abbd5310bc4c1e5bf4a30
SHA1a37e346c278f2bacb2d799d5baca17851a076d86
SHA256c5098add3b0a2ac791e4f148eff2c9e20daca899091ecf09b396c29452dbd66f
SHA512a3449c9d42162d930d37bce680b1ab3ccf1ae7984705f83bdd6f53ff2f4ae4b946fed004be996bb9074b34c95f582db8181f87688c96ab5b59e2cee579c1e6eb
-
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2444.txt.420Filesize
11KB
MD593bdbaf650c1f3796f27574178802f94
SHA1fce344ff9a7983cfc5fd6f3f071d04dc2208638f
SHA25691382d835a16a0adde053f1c1d1e46bfd396fda99aa40f33bf75d992f16f3fd8
SHA5122f88faac32852a4d50e9bda8699f83ac198d8a2efce0e89e87944452e20cd518580fc6f7ee0062048ede745b3d6aed0904b644e173bb93e985813414d3f7d14b
-
C:\Users\Admin\AppData\Local\Temp\jawshtml.html.420Filesize
16B
MD565e115805f15f9cda5eb01e8f742d121
SHA1e3ecf29bfa71ce07baf8d02009afb8766f35981b
SHA2567852451b2b252515f369b14bd765135c2e11fee72276b5020e3ed61513c5611a
SHA512dccbfdd893e5806fa1418e48e0c0c72ec2d1266ee7de48fce34bf3f74bda7e0682e8bf90de53594f34c3d5682c8164d9f6b6ea3977619be8487c2e339faa1ada
-
C:\Users\Admin\AppData\Local\Temp\mapping.csv.420Filesize
120KB
MD542c12f9e321e00ee8f2ec180e7863e24
SHA18d32c5df1057f7d040c919fbea6af11a274d2374
SHA25663f8f0d578669353be78d86d0173e8f49202fd56f88d36bbefcae31b55d9ac8a
SHA512c917ed0f9013642a6fe7968315d8454db9173b75e54184449682f75d8e5c02bdc77895e08e15eeb595de6811c09c5fbe0b85982e664223e28d351d2dd10225b2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\EncryptedLog.txt.lnk.420Filesize
592B
MD5d8ccd0c94ad1370faed1faab6d1e8be9
SHA18ed2c307b1d9bfea77b9da16e04a0b9aa17bcfb6
SHA25660146b0b9d3867433d793aec3d3dae70ff24d5bb075563dd6f2439d391abd494
SHA51225f5ab436de8d121f4101be424449337c9a27d0d1254ff4f97a2c3f239aba2e7ed554b6932ad88c53ae2aa8603e9ddded3adad41e64726ed2e968ba6e163216f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg.420Filesize
51KB
MD5f14ebdbbc002c8ca15a7b7e139b01b25
SHA1361c8e0f9e1480937b44cb208b65da4cd85d3d52
SHA256c4ac4b34f8ac38a53e2eb6f1b35fefc01cd61c9c325e6ddf5f2d54de518515b8
SHA512a9b2de5fd410db8e58b10fd8b0d854c8c9b191cc4157d38adb07600ee89110665169849d84692a749798db7063de233d837d31f1b0a85b248bad7f32ee4fb269
-
C:\Users\Admin\AppData\Roaming\WatchSend.xml.420Filesize
810KB
MD5f37e0abcb4f0ba32537a66566ae69cb6
SHA1667b07c0bed454a8552bc4c6a1f9a536e2f291e9
SHA256bddfe05257bf06d713eb04265a7bdb1e7f51401308315fd6f12483a71927b9a6
SHA512bc4ddec1072686190b4554acefe227423383aab1fdaedf5bd03a656feef01b6ef8522c66438ae0a296f749519f6f2764b37ed836a29b7c23f9f734c90abbab56
-
C:\Users\Admin\Links\Downloads.lnk.420Filesize
960B
MD58ba9d6fc77dbcc2d840b4ddd76f017f6
SHA1730d6e597d47448a280f269310aa2230861084f0
SHA25648f2bfdb95de824399910083876121f5df537b3cb81687aca055d4263892f0c4
SHA512a5eea2fef2c57ec1b2b0d727d6d7f5a124372024e6f7b993664beb1d0272e1afb8d5b21a7190e280ae1057d0fbc6d56efc7b93f9d0eff735a9a6e82d568f0671
-
C:\Windows\System32\Seven.dllFilesize
1.0MB
MD5f48ad41f06e945156184c653e5f45b1b
SHA18792aac6280cd38e8abf01ae67e15884f6a4da99
SHA256883a72c2f8f197bb5b0909d5d08159f41319fc4ed086bd4628668f80d7deccd8
SHA512be7d93d89abaf8c91de416334b63b8d99d44ee866044534d6a4257eea15e11651a90bd89af3398be904872612b302d600dce6b394c449da02b683ac943052341
-
C:\Windows\System32\SevenCopy.exeFilesize
139KB
MD56503f847c3281ff85b304fc674b62580
SHA1947536e0741c085f37557b7328b067ef97cb1a61
SHA256afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
SHA512abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
memory/5476-521-0x00007FF65DEF0000-0x00007FF65DF57000-memory.dmpFilesize
412KB
-
memory/6264-519-0x00007FF65DEF0000-0x00007FF65DF57000-memory.dmpFilesize
412KB
-
memory/16276-358-0x000002333F0A0000-0x000002333F0C2000-memory.dmpFilesize
136KB
-
memory/18192-520-0x00007FF65DEF0000-0x00007FF65DF57000-memory.dmpFilesize
412KB